Gfk2222u Pacsystems Rx3i Rx7i Cpu Ref Manual

Programmable Control Products
PACSystems*
RX7i & RX3i CPU
Reference Manual
GFK-2222U
November 2014
GFL-002
Warnings, Cautions, and Notes as Used in this Publication
Warning
Warning notices are used in this publication to emphasize that hazardous
voltages, currents, temperatures, or other conditions that could cause
personal injury exist in this equipment or may be associated with its use.
In situations where inattention could cause either personal injury or damage
to equipment, a Warning notice is used.
Caution
Caution notices are used where equipment might be damaged if care is
not taken.
Note: Notes merely call attention to information that is especially significant

to understanding and operating the equipment.
These instructions do not purport to cover all details or variations in equipment, nor to provide for
every possible contingency to be met during installation, operation, and maintenance. The
information is supplied for informational purposes only, and GE makes no warranty as to the
accuracy of the information included herein. Changes, modifications, and/or improvements to
equipment and specifications are made periodically and these changes may or may not be reflected
herein. It is understood that GE may make changes, modifications, or improvements to the
equipment referenced herein or to the document itself at any time. This document is intended for
trained personnel familiar with the GE products referenced herein.
GE may have patents or pending patent applications covering subject matter in this document. The
furnishing of this document does not provide any license whatsoever to any of these patents.
GE PROVIDES THE FOLLOWING DOCUMENT AND THE INFORMATION INCLUDED THEREIN AS-IS AND
WITHOUT WARRANTY OF ANY KIND, EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY
IMPLIED STATUTORY WARRANTY OF MERCHANTABILITY OR FITNESS FOR PARTICULAR PURPOSE.
* indicates a trademark of General Electric Company and/or its subsidiaries.

All other trademarks are the property of their respective owners.
©Copyright 2014 General Electric Company.

All Rights Reserved
If you purchased this product through an Authorized Channel Partner, please contact the seller
directly.
Contact Information
General Contact Information

Online technical support and http://support.ge-ip.com
GlobalCare
Additional information http://www.ge-ip.com/
Solution Provider solutionprovider.ip@ge.com
Technical Support
If you have technical problems that cannot be resolved with the information in this manual, please
contact us by telephone or email, or on the web at http://support.ge-ip.com
Americas
Online Technical Support http://support.ge-ip.com
Phone 1-800-433-2682
International Americas Direct Dial 1-780-420-2010 (if toll free 800 option is unavailable)
Technical Support Email support.ip@ge.com
Customer Care Email customercare.ip@ge.com
Primary language of support English
Europe, the Middle East, and Africa

Phone +800-1-433-2682
EMEA Direct Dial +420 239015850 (if toll free 800 option is unavailable or if
dialing from a mobile telephone)
Technical Support Email support.emea.ip@ge.com
Customer Care Email customercare.emea.ip@ge.com
Primary languages of support English, French, German, Italian, Czech, Spanish
Asia Pacific
Phone +86-400-820-8208
+86-21-3877-7006 (India, Indonesia, and Pakistan)
Technical Support Email support.cn.ip@ge.com (China)
support.jp.ip@ge.com (Japan)
support.in.ip@ge.com (remaining Asia customers)
Customer Care Email customercare.apo.ip@ge.com
customercare.cn.ip@ge.com (China)
Table of Contents
Table of Contents................................................................................................................................................ i
Table of Figures................................................................................................................................................ xv
Chapter 1 Introduction............................................................................................................................ 1
1.1. Revisions in this Manual ............................................................................................................. 2
1.2. PACSystems Control System Overview .................................................................................... 3

1.2.1 Programming and Configuration ................................................................................................................................... 3
1.2.2 Process Systems ...................................................................................................................................................................... 3
1.2.3 PACSystems CPU Models .................................................................................................................................................... 4
1.3. Common CPU Features ............................................................................................................... 5

1.3.1 Firmware Storage in Flash Memory .............................................................................................................................. 5
1.3.2 Operation, Protection, and Module Status ................................................................................................................ 5
1.3.3 Ethernet Global Data............................................................................................................................................................. 6
1.3.4 OPC UA.......................................................................................................................................................................................... 6
1.4. RX3i Overview ............................................................................................................................... 7
1.5. RX7i Overview ............................................................................................................................... 9
1.6. Migrating Series 90 Applications to PACSystems ................................................................ 10
1.7. PACSystems Documentation ................................................................................................... 11
Chapter 2 CPU Features & Specifications .......................................................................................... 13
2.1. RX3i Features and Specifications ............................................................................................ 14

2.1.1 CPU310 .......................................................................................................................................................................................14
2.1.2 CPU315 and CPU320/CRU320 .......................................................................................................................................17
2.1.3 CPE305 and CPE310 ............................................................................................................................................................22
2.2. RX7i Features and Specifications ............................................................................................ 36

2.2.1 CPE010, CPE020 and CRE020 .........................................................................................................................................36
2.2.2 CPE030/CRE030 and CPE040/CRE040 .......................................................................................................................39
2.2.3 RX7i Embedded Ethernet Interface .............................................................................................................................41
Chapter 3 CPU Configuration............................................................................................................... 47
3.1. Configuring the CPU .................................................................................................................. 48
3.2. Configuration Parameters........................................................................................................ 49

3.2.1 Settings Parameters ............................................................................................................................................................49
3.2.2 Modbus TCP Address Map................................................................................................................................................51
GFK-2222U October 2014 i

Table of Contents
3.2.3 Scan Parameters ...................................................................................................................................................................51

3.2.4 Memory Parameters ...........................................................................................................................................................53
3.2.5 Fault Parameters...................................................................................................................................................................56
3.2.6 Redundancy Parameters (Redundancy CPUs Only) ...........................................................................................57
3.2.7 Transfer List .............................................................................................................................................................................57
3.2.8 Port 1 and Port 2 Parameters .........................................................................................................................................58
3.2.9 Scan Sets Parameters ........................................................................................................................................................61
3.2.10 Power Consumption Parameters .................................................................................................................................61
3.2.11 Access Control .......................................................................................................................................................................62
3.3. Setting a Temporary IP Address .............................................................................................. 63
3.4. Storing (Downloading) Hardware Configuration ................................................................. 65
3.5. Configuring the Embedded Ethernet Interface .................................................................... 66
Chapter 4 CPU Operation ..................................................................................................................... 67
4.1. CPU Sweep ................................................................................................................................... 68

4.1.1 Parts of the CPU Sweep .....................................................................................................................................................68
4.1.2 CPU Sweep Modes................................................................................................................................................................72
4.2. Program Scheduling Modes ..................................................................................................... 75
4.3. Window Modes ........................................................................................................................... 76
4.4. Data Coherency in Communications Windows.................................................................... 77
4.5. Run/Stop Operations ................................................................................................................. 78

4.5.1 CPU Stop Modes ...........................................................................................................................................................................78
4.5.2 Stop-to-Run Mode Transition .........................................................................................................................................79
4.5.3 Run/Stop Mode Switch Operation................................................................................................................................79
4.6. Flash Memory Operation .......................................................................................................... 80
4.7. Logic/Configuration Source and CPU Operating Mode at Power-up ............................... 81

4.7.1 CPU Mode when Memory Not Preserved/Power-up Source is Flash ........................................................82
4.7.2 CPU Mode when Memory Preserved ..........................................................................................................................82
4.8. Clocks and Timers ...................................................................................................................... 84

4.8.1 Elapsed Time Clock ..............................................................................................................................................................84
4.8.2 Time-of-Day Clock ................................................................................................................................................................84
4.8.3 Watchdog Timer ....................................................................................................................................................................85
4.9. System Security .......................................................................................................................... 87

4.9.1 Passwords and Privilege Levels - Legacy Mode ...................................................................................................87
4.9.2 OEM Protection – Legacy Mode ....................................................................................................................................88
4.9.3 Enhanced Security for Passwords and OEM Protection...................................................................................89
4.9.4 Legacy/Enhanced Security Comparison ..................................................................................................................90
ii PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Table of Contents
4.10. PACSystems I/O System ............................................................................................................ 91

4.10.1 I/O Configuration ..................................................................................................................................................................91
4.10.2 Genius I/O .................................................................................................................................................................................93
4.10.3 I/O System Diagnostic Data Collection .....................................................................................................................94
4.11. Power-Up and Power-Down Sequences ................................................................................ 96

4.11.1 Power-Up Sequence ...........................................................................................................................................................96
4.11.2 Power-Down Sequence ....................................................................................................................................................97
4.11.3 Retention of Data Memory Across Power Failure ...............................................................................................97
Chapter 5 Program Organization........................................................................................................ 99
5.1. Structure of a PACSystems Application Program .............................................................. 100

5.1.1 Blocks .......................................................................................................................................................................................100
5.1.2 Functions and Function Blocks...................................................................................................................................100
5.1.3 How Blocks Are Called.....................................................................................................................................................100
5.1.4 Nested Calls ..........................................................................................................................................................................101
5.1.5 Types of Blocks ....................................................................................................................................................................101
5.1.6 Local Data ..............................................................................................................................................................................112
5.1.7 Parameter Passing Mechanisms ...............................................................................................................................113
5.1.8 Languages .............................................................................................................................................................................115
5.2. Controlling Program Execution ............................................................................................. 118
5.3. Interrupt-Driven Blocks .......................................................................................................... 119

5.3.1 Interrupt Handling .............................................................................................................................................................119
5.3.2 Timed Interrupts .................................................................................................................................................................120
5.3.3 I/O Interrupts ........................................................................................................................................................................120
5.3.4 Module Interrupts ..............................................................................................................................................................121
5.3.5 Interrupt Block Scheduling ............................................................................................................................................121
Chapter 6 Program Data .................................................................................................................... 123
6.1. Variables .................................................................................................................................... 124

6.1.1 Mapped Variables ..............................................................................................................................................................124
6.1.2 Symbolic Variables ............................................................................................................................................................124
6.1.3 I/O Variables .........................................................................................................................................................................125
6.1.4 Arrays .......................................................................................................................................................................................127
6.1.5 Variable Indexes and Arrays ........................................................................................................................................127
6.2. Reference Memory ................................................................................................................... 130

6.2.1 Word (Register) References ..........................................................................................................................................130
6.2.2 Bit (Discrete) References.................................................................................................................................................132
6.3. User Reference Size and Default ........................................................................................... 133

6.3.1 %G User References and CPU Memory Locations ...........................................................................................133
GFK-2222U November 2014 iii

Table of Contents
6.4. Genius Global Data .................................................................................................................. 134
6.5. Transitions and Overrides ...................................................................................................... 135
6.6. Retentiveness of Logic and Data .......................................................................................... 136
6.7. Data Scope ................................................................................................................................ 137
6.8. System Status References ...................................................................................................... 138

6.8.1 %S References.....................................................................................................................................................................138
6.8.2 %SA, %SB, and %SC References ...............................................................................................................................139
6.8.3 Fault References .................................................................................................................................................................141
6.9. How Program Functions Handle Numerical Data.............................................................. 143

6.9.1 Data Types .............................................................................................................................................................................143
6.9.2 Floating Point Numbers ..................................................................................................................................................145
6.10. User Defined Types (UDTs) ..................................................................................................... 147

6.10.1 Working with UDTs ...........................................................................................................................................................147
6.10.2 UDT Properties ....................................................................................................................................................................147
6.10.3 UDT Limits..............................................................................................................................................................................148
6.10.4 Run Mode Store of UDTs ................................................................................................................................................148
6.10.5 UDT Operational Notes...................................................................................................................................................149
6.11. Operands for Instructions ...................................................................................................... 150
6.12. Word-for-Word Changes ........................................................................................................ 152

6.12.1 Exception: Symbolic Variables ....................................................................................................................................152
Chapter 7 Ladder Diagram (LD) Programming............................................................................... 153
7.1. Advanced Math Functions ...................................................................................................... 154

7.1.1 Exponential/Logarithmic Functions .........................................................................................................................155
7.1.2 Square Root ..........................................................................................................................................................................156
7.1.3 Trig Functions.......................................................................................................................................................................157
7.1.4 Inverse Trig – ASIN, ACOS, and ATAN ......................................................................................................................158
7.2. Bit Operation Functions .......................................................................................................... 159

7.2.1 Data Lengths for the Bit Operation Functions....................................................................................................160
7.2.2 Bit Position .............................................................................................................................................................................161
7.2.3 Bit Sequencer .......................................................................................................................................................................162
7.2.4 Bit Set, Bit Clear ...................................................................................................................................................................165
7.2.5 Bit Test .....................................................................................................................................................................................166
7.2.6 Logical AND, Logical OR, and Logical XOR ...........................................................................................................167
7.2.7 Logical NOT ...........................................................................................................................................................................169
7.2.8 Masked Compare ...............................................................................................................................................................170
7.2.9 Rotate Bits..............................................................................................................................................................................173
7.2.10 Shift Bits ..................................................................................................................................................................................174
iv PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Table of Contents
7.3. Coils ............................................................................................................................................ 176

7.3.1 Coil Checking ........................................................................................................................................................................176
7.3.2 Graphical Representation of Coils ............................................................................................................................176
7.3.3 Set Coil, Reset Coil..............................................................................................................................................................178
7.3.4 Transition Coils ....................................................................................................................................................................180
7.4. Contacts ..................................................................................................................................... 184

7.4.1 Continuation Contact ......................................................................................................................................................185
7.4.2 Fault Contact ........................................................................................................................................................................185
7.4.3 High and Low Alarm Contacts ....................................................................................................................................186
7.4.4 No Fault Contact ................................................................................................................................................................186
7.4.5 Normally Closed and Normally Open Contacts .................................................................................................187
7.4.6 Transition Contacts ...........................................................................................................................................................188
7.5. Control Functions ..................................................................................................................... 193

7.5.1 Do I/O .......................................................................................................................................................................................194
7.5.2 Edge Detectors ....................................................................................................................................................................197
7.5.3 Drum .........................................................................................................................................................................................199
7.5.4 Mask I/O Interrupt..............................................................................................................................................................206
7.5.5 Read Switch Position ........................................................................................................................................................207
7.5.6 Scan Set IO ............................................................................................................................................................................208
7.5.7 Suspend I/O...........................................................................................................................................................................209
7.5.8 Suspend or Resume I/O Interrupt .............................................................................................................................211
7.6. Conversion Functions .............................................................................................................. 212

7.6.1 Convert Angles ....................................................................................................................................................................213
7.6.2 Convert UINT or INT to BCD4 .......................................................................................................................................214
7.6.3 Convert DINT to BCD8 .....................................................................................................................................................215
7.6.4 Convert BCD4, UINT, DINT, or REAL to INT ............................................................................................................216
7.6.5 Convert BCD4, INT, DINT, or REAL to UINT ............................................................................................................218
7.6.6 Convert BCD8, UINT, INT, REAL or LREAL to DINT..............................................................................................220
7.6.7 Convert BCD4, BCD8, UINT, INT, DINT, and LREAL to REAL ..........................................................................222
7.6.8 Convert REAL to LREAL ....................................................................................................................................................224
7.6.9 Convert DINT to LREAL ....................................................................................................................................................225
7.6.10 Truncate .................................................................................................................................................................................225
7.7. Counters .................................................................................................................................... 226

7.7.1 Data Required for Counter Function Blocks ........................................................................................................226
7.7.2 Down Counter ......................................................................................................................................................................228
7.7.3 Up Counter ............................................................................................................................................................................229
7.8. Data Move Functions............................................................................................................... 231

7.8.1 Array Size................................................................................................................................................................................233
7.8.2 Array Size Dimension Function Blocks....................................................................................................................234
7.8.3 Block Clear .............................................................................................................................................................................236
7.8.4 Block Move ............................................................................................................................................................................236
GFK-2222U November 2014 v

Table of Contents
7.8.5 BUS_ Functions ...................................................................................................................................................................238

7.8.6 Communication Request (COMMREQ) ....................................................................................................................244
7.8.7 Data Initialization ...............................................................................................................................................................249
7.8.8 Data Initialize ASCII ...........................................................................................................................................................250
7.8.9 Data Initialize Communications Request ..............................................................................................................251
7.8.10 Data Initialize DLAN ..........................................................................................................................................................251
7.8.11 Move .........................................................................................................................................................................................252
7.8.12 Move Data .............................................................................................................................................................................254
7.8.13 Move Data Explicit ............................................................................................................................................................255
7.8.14 Move From Flat ...................................................................................................................................................................256
7.8.15 Move to Flat ..........................................................................................................................................................................258
7.8.16 Shift Register ........................................................................................................................................................................260
7.8.17 Size Of ......................................................................................................................................................................................262
7.8.18 Swap.........................................................................................................................................................................................263
7.8.19 Data Table Functions ......................................................................................................................................................264
7.8.20 Array Move ............................................................................................................................................................................266
7.8.21 Array Range ..........................................................................................................................................................................268
7.8.22 FIFO Read...............................................................................................................................................................................270
7.8.23 FIFO Write ..............................................................................................................................................................................272
7.8.24 LIFO Read ...............................................................................................................................................................................274
7.8.25 LIFO Write ..............................................................................................................................................................................275
7.8.26 Search......................................................................................................................................................................................276
7.8.27 Sort ............................................................................................................................................................................................278
7.8.28 Table Read ............................................................................................................................................................................279
7.8.29 Table Write ............................................................................................................................................................................280
7.9. Math Functions ......................................................................................................................... 281

7.9.1 Absolute Value .....................................................................................................................................................................282
7.9.2 Add .............................................................................................................................................................................................283
7.9.3 Divide ........................................................................................................................................................................................285
7.9.4 Modulus ...................................................................................................................................................................................287
7.9.5 Multiply ....................................................................................................................................................................................288
7.9.6 Scale..........................................................................................................................................................................................290
7.9.7 Subtract...................................................................................................................................................................................291
7.10. Program Flow Functions ......................................................................................................... 292

7.10.1 Argument Present .............................................................................................................................................................293
7.10.2 Call .............................................................................................................................................................................................294
7.10.3 Comment ...............................................................................................................................................................................297
7.10.4 JumpN .....................................................................................................................................................................................297
7.10.5 Master Control Relay/End Master Control Relay ..............................................................................................298
7.10.6 Wires ........................................................................................................................................................................................300
7.11. Relational Functions ................................................................................................................ 301

7.11.1 Compare.................................................................................................................................................................................302
7.11.2 Equal, Not Equal, Greater or Equal, Greater Than, Less or Equal, Less Than..................................... 303
vi PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Table of Contents
7.11.3 EQ_DATA ................................................................................................................................................................................304

7.11.4 Range .......................................................................................................................................................................................305
7.12. Timers ......................................................................................................................................... 306

7.12.1 Timed Contacts...................................................................................................................................................................306
7.12.2 Timer Function Blocks .....................................................................................................................................................307
7.12.3 Standard Timer Function Blocks ...............................................................................................................................321
Chapter 8 Function Block Diagram (FBD) ........................................................................................ 327
8.1. Advanced Math Functions ...................................................................................................... 329

8.1.1 EXPT Function ......................................................................................................................................................................331
8.2. Bit Operation Functions .......................................................................................................... 332

8.2.1 Logical AND, Logical OR, and Logical XOR ...........................................................................................................334
8.2.2 Logical NOT ...........................................................................................................................................................................336
8.3. Comments ................................................................................................................................. 337

8.3.1 Text Block ...............................................................................................................................................................................337
8.4. Comparison Functions ............................................................................................................ 338

8.4.1 Equal, Not Equal, Greater or Equal, Greater Than, Less or Equal, Less Than ..................................... 340
8.5. Control Functions ..................................................................................................................... 341
8.6. Counters .................................................................................................................................... 343
8.7. Data Move Functions............................................................................................................... 344

8.7.1 Fan Out ....................................................................................................................................................................................348
8.7.2 Move Data..............................................................................................................................................................................349
8.8. Math Functions ......................................................................................................................... 351

8.8.1 Add .............................................................................................................................................................................................353
8.8.2 Divide ........................................................................................................................................................................................354
8.8.3 Modulus ...................................................................................................................................................................................355
8.8.4 Multiply ....................................................................................................................................................................................356
8.8.5 Negate .....................................................................................................................................................................................357
8.8.6 Subtract...................................................................................................................................................................................358
8.9. Program Flow Functions ......................................................................................................... 359
8.10. Timers ......................................................................................................................................... 360

8.10.1 Built-in Timer Function Blocks ....................................................................................................................................360
8.10.2 Standard Timer Function Blocks ...............................................................................................................................361
8.11. Type Conversion Functions .................................................................................................... 362

8.11.1 Convert WORD to INT ......................................................................................................................................................364
8.11.2 Convert WORD to UINT ...................................................................................................................................................364
GFK-2222U November 2014 vii

Table of Contents
8.11.3 Convert DWORD to DINT ...............................................................................................................................................365

8.11.4 Convert INT or UINT to WORD ....................................................................................................................................365
8.11.5 Convert DINT to DWORD ...............................................................................................................................................366
Chapter 9 Service Request Function ................................................................................................ 367
9.1. Operation of SVC_REQ Function ............................................................................................ 368

9.1.1 Ladder Diagram ..................................................................................................................................................................368
9.1.2 Function Block Diagram .................................................................................................................................................369
9.2. SVC_REQ 1: Change/Read Constant Sweep Timer ............................................................. 370
9.3. SVC_REQ 2: Read Window Modes and Time Values ........................................................... 372
9.4. SVC_REQ 3: Change Controller Communications Window Mode ................................... 373
9.5. SVC_REQ 4: Change Backplane Communications Window Mode and Timer Value .... 374
9.6. SVC_REQ 5: Change Background Task Window Mode and Timer Value ........................ 375
9.7. SVC_REQ 6: Change/Read Number of Words to Checksum ............................................. 376
9.8. SVC_REQ 7: Read or Change the Time-of-Day Clock ......................................................... 378

9.8.1 Parameter Block Formats..............................................................................................................................................378
9.9. SVC_REQ 8: Reset Watchdog Timer ...................................................................................... 385
9.10. SVC_REQ 9: Read Sweep Time from Beginning of Sweep ................................................. 386
9.11. SVC_REQ 10: Read Target Name ........................................................................................... 387
9.12. SVC_REQ 11: Read Controller ID ............................................................................................ 388
9.13. SVC_REQ 12: Read Controller Run State .............................................................................. 389
9.14. SVC_REQ 13: Shut Down (Stop) CPU ...................................................................................... 390
9.15. SVC_REQ 14: Clear Controller or I/O Fault Table................................................................ 391
9.16. SVC_REQ 15: Read Last-Logged Fault Table Entry............................................................. 392
9.17. SVC_REQ 16: Read Elapsed Time Clock ................................................................................ 395
9.18. SVC_REQ 17: Mask/Unmask I/O Interrupt ........................................................................... 397

9.18.1 Masking/Unmasking Module Interrupts ................................................................................................................397
9.19. SVC_REQ 18: Read I/O Forced Status ................................................................................... 399
9.20. SVC_REQ 19: Set Run Enable/Disable ................................................................................... 400
9.21. SVC_REQ 20: Read Fault Tables ............................................................................................. 401

9.21.1 Non-Extended Formats ..................................................................................................................................................401
viii PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Table of Contents
9.21.2 Extended Formats .............................................................................................................................................................403
9.22. SVC_REQ 21: User-Defined Fault Logging ........................................................................... 406
9.23. SVC_REQ 22: Mask/Unmask Timed Interrupts.................................................................... 408
9.24. SVC_REQ 23: Read Master Checksum................................................................................... 409
9.25. SVC_REQ 24: Reset Module ..................................................................................................... 410
9.26. SVC_REQ 25: Disable/Enable EXE Block and Standalone C Program Checksums........ 411
9.27. SVC_REQ 29: Read Elapsed Power Down Time ................................................................... 412
9.28. SVC_REQ 32: Suspend/Resume I/O Interrupt...................................................................... 413
9.29. SVC_REQ 45: Skip Next I/O Scan ............................................................................................ 414
9.30. SVC_REQ 50: Read Elapsed Time Clock ................................................................................ 415
9.31. SVC_REQ 51: Read Sweep Time from Beginning of Sweep ............................................... 417
9.32. SVC_REQ 56: Logic Driven Read of Nonvolatile Storage ................................................... 418
9.33. SVC_REQ 57: Logic Driven Write to Nonvolatile Storage.................................................. 422

9.33.1 Parameter Block for SVC_REQ 57 .............................................................................................................................425
Chapter 10 PID Built-In Function Block .............................................................................................. 429
10.1. Operands of the PID Function................................................................................................ 430

10.1.1 Operands for LD Version of PID Function Block ................................................................................................430
10.1.2 Operands for FBD Version of PID Function Block .............................................................................................431
10.2. Reference Array for the PID Function .................................................................................. 432

10.2.1 Scaling Input and Outputs ............................................................................................................................................432
10.2.2 Reference Array Parameters .......................................................................................................................................432
10.3. Operation of the PID Function ............................................................................................... 439

10.3.1 Automatic Operation .......................................................................................................................................................439
10.3.2 Manual Operation .............................................................................................................................................................439
10.3.3 Time Interval for the PID Function ............................................................................................................................440
10.4. PID Algorithm Selection (PIDISA or PIDIND) and Gain Calculations ............................... 441
10.4.1 Derivative Term ..................................................................................................................................................................442
10.4.2 Error Term Mode ................................................................................................................................................................442
10.4.3 Derivative Action on PV Bit ...........................................................................................................................................442
10.4.4 Combined Operation of Error Term and Derivative Action Modes .........................................................442
10.4.5 CV Bias Term ........................................................................................................................................................................443
10.4.6 CV Amplitude and Rate Limits ....................................................................................................................................443
10.4.7 Sample Period and PID Function Block Scheduling ........................................................................................444
GFK-2222U November 2014 ix

Table of Contents
10.5. Determining the Process Characteristics ........................................................................... 445
10.6. Setting Tuning Loop Gains ..................................................................................................... 446

10.6.1 Basic Iterative Tuning Approach ...............................................................................................................................446
10.6.2 Setting Loop Gains Using the Ziegler and Nichols Tuning Approach .................................................... 446
10.6.3 Ideal Tuning Method ........................................................................................................................................................447
10.7. Example...................................................................................................................................... 448
Chapter 11 Structured Text (ST) Programming................................................................................. 451
11.1. Language Overview ................................................................................................................. 452

11.1.1 Statements............................................................................................................................................................................452
11.1.2 Expressions ...........................................................................................................................................................................452
11.1.3 Operators ...............................................................................................................................................................................452
11.1.4 Structured Text Syntax ...................................................................................................................................................454
11.2. Statement Types ...................................................................................................................... 455

11.2.1 Assignment Statement ...................................................................................................................................................456
11.2.2 Function Call ........................................................................................................................................................................456
11.2.3 RETURN Statement ...........................................................................................................................................................460
11.2.4 IF Statement .........................................................................................................................................................................461
11.2.5 CASE Statement .................................................................................................................................................................462
11.2.6 FOR … DO Statements .....................................................................................................................................................464
11.2.7 WHILE Statement ..............................................................................................................................................................466
11.2.8 REPEAT Statement ............................................................................................................................................................467
11.2.9 ARG_PRES Statement ......................................................................................................................................................468
11.2.10 Exit Statement ..................................................................................................................................................................469
Chapter 12 Communications ............................................................................................................... 471
12.1. Ethernet Communications ..................................................................................................... 472

12.1.1 Embedded Ethernet Interface ....................................................................................................................................472
12.1.2 Ethernet Interface Modules..........................................................................................................................................473
12.2. Serial Communications ........................................................................................................... 474

12.2.1 Serial Port Communications Capabilities .............................................................................................................474
12.2.2 Configurable Stop Mode Protocols ..........................................................................................................................475
12.2.3 Serial Port Pin Assignments .........................................................................................................................................475
12.2.4 Serial Port Baud Rates ....................................................................................................................................................479
12.3. Series 90-70 Communications and Intelligent Option Modules ...................................... 480
12.3.1 Communications Coprocessor Module (CMM) ...................................................................................................480
12.3.2 Programmable Coprocessor Module (PCM).........................................................................................................481
12.3.3 DLAN/DLAN+ (Drives Local Area Network) Interface ......................................................................................482
x PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Table of Contents
Chapter 13 Serial I/O, SNP & RTU Protocols ...................................................................................... 483
13.1. Configuring Serial Ports Using COMMREQ Function 65520 ............................................. 484
13.1.1 COMMREQ Function Example .....................................................................................................................................484
13.1.2 Timing ......................................................................................................................................................................................484
13.1.3 Sending Another COMMREQ to the Same Port ..................................................................................................484
13.1.4 Invalid Port Configuration Combinations .............................................................................................................485
13.1.5 COMMREQ Command Block Parameter Values ................................................................................................485
13.1.6 Sample COMMREQ Command Blocks for Serial Port Setup function .................................................... 486
13.2. Serial I/O Protocol .................................................................................................................... 489

13.2.1 Calling Serial I/O COMMREQs from the CPU Sweep ........................................................................................489
13.2.2 Compatibility ........................................................................................................................................................................489
13.2.3 Status Word for Serial I/O COMMREQs ..................................................................................................................489
13.2.4 Serial I/O COMMREQ Commands ..............................................................................................................................491
13.2.5 Overlapping COMMREQs ...............................................................................................................................................491
13.2.6 Initialize Port Function (4300) ......................................................................................................................................492
13.2.7 Set Up Input Buffer Function (4301) ........................................................................................................................493
13.2.8 Flush Input buffer Function (4302) ...........................................................................................................................494
13.2.9 Read port status Function (4303) ..............................................................................................................................495
13.2.10 Cancel COMMREQ Function (4399)........................................................................................................................498
13.2.11 Autodial Function (4400) .............................................................................................................................................499
13.2.12 Write bytes Function (4401) ......................................................................................................................................501
13.2.13 Read bytes Function (4402) .......................................................................................................................................502
13.2.14 Read String Function (4403) ......................................................................................................................................504
13.3. RTU Slave Protocol ................................................................................................................... 506

13.3.1 Message Format ................................................................................................................................................................506
13.3.2 Cyclic Redundancy Check (CRC) ................................................................................................................................511
13.3.3 Cyclic Redundancy Check Register..........................................................................................................................511
13.3.4 Calculating the CRC-16 ..................................................................................................................................................512
13.3.5 Calculating the Length of Frame ..............................................................................................................................514
13.3.6 RTU Message Descriptions ...........................................................................................................................................515
13.3.7 RTU Scratch Pad ................................................................................................................................................................531
13.3.8 Communication Errors....................................................................................................................................................532
13.3.9 RTU Slave/SNP Slave Operation with Programmer Attached....................................................................535
13.4. SNP Slave Protocol ................................................................................................................... 536

13.4.1 Permanent Datagrams ..................................................................................................................................................536
13.4.2 Communication Requests (COMMREQs) for SNP ..............................................................................................536
Chapter 14 Diagnostics ......................................................................................................................... 537
14.1. Fault Handling Overview ........................................................................................................ 538

14.1.1 System Response to Faults ..........................................................................................................................................538
14.1.2 Fault Tables ..........................................................................................................................................................................538
14.1.3 Fault Actions and Fault Action Configuration ....................................................................................................539
GFK-2222U November 2014 xi

Table of Contents
14.2. Using the Fault Tables ............................................................................................................. 540

14.2.1 Controller Fault Table ......................................................................................................................................................540
14.2.2 I/O Fault Table .....................................................................................................................................................................542
14.3. System Handling of Faults ...................................................................................................... 544

14.3.1 System Fault References ...............................................................................................................................................544
14.3.2 Using Fault Contacts .......................................................................................................................................................548
14.3.3 Using Point Faults..............................................................................................................................................................549
14.3.4 Using Alarm Contacts .....................................................................................................................................................550
14.4. Controller Fault Descriptions and Corrective Actions ...................................................... 551

14.4.1 Controller Fault Groups ..................................................................................................................................................551
14.4.2 Loss of or Missing Rack (Group 1) .............................................................................................................................552
14.4.3 Loss of or Missing Option Module (Group 4) ........................................................................................................553
14.4.4 Addition of, or Extra Rack (Group 5) .........................................................................................................................554
14.4.5 Reset of, Addition of, or Extra Option Module (Group 8)................................................................................555
14.4.6 System Configuration Mismatch (Group 11) .......................................................................................................556
14.4.7 System Bus Error (Group 12) ........................................................................................................................................562
14.4.8 CPU Hardware Failure (Group 13) .............................................................................................................................563
14.4.9 Module Hardware Failure (Group 14)......................................................................................................................564
14.4.10 Option Module Software Failure (Group 16) .....................................................................................................565
14.4.11 Program or Block Checksum Failure (Group 17) ............................................................................................566
14.4.12 Battery Status (Group 18) ...........................................................................................................................................567
14.4.13 Constant Sweep Time Exceeded (Group 19) ....................................................................................................568
14.4.14 System Fault Table Full (Group 20) ........................................................................................................................569
14.4.15 I/O Fault Table Full (Group 21) ................................................................................................................................570
14.4.16 User Application Fault (Group 22) .........................................................................................................................571
14.4.17 CPU Over-Temperature (Group 24) .......................................................................................................................573
14.4.18 Power Supply Fault (Group 25) ................................................................................................................................574
14.4.19 No User Program on Power-Up (Group 129) ....................................................................................................575
14.4.20 Corrupted User Program on Power-Up (Group 130) ....................................................................................576
14.4.21 Window Completion Failure (Group 131) ...........................................................................................................577
14.4.22 Password Access Failure (Group 132)..................................................................................................................578
14.4.23 Null System Configuration for Run Mode (Group 134) ...............................................................................579
14.4.24 CPU System Software Failure (Group 135) ........................................................................................................580
14.4.25 Communications Failure During Store (Group 137)......................................................................................582
14.4.26 Non-Critical CPU Software Event (Group 140) .................................................................................................583
14.5. I/O Fault Descriptions and Corrective Actions ................................................................... 585

14.5.1 Fault Extra Data .................................................................................................................................................................585
14.5.2 I/O Fault Groups .................................................................................................................................................................585
14.5.3 I/O Fault Categories .........................................................................................................................................................586
14.5.4 Circuit Faults (Category 1) .............................................................................................................................................589
14.5.5 Loss of Block (Category 2) .............................................................................................................................................594
14.5.6 Addition of Block (Category 3).....................................................................................................................................595
14.5.7 I/O Bus Fault (Category 6) .............................................................................................................................................596
xii PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Table of Contents
14.5.8 Module Fault (Category 8) .............................................................................................................................................597

14.5.9 Addition of IOC (Category 9) .........................................................................................................................................598
14.5.10 Loss of or Missing IO Controller (Category 10) ................................................................................................599
14.5.11 IOC (I/O Controller) Software Fault (Category 11) ..........................................................................................600
14.5.12 Forced and Unforced Circuit (Categories 12 and 13) .................................................................................601
14.5.13 Loss of or Missing I/O Module (Category 14) ...................................................................................................602
14.5.14 Addition of I/O Module (Category 15) ..................................................................................................................603
14.5.15 Extra I/O Module (Category 16) ...............................................................................................................................604
14.5.16 Extra Block (Category 17) ...........................................................................................................................................605
14.5.17 IOC Hardware Failure (Category 18) .....................................................................................................................606
14.5.18 GBC Stopped Reporting Faults (Category 19) ..................................................................................................607
14.5.19 GBC Software Exception (Category 21) ...............................................................................................................608
14.5.20 Block Switch (Category 22) ........................................................................................................................................609
14.5.21 Reset of IOC (Category 27) .........................................................................................................................................610
14.6. Diagnostic Logic Blocks (DLBs) .............................................................................................. 611

14.6.1 DLB Operation .....................................................................................................................................................................612
14.6.2 Executing DLBs ...................................................................................................................................................................614
14.6.3 Diagnostic Logic Block (DLB) Example ...................................................................................................................618
Appendix A Performance Data ................................................................................................................... 623
A-1 Boolean Execution Times ..................................................................................................................... 623

A-1.1 Boolean Execution Measurements (milliseconds per 1000 Boolean executions) ........................... 624
A-2 Instruction Timing ................................................................................................................................. 625

A-2.1 Overview .................................................................................................................................................................................625
A-2.2 CPU Version Information................................................................................................................................................626
A-2.3 RX3i Instruction Times .....................................................................................................................................................627
A-2.4 RX7i Instruction Times .....................................................................................................................................................640
A-3 Overhead Sweep Impact Times .......................................................................................................... 650

A-3.1 Base Sweep Times .............................................................................................................................................................651
A-3.2 What the Sweep Impact Tables Contain ...............................................................................................................653
A-3.3 Programmer Sweep Impact Times ...........................................................................................................................654
A-3.4 I/O Scan and I/O Fault Sweep Impact.....................................................................................................................655
A-3.5 Ethernet Global Data Sweep Impact .......................................................................................................................662
A-3.6 Sweep Impact of Intelligent Option Modules ......................................................................................................667
A-3.7 I/O Interrupt Performance and Sweep Impact ..................................................................................................670
A-3.8 Timed Interrupt Performance ......................................................................................................................................673
A-3.9 Example of Predicted Sweep Time Calculation .................................................................................................674
GFK-2222U November 2014 xiii

Table of Contents
Appendix B User Memory Allocation ......................................................................................................... 675
B-1 Items that Count Against User Memory ........................................................................................... 675
B-2 User Program Memory Usage ............................................................................................................. 675

B-2.1 %L and %P Program Memory .....................................................................................................................................676
B-2.2 Program Logic and Overhead .....................................................................................................................................677
xiv PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Table of Contents
Table of Figures
Figure 1: Accessing Real-Time Clock Battery (except CPE330) ___________________________________________ 27
Figure 2: Sample Tool for Coin Battery Extraction ____________________________________________________ 28
Figure 3: Hardware Configuration Display in Proficy Machine Edition ____________________________________ 48
Figure 4: Set Temporary IP Address _______________________________________________________________ 63
Figure 5: Downloading Hardware Configuration to CPU _______________________________________________ 65
Figure 6: Selecting Embedded Ethernet for Configuration ______________________________________________ 66
Figure 7: Major Phases of a Typical CPU Sweep ______________________________________________________ 69
Figure 8: Typical Sweeps in Normal Sweep Mode ____________________________________________________ 72
Figure 9: Typical Sweeps in Constant Sweep Mode ___________________________________________________ 73
Figure 10: Typical Sweeps in Constant Window Mode_________________________________________________ 74
Figure 11: CPU Sweep in Stop-I/O Disabled and Stop-I/O Enabled Modes _________________________________ 79
Figure 12: Example of Block Call _________________________________________________________________ 100
Figure 13: Conditional Block Call_________________________________________________________________ 102
Figure 14: Block Call with Parameters ____________________________________________________________ 102
Figure 15: Defining Member Variables for a User-Defined Function Block ________________________________ 105
Figure 16: Creating a User-Defined Function Block __________________________________________________ 106
Figure 17: Use of User-Defined Function Block in Ladder Logic _________________________________________ 106
Figure 18: Display of Instance Data Structures______________________________________________________ 106
Figure 19: Calling an External Block in Ladder Logic _________________________________________________ 109
Figure 20: Relationship of %L & %P to Program Blocks _______________________________________________ 112
Figure 21: Local Data (%L) Usage by Program Blocks ________________________________________________ 112
Figure 22: Parameter Passing Example ___________________________________________________________ 113
Figure 23: Explanation of Ladder Diagram Rung ____________________________________________________ 115
Figure 24: Illustration of Function Block Diagram ___________________________________________________ 116
Figure 25: Conflict Avoidance when using Interrupt-Driven Blocks ______________________________________ 120
Figure 26: Adding a UDT to Project in PME Navigator ________________________________________________ 147
Figure 27:PID in Ladder Diagram ________________________________________________________________ 429
Figure 28: PID in Function Block Diagram__________________________________________________________ 429
Figure 29: PID_IND Diagram ____________________________________________________________________ 441
Figure 30: PID Example Logic ___________________________________________________________________ 449
Figure 31: RTU Message Transactions ____________________________________________________________ 506
Figure 32: RTU Read Output Table Example________________________________________________________ 509
Figure 33: CRC Register Operation _______________________________________________________________ 511
Figure 34: RTU Read Output Table Message Format _________________________________________________ 515
Figure 35: RTU Read Input Table Message Format __________________________________________________ 516
Figure 36: RTU Read Registers Message Format ____________________________________________________ 517
Figure 37: RTU Read Analog Inputs Message Format ________________________________________________ 518
Figure 38: RTU Force Single Output Message Format ________________________________________________ 519
Figure 39: RTU Preset Single Register Message Format ______________________________________________ 520
Figure 40: RTU Read Exception Status Message Format ______________________________________________ 521
Figure 41: RTU Loopback/Maintenance Message Format _____________________________________________ 522
Figure 42: RTU Force Multiple Outputs Message Format _____________________________________________ 524
Figure 43: RTU Preset Multiple Registers Message Format ____________________________________________ 525
Figure 44: RTU Report Device Type Message Format ________________________________________________ 526
Figure 45: RTU Read Scratch Pad Memory Message Format __________________________________________ 530
Figure 46: RTU Error Response Format ____________________________________________________________ 532
GFK-2222U November 2014 xv

Table of Contents
Figure 47: Controller Fault Table Display __________________________________________________________ 540

Figure 48: Detail Information for Controller Fault Entry ______________________________________________ 541
Figure 49: I/O Fault Table Display ________________________________________________________________ 542
Figure 50: I/O Fault Table Fault Entry Detail Display _________________________________________________ 543
Figure 51: Diagnostic Logic Blocks (DLBs) assigned to Target in MPE ___________________________________ 612
Figure 52: Properties of Diagnostic Logic Block (DLB) ________________________________________________ 614
Figure 53: DLB Heartbeat Setting ________________________________________________________________ 614
Figure 54: Drag DLB from Toolchest and Drop in Active Blocks Node ____________________________________ 620
Figure 55: Set DLB Execution Mode to Sweep (Properties Tab) _________________________________________ 620
Figure 56: Start DLB Execution __________________________________________________________________ 620
Figure 57: Initialize Local Symbolic Variables _______________________________________________________ 621
Figure 58: DLB Icon and Status Bar after Execution has Commenced ____________________________________ 621
Figure 59: Data Watch for DLB Variables __________________________________________________________ 621
Figure 60: Interrupt Execution Considerations ______________________________________________________ 671
xvi PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Chapter 1 Introduction
This manual contains general information about PACSystems CPU operation and program content. It
also provides detailed descriptions of specific programming requirements.
Chapter 1 provides a general introduction to the PACSystems family of products, including new
features, product overviews, and a list of related documentation.
CPU hardware features and specifications are provided in Chapter 2.
Installation procedures are described in the PACSystems RX7i Installation Manual, GFK-2223 and the
PACSystems RX3i System Manual, GFK-2314.
CPU Configuration is described in Chapter 3. Configuration using the programming software
determines characteristics of module operation and establishes the program references used by
each module in the system. For details on configuration of the embedded RX7i Ethernet interface as
well as the rack-based RX7i and RX3i Ethernet Interface modules, refer to TCP/IP Ethernet
Communications for PACSystems, GFK-2224.
CPU Operation is described in Chapter 4.
Programming Features are described in Chapter 5 through Chapter 9 and in Appendix A.
■ Elements of an Application Program: Chapter 5
■ Program Data: Chapter 6
■ Ladder Diagram (LD) instruction set reference: Chapter 7
■ Function Block Diagram (FBD) instruction set reference: Chapter 8
■ The Service Request Function: Chapter 9
■ The PID Function: Chapter 10
■ Structured Text (ST): Chapter 11
Ethernet and Serial Communications are described in Chapter 12.
Serial I/O, SNP, and RTU Protocols are described in Chapter 13.
Diagnostics, including Fault Handling and Diagnostic Logic Blocks are described in Chapter 14.
Instruction Timing is provided in Appendix A.
User Memory Allocation is described in Appendix B.
GFK-2222U November 2014 1

Chapter 1. Introduction
1.1. Revisions in this Manual

Note: A given feature may not be implemented on all PACSystems CPUs. To determine whether a
feature is available on a given CPU model and firmware version, please refer to the Important
Product Information (IPI) document provided for the CPU version that you are using.
Rev Date Description
U Nov-14  New Appendix (A-3.6) EGD Sweep Impact for Embedded Eternet Interface on
RX3i CPE 305 and 310.
T Oct-14  Support for OPC UA using embedded Ethernet port in CPE305/CPE310 with CPU
firmware 8.20.
 Support for Ethernet Global Data (EGD Class 1) using embedded Ethernet port in
CPE305/CPE310 with CPU firmware 8.30 Sweep impact of EGD on Embedded
Ethernet interface. Direct replacement for S90-30 IC693CPU374.
 New communications capabilities provided by:
o IC695PNS001 – PROFINET Scanner Module
o IC695GCG001 – Genius Communications Gateway via PROFINET
o IC695EDS001 – Ethernet based DNP3 Outstation
S July-13  Support for Modbus/TCP Server, SRTP channels and Modbus/TCP client channels
on RX3i CPE305/CPE310 embedded Ethernet interface – Chapter 2 & Chapter 12
 Support for Access Control List – Chapter 3and Chapter 14
 Modbus TCP/IP mapping for CPE305/CPE310 – Chapter 3
 Enhanced Security Passwords and OEM Protection – Chapter 4
 Serial I/O protocol enhancements (Data Set Ready, Ring Indicator, and Data
Carrier Detect) – Chapter 13
 Diagnostics for PROFINET alarms and PROFINET network faults, including
#PNIO_ALARM, SA0030 – Chapter 6 and Chapter 14
 Instruction executions times measured for RX3i CPU320/CRU320 – Appendix A
 Sweep impact times for new modules: IC694MDL758, IC694APU300-CA and
later, IC695PNS001, IC694ALG442, IC694ALG220, IC694MDL645 and
IC694MDL740 – Appendix A
earlier  Added instructions for replacing the RX3i CPE305/CPE310 real-time clock
battery: Chapter 2
 Corrected definitions of reverse acting and direct acting modes for PID functions
– Chapter 10
 Expanded data for Boolean execution measurements – Appendix A
 Re-instated instruction times for RX7i CPE/CRE030/040 release 6.0 as published
in version Q of the manual (unintentionally omitted from version R) – Appendix A
 Compatibility information for volatile memory backup batteries has been
consolidated in the PACSystems Battery and Energy Pack Manual – throughout
2 PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

1.2. PACSystems Control System Overview

The PACSystems controller environment combines performance, productivity, openness and
flexibility. The PACSystems control system integrates advanced technology with existing systems. The
result is seamless migration that protects your investment in I/O and application development.
1.2.1 Programming and Configuration
Proficy* Machine Edition programming software provides a universal engineering development
environment for all programming, configuration and diagnostics of PACSystems. A PACSystems CPU
is programmed and configured using the programming software to perform process and discrete
automation for various applications. The CPU communicates with I/O and smart option modules
through a rack-mounted backplane. It communicates with the programmer and/or HMI devices via
the Ethernet ports or via the serial ports 1 and 2 using Serial I/O, or Modbus RTU slave protocols.
1.2.2 Process Systems
PACSystems CPUs with firmware version 5.0 and later support Proficy Process Systems (PPS). PPS is a
complete, tightly integrated, seamless process control system using PACSystems, Proficy HMI/SCADA,
and Proficy Production Management Software to provide control, optimization, and performance
management to manage and monitor batch or continuous manufacturing. It delivers the tools
required to design, implement, document, and maintain an automated process. For information
about purchasing PPS software, refer to the Support website.

1.2.3 PACSystems CPU Models

Family Catalog Number Description
RX3i CPUs IC695CPU310 300MHz Celeron CPU, 10 MB user memory
IC695CPU315 1 GHz Celeron-M CPU, 20 MB user memory
IC695CPU320 1 GHz Celeron-M CPU, 64 MB user memory
IC695NIU001+ 1.1 GHz Atom 510 NIU. For information, see the RX3i
versions –AAAA and Ethernet NIU User’s Manual, GFK-2439
later
IC695NIU001 300MHz Celeron NIU. For information, see the
PACSystems RX3i Ethernet NIU User’s Manual,
GFK-2439
RX3i CPUs with IC695CPE305 1.1GHz Atom CPU, 5 MB user memory
embedded Ethernet
IC695CPE310 1.1GHz Atom CPU, 10 MB user memory
Interface 1
RX3i Redundancy IC695CRU320 1 GHz Celeron-M CPU, 64 MB user memory
CPU
RX7i CPUs with IC698CPE010 300MHz, Celeron CPU, 10MB user memory
embedded Ethernet
IC698CPE020 700MHz, Pentium CPU, 10 MB user memory,
Interface
IC698CPE030 600MHz, Pentium-M CPU, 64MB user memory
IC698CPE040 1800MHz, Pentium-M CPU, 64MB user memory
RX7i Redundancy IC698CRE020 700MHz, Pentium CPU, 10 MB user memory
CPUs with
IC698CRE030 600MHz, Pentium-M CPU, 64MB user memory
embedded
Ethernet Interface IC698CRE040 1800MHz, Pentium-M CPU, 64MB user memory
1 The RX3i CPE305/CPE310 embedded Ethernet interface provides a maximum of two programmer
connections. It does not support the full set of Ethernet interface features described in this manual. For a
summary of RX3i embedded Ethernet interface features, refer to TCP/IP Ethernet Communications for
PACSystems, GFK-2224K or later.

1.3. Common CPU Features

PACSystems CPU models have the following features in common:
■ Programming in Ladder Diagram, Function Block Diagram, Structured Text and C.
■ Floating point (real) data functions.
■ Configurable data and program memory.
■ CPE305 and CPE310 have battery-less retention of user memory non-volatile flash. All other
models have battery-backed RAM for user data (program, configuration, register data, and
symbolic variable) storage and clocks.
■ CPE305 and CPE310 models have battery backup for real time clock (elapsed time clock).
■ Non-volatile built-in flash memory for user data (program, configuration, register data, and
symbolic variable) storage. Use of this flash memory is optional.
■ Configurable Run/Stop mode switch.
■ Embedded RS-232 and RS-485 communications. (CPE305 has only RS-232 communications).
■ Up to 512 program blocks. Maximum size for a block is 128KB.
■ Auto Located Symbolic Variables, which allows you to create a variable without specifying a
reference address.
■ Bulk memory area accessed via reference table %W. The upper limit of this memory area can be
configured to the maximum available user RAM.
■ Larger reference table sizes, compared to Series 90* CPUs: 32Kbits for discrete %I and %Q and
up to 32K words each for analog %AI and %AQ.
■ Online Editing mode that allows you to easily test modifications to a running program. (For details
on using this feature, refer to the programming software online help and Proficy Logic Developer
Getting Started, GFK-1918.)
■ Bit in word referencing that allows you to specify individual bits in a WORD reference in retentive
memory as inputs and outputs of Boolean expressions, function blocks, and calls that accept bit
parameters.
■ In-system upgradeable firmware.
1.3.1 Firmware Storage in Flash Memory

The CPU uses non-volatile flash memory for storing the operating system firmware. This allows
firmware to be updated without disassembling the module or replacing EPROMs. The operating
system firmware is updated by connecting to the CPU with a PC compatible computer and running
the software included with the firmware upgrade kit.
1.3.2 Operation, Protection, and Module Status
Operation of the CPU can be controlled by the three-position Run/Stop switch or remotely by an
attached programmer and programming software. Program and configuration data can be locked
through software passwords. The status of the CPU is indicated by the CPU LEDs on the front of the
module. For details, see “Indicators” for each PACSystems family.
Note: The RESET pushbutton is provided to support future features and has no effect on CPU
operation in the current version.

1.3.3 Ethernet Global Data

Note: Effective with RX3i CPE310/CPE305 Firmware Release 8.30, the CPU itself also supports EGD
Class 1 2. Prior to that firmware release, EGD was only available in the RX3i via the RX3i
Ethernet Interface Module (ETM001).
Each PACSystems CPU supports up to 255 simultaneous EGD pages across all Ethernet interfaces in
the Controller. EGD pages must be configured in the programming software and stored into the CPU.
The EGD configuration can also be loaded from the CPU into the programming software. Both
produced and consumed pages can be configured. PACSystems CPUs support the use of only part of
a consumed EGD page, and EGD page production and consumption to the broadcast IP address of
the local subnet.
The PACSystems CPU supports 2ms EGD page production and timeout resolution. EGD pages can be
configured for a production period of 0, indicating the page is to be produced every output scan. The
minimum period for these “as fast as possible” pages is 2ms. Refer to the section, A3.6 for EGD
configuration on Embedded Ethernet interface of CPE305/310.
During EGD configuration, PACSystems Ethernet interfaces are identified by their Rack/Slot location.
1.3.4 OPC UA
Each PACSystems CPE305/CPE310 supports Open Productivity and Connectivity Unified Architecture
(OPC UA) Server communications on the embedded Ethernet port only.
For more information on OPC UA support see GFK-2224 version M or higher (Chapter 10).
Note: Effective with CPE310/CPE305 Firmware Release 8.20, the CPE embedded Ethernet port
supports OPC UA Server.
2Proficy Machine Edition Release 8.50 SIM 7 is required for EGD Class 1 on Embedded Ethernet interface of
CPE305/CPE310.

1.4. RX3i Overview

The RX3i control system hardware consists of an RX3i universal backplane and up to seven
Series 90-30 expansion or remote racks. The CPU can be in any slot in the universal backplane
except the last slot, which is reserved for the serial bus transmitter, IC695LRE001.
The RX3i supports user defined Function Blocks (LD logic only) and Structured Text programming.
The RX3i universal backplane uses a dual bus that provides both:
■ High-speed PCI for fast throughput of new advanced I/O.
■ Serial backplane for easy migration of existing Series 90-30 I/O
The RX3i universal backplane and Series 90-30 expansion/remote racks support the Series 90-30
Genius Bus Controller and Motion Control modules, and most Series 90-30/RX3i discrete and analog
I/O with catalog prefixes IC693 and IC694. RX3i modules with catalog prefixes IC695, including the
Ethernet and other communications modules can only be installed in the universal backplane. See
the PACSystems RX3i System Manual, GFK-2314 for a list of supported modules.
RX3i supports hot standby (HSB) CPU redundancy, which allows a critical application or process to
continue operating if a failure occurs in any single component. A CPU redundancy system consists of
an active unit that actively controls the process and a backup unit that is synchronized with the
active unit and can take over the process if it becomes necessary. Each unit must have a redundancy
CPU, (IC695CRU320). The redundancy communication path is provided by IC695RMX128 Redundancy
Memory Xchange (RMX) modules set up as redundancy links. For details on the operation of
PACSystems redundancy systems, refer to the PACSystems Hot Standby CPU Redundancy User’s
Guide, GFK-2308.
RX3i communications features include:
■ Open communications support includes Ethernet, PROFIBUS, PROFINET, Modbus TCP, Ethernet
Global Data (EGD), DNP3 and serial protocols.
■ The CPE305 and CPE310 CPUs provide an embedded Ethernet interface which is used to connect
up the programmer (Proficy Machine Edition).
■ Effective with RX3i CPE310/CPE305 Firmware Release 7.30, the embedded Ethernet port on the
CPU provided support for Service Request Transfer Protocol (SRTP) channels and for Modbus TCP.
■ Effective with CPE310/CPE305 Firmware Release 8.20, the CPE embedded Ethernet port supports
OPC UA Server. See GFK-2224 version M or higher (Chapter 10).
■ Effective with RX3i CPE310/CPE305 Firmware Release 8.30, the CPU itself also supports Ethernet
Global Data (EGD) 2. Prior to that firmware release, EGD was only available in the RX3i via the RX3i
Ethernet Interface Module (ETM001). With this upgrade, these CPUs are positioned as a direct
replacement for S90-30 IC693CPU374.
■ The rack-based ETM001 Ethernet Interface has dual RJ-45 ports connected through an auto-
sensing switch. This eliminates the need for rack-to-rack switches or hubs. The ETM001 supports
upload, download and online monitoring, and provides 32 SRTP channels with a maximum of 48
simultaneous SRTP server connections. It also supports Modbus TCP. For details on Ethernet
Interface capabilities, refer to TCP/IP Ethernet Communications for PACSystems, GFK-2224.
■ PROFIBUS communications via the PROFIBUS Master module. For details, refer to the PACSystems
RX3i PROFIBUS Modules User’s Manual, GFK-2301.
■ PROFINET communications via the PROFINET Controller module IC695PNC001 and PROFINET
Scanner module IC695PNS001. For details, refer to the PACSystems RX3i PROFINET Controller
Manual, GFK-2571 and PACSystems RX3i PROFINET Scanner Manual, GFK-2737.

■ Effective with the release of IC695GCG001, the RX3i may be equipped to control a Genius Bus via
a PROFINET Interface. See Genius Communications Gateway User’s Manual GFK-2892.
■ Effective with the release of IC695EDS001, the RX3i may be configured as a DNP3 Outstation. See
DNP3 Outstation User’s Manual GFK-2911.
■ IC695CMM002 and IC695CMM004 expand the serial communications capability of the RX3i
system. See RX3i Serial Communications Modules User’s Manual, GFK-2460.
■ CPE310, CPU310, CPU315, CPU/CRU320 and NIU001 provide two serial ports, one RS-232 and
one RS-485.
■ CPE305 provides one RS-232 serial port.

1.5. RX7i Overview

The RX7i control system hardware consists of an RX7i rack and up to seven Series 90-70 expansion
racks. The CPU resides in slot 1 of the main rack. RX7i racks use a VME64 backplane that provides up
to four times the bandwidth of existing VME based systems, including the current Series 90-70
systems for faster I/O throughput. The VME64 base supports all standard VME modules including
Series 90-70 I/O and VMIC modules.
Expansion racks support Series 90-70 discrete and analog I/O, the Genius Bus Controller, and the
High Speed Counter. The CPU provides an embedded auto-sensing 10/100 Mbps half/full duplex
Ethernet interface.
RX7i supports hot standby (HSB) CPU redundancy, which allows a critical application or process to
continue operating if a failure occurs in any single component. A CPU redundancy system consists of
an active unit that actively controls the process and a backup unit that is synchronized with the
active unit and can take over the process if it becomes necessary. Each unit must have a redundancy
CPU, (IC698CRE020, CRE030 or CRE040). The redundancy communication path is provided by
IC698RMX016 Redundancy Memory Xchange (RMX) modules set up as redundancy links. For details
on the operation of PACSystems redundancy systems, refer to the PACSystems Hot Standby CPU
Redundancy User’s Guide, GFK-2308.
Note: Extended operation with dissimilar CPU types is not allowed. During normal operation, the
primary and secondary units in an HSB redundancy system must have the same CPU model
type.
The primary and secondary units of an HSB redundancy system can have dissimilar model
types for a limited time, for the purpose of system upgrade only. Fail wait times for the higher
performance CPU in a dissimilar redundant pair may need to be increased to allow
synchronization.
RX7i communications features include:
■ Open communications support includes Ethernet, Genius, and serial protocols.
■ A built-in 10/100mb Ethernet interface that has dual RJ-45 ports connected through an auto-
sensing switch for upload, download and online monitoring. This eliminates the need for rack-to-
rack switches or hubs. The CPU Ethernet Interface provides basic remote control system
monitoring from a web browser and allows a combined total of up to 16 web server and FTP
connections. For details on Ethernet Interface capabilities, refer to TCP/IP Ethernet
■ Two serial ports, one RS-232 and one RS-485.
■ An RS-232 isolated Ethernet station manager serial port.

1.6. Migrating Series 90 Applications to PACSystems

The PACSystems control system provides cost-effective expansion of existing systems. Support for
existing Series 90 modules, expansion racks and remote racks protects your hardware investment.
You can upgrade on your timetable without disturbing panel wiring.
■ The RX3i supports most Series 90-30 modules, expansion racks, and remote racks. For a list of
supported I/O, Communications, Motion, and Intelligent modules, see the PACSystems RX3i
System Manual, GFK-2314.
■ The RX7i supports most existing Series 90-70 modules, expansion racks and Genius networks. For
a list of supported I/O, Communications, and Intelligent modules, see the PACSystems RX7i
Installation Manual, GFK-2223.
■ Conversion of Series 90-70 and Series 90-30 programs preserves existing development effort.
■ Conversion of VersaPro and Logicmaster applications to Machine Edition allows smooth
transition to PACSystems.

1.7. PACSystems Documentation

PACSystems Manuals
PACSystems CPU Reference Manual, GFK-2222
TCP/IP Ethernet Communications for PACSystems, GFK-2224
Station Manager for PACSystems, GFK-2225
PACSystems C Toolkit User’s Guide, GFK-2259
PACSystems Memory Xchange Modules User’s Manual, GFK-2300
PACSystems Hot Standby CPU Redundancy User’s Manual, GFK-2308
PACSystems Battery and Energy Pack Manual, GFK-2741
Proficy Machine Edition Logic Developer Getting Started, GFK-1918
Proficy Process Systems Getting Started Guide, GFK-2487
RX3i Manuals
PACSystems RX3i System Manual, GFK-2314
DSM324i Motion Controller for PACSystems RX3i and Series 90-30, GFK-2347
PACSystems RX3i PROFIBUS Modules User’s Manual, GFK-2301
PACSystems RX3i MAXON Software User’s Manual, GFK-2409
PACSystems RX3i Ethernet NIU User’s Manual, GFK-2439
PACMotion Multi-Axis Motion Controller User’s Manual, GFK-2448
PACSystems RX3i PROFINET Controller Manual, GFK-2571
PACSystems RX3i PROFINET Scanner Manual, GFK-2737
PACSystems RX3i Serial Communications Modules User’s Manual, GFK-2460
PACSystems RX3i Genius Communications Gateway User’s Manual, GFK-2892
PACSystems RX3i DNP3 Outstation User’s Manual, GFK-2911
RX7i Manuals
PACSystems RX7i Hardware and Installation Manual, GFK-2223
PACSystems RX7i User's Guide to Integration of VME Modules, GFK-2235
Genius Bus Controller User’s Manual, GFK-2017
Series 90 Manuals
Series 90-30 Genius Bus Controller, GFK-1034
Distributed I/O Systems Manuals
Genius I/O System User’s Manual, GEK904861
Genius I/O Analog and Discrete Blocks User’s Manual, GEK904862
In addition to these manuals, datasheets and product update documents describe individual
modules and product revisions. The most recent PACSystems documentation is available on the
Support website.

Chapter 2 CPU Features & Specifications
This chapter provides details on the hardware features of the PACSystems CPUs and their
specifications.
■ RX3i Features and Specifications page 14

■ RX7i Features and Specifications page 36

Chapter 2. CPU Features & Specifications
2.1. RX3i Features and Specifications

2.1.1 CPU310
IC695CPU310: 300 MHz CPU microprocessor
Serial Ports
The CPU has two independent, on-board serial ports, accessed by connectors on the front of the
module. Ports 1 and 2 provide serial interfaces to external devices. Either port can be used for
firmware upgrades. For serial port pin assignments and details on serial communications, refer to
Chapter 12.

CPU310 Indicators
The eight CPU LEDs indicate the operating status of various CPU functions.
LED State
CPU Operating State
On Blinking Off
CPU OK On CPU has passed its power-up diagnostics and is functioning

properly. 3
CPU OK Off CPU problem. RUN and OUTPUTS ENABLED LEDs may be
blinking in an error code pattern, which can be used by
technical support for troubleshooting. This condition and any
error codes should be reported to your technical support
representative.
CPU OK, OUTPUTS ENABLED, CPU is in boot mode and is waiting for a firmware update
RUN Blinking in unison through a serial port.
CPU OK Blinking CPU in Stop/Halt state; possible watchdog timer fault. Refer
Other LEDs off. to the fault tables. If the programmer cannot connect, cycle
power with battery attached and refer to fault tables.
RUN On CPU is in Run mode.
RUN Off CPU is in Stop mode.
OUTPUTS ENABLED On Output scan is enabled.
OUTPUTS ENABLED Off Output scan is disabled.
I/O FORCE On Override is active on a bit reference.
BATTERY Off Normal battery 4
BATTERY Blinking Battery low4
BATTERY On Battery has failed or is not attached4
SYSTEM FAULT On CPU is in Stop/Faulted mode because a fatal fault has
occurred.
COM1 Blinking Signal activity on port.
COM2 Blinking
3 After initialization sequence is complete.

4 Low battery detection requires a smart battery. For details, refer to PACSystems Battery and Energy Pack
Manual, GFK-2741.

Specifications – CPU310
For environmental specifications, see Appendix A of the PACSystems RX3i System Manual, GFK-2314.
Program storage Up to 10 Mbytes of battery-backed RAM 5
10Mbyte of non-volatile flash user memory
Power requirements +3.3 VDC: 1.25 Amps nominal
+5 VDC: 1.0 Amps nominal
Operating Temperature 0 to 60°C (32°F to 140°F)
Floating point Yes
Time of Day Clock accuracy Maximum drift of ±2 seconds per day.
Can be synchronized to an Ethernet time master within
±2ms of the SNTP time-stamp.
Elapsed Time Clock (internal timing) ±0.01% maximum
accuracy
Embedded communications RS-232, RS-485
Serial Protocols supported Modbus RTU Slave, SNP Slave, Serial I/O
Backplane Dual backplane bus support: RX3i PCI and 90-30-style
serial
PCI compatibility System designed to be electrically compliant with PCI 2.2
standard
Program blocks Up to 512 program blocks. Maximum size for a block is
128KB.
Flash memory endurance rating 100,000 write/erase cycles minimum
Memory %I and %Q: 32Kbits for discrete
(For a detailed listing of memory areas, %AI and %AQ: configurable up to 32Kwords
refer to Chapter 6.) %W: configurable up to the maximum available user RAM
Managed memory (Symbolic and I/O variables combined):
configurable up to 10 Mbytes
5 For estimated battery life under various conditions, refer to the PACSystems Battery and Energy Pack Manual,
GFK-2741.

2.1.2 CPU315 and CPU320/CRU320

IC695CPU315: 1 GHz CPU microprocessor
IC695CPU320: 1 GHz CPU microprocessor
IC695CRU320: 1 GHz CPU microprocessor with redundancy
Serial Ports
The CPU has two independent, on-board serial ports, accessed by connectors on the front of the
module. Ports 1 and 2 provide serial interfaces to external devices. Either port can be used for
firmware upgrades. For serial port pin assignments and details on serial communications, refer to
Chapter 12.

CPU315, CPU320 and CRU320 Indicators

The eight CPU LEDs indicate the operating status of various CPU functions.
LED State
On
CPU Operating State
Blinking Off
CPU OK On CPU has passed its power-up diagnostics and is functioning

properly. 6
CPU OK Off CPU problem. RUN and OUTPUTS ENABLED LEDs may be
blinking in an error code pattern, which can be used by
technical support for troubleshooting. This condition and any
error codes should be reported to your technical support
representative.
CPU OK, OUTPUTS ENABLED, CPU is in boot mode and is waiting for a firmware update
RUN Blinking in through a serial port.
unison
CPU OK Blinking CPU in Stop/Halt state; possible watchdog timer fault. Refer to
Other LEDs off. the fault tables. If the programmer cannot connect, cycle
power with battery attached and refer to fault tables.
RUN On CPU is in Run mode.
OUTPUTS ENABLED On Output scan is enabled.
OUTPUTS ENABLED Off Output scan is disabled.
BATTERY Off Normal battery 7
BATTERY Blinking Battery low5
BATTERY On Battery has failed or is not attached3
SYSTEM FAULT On CPU is in Stop/Faulted mode because a fatal fault has
occurred.
COM1 Blinking Signal activity on port.
COM2 Blinking
6 After initialization sequence is complete.

7 Low battery detection requires hardware revision –Fx or later and a smart battery. For details, refer to the
PACSystems Battery and Energy Pack Manual, GFK-2741.

Specifications – CPU315 and CPU320

For environmental specifications, see Appendix A of the PACSystems RX3i System Manual, GFK-2314.
Program storage
CPU315 Up to 20MB of battery-backed RAM5
20MB of non-volatile flash user memory
CPU320 Up to 64 MB of battery-backed RAM†
64 MB of non-volatile flash user memory
Floating point Yes
Can be synchronized to an Ethernet time master within
±2ms of the SNTP time-stamp.
accuracy
Backplane Dual backplane bus support: RX3i PCI and 90-30-style
serial
standard
Program blocks Up to 512 program blocks. Maximum size for a block is
128KB.
(For a detailed listing of memory areas, %AI and %AQ: configurable up to 32Kwords
refer to Chapter 6.) %W: configurable up to the maximum available user RAM

Specifications – CRU320
Note: For environmental specifications and compliance to standards (for example, FCC or European
Union Directives), refer to the PACSystems RX3i System Manual, GFK-2314.
Program storage Up to 64 Mbytes of battery-backed RAM5
64 Mbytes of non-volatile flash user memory
Floating point Yes
Time of Day Clock accuracy Maximum drift of 2 seconds per day
Elapsed Time Clock (internal timing) accuracy 0.01% maximum
Backplane Dual backplane bus support: RX3i PCI and 90-30-style serial
standard
Program blocks Up to 512 program blocks. Maximum size for a block is 128KB.
%AI and %AQ: configurable up to 32Kwords
%W: configurable up to the maximum available user RAM
Symbolic: configurable up to 64 Mbytes
Memory error checking and correction (ECC) Single bit correcting and multiple bit checking.
Switchover Time 8 Maximum 1 logic scan, minimum 3.133ms.
Typical Base Sweep Time (Reference Data 3.66ms: 1K Discrete I/O, 125 Analog I/O and 1K Registers
Transfer List Impact 9 3.87ms: 2K Discrete I/O, 250 Analog I/O and 2K Registers
4.30ms: 4K Discrete I/O, 500 Analog I/O and 4K Registers
5.16ms: 8K Discrete I/O, 1K Analog I/O and 8K Registers
Maximum amount of data in redundancy Up to 2 Mbytes
transfer list
Number of redundant redundancy links Up to two IC695RMX128 synchronization links are supported.
supported
8 Switchover time is defined as the time from failure detection until backup CPU is active in a redundancy
system.
9 Symbolic variable and Reference data can be exchanged between redundancy controllers. Up to 2 Mbytes of
data is available for transfer.

Error Checking and Correction, IC695CRU320

RX3i Redundancy CPUs provide error checking and correction (ECC), which results in slightly slower
system performance, primarily during power-up, because it uses an extra 8 bits that must be
initialized.
For details on ECC, refer to the PACSystems Hot Standby CPU Redundancy User’s Guide, GFK-2308.
Note: Multiple Recoverable Memory Error faults may be generated when a single-bit ECC error is
detected. When a single-bit ECC error is detected, the value presented to the microprocessor
is corrected. However, the value stored in RAM is not corrected until the next time the
microprocessor writes to that RAM location.

2.1.3 CPE305 and CPE310

IC695CPE305: IC695CPE310:
1.1GHz CPU with 5MB of User Memory 1.1GHz CPU with 10MB of User Memory
OK IO FORCE
CPU OK I/O FORCE
RN STATUS
RUN STATUS
EN SYS FLT
OUTPUTS ENABLED SYS FLT
CM RDSD
COM 1 RDSD /
RESET COM2
RESET
CPE305 NIU001+
COM 1
ETHERNET
ETHERNET
USB-A RDSD !
USB-A RDSD !
COM 2
RJ-25
RS-232

Specifications
Memory retention The non-volatile storage (NVS) can retain data
indefinitely without loss of data integrity. When
CPU power is restored, data stored in NVS is
transferred back to user memory and the NVS is
cleared.
An optional IC695ACC400 Energy Pack powers the
CPU long enough to write its user memory contents
to non-volatile storage during a system power loss.
Program storage CPE305: 5 Mbytes of non-volatile flash user
memory
CPE310: 10 Mbytes of non-volatile flash user
memory
Power requirements, nominal +3.3 VDC: 1.0 A
+5 VDC: 1.0 A (up to 1.5 A if USB is fully loaded with
0.5 A)
+24 VDC: 0.5A at startup, 0.1 A during run time
(Applies only if Energy Pack is connected to the
CPE3xx.)
Floating point Yes
Time of Day Clock accuracy Maximum drift of 2 seconds per day
Elapsed Time Clock (internal timing) accuracy 0.01% maximum
Embedded serial communications CPE305: RS-232
CPE310: RS-232 (COM1) and RS-485 (COM2)
Backplane Dual backplane bus support: RX3i PCI and 90-30-
style serial
PCI compatibility System designed to be electrically compliant with
PCI 2.2 standard
Program blocks Up to 512 program blocks. Maximum size for a
block is 128KB.
%AI and %AQ: configurable up to 32Kwords
%W: configurable up to the maximum available
user memory
Symbolic: configurable up to 10 Mbytes

Embedded Ethernet interface specifications

Max. no. of connections Up to 32 simultaneous SRTP Server connections, up
to 16 simultaneous Modbus/TCP Server connections,
and up to 16 simultaneous communications channels
of either SRTP Channels or Modbus/TCP Client
channels
Ethernet data rate 10Mb/sec and 100Mb/Sec
Physical interface 1 port: 10BaseT RJ-45
Service Request Transfer Protocol (SRTP) Supported via CPE310/CPE305 Firmware Release 7.30
channels
Modbus TCP Supported via CPE310/CPE305 Firmware Release 7.30
OPC UA 10 Supports up to 12,500 Variables and up to 5 sessions
Ethernet Global Data (EGD) EGD Class 1 only [ Supported via CPE310/CPE305
Firmware Release 8.302]
Number of EGD configuration-based pages 255 11
Time synchronization None.
Selective consumption of EGD Yes
Load EGD configuration from PLC to Yes
programmer
Remote Station Manager over UDP Yes. Refer to the Station Manager Manual, GFK-2225L
or later for supported commands.
Configurable Advanced User Parameters Yes. Refer to TCP/IP Ethernet Communications for
PACSystems, GFK-2224M or later for supported AUPs.
For environmental specifications and compliance to standards (for example, FCC or European Union
Directives), refer to the PACSystems RX3i System Manual, GFK-2314.
CPE310 Backward Compatibility with CPU310

The CPE310 may be swapped with a CPU310 with no upgrade to the Proficy Machine Edition Logic
Developer-PLC programming software. Logic and configuration equality in the programming
software will be maintained when storing the same project to either a CPU310 or a CPE310. Proficy
Machine Edition versions that recognize the CPE310 (7.0 SIM3 and newer), will allow either a CPU310
configuration or a CPE310 configuration to be stored to the CPE310. For all programming software
versions (both current and legacy) a CPU310 device can accept only a CPU310 configuration.
10See GFK-2224M Chapter 10 for discussion of OPC UA.

11The 255 limit includes the number of exchanges configured on Embedded Ethernet Interface of
CPE305/310. They are not over and above this limit. Refer to Appendix A-3.6 for configuration
guidelines. Multicast network can include up to 31 numbered groups.

Legacy CPU310 Projects

The CPE310 supports CPU310 projects. Proficy Machine Edition versions earlier than 7.10 SIM 3
interpret the CPE310 as a CPU310. The CPE310 can be configured as a CPU310 using Proficy Machine
Edition versions as old as 5.5, Service Pack 1.
RDSD Port
If a CPU310 configuration is stored to a CPE310, the RDSD port is enabled to allow you to transfer
CPU310 projects to CPE310 models without using Proficy Machine Edition.
Fault Behavior
Faults related to the embedded CPE310 Ethernet interface may be generated on power-up. For
details, see “Replacing a CPU310 with a CPE310” below.
Replacing a CPU310 with a CPE310
 A CPE310 that is configured as a CPU310 logs the following faults in the Controller fault table:
- A LAN Transceiver Fault is generated because the RX3i system detects that the embedded
Ethernet module does not have a network connection.
- An Extra Option Module fault is generated because the embedded Ethernet module is
detected as an unconfigured module.
- If the Energy Pack capacitor pack is disconnected or fails, the legacy faults for a missing or
failed battery are logged.
 When a CPE310 is configured as a CPU310, Ethernet properties cannot be configured and
there should be no cable connected to the Ethernet port.
 When a CPE310 is configured as a CPU310, the Show Status dialog box in Proficy Machine
Edition displays “CPU310A.”
CPE310 versus CPU310 Performance Differences
The following differences should be considered when converting legacy applications or developing
new applications.
 Some exceptionally lengthy CPE backplane operations, such as MC_CamTableSelect, Data
Log and Read Event Queue functions, will take longer to complete compared to other RX3i
CPU models, and may delay backplane operations to IC695 modules.
For example, when an MC_CamTableSelect function block is executed on the PMM335 module, the
CPU’s acknowledgement of the PMM355 module interrupt may be delayed. In this situation, you may
see the following fault in the I/O Fault Table, even when the interrupt has not been dropped: Error
initiating an interrupt to the CPU.
 Performance specifications for many features, such as power-up time, function block
execution times and I/O module sweep times have changed. For details, refer to Appendix A.
 The RS-232 port on the CPE310 does not provide 5V power on pin 5.
CPU305 Performance Differences vs. CPE310 and Legacy RX3i CPUs
The CPE305 exhibits the same performance differences as listed above for the CPE310.
The CPE305 supports legacy CPU310 projects that fit within 5 Mbytes of user memory. The project
configuration must be changed to support this conversion.
Because the CPE305 has less user memory than the other RX3i CPUs, operations that involve
transferring large files could fail.

For example, depending on the number and sizes of Data Log files already stored, the Get_DL (Get
Data Log) command could fail with a C10 hex (file transfer failure occurred while sending the data log
file to the CPU) error. To correct this error
1. Upload the data logs to Machine Edition and delete the logs from the CPU.
2. Take steps to reduce the size of the log file, such as reducing the number of samples, the
sample rate, or the number of parameters logged.
Switches
The RDSD and Run Mode switches are located behind the protective door, as shown below. The Reset
switch is not used.
D
CPU OK I/O FORCE OK IO FORCE

RUN STATUS RN STATUS
EN SYS FLT
OUTPUTS ENABLED SYS FLT
COM 1 RDSD / CM RDSD
COM2 RESET
RESET
IC695CPE310 IC695CPE305
START
START
UPLOAD
RDSD RDSD
UPLOAD
OFF
OFF
DOWNLOAD
DOWNLOAD
COM 1 STOP RUN

STOP RUN
RUN I/O MODE
RUN I/O MODE
ENABLE
ENABLE
RUN OUTPUT
RUN OUTPUT
DISABLE
DISABLE
IP ADDRESS
IP ADDRESS
MAC ADDRESS
MAC ADDRESS
ETHERNET
ETHERNET
USB-A RDSD !
USB-A RDSD !
COM 2
RJ-25
Energy Pack Energy Pack

RS-232 Connector
Connector
(not shown) (not shown)
Switch Operation
RDSD Switches Function
Start pushbutton Pressing this switch initiates RDSD data transfer. (The three-position switch
must be set to Upload or Download.)
Three-position Enables/disables RDSD data transfer and selects the direction of data
switch transfer.

Upload Loads application from CPU to RDSD.

Off Disables RDSD data transfer.
Download Stores application from RDSD to CPU.
Run Mode Switch The Run Mode switch operates as described in Chapter 4.
Real-Time Clock Battery

The CPE3xx is shipped with a real time
clock (RTC) battery (IC690ACC001)
installed, with a pull-tab on the battery.
Real Time
The pull-tab should be removed before Clock Battery
installing the CPE3xx module.
There are no diagnostics or indicators to Positive (+)
monitor RTC battery status. side faces
away from
The RTC battery has an estimated life of
circuit board
5 years and must be replaced every 5
years on a regular
maintenance schedule.
If the RTC battery fails, the CPU date and
time is reset to 12:00 AM, 01-10-2000 at
startup. The CPU operates normally with
a failed or missing RTC battery; only the
initial CPU TOD clock information will be
incorrect.
Figure 1: Accessing Real-Time Clock Battery

(except CPE330)
Replacing the Real-Time Clock Battery

The replacement battery must be IC690ACC001 from GE Intelligent Platforms or equivalent, such as
Panasonic BR2032.
Warning
Use of a different type of battery than that specified here
may present a risk of fire or explosion.
Battery may explode if mistreated. Do not recharge,
disassemble, heat above 100°C (212°F) or incinerate.

Caution
To avoid damage from electrostatic discharge, use proper
precautions when performing these procedures:
 Wear a properly functioning antistatic strap and be sure
that you are fully grounded. Never touch the printed
circuit board, or components on the board, unless you
are wearing an antistatic strap.
 Any surface upon which you place the unprotected
circuit board should be static-safe, facilitated by
antistatic mats if possible.
Extra caution should be taken in cold, dry weather, when static charges
can easily build up.
Battery Removal Method 1

1. Power down the rack and remove the CPU from the backplane.
2. Using a curved probe with a non-conducting surface, for example a non-metallic dental pick,
reach in from the back of the module and pull the battery out of its retaining clip. (You can
use needle-nose pliers to grasp the battery and pull it the rest of the way out.)
Sample Tool for Battery Removal
Figure 2: Sample Tool for Coin Battery Extraction

Battery Removal Method 2
1. Power down the rack and remove the CPU from the backplane.
2. Squeeze both sides of the module and remove the front section of the plastic housing.
3. Lift the two clips on the side of the plastic housing to release the circuit board and pull the
board out of the housing.
4. Pull the battery out of its retaining clip.
Installing a New RTC Battery
Install the battery with the positive (+) side up. That is, with the + side away from the board and
toward the housing plastic.

Indicators
CPU Indicators
LED LED State
CPU Operating State
On Blinking Off
CPE305: OK On, Green CPU has passed its power-up diagnostics and is
CPE310: CPU OK functioning properly. (After initialization sequence is
complete.)
Off CPU problem. RUN and OUTPUTS ENABLED LEDs may
be blinking in an error code pattern, which can be used
by technical support for troubleshooting. This condition
and any error codes should be reported to your
technical support representative.
Blinking; Other LEDs off CPU in Stop-Halt state; possible watchdog timer fault.
Refer to the fault tables. If the programmer cannot
connect, cycle power with a charged Energy Pack
attached and refer to fault tables.
CPE305: OK and EN Blinking in unison CPU is in boot mode and is waiting for a firmware
CPE310: CPU OK and update through a serial port.
OUTPUTS ENABLED
CPE305: RN On CPU is in Run mode.
CPE310: RUN Off CPU is in Stop mode.
CPE305: EN On Output scan is enabled.
CPE310: OUTPUTS Off Output scan is disabled.
ENABLED
STATUS Blinking green Energy Pack charging; not yet charged above the
minimum operating voltage.
On red Energy Pack circuit fault.
Blinking red Energy Pack near its end of life and should be replaced
soon.
On green Energy Pack is charged above its minimum operating
voltage.
Off Energy Pack not connected.
SYS FLT On red CPU is in Stop/Faulted mode because a fatal fault has
(System Fault) occurred.
CPE305: CM Blinking green Signal activity on COM1 port.
CPE310: COM1 Off No activity on COM1 port
CPE310 only Blinking green Signal activity on COM2 port.
RDSD / COM2 Off No activity on COM2 port
(RDSD not attached)

RDSD Indicators
LED LED State
RDSD Operating State
On Blinking Off
CPE310 only On red The RDSD has been removed during a store. The
SYS FLT and CPU must be power cycled to resume RDSD
Off or blinking
RDSD / COM2 operations.
green
CPE305: RDSD On green Valid RDSD connected or data transfer complete.
CPE310: Blinking green Data transfer in progress.
RDSD / COM2
On red RDSD fault. Check for and correct the following
(RDSD active:
conditions:
RDSD attached to
CPU type mismatch with project on RDSD.
USB-A RDSD port.)
Data transfer error.
Corrupted or invalid USB file system.
Insufficient space on RDSD.
Blinking red RDSD-Controller project name mismatch.
Off RDSD not attached or USB port is disabled.
Ethernet Indicators
LED LED State
CPU Operating State
On Blinking Off
100 On, Green Network data speed is 100 Mbps.

Off Network data speed is 10 Mbps.
LINK On, Green The link is physically connected.
Blinking green Traffic is detected at the port.
Serial Ports
These ports provide serial interfaces to external devices and can be used for firmware upgrades. All
serial ports are isolated. For serial port pin assignments and details on serial communications, refer
to Chapter 12.
CPE305 one RS-232 port.
CPE310 one RS-232 port (COM1) and one RS-485 port (COM2).
The RS-232 port does not supply the 5VDC power offered by other RX3i and Series 90-30 CPUs. Cable
IC693CBL316 must be used for RS-232 serial connections to the CPE3xx.
Ethernet Port
The embedded Ethernet interface supports communications with the Machine Edition programming
software using the proprietary SRTP protocol. The CPE3xx CPUs provide two SRTP-server
connections.
This interface does not support Ethernet Global Data protocol.
The embedded Ethernet interface has one RJ-45 Ethernet port that automatically senses the data
rate (10Mbps or 100Mbps), duplex (half duplex or full duplex), and cabling arrangement (straight
through or crossover) of the attached link.

Removable Data Storage Devices (RDSDs)

The CPE3xx provides the ability to transfer applications to and from an RDSD (USB-compatible device,
such as a memory stick, smart phone, digital camera or MP3 device). Once the data is copied to the
RDSD, it can be written to other RX3i CPE3xx CPUs of the same type, with no programmer software
needed. The RDSD interface requires a user-supplied flash memory device that complies with the
USB 2.0 Specification.
The USB port must be enabled in the RX3i configuration in order to transfer data between the CPU
and the RDSD. The CPE3xx is shipped with the RDSD (USB) port enabled.
The RDSD load and store operations can include the following data:
 An entire application, including logic and configuration, reference table data, and cam files
for Motion applications. (Motion files and local logic for DSM motion applications are
supported.) Configuration can include Ethernet Global Data and Advanced User Parameters
for the rack-based Ethernet interface. (Although a complete, unmodified application must be
placed on the RDSD, you can use an options.txt file to download selected components of the
application to the target CPU.)
 Passwords and OEM key, if any, are encrypted and written to the RDSD when the project is
loaded from the CPU. When the project is stored to a CPU that has no passwords or OEM key,
those are copied to the CPU.
Note: With Enhanced Security enabled, the RDSD update will fail if the RDSD source
controller has Level 4 password protection and the destination controller is password
protected, regardless of whether the passwords match.
With Legacy security, when the project is stored to a CPU that has passwords and/or
OEM key, the passwords must match or the store will fail.
 Fault tables are written to the RDSD before and after a load to or store from the RDSD.
 If a hardware configuration that disables the USB port is successfully stored to the CPU, the
fault tables will not be written to the RDSD at completion of the store operation.
Note: The USB port is for transfer of application data only. It is not intended for permanent
connection.
Note: When using RDSD, all programming software connections must be in the “Offline” state for
the RDSD to function properly.

Uploading a Project from the CPU to the RDSD

Notes: Only one application project can be stored to the RDSD at a time. Before the RX3i writes the
project to the RDSD, any previous application is removed; if a directory named PACS_Folder
exists on the RDSD at the start of the upload, it is deleted with all of its contents.
Flash devices write in whole memory blocks and memory block sizes vary among devices.
The amount of space used by a project may vary between RDSDs due to the differences in
minimum block sizes and therefore the number of blocks used by a project. The minimum
amount of memory required will be the size of the entire project plus an additional block for
the options.txt file, if used.
1. Place the CPU that contains the project to be transferred in Run or Stop mode.
2. If the programmer is online with the RX3i, either go Offline or select Monitor mode.
3. Insert the RDSD into the USB connector on the CPU. (After 1 – 2 sec, the RDSD LED turns solid
green.)
4. Push the RDSD direction switch to the left (UPLOAD).
5. Momentarily depress the START pushbutton. Do not remove the RDSD from the CPU during
the transfer.
 The RDSD LED blinks green during the transfer. This can take from 10 – 150 sec, depending
upon the size of the project data.
 The RDSD LED should turn solid green, indicating that the transfer completed successfully.
 If the RDSD LED turns solid red, the transfer has failed. There will be a copy of the fault tables
as they existed at the end of the attempted transfer on the RDSD. Insert the RDSD into a PC
which has the PACS Analyzer software and select the plcfaultafter.dat file on the RDSD for
fault table analysis by the Analyzer. The PACS Analyzer software can be downloaded from the
Support website, http://support.ge-ip.com.
 If the RDSD LED turns solid red, indicating an error, another RDSD operation cannot be
initiated until the device is disconnected then reconnected.
Caution
 If the RDSD is removed during data transfer from the CPU, the
integrity of the RDSD and the files on it cannot be guaranteed.
The RDSD status LED will indicate a fault, and the CPU will abort
the data transfer and remain in its current operating mode.
 The project files, consisting of the entire contents of the
PACS_Folder directory and all of its subdirectories, loaded on
the RDSD must not be modified. If they are modified, the files
transferred to the CPU will be invalid
6. When the RDSD LED turns solid green, indicating the transfer has been successfully
completed, remove the RDSD from the CPU. The RDSD can now be used to transfer the
application to other RX3i controllers of the same model type.
You can copy the entire applications directory to another USB device and use that device as
the source for downloads to CPE3xx CPUs, provided none of the files in that directory are
changed in any way during the transfer.

Downloading a Project from the RDSD to the CPU

To download a project to the RX3i, the RDSD must contain a valid project, consisting of the hardware
configuration, application logic, and reference memory in a compiled format (originating from
another RX3i controller). The project files, consisting of the entire contents of the PACS_Folder
directory and all of its subdirectories, loaded on the RDSD must not be modified. If they are modified,
the files transferred to the CPU will be invalid.
By default, all project components are stored to the CPU and are written to flash. You can change
this operation by placing an options.txt file on the RDSD as described below.
1. Ensure that the RX3i is in STOP mode
2. If PROFICY Machine Edition is online with the RX3i, either go Offline or select Monitor mode.
3. Connect the RDSD to the USB connector on the CPU that will be receiving the files. The RDSD
LED turns solid green. Move the RDSD direction switch to the right (DOWNLOAD).
4. Momentarily depress the START pushbutton. Do not remove the RDSD from the CPU during
the transfer.
 If the target name in the RDSD is different from the target name in the RX3i, the RDSD LED will
blink red. If this is expected or acceptable, momentarily depress the START pushbutton again.
 The RDSD LED blinks green during the transfer. This can take from 10 – 150 sec, depending upon
the size of the project data.
 The RDSD LED should turn solid green, indicating that the transfer completed successfully.
Unless the RUN/STOP switch has been disabled in the hardware configuration just stored, it can
be used to place the RX3i into RUN mode after the transfer.
 If the RDSD LED turns solid red, the transfer has failed. There will be a copy of the fault tables as
they existed at the end of the attempted transfer on the RDSD. Insert the RDSD into a PC which
has the PACS Analyzer software and select the plcfaultafter.dat file on the RDSD for fault table
analysis by the Analyzer.
If the RDSD LED turns solid red, indicating an error, another RDSD operation cannot be
initiated until the device is disconnected then reconnected.
Caution
If the RDSD is removed during data transfer to the CPU, the
RX3i controller will generate a fatal fault (sequence store
fault). You will need to clear the fault tables through a
programmer connection or by power cycling the CPU with
the Energy Pack disconnected before attempting to
download again.
5. When the RDSD LED turns solid green, indicating the transfer has been successfully
completed, remove the RDSD from the CPU.
The RUN/STOP switch can be used to place the RX3i into RUN mode after the transfer, unless
it has been disabled in the hardware configuration just stored. (If the RUN/STOP switch is
disabled, you will need to connect with the programmer to place the RX3i in RUN mode.

Using an Options.txt File to Modify Download Operation

An options.txt file can be used to modify the operation of the RDSD during a store to the RX3i. This is
a plain-text file which can contain some or all of the following statements, in any order. The format
of each option line is the option keyword, followed by a space, followed by either a capital Y or a
capital N. The option keyword must be spelled exactly as indicated below. If an option statement is
omitted from the file, the default value will be used.
If you want to use all of the default operations, the options.txt file is not necessary.
Options.txt File Format
Option Keyword Default value Description
Download_LogicAndCfg Y (yes) Logic and configuration are copied to the CPE305 (including
symbolic variables)
Download_Data Y (yes) Reference memory is copied to the CPE305 (excluding symbolic
variables)
Download_CamFiles Y (yes) Cam files are copied to the CPE305
Write_Flash Y (yes) The downloaded CPE305 contents (as specified by the above
keywords) by default will be written to flash upon completion of the
store
Sample options.txt File

If the following options.txt file is present on the RDSD, logic, configuration and reference data are
copied to the CPU, and files are written to flash. Cam files are not copied.
Download_LogicAndCfg Y
Download_Data Y
Download_CamFiles N
Write_Flash Y
Security
When the application is written to the RDSD from a controller that has passwords and/or an OEM key
defined, the passwords and OEM key are encrypted and stored on the RDSD. When the project is
written from the RDSD to a CPE3xx, the passwords and OEM key are copied to it.
If an OEM key is defined on the RDSD, when transfer is complete, the OEM protection will be enabled
(locked). When an application is being stored to a CPE305 that already has passwords and/or an OEM
key defined, the passwords/key on the RDSD must match the passwords/key in the target CPE3xx, or
the transfer will fail.
RDSD Error Reporting
Errors are indicated when the RDSD LED becomes solid red (not blinking). All errors are reported in the
Controller fault tables. If the Controller has faults in its fault tables before it receives a store, the fault
tables are written to plcfaultbefore.dat and iofaultbefore.dat on the RDSD. If the Controller has faults
in its fault tables after it receives a store, the fault tables are written to plcfaultafter.dat and
iofaultafter.dat on the RDSD. Previous versions of these files are deleted before the transfer. If either
fault table is empty, the corresponding file is not written and will not be present.
If a hardware configuration that disables the USB port is stored to the CPU, the fault tables will not be
written to the RDSD at completion of the store operation because the USB port will be disabled at the
end of the store process.

Operation with Energy Pack

The CPE3xx preserves user memory using an Energy Pack without the need to periodically replace
batteries. An IC695ACC400 Energy Pack powers the CPU long enough for the CPU to write its user
memory contents to the CPU’s non-volatile storage during a system power loss. For details on the
Energy Pack, refer to the datasheet GFK-2724.
User memory is preserved only if the Energy Pack is connected (and charged) at power-down and if it
is present at power-up. Removing or reconnecting the Energy Pack while the CPE3xx is not powered
has no effect on the preservation of user memory.
The %S0014 (PLC_BAT) system status reference indicates the Energy Pack.:
Note: When the Energy Pack is powered up for the first time, or is in a system that has been
powered down long enough to completely discharge the Energy Pack, a period of time will be
required for it to charge up to its operating level. The STATUS LED of the CPU will blink green
during this time.
Note: Because the Time of Day (TOD) clock is powered by the Real Time Clock battery, removal of
the Energy Pack does not cause the CPU to lose the TOD value.
Energy Pack Replacement
If an Energy Pack fails, you can replace it with a new unit while the CPU is in operation. When an
Energy Pack is replaced, the new Energy Pack must charge. If a loss of power occurs while the
Energy Pack is disconnected or before it is fully charged, a memory loss may occur.

2.2. RX7i Features and Specifications

2.2.1 CPE010, CPE020 and CRE020
IC698CPE010: 300MHz CPU microprocessor
IC698CPE020: 700MHz CPU microprocessor
IC698CRE020: 700MHz CPU microprocessor with redundancy
CPU Serial Ports
The CPU has three independent, on-board serial ports, accessed by connectors
on the front of the module. Ports 1 and 2 provide serial interfaces to external
devices; either can be used for firmware upgrades. The third on-board serial
port is a dedicated Ethernet Station Manager port. All serial ports are isolated.
For serial port pin assignments and details on serial communications, refer to
Chapter 12.
Ethernet Ports
For details on the embedded Ethernet interface, refer to page 41.
CPU Indicators
Five CPU LEDs indicate the operating status of various CPU functions.
LED State
CPU Operating State
On Blinking Off
OK On CPU has passed its power-up diagnostics and is

functioning properly.
OK Off CPU problem. EN and RUN LEDs may be blinking
in an error code pattern, which can be used by
technical support for troubleshooting. This
condition and any error codes should be reported
to your technical support representative.
OK, EN, RUN CPU is in boot mode and is waiting for a firmware
Blinking in unison update through a serial port.
OK Blinking CPU in Stop/Halt state; possible watchdog timer
Other LEDs off. fault. Refer to the fault tables. If the programmer
cannot connect, cycle power with battery
RUN On CPU is in Run mode
ENA On Output scan is enabled.
ENA Off Output scan is disabled.
C1 (port 1) Blinking Signals activity on port.
C2 (port 2) Blinking

Specifications – CPE010, CPE020 and CRE020 Models

For environmental specifications, see “RX7i General Specifications” in Appendix A of the RX7i
Power requirements
CPE010 +5 VDC: 3.2 Amps nominal
-12 VDC: 0.008 Amps nominal
CPE020, CRE020 +5 VDC: 4.5 Amps nominal
Operating Temperature CPE010: 0 to 50°C (32°F to 122°F
0 to 60°C (32°F to 140°F) with fan tray
CPE020, CRE020: 0 to 60°C (32°F to 140°F), fan tray required
Floating point Yes
Can be synchronized to an Ethernet time master within ±2ms of
the SNTP time-stamp.
Elapsed Time Clock (internal ±0.01% maximum
timing) accuracy
Embedded communications RS-232, RS-485, Ethernet interface
To determine availability for a given firmware version, please
refer to the Important Product Information document provided
with the CPU.
Ethernet Ports Embedded auto-sensing 10/100 Mbps half/full duplex Ethernet
interface
VME Compatibility System designed to support the VME64 standard ANSI/VITA 1
Program blocks Up to 512 program blocks. Maximum size for a block is 128 KB.
(For a detailed listing of memory %AI and %AQ: configurable up to 32k words
areas, refer to Chapter 6.) %W: configurable up to the maximum available user RAM
Error Checking and Correction CRE020 only.

Ethernet Interface Specifications

Web-based data monitoring Up to 16 web server and FTP connections
(combined)
Ethernet data rate 10Mb/sec and 100Mb/sec
Physical interface 10BaseT RJ45
WinLoader support Yes
Number of EGD configuration-based pages 255
Time synchronization SNTP
programmer
Remote Station Manager over UDP Yes
Local Station Manager (RS-232) Dedicated RS-232 port
Configurable Advanced User Parameters Yes
Error Checking and Correction, IC698CRE020

Redundancy CPUs are shipped with error checking and correction (ECC) enabled. Enabling ECC
results in slightly slower system performance, primarily during power-up, because it uses an extra 8
bits that must be initialized. If you upgrade the firmware on the non-redundancy CPU model
IC698CPE020 to support redundancy, you must set the ECC jumper to the enabled state as described
in the installation instructions provided with the upgrade kit.
The CRE020 performance measurements provided in Appendix A were done with ECC enabled.

2.2.2 CPE030/CRE030 and CPE040/CRE040

CPE030/CRE030: 600MHz Pentium-M microprocessor
CPE040/CRE040: 1800MHz Pentium-M microprocessor
CPU Serial Ports
The CPU has three independent, isolated, on-board serial ports, accessed by
connectors on the front of the module. Ports 1 and 2 provide serial interfaces to
external devices and can be used for firmware upgrades. The third serial port is
a dedicated Ethernet Station Manager port. For serial communications, see
Chapter 13.
Ethernet Ports
For details on the embedded Ethernet interface, refer to page 41.
CPU Indicators
Seven CPU LEDs indicate CPU operating status.
LED State
CPU Operating State
On Blinking Off
CPU OK On CPU has passed its power-up diagnostics and is

functioning properly.
CPU OK Off CPU problem. RUN and OUTPUTS ENABLED LEDs
may be blinking in an error code pattern, which
can be used by technical support for diagnostics.
This condition and any error codes should be
reported to your technical support representative.
CPU OK, OUTS ENA, RUN CPU is in boot mode and is waiting for a firmware
Blinking in unison update through a serial port.
OK Blinking CPU in Stop/Halt state; possible watchdog timer
Other LEDs off fault. Refer to the fault tables. If the programmer
cannot connect, cycle power with battery
OUTS ENA On Output scan is enabled.
OUTS ENA Off Output scan is disabled.
I/O FORCE On Override is active on a bit reference
(Not used by CRE030 and CRE040.)
BATTERY On Battery has failed or is not attached.
SYS FAULT On CPU is in Stop/Faulted mode because a fatal fault
has occurred.
C1 (port 1) Blinking Signal activity on port.
C2 (port 2) Blinking

Specifications – CPE030/CRE030 and CPE040/CRE040 Models

For environmental specifications, see “RX7i General Specifications” in Appendix A of the RX7i
Power requirements CPE030/CRE030:+5 VDC: 3.2 Amps nominal
CPE040/CRE040: +5 VDC: 6.8 Amps nominal
Operating temperature CPE030/CRE030: 0 to 50°C (32°F to 122°F
0 to 60°C (32°F to 140°F) with fan tray
CPE040/CRE040: 0 to 60°C (32°F to 140°F), fan tray required
Floating point Yes
Can be synchronized to an Ethernet time master within ±2ms of the SNTP
time-stamp.
accuracy
Embedded communications RS-232, RS-485, Ethernet interface
To determine availability for a given firmware version, please refer to the
Important Product Information document provided with the CPU.
Ethernet Ports Embedded auto-sensing 10/100 Mbps half/full duplex Ethernet interface
[Optional] Station Manager cable IC200CBL001
for Ethernet Interface
VME Compatibility System designed to support the VME64 standard ANSI/VITA 1
Program blocks Up to 512 program blocks. Maximum size for a block is 128KB.
(For a detailed listing of memory %AI and %AQ: configurable up to 32Kwords
areas, refer to Chapter 6.) %W: configurable up to the maximum available user RAM
Managed memory (Symbolic and I/O variables combined): configurable up
to 10 Mbytes
Error checking and correction CRE030 and CRE040 only

Ethernet Interface Specifications

Web-based data monitoring Up to 16 web server and FTP connections
(combined)
Ethernet data rate 10 Mb/sec and 100 Mb/sec
Physical interface 10BaseT RJ45
WinLoader support Yes
Number of EGD configuration-based pages 255
Time synchronization SNTP
programmer
Remote Station Manager over UDP Yes
Local Station Manager (RS-232) Dedicated RS-232 port
Configurable Advanced User Parameters Yes
Error Checking and Correction, IC698CRE030 and IC698CRE040

Redundancy CPUs are shipped with error checking and correction (ECC) enabled. Enabling ECC
results in slightly slower system performance, primarily during power-up, because it uses an extra 8
bits that must be initialized. If you upgrade the firmware on a non-redundancy CPU model to support
redundancy, you must set the ECC jumper to the enabled state as described in the installation
instructions provided with the upgrade kit.
Note: Multiple Recoverable Memory Error faults may be generated when a single-bit ECC error is
detected. When a single-bit ECC error is detected, the value presented to the microprocessor
is corrected. However, the value stored in RAM is not corrected until the next time the
microprocessor writes to that RAM location.
2.2.3 RX7i Embedded Ethernet Interface

Ethernet Ports
The embedded Ethernet Interface provides two RJ-45 Ethernet ports. Either or both of these ports
may be connected to other Ethernet devices. Each port automatically senses the data rate (10Mbps
or 100Mbps), duplex (half duplex or full duplex), and cabling arrangement (straight through or
crossover) of the attached link.) For Ethernet port pin assignments, refer to Chapter 12. For details on
Ethernet communications, refer to the following manuals:
TCP/IP Ethernet Communications for PACSystems User’s Guide, GFK-2224
PACSystems TCP/IP Communications Station Manager Manual, GFK-2225

Caution
The two ports on the Ethernet Interface must not be
connected, directly or indirectly to the same device. The hub
or switch connections in an Ethernet network must form a
tree; otherwise duplication of packets may result.
Ethernet Interface Indicators

The Ethernet Interface indicators consist of seven light emitting diodes (LEDs). All are single-color
green LEDs controlled by the Ethernet interface.
 Module OK (EOK)
 LAN online (LAN)
 Status (STAT)
 Two activity LEDS (LINK)
 Two speed LEDS (100)
The EOK, LAN, and STAT LEDs are grouped together and indicate the state and status of the Ethernet
interface.
Each Ethernet port has two green LED indicators, Link and 100. The LINK LED indicates the network
link status and activity. This LED is illuminated when the link is physically connected and blinks when
traffic is detected at the port. Note that traffic at the port does not necessarily mean that traffic is
present at the Ethernet interface, since the traffic may be going between ports of the switch. The 100
LED indicates the network data speed (10 or 100 Mb/sec). This LED is illuminated if the network
connection is 100 Mbps.
LED operation is described in the following tables.

Ethernet LED Operation

LED State
On
Ethernet Operating State
Blinking Off
EOK Blink error code Hardware Failure

LAN Off
STAT Off
EOK Fast Blink Performing Diagnostics
LAN Off
STAT Off
EOK Slow Blink Waiting for Ethernet configuration from CPU
LAN Off
STAT Off
EOK Slow Blink† Waiting for IP Address
LAN On/Traffic/Off
STAT Slow Blink†
(† EOK and STAT blink in unison)
EOK On Operational
LAN On/Traffic/Off
STAT On/Off
EOK Slow Blink‡ Software Load
LAN Slow Blink‡
STAT Slow Blink‡
(‡ All LEDs blink in unison)
EOK LED Operation
The EOK LED indicates whether the Ethernet interface is able to perform normal operation. This LED is
on for normal operation and blinks for all other operations. When a hardware or unrecoverable
runtime failure occurs, the EOK LED blinks a two-digit error code identifying the failure. The LED first
blinks to indicate the most significant error digit, then after a brief pause blinks again to indicate the
least significant error digit. After a long pause the error code display repeats.

EOK LED Blink Codes for Ethernet Hardware Failures

Blink Code Description
0x12 Undefined or Unexpected Interrupt.
0x13 Timer failure during power up diagnostics.
0x14 DMA failure during power up diagnostics.
0x21 RAM failure during power up diagnostics.
0x22 Stack error during power up diagnostics.
0x23 Shared Memory Interface error during power up diagnostics.
0x24 Firmware CRC (cyclic redundancy check) error during power up or Factory Test.†
0x25 Run time exception
0x31 Undefined instruction or divide by zero
0x32 Software interrupt
0x33 Instruction pre-fetch abort
0x34 Data abort
0x35 Unexpected Runtime IRQ
0x36 Unexpected Runtime FIQ (fast interrupt request)
0x37 Reserved Exception or branch through zero
† CRC error or software error during normal operation causes Ethernet restart.
LAN LED Operation

The LAN LED indicates access to the Ethernet network. During normal operation and while waiting for
an IP address, the LAN LED blinks to indicate network activity. This LED remains on when the Ethernet
interface is not actively accessing the network but the network is available, and it is off if network
access is not available. The definition of the network being available as indicated by this LED is that
the Ethernet physical interface is available and one or both of the Ethernet ports is connected to an
active network.
STAT LED Operation
The STAT LED indicates the condition of the Ethernet interface in normal operational mode. If the
STAT LED is off, an event has been entered into the exception log and is available for viewing via the
Station Manager interface. The STAT LED is on during normal operation when no events are logged.
In the other states, the STAT LED is either off or blinking and helps define the operational state of the
module.
Ethernet Port LEDs Operation (100Mb and Link/Activity)
Each of the two Ethernet ports has two green LED indicators, 100 and LINK. The 100 LED indicates
the network data speed (10 or 100 Mb/sec). This LED is illuminated if the network connection is 100
Mbps.
The LINK LED indicates the network link status and activity. This LED is illuminated when the link is
physically connected and blinks when traffic is detected at the port. Note that traffic at the port does
not necessarily mean that traffic is present at the Ethernet interface, since the traffic may be going
between ports of the switch.

Ethernet Restart Pushbutton

The Ethernet Restart pushbutton is used to manually restart the Ethernet firmware without power
cycling the entire control system. It is recessed to prevent accidental operation. The restart does not
occur until the pushbutton is released.
The type of restart behavior is selected by the length of time that the pushbutton is depressed. The
pushbutton-controlled restart operations are listed in the following table, along with the LED
indications for each. In all cases, the EOK, LAN and STAT LEDs briefly turn on in unison as an LED test.
The Ethernet port LEDs are not affected by a manual restart of the Ethernet firmware.
Restart Operation Depress Ethernet Restart Ethernet LEDs
pushbutton for Illuminated
Normal restart Less than 5 seconds EOK, LAN, STAT
Restart without Ethernet plug-in 5 to 10 seconds LAN, STAT
applications
Restart into Firmware Update operation More than 10 seconds STAT
Normal Restart
When the Ethernet Restart pushbutton is pressed for less than 5 seconds, the Ethernet interface will
restart into normal operation.
Restart without Ethernet Plug-in Applications
When the Restart pushbutton is pressed and held for 5 to 10 seconds, the Ethernet interface will
restart into normal operation but does not start any optional Ethernet plug-in applications. This is
typically done during troubleshooting.
Restart into Firmware Update Operation
When the Ethernet Restart pushbutton is pressed and held for more than 10 seconds, the Ethernet
interface will restart into firmware update operation. This is typically done during troubleshooting to
bypass possibly invalid firmware and allow valid firmware to be loaded using WinLoader.
Until the firmware update actually begins, you can manually exit the firmware update and restart
with the existing firmware by pressing the Ethernet Restart pushbutton again.


Chapter 3 CPU Configuration
The PACSystems CPU and I/O system is configured using Proficy Machine Edition Logic Developer-
PLC programming software.
The CPU verifies the physical module and rack configuration at power-up and periodically during
operation. The physical configuration must be the same as the programmed configuration.
Differences are reported to the CPU alarm processor for configured fault response. Refer to the
Machine Edition Logic Developer-PLC Getting Started Manual, GFK-1918 and the online help for a
description of configuration functions.
Note: A CPE020, CPE030 or CPE040 can be converted to the corresponding redundancy CPU
(CRE020, CRE030 or CRE040) by installing different firmware and moving a jumper. Detailed
instructions are included in the firmware upgrade kit for the redundancy CPU.

Chapter 3. CPU Configuration
3.1. Configuring the CPU

To configure the CPU using the Logic Developer-PLC programming software, do the following:
1. In the Project tab of the Navigator, expand your
PACSystems Target, the hardware configuration, and the
main rack (Rack 0).
2. Right click the CPU slot and choose Configure. The
Parameter Editor window displays the CPU parameters.
Note: An RX7i CPU must be installed in Rack 0, Slot 1. A
double-wide RX3i CPU occupies two slots and can
be installed in any pair of slots in Rack 0 except
the two highest numbered lots in the rack. The
single-wide CPE305 RX3i CPU requires one slot
and can be installed in any slot in RX3i Rack 0,
except the highest numbered slot or slot 0. Figure 3: Hardware Configuration
3. To edit a parameter value, click the desired tab, then click Display in Proficy Machine Edition
in the appropriate Values field. Refer to “Configuration
Parameters” on page 49 for information on these fields.
4. Store the configuration to the Controller so these settings
can take effect. For details, see “Storing (Downloading) a
Configuration” on page 65.
Note: If available, the embedded Ethernet Interface is displayed in a sub-slot of the CPU. For details
on configuring the embedded Ethernet Interface, refer to page 66.

3.2. Configuration Parameters

3.2.1 Settings Parameters
These parameters specify basic operating characteristics of the CPU. For details on how these
parameters affect CPU operation, refer to Chapter 5.
Settings Parameters
Passwords Specifies whether passwords are Enabled or Disabled. Default: Enabled.
Note: If Enhanced Security 12 is enabled in the target properties, the Passwords
setting will be Enabled and read-only, and the Access Control tab (page 62)
appears.
When passwords are disabled, they cannot be re-enabled without clearing PLC
memory.
Stop-Mode I/O Specifies whether the I/O is scanned while the PLC is in Stop mode. Default:
Scanning Disabled. (Always Disabled for Redundancy CPU.)
Note: This parameter corresponds to the I/O ScanStop parameter on a Series 90-
70 PLC.
Watchdog Timer (ms) (Milliseconds in 10ms increments.) Requires a value that is greater than the program
sweep time.
The software watchdog timer is designed to detect "failure to complete sweep"
conditions. The CPU restarts the watchdog timer at the beginning of each sweep.
The watchdog timer accumulates time during the sweep. The software watchdog
timer is useful in detecting abnormal operation of the application program, which
could prevent the PLC sweep from completing within the watchdog time period.
Valid range: 10 through 2550, in increments of 10.
Default: 200.
For details on setting the watchdog timer in a CPU redundancy system, refer to the
PACSystems Hot Standby CPU Redundancy User’s Guide, GFK-2308.
Logic/Configuration Specifies the location/source of the logic and configuration data that is to be used
Power-up Source (or loaded/copied into RAM) after each power up.
Choices: Always RAM, Always Flash, Conditional Flash.
Default: Always RAM.
Data Power-up Source Specifies the location/source of the reference data that is to be used (or
loaded/copied into RAM) after each power up.
Choices: Always RAM, Always Flash, Conditional Flash.
Default: Always RAM.
12 For availability, refer to the Important Product Information document for the CPU firmware version that you
are using.

Settings Parameters
Run/Stop Switch Enables or disables the Run/Stop Mode Switch.
Choices:
Enabled: Enables you to use the physical switch on the PLC to switch the PLC into
Stop mode or from Stop mode into Run mode and clear non-fatal faults.
Disabled: Disables the physical Run/Stop switch on the PLC.
Default: Enabled.
Note: If both serial ports are configured for any protocol other than RTU Slave or
SNP Slave, the Run/Stop switch should not be disabled without first must
making sure that there is a way to stop the CPU, or take control of the CPU
through another device such as an Ethernet interface. If the CPU can be set
to Stop mode, it will switch the protocol from Serial I/O to the Stop Mode
protocol (default is RTU Slave). For details on Stop mode settings, refer to
“Port 1 and Port 2 Parameters” on page 58.
This applies to Port 1 on the CPE305, which has only one serial port.
Memory Protection Enables or disables the Memory Protect feature associated with the Run/Stop Mode
Switch Switch.
Choices:
Enabled: Memory Protect is enabled, which prevents writing to program memory
and configuration and forcing or overriding discrete data.
Disabled: Memory Protect is disabled.
Default: Disabled.
Power-up Mode Selects the CPU mode to be in effect immediately after power-up.
Choices: Last, Stop, Run.
Default: Last (the mode it was in when it last powered down).
Note: If the battery or Energy Pack is missing or has failed and if
Logic/Configuration Power-up Source is set to Always RAM, the CPU powers
up in Stop mode regardless of the setting of the Power-up Mode parameter.
Modbus Address Space Specifies the type of memory mapping to be used for data transfer between
Mapping Type Modbus TCP/IP clients and the PACSystems controller.
Choices:
Disabled: The “Disabled” setting is intended for use in systems containing Ethernet
firmware that does not support Modbus TCP.
Standard Modbus Addressing: Causes the Ethernet firmware to use the standard
map, which is displayed on the Modbus TCP Address Map tab.
Default: Disabled
For details on the PACSystems implementation of Modbus/TCP server, refer to
TCP/IP Communications for PACSystems, GFK-2224.
Universal Serial Bus RX3i CPE305/CPE310 CPUs only. Enables or disables the USB port for use with RDSD
(removable data storage devices). The USB port is enabled by default in the
CPE305/CPE310 and in the hardware configuration.
If a CPU310 configuration is stored to a CPE310, the USB port will be enabled.

3.2.2 Modbus TCP Address Map

This read-only tab displays the standard mapping assignments between Modbus address space and
the CPU address space. Ethernet modules and daughterboards in the PACSystems controller use
Modbus-to-PLC address mapping based on this map.
Modbus The Modbus protocol uses five reference table designations:

Register 0xxxx Coil Table. Mapped to the %Q table in the CPU.
1xxxx Input Discrete Table. Mapped to the %I table in the CPU.
3xxxx Input Register Table. Mapped to the %AI register table in the CPU.
4xxxx Holding Register Table. Mapped to the %R table in the CPU.
6xxxx File Access Table. Mapped to the %W table in the CPU.
Start Address Lists the beginning address of the mapped region.
End Address Lists the ending address of the mapped region. For word memory types (%AI, %R and %W)
the highest address available is configured on the Memory tab.
PLC Memory Lists the memory type of the mapped region.
Length Displays the length of the mapped region.
3.2.3 Scan Parameters

These parameters determine the characteristics of CPU sweep execution.
Scan Parameters
Sweep Mode The sweep mode determines the priority of tasks the CPU performs during the sweep and
defines how much time is allotted to each task. The parameters that can be modified vary
depending on the selection for sweep mode.
The Controller Communications Window, Backplane Communications Window, and
Background Window phases of the PLC sweep can be run in various modes, based on the
PLC sweep mode.
Choices:
 Normal mode: The PLC sweep executes as quickly as possible. The overall PLC sweep
time depends on the logic program and the requests being processed in the windows
and is equal to the time required to execute the logic in the program plus the
respective window timer values. The window terminates when it has no more tasks to
complete. This is the default value.
 Constant Window mode: Each window operates in a Run-to-Completion mode. The
PLC alternates among three windows for a time equal to the value set for the window
timer parameter. The overall PLC sweep time is equal to the time required to execute
the logic program plus the value of the window timer. This time may vary due to
sweep-to-sweep differences in the execution of the program logic.
 Constant Sweep mode: The overall PLC sweep time is fixed. Some or all of the
windows at the end of the sweep might not be executed. The windows terminate
when the overall PLC sweep time has reached the value specified for the Sweep Timer
parameter.

Scan Parameters
Logic Checksum The number of user logic words to use as input to the checksum algorithm each sweep.
Words Valid range: 0 through 32760, in increments of 8.
Default: 16.
Controller (Available only when Sweep Mode is set to Normal.) Execution settings for the Controller
Communication Communications Window.
Window Mode Choices:
 Complete: The window runs to completion. There is no time limit.
 Limited: Time sliced. The maximum execution time for the Controller Communications
Window per scan is specified in the Controller Communications Window Timer
parameter.
Default: Limited.
Note: This parameter corresponds to the Programmer Window Mode parameter on a
Series 90-70 PLC.
Controller (Available only when Sweep Mode is set to Normal. Read-only if the Controller
Communications Communications Window Mode is set to Complete.) The maximum execution time for the
Window Timer Controller Communications Window per scan. This value cannot be greater than the value
(ms) for the watchdog timer.
The valid range and default value depend on the Controller Communications Window
Mode:
 Complete: There is no time limit.
 Limited: Valid range: 0 through 255ms. Default: 10.
Note: This parameter corresponds to the Programmer Window Timer parameter on a
Series 90-70 PLC.
Backplane (Available only when Sweep Mode is set to Normal.) Execution settings for the Backplane
Communication Communications Window.
Window Mode Choices:
Complete: The window runs to completion. There is no time limit.
Limited: Time sliced. The maximum execution time for the Backplane Communications
Window per scan is specified in the Backplane Communications Window Timer
parameter.
Default: Complete.
Backplane (Available only when Sweep Mode is set to Normal. Read-only if the Backplane
Communications Communications Window Mode is set to Complete.) The maximum execution time for the
Window Timer Backplane Communications Window per scan. This value can be greater than the value
(ms) for the watchdog timer.
The valid range and the default depend on the Backplane Communications Window
Mode:
 Complete: There is no time limit. The Backplane Communications Window Timer
parameter is read-only.
 Limited: Valid range: 0 through 255ms. Default: 255. (10ms for Redundancy CPUs.)

Scan Parameters
Background (Available only when Sweep Mode is set to Normal.) The maximum execution time for the
Window Background Communications Window per scan. This value cannot be greater than the
Timer (ms) value for the watchdog timer.
Valid range: 0 through 255
Default: 0 (5ms for Redundancy CPUs)
Sweep Timer (Available only when Sweep Mode is set to Constant Sweep.) The maximum overall PLC
(ms) scan time. This value cannot be greater than the value for the watchdog timer.
Some or all of the windows at the end of the sweep might not be executed. The windows
terminate when the overall PLC sweep time has reached the value specified for the Sweep
Timer parameter.
Valid range: 5 through 2550, in increments of 5. If the value typed is not a multiple of 5ms,
it is rounded to the next highest valid value.
Default: 100.
Window Timer (Available only when Sweep Mode is set to Constant Window.) The maximum combined
(ms) execution time per scan for the Controller Communications Window, Backplane
Communications Window, and Background Communications Window. This value cannot
be greater than the value for the watchdog timer.
Valid range: 3 through 255, in increments of 1.
Default: 10.
Number of Last (Available only for CPUs with firmware version 1.5 and greater.) The number of scans to
Scans execute after the PACSystems CPU receives an indication that a transition from Run to
Stop mode should occur. (Used for Stop and Stop Fault, but not Stop Halt.)
Choices: 0, 1, 2, 3, 4, 5.
Default:
0 when creating a new PACSystems target.
0 when converting a Series 90-70 target to a PACSystems target.
1 when converting a Series 90-30 target to a PACSystems target.
3.2.4 Memory Parameters

The PACSystems user memory contains the application program, hardware configuration (HWC),
registers (%R), bulk memory (%W), analog inputs (%AI), analog outputs (%AQ), and managed memory.
Managed memory consists of allocations for symbolic variables and I/O variables. The symbolic
variables feature allows you to create variables without having to manually locate them in memory.
An I/O variable is a symbolic variable that is mapped to the inputs and outputs of a module in the
hardware configuration. For details on using symbolic variables and I/O variables, refer to Chapter 7.
The amount of memory allocated to the application program and hardware configuration is
automatically determined by the actual program (including logic C data, and %L and %P), hardware
configuration (including EGD and AUP), and symbolic variables created in the programming software.
The rest of the user memory can be configured to suit the application. For example, an application
may have a relatively large program that uses only a small amount of register and analog memory.
Similarly, there might be a small logic program but a larger amount of memory needed for registers
and analog inputs and outputs.
Appendix B provides a summary of items that count against user memory.

Calculation of Memory Required for Managed Memory

The total number of bytes required for symbolic and I/O variables is calculated as follows:
[((number of symbolic discrete bits) × 3) / (8 bits/byte)]
+ [((number of I/O discrete bits) × Md) / (8 bits/byte)]
+ [(number of symbolic words × (2 bytes/word)]
+ [(number of I/O words) × (Mw bytes/word)]
Md = 3 or 4. The number of bits is multiplied by 3 to keep track of the force, transition, and value of
each bit. If point faults are enabled, the number of I/O discrete bits is multiplied by 4.
Mw = 2 or 3. There are two 8-bit bytes per 16-bit word. If point faults are enabled, the number of
bytes is multiplied by 3 because each I/O word requires an extra byte.
Calculation of Total User Memory Configured
The total amount of configurable user memory (in bytes) configured in the CPU is calculated as
follows:
total managed memory (bytes)
+ total reference words × (2 bytes/word)
+ [if Point Faults are enabled] (total words of %AI memory + total words of %AQ
memory) × (1 byte / word)
+ [if Point Faults are enabled] (total bits of %I memory + total bits of %Q memory) /
8 bits/byte)
Note: The total number of reference points is considered system memory and is not counted
against user memory.

Memory Allocation Configuration

Memory Parameters
Reference Points
%I Discrete Input, %Q Discrete Output, The upper range for each of these memory types. Read only.
%M Internal Discrete, %S System, %SA
System, %SB System, %SC System, %T
Temporary Status, %G Genius Global
Total Reference Points Read only. Calculated by the programming software.
Reference Words
%AI Analog Input Valid range: 0 through 32,640 words.
Default: 64
%AQ Analog Output Valid range: 0 through 32,640 words.
Default: 64
%R Register Memory Valid range: 0 through 32,640 words.
Default: 1024.
%W Bulk Memory Valid range: 0 through maximum available user RAM.
Increments of 2048 words.
Default: 0.
Total Reference Words Read only. Calculated by the programming software.
Managed Memory
Symbolic Discrete (Bits) The configured number of bits reserved for symbolic discrete
variables.
Valid range: 0 through 83,886,080 in increments of 32768 bits.
Default: 32,768.
Symbolic Non-Discrete (Words) The configured number of 16-bit register memory locations reserved
for symbolic non-discrete variables.
Valid range: 0 through 5,242,880 in increments of 2048 words.
Default: 65,536.
I/O Discrete (Bits) The configured number of bits reserved for discrete IO variables.
Valid range: 0 through 83,886,080 in increments of 32768 bits.
Default: 0
I/O Non-Discrete (Words) The configured number of 16-bit register memory locations reserved
for non-discrete IO variables.
Valid range: 0 through 5,242,880 in increments of 2048 words.
Default: 0
Total Managed Memory Required (Bytes) Read only. See page 54 for calculation.
Total User Memory Required (Bytes) Read only. See page 54 for calculation.
Point Fault References The Point Fault References parameter must be enabled if you want
to use fault contacts in your logic. Assigning point fault references
causes the CPU to reserve additional memory.
When you download both the HWC and the logic to the PLC, the
download routine checks if there are fault contacts in the logic and if
there are, it checks if the HWC to download has the Point Fault
References parameter set to Enabled. If the parameter is Disabled,
an error is displayed in the Feedback Zone.
When you download only logic to the PLC, the download routine
checks if there are fault contacts in the logic and if there are, it
checks if the HWC on the PLC has the Point Fault References
parameter set to Enabled. If the parameter is Disabled, an error is
displayed in the Feedback Zone.

3.2.5 Fault Parameters

You can configure each fault action to be either diagnostic or fatal.
A diagnostic fault does not stop the PLC from executing logic. It sets a diagnostic variable and is
logged in a fault table.
A fatal fault transitions the PLC to the Stop Faulted mode. It also sets a diagnostic variable and is
logged in a fault table.
Fault Parameters
Loss of or Missing (Fault group 1.) When BRM failure or loss of power loses a rack or when a configured rack is
Rack missing, system variable #LOS_RCK (%SA12) turns ON. (To turn it OFF, fix the hardware
problem and cycle power on the rack.)
Default: Diagnostic.
Loss of or Missing (Fault group 2.) When a Bus Controller stops communicating with the PLC or when a
I/O Controller configured Bus Controller is missing, system variable #LOS_IOC (%SA13) turns ON. (To turn
it OFF, replace the module and cycle power on the rack containing the module.)
Loss of or Missing (Fault group 3.) When an I/O module stops communicating with the PLC CPU or a
I/O Module configured module is missing, system variable #LOS_IOM (%SA14) turns ON. (To turn it OFF,
replace the module and cycle power on the rack containing the module.)
Loss of or Missing (Fault group 4.) When an option module stops communicating with the PLC CPU or a
Option Module configured option module is missing, system variable #LOS_SIO (%SA15) turns ON. (To turn
it OFF, replace the module and cycle power on the rack containing the module.)
System Bus Error (Fault group 12.) When a bus error occurs on the backplane, system variable #SBUS_ER
(%SA32) turns ON. (To turn it OFF, cycle power on the main rack.)
Default: Fatal.
I/O Controller or (Fault group 9.) When a Bus Controller reports a bus fault, a global memory fault, or an IOC
I/O Bus Fault hardware fault, system variable #IOC_FLT (%SA22) turns ON. (To turn it OFF, cycle power on
the rack containing the module when the configuration matches the hardware after a
download.)
System (Fault group 11.) When a configuration mismatch is detected during system power-up or
Configuration during a download of the configuration, system variable #CFG_MM (%SA9) turns ON. (To
Mismatch turn it OFF, power up the PLC when no mismatches are present or download a
configuration that matches the hardware.)
This parameter determines the fault action when the CPU is not running. If a system
configuration mismatch occurs when the CPU is in Run mode, the fault action will be
Diagnostic. This prevents the running CPU from going to STOP/FAULT mode. To override this
behavior, see “Configuring the CPU to Stop Upon Loss of a Critical Module” on page 57.
Default: Fatal.
Fan Kit Failure (Fault group 0x17.) When a fault is detected in the Smart Fan kit, system variable #FAN_FLT
(%SA7) turns ON. (To turn a fan kit fault OFF, clear the PLC fault table or reset the PLC.)
Recoverable Local Redundancy CPUs only. (Fault group 38) Determines whether a single-bit ECC error causes
Memory Error the CPU to stop or allows it to continue running.
Choices: Diagnostic, Fatal.
Note: When a multiple-bit ECC error occurs, a Fatal Local Memory Error fault (error code
169) is logged in the CPU Hardware Fault Group (group number 13).

Fault Parameters
CPU Over (Fault group 24, error code 1.) When the operating temperature of the CPU exceeds the
Temperature normal operating temperature, system variable #OVR_TMP (%SA8) turns ON. (To turn it OFF,
clear the Controller Fault Table or reset the PLC.)
Controller Fault (Read-only.) The maximum number of entries in the Controller Fault Table.
Table Size Value set to 64.
I/O Fault Table Size (Read-only.) The maximum number of entries in the I/O Fault Table.
Value set to 64.
Configuring the CPU to Stop Upon the Loss of a Critical Module

In some cases, you may want to override the Run mode behavior of the System Configuration
Mismatch fault. A given module may be critical to the PLC’s ability to properly control a process. In
this case, if the module fails then it may be better to have the CPU go to stop mode, especially if the
CPU is acting as a backup unit in a redundant system.
One way to cause the CPU to stop is to set the configured action for a Loss-of-Module fault to Fatal
so that the CPU stops if a module failure causes a loss-of-module fault. The correct loss-of-module
fault must be chosen for the critical module of interest: I/O controller, I/O module, and Option
module. The Ethernet communications module is an example of an Option module.
This approach has a couple of disadvantages. First, it applies to all modules of that category, which
may include modules that are not critical to the process. Second, it relies on the content of the fault
table. If the table is cleared via program logic or user action, the CPU will not stop.
In systems that use Ethernet Network Interface Units (ENIUs) for remote I/O, a critical module of
interest may be the Ethernet module that provides the network connection to the ENIU. Other
techniques can be used to provide a more selective response to an Ethernet module failure than the
Loss-of-Option module fault. One technique is to use application logic to monitor the Ethernet
Interface Status bits, which are described in “Monitoring the Ethernet Interface Status Bits” in the
TCP/IP Ethernet for PACSystems User’s Manual, GFK-2224. If the logic determined that a critical
Ethernet module was malfunctioning, it could execute SVC_REQ #13 to stop the CPU.
Since the ENIU uses Ethernet Global Data to communicate with the PACSystems CPU, another
selective technique is to monitor the Exchange Status Words to determine the health of individual
EGD exchanges. For details on this status word, refer to “Exchange Status Word Error Codes” in GFK-
2224. Because the types of errors indicated by the exchange status word may be temporary in
nature, stopping the CPU may not be an appropriate response for these errors. Nevertheless, the
status could be used to tailor the response of the application to changing conditions in the EGD
network.
In some cases the critical module may reside in an expansion rack. In that case, in addition to the
loss-of-module fault, it is recommended to set the Loss-of-Rack fault to Fatal. Then if the rack fails or
loses power, the CPU will go to stop mode.
3.2.6 Redundancy Parameters (Redundancy CPUs Only)
These parameters apply only to redundancy CPUs. For details on configuring CPU for redundancy,
refer to the PACSystems Hot Standby CPU Redundancy User’s Guide, GFK-2308.
3.2.7 Transfer List
These parameters apply only to redundancy CPUs. For details on configuring CPU for redundancy,
refer to the PACSystems Hot Standby CPU Redundancy User’s Guide, GFK-2308.

3.2.8 Port 1 and Port 2 Parameters

These parameters configure the operating characteristics of the CPU serial ports. Ports 1 and 2 have
the same set of configuration parameters. The protocol (Port Mode) determines the parameters that
can be set for each port.
Port Parameters
Port Mode The protocol to execute on the serial port. Determines the list of parameters displayed on the
Port tab. Only the parameters required by the selected protocol are displayed.
Choices:
 RTU Slave mode: Reserved for the use of the Modbus RTU Slave protocol. This mode also
permits connection to the port by an SNP master, such as the WinLoader utility or the
programming software.
 Message mode: The port is open for user logic access. This mode enables C language blocks
to perform serial port I/O operations via the C Runtime Library functions.
 Available: The port is not to be used by the PLC firmware. (The CPE305 does not support this
selection.)
 SNP Slave: Reserved for the exclusive use of the SNP slave. This mode permits connection to
the port by an SNP master, such as the WinLoader utility or the programming software.
 Serial I/O: Enables you to perform general-purpose serial communications by using
COMMREQ functions.
Default: RTU Slave.
Note: If both serial ports are configured for any protocol other than RTU Slave or SNP Slave,
the Run/Stop switch should not be disabled without first making sure that there is a way
to stop the CPU, or take control of the CPU through another device such as the Ethernet
module. The Serial I/O protocol is only active when the CPU is in run mode. If the CPU can
be set to Stop mode, it will switch the protocol from Serial I/O to the Stop Mode protocol
(default is RTU Slave). If an SNP Master, such as the programming software in Serial
mode, begins communicating on a port, the RTU protocol automatically switches to SNP
Slave. As long as the CPU can be stopped, the protocol of the port can be auto-switched
to one that enables serial programmer connection. For Stop Mode protocols, see page
60.
If the Ethernet module is available, you can control the CPU by connecting the Machine
Edition programming software to the Ethernet port.
Station (RTU Slave only) ID for the RTU Slave.
Address Valid range: 1 through 247.
Default: 1.
Note: You should avoid using station address 1 for any other Modbus slave in a PACSystems
control system because the default station address for the CPU is 1. The CPU uses the
default address in two situations:
1. If you power up without a configuration, the default station address of 1 is used.
2. When the Port Mode parameter is set to Message Mode, and Modbus becomes the protocol
in stop mode, the station address defaults to 1.
In either of these situations, if you have a slave configured with a station address of 1,
confusion may result when the CPU responds to requests intended for that slave.
Note: The least significant bit of the first byte must be 0. For example, in a station address of
090019010001, 9 is the first byte.
Data Rate (All Port Modes except “Available”.) Data rate (bits per second) for the port.
Choices: 1200 Baud, 2400 Baud, 4800 Baud, 9600 Baud, 19.2k Baud, 38.4k Baud, 57.6k Baud,
115.2k Baud.
Default: 19.2k Baud.

Port Parameters
Data Bits (Available only when Port Mode is set to Message mode or Serial I/O.) The number of bits in a
word for serial communication. SNP uses 8-bit words.
Choices: 7, 8.
Default: 8.
Flow (RTU slave, Message Mode, or Serial I/O.) Type of flow control to be used on the port.
Control Choices:
 For Serial I/O Port Mode: None, Hardware, Software (XON/XOFF).
 For all other Port Modes: None, Hardware.
Default: None.
Note: The Hardware flow-control is RTS/CTS crossed.
Parity (All Port Modes except Available.) The parity used in serial communication. Can be changed if
required for communication over modems or with a different SNP master device.
Choices: None, Odd, Even.
Default: Odd.
Stop bits (Available only when Port Mode is set to Message Mode, SNP Slave or Serial I/O.) The number of
stop bits for serial communication. SNP uses 1 stop bit.
Choices: 1, 2.
Default: 1.
Physical (All port modes except Available.) The type of physical interface that this protocol is
Interface communicating over.
Choices:
 2-wire: There is only a single path for receive and transmit communications. The receiver
is disabled while transmitting.
 4-wire: There is a separate path for receive and transmit communications and the
transmit line is driven only while transmitting.
 4-wire Transmitter on: There is a separate path for receive and transmit
communications and the transmit line is driven continuously. Note that this choice is
not appropriate for SNP multi-drop communications, since only one device on the multi-
drop line can be transmitting at a given time.
Default: 4-wire Transmitter On.
Turn (Available only when Port Mode is set to SNP Slave.) The Turn Around Delay Time is the minimum
Around time interval required between the reception of a message and the next transmission. In 2-wire
Delay Time mode, this interval is required for switching the direction of data transmission on the
(ms) communication line.
Valid range: 0 through 2550ms, in increments of 10.
Default: 0.
Timeout (s) (Available only when Port Mode is set to SNP Slave.) The maximum time that the slave will wait to
receive a message from the master. If a message is not received within this timeout interval, the
slave will assume that communications have been disrupted, and then it will wait for a new
attach message from the master.
Valid range: 0 through 60 seconds.
Default: 10.
SNP ID (Available only when Port Mode is set to SNP Slave.) The port ID to be used for SNP
communications. In SNP multi-drop communications, this ID is used to identify the intended
receiver of a message. This parameter can be left blank if communication is point to point. To
change the SNP ID, click the values field and enter the new ID. The SNP ID is up to seven
characters long and can contain the alphanumeric characters (A through Z, 0 through 9) or the
underline (_).

Port Parameters
Specify (All port modes except Available.) Determines whether you accept the default stop mode or set it
Stop Mode yourself.
Choices:
No: The default stop mode is used.
Yes: The stop mode parameters appear and you can select the stop mode. If you set the stop
mode to the same protocol as the run mode, then the other stop mode parameters are read-only
and are set to the same values as for the run mode.
Default: No.
Stop Mode (Available only when Specify stop mode is set to Yes.) The stop mode protocol to execute on the
serial port. If you set the stop mode to the same protocol as for the run mode, then the other stop
mode parameters are read-only and are set to the same values as for the run mode.
Choices and defaults are determined by the Port Mode setting.
■ SNP Slave: Reserved for the exclusive use of the SNP slave.
■ RTU Slave: Reserved for the exclusive use of the Modbus RTU Slave protocol.
If the Stop mode protocol is different from the Port mode protocol, you can set parameters for
the Stop mode protocol.
If you do not select a Stop mode protocol, the default protocol with default parameter settings is
used.
Port (Run) Mode Stop Mode
RTU Slave Choices: SNP Slave, RTU Slave
Default: RTU Slave.
Message Mode Choices: SNP Slave, RTU Slave
Default: RTU Slave.
Available Available (Not supported on CPE305)
SNP Slave SNP Slave
Serial I/O Choices: SNP Slave, RTU Slave
Default: RTU Slave.
Note: Setting the Port Mode to RTU Slave and the Stop Mode to SNP Slave may cause loss of
programmer connection and delayed reconnection when the controller transitions from
Stop to Run mode. To avoid this behavior, select SNP Slave for the Port Mode and do not
specify a Stop Mode. For additional details, see “RTU Slave/SNP Slave Operation With
Programmer Attached” in Chapter 14.
Turn (Available only when Stop Mode is set to SNP Slave.) The Turn Around Delay Time is the minimum
Around time interval required between the reception of a message and the next transmission. In 2-wire
Delay Time mode, this interval is required for switching the direction of data transmission on the
(ms) communication line.
Valid range: 0 through 2550ms, in increments of 10.
Default:
 When the Stop Mode is different from the Port Mode: 0ms.
 When the Stop Mode is the same as the Port Mode: the value is read-only and is set to the
same value as the Turn Around Delay Time for the Port Mode.
Timeout (s) (Available only when Stop Mode is set to SNP Slave.) The maximum time that the slave will wait to
receive a message from the master. If a message is not received within this timeout interval, the
slave will assume that communications have been disrupted, and then it will wait for a new
attach message from the master.
Valid range: 0 through 60 seconds.
Default:
 When the Stop Mode is different from the Port Mode: 10 seconds.
same value as the Timeout for the Port Mode.

Port Parameters
SNP ID (Available only when Stop Mode is set to SNP Slave.) The port ID to be used for SNP
communications. In SNP multi-drop communications, this ID is used to identify the intended
receiver of a message. This parameter can be left blank if communication is point to point. To
change the SNP ID, click the values field and enter the new ID. The SNP ID is up to seven
characters long and can contain the alphanumeric characters (A through Z, 0 through 9) or the
underline (_).
Default:
 When the Stop Mode is different from the Port Mode: the default is blank.
same value as the SNP ID for the Port Mode.
Station (Available only when Stop Mode is set to RTU slave.) ID for the RTU Slave.
Address Valid range: 1 through 247.
Default:
 When the Stop Mode is different from the Port Mode: 1.
same value as the Station Address for the Port Mode.
3.2.9 Scan Sets Parameters

You can create multiple sets of asynchronous I/O scans, with a unique scan rate assigned to each
scan set. You can assign up to 31 scan sets for a total of 32. Scan set 1 is the standard scan set
where I/O is scanned once per sweep. Each module is assigned to a scan set during the
configuration of that module. Scan Set 1 is the default scan set.
Scan Set Parameters
Number A sequential number from 1 to 32 is automatically assigned to each scan set. Scan set 1 is
reserved for the standard scan set.
Scan Type Determines whether the scan set is enabled (as a fixed scan) or is disabled.
Choices: Disabled, Fixed Scan.
Default: Disabled.
Number of (Editable only when the Scan Type is set to Fixed Scan.) The scan rate of the scan set. Double-
Sweeps click the field, then select a value. A value of 0 prevents the I/O from being scanned.
Valid range: 0 through 64.
Default: 1.
Output (Editable only when the Number of Sweeps is non-zero.) The number of sweeps that the output
Delay scan is delayed after the input scan has occurred. Double-click on field, then select a value.
Valid range: 0 to (number of Sweeps - 1)
Default: 0.
Description (Editable only when the Scan Type is set to Fixed Scan.) Brief description of the scan set (32
characters maximum).
3.2.10 Power Consumption Parameters

The programming software displays the power consumed by the CPU (in Amps) for each voltage
provided by the power supply.

3.2.11 Access Control

The Access Control list allows you to specify the reference address ranges that can be accessed by
non-local devices such as HMIs and other controllers. To use this feature, Enhanced Security must be
enabled in the properties of the target.
When Enhanced Security mode is enabled, any reference address range not defined cannot be
accessed by other devices. External reads and writes that do not exist in the table are rejected by the
firmware.
If overlapping memory ranges are defined, they must have the same Access level.
For symbolic variables, access control is specified by the Publish property of the variable, which
includes a Read Only and Read/Write setting.
Note: When requesting data from an external device, some drivers packetize data to optimize
communication. If a request attempts to read a value that is not published, the entire packet
will fail. A fault has been added to the fault table to help you understand a failed read/write.
After addressing the fault, you must clear the fault in order to try again.
Access Control List Settings
Memory The memory area in which the reference address range is defined.
Area Default: Select an Area
Choices: %AI Analog Input, %AQ Analog Output, %I Discrete Input, %G Genius Global,
%M Internal Discrete, %Q Discrete Output, %R Register Memory, %S System, %SA
System, %SB System, %SC System, %T Temporary Status, %W Bulk Memory.
Start The starting offset of the reference address range.
Default: 0 (not valid)
Valid range:
For %S, %SA, %SB and %SC, must be 1.
All other memory types: 1 through the upper limit of the reference address range. Must be less
than the End value.
End The ending offset of the reference address range.
Default: 0 (not valid)
Valid range:
For %S, %SA, %SB and %SC, must be 128.
All other memory types: Any value greater than Start, through the upper limit of the reference
address range.
For word memory types (%AI, %R and %W) the highest address available is configured on the
Memory tab.
Access Selects the type of external access allowed for the defined address range.
Choices: Read-Only, Read/Write
Default: Read-Only

3.3. Setting a Temporary IP Address

Note: The CPE305/CPE310 does not support setting a temporary IP address. The IP address can be
set by connecting through a serial port or over Ethernet using the factory-set default IP
address.
To initiate Ethernet communications between the programming software and the Controller, you first
need to set an IP address. You can use the Set Temporary IP Address utility to specify an IP address
or download a hardware configuration with an IP address through a serial port.
The following restrictions apply when using the Set Temporary IP Address utility:
 To use the Set Temporary IP Address utility, the PLC CPU must not be in RUN mode. IP address
assignment over the network will not be processed until the CPU is stopped and is not scanning
outputs.
 The Set Temporary IP Address utility does not function if communications with the networked
PACSystems target travel through a router. The Set Temporary IP Address utility can be used if
communications with the networked PACSystems target travel across network switches and
hubs.
 The current user logged on the computer running the Set Temporary IP Address utility must have
full administrator privileges.
 The target PACSystems must be located on the same local sub-network as the computer running
the Set Temporary IP Address utility. The sub-network is specified by the computer's subnet mask
and the IP addresses of the computer and the PACSystems Ethernet Interface.
Note: To set the IP address, you will need the MAC
address of the Ethernet Interface.
1. Connect the PACSystems to the Ethernet network.
2. In the Project tab of the Navigator, right click the
PACSystems target, choose Offline Commands, and
then choose Set Temporary IP Address. The Set
Temporary IP Address dialog box appears.
3. In the Set Temporary IP Address dialog box, do the
following:
 Specify the MAC address.
 In the IP Address to Set box, specify the temporary
IP address you want to set on the PACSystems.
 If necessary, select the Enable Network Interface
Selections check box and specify the IP address of
the network interface on which the PACSystems is
located.
4. When the fields are properly configured, click the Set
IP button.
5. The IP Address of the specified PACSystems will be set
to the indicated address. This may take up to a
minute.
After the programmer is connected, the actual IP address
for the Ethernet interface, which is set in the hardware
Figure 4: Set Temporary IP Address
configuration, should be downloaded to the controller.
The temporary IP address remains in effect until the Ethernet interface is restarted, power-cycled or
until the hardware configuration is downloaded or cleared.

Caution
The temporary IP address set by the Set Temporary IP
Address utility is not retained through a power cycle. To set
a permanent IP Address, you must set the IP Address
property of the target and download (store) HWC to the
PACSystems.
The Set Temporary IP Address utility can assign a temporary
IP address even if the target Ethernet Interface has
previously been configured to a non-default IP address. (This
includes overriding an IP address previously configured by
the programmer.)
Use this IP Address assignment mechanism with care..

3.4. Storing (Downloading) Hardware Configuration

A PACSystems control system is configured by creating a configuration file in the programming
software, then transferring (downloading) the file from the programmer to the CPU via serial port1,
serial port 2, or an Ethernet Interface. If you use a serial port, it must be configured as RTU Slave
(default) or SNP Slave.
The CPU stores the configuration file in its non-volatile RAM memory. After the configuration is stored,
I/O scanning is enabled or disabled according to the newly stored configuration parameters.
Before you can use an Ethernet Interface to store the hardware configuration to the PACSystems,
you must first set the IP address in the Ethernet Interface either by using the Set Temporary IP
Address utility (see page 63) or by downloading a hardware configuration through a serial
connection.
1. In the programmer software, go to the
Project tab of the Navigator, right click the
Target, and choose Go Online.
2. Right click the Target and choose Online
Commands, Set Programmer Mode. Make
sure the CPU is in Stop mode.
3. Right click the Target node, and choose
Download to Controller.
4. In the Download to Controller dialog box,
select the items to download and click OK.
Figure 5: Downloading Hardware Configuration to CPU
Notes: If you download to a PACSystems target that already has a project on it, the existing project
is overwritten.
If I/O variables are configured, hardware configuration and logic cannot be stored
independently. They must be stored at the same time.
If passwords have been set, when you go online, you will be taken to the highest unprotected
level. If no passwords have been set, you will go online with Privilege Level 4.

3.5. Configuring the Embedded Ethernet Interface

Before you can use the embedded Ethernet Interface, you must configure it using the programming
software. To configure the embedded Ethernet interface:
1. In the Project tab of the Navigator, expand
your PACSystems Target, the hardware
configuration, and the main rack (Rack 0).
2. Expand the CPU slot (Slot 1). The Ethernet
Interface daughterboard is displayed as
Ethernet.
3. Right click the daughterboard slot and
choose Configure. The Parameter Editor
window displays the Ethernet Interface
parameters.
Figure 6: Selecting Embedded Ethernet for

Configuration
Ethernet interface configuration includes the following additional procedures. For details on
completing these steps, refer to the TCP/IP Ethernet Communications for PACSystems User’s Manual,
GFK-2224.
▪ Assigning an IP address for initial network operation, such as connecting the programmer to
download the hardware configuration, using the Set Temporary IP Address utility (see page 63) or
by downloading a hardware configuration through a serial connection.
▪ Configuring the characteristics of the Ethernet interface.
▪ Configuring Ethernet Global Data, if used (Not supported by CPE305/CPE310).
▪ (Optional, not required for most systems). Setting up the RS-232 port for Local Station Manager
Operation. This is part of the basic Ethernet Interface configuration.
▪ (Optional, not required for most systems). Configuring advanced user parameters. This requires
creating a separate ASCII parameter file that is stored to the Controller with the hardware
configuration. The Ethernet Interface has a set of default Advanced User Parameter values that
should be changed only in exceptional circumstances by experienced users.
▪ (Optional) Setting up the Controller for Modbus/TCP Server operation.
Note: When a CPE310 is configured as a CPU310, Ethernet properties cannot be configured.
The embedded Ethernet interface is not supported when CPE310 is configured as a CPU310
and the Ethernet port should not be connected to any network because it may have adverse
effects on the network and/or operation of the CPU

Chapter 4 CPU Operation
This chapter describes the operating modes of a PACSystems CPU and describes the tasks the CPU
carries out during these modes. The following topics are discussed:
 CPU Sweep
 Program Scheduling Modes
 Window Modes
 Run/Stop Operations
 Flash Memory Operation
 Clocks and Timers
 System Security
 I/O System
 Power-Up and Power-Down Sequences

Chapter 4. CPU Operation
4.1. CPU Sweep

The application program in the CPU executes repeatedly until stopped by a command from the
programmer, from another device, from the Run/Stop switch on the CPU module, or a fatal fault
occurs. In addition to executing the application program, the CPU obtains data from input devices,
sends data to output devices, performs internal housekeeping, performs communications tasks, and
performs self-tests. This sequence of operations is called the sweep.
The CPU sweep runs in one of three sweep modes:
Normal In this mode, each sweep can consume a variable amount of time.
Sweep The Logic Window is executed in its entirety each sweep. The
Communications and Background Windows can be set to execute in
Limited or Run-to-Completion mode.
Constant In this mode, each sweep begins at a user-specified Constant Sweep
Sweep time after the previous sweep began. The Logic Window is executed
in its entirety each sweep. If there is sufficient time at the end of the
sweep, the CPU alternates among the Communications and
Background Windows, allowing them to execute until it is time for the
next sweep to begin.
Constant In this mode, each sweep can consume a variable amount of time.
Window The Logic Window is executed in its entirety each sweep. The CPU
alternates among the Communications and Background Windows,
allowing them to execute for a time equal to the user-specified
Constant Window timer.
Note: The information presented above summarizes the different sweep modes. For additional
information, refer to “CPU Sweep Modes” on page 72.
The CPU also operates in one of four Run/Stop Modes (for details, see “Run/Stop Operations” on
page 78):
■ Run/Outputs Enabled
■ Run/Outputs Disabled
■ Stop/IO Scan
■ Stop/No IO
4.1.1 Parts of the CPU Sweep
There are seven major phases in a typical CPU sweep as shown in the following figure.

Housekeeping
Start-of-Sweep
input scan
Application Program
Task Execution
(Logicwindow)
Output Scan
Prog
window no
scheduled
?
yes
Controller
Communications
Window
Comm
no
window
scheduled
?
yes
Backplane
Communications
Window
Background no
task
scheduled
?
yes
Background task
Window
Start next sweep
Figure 7: Major Phases of a Typical CPU Sweep

Major Phases in a Typical CPU Sweep

Phase Activity
Housekeeping The housekeeping portion of the sweep performs the tasks necessary to prepare for the
start of the sweep. This includes updating %S bits, determining timer update values,
determining the mode of the sweep (Stop or Run), and polling of expansion racks.
Expansion racks are polled to determine if power has just been applied to an expansion
rack. Once an expansion rack is recognized, then configuration of that rack and all of its
modules are processed in the Controller Communications Window.
Input Scan During the input scan, the CPU reads input data from the Genius Bus Controllers and input
modules. If data has been received on an EGD page, the CPU copies the data for that page
from the Ethernet interface to the appropriate reference memory. For details, see TCP/IP
Ethernet Communications for PACSystems, GFK-2224
Note: The input scan is not performed if a program has an active Suspend I/O function
on the previous sweep.
Application The CPU solves the application program logic. It always starts with the first instruction in
Program Task the program. It ends when the last instruction is executed. Solving the logic creates a new
Execution (Logic set of output data.
Window) For details on controlling the execution of programs, refer to Chapter 5.
Interrupt driven logic can execute during any phase of the sweep. For details, refer to
Chapter 5.
A list of execution times for instructions can be found in Appendix A.
Output Scan The CPU writes output data to bus controllers and output modules. The user program
checksum is computed.
During the output scan, the CPU sends output data to the Genius Bus Controllers and
output modules. If the producer period of an EGD page has expired, the CPU copies the
data for that page from the appropriate reference memory to the Ethernet interface. The
output scan is completed when all output data has been sent.
If the CPU is in Run mode and it is configured to perform a background checksum
calculation, the background checksum is performed at the end of the output scan. The
default setting for number of words to checksum each sweep is 16. If the words to
checksum each sweep is set to zero, this processing is skipped. The background checksum
helps ensure the integrity of the user logic while the CPU is in Run mode.
The output scan is not performed if a program has an active Suspend I/O function on the
current sweep.

Phase Activity
Controller Services the onboard Ethernet and serial ports. In addition, reconfiguration of expansion
Communications racks and individual modules occurs during this portion of the sweep.
Window The CPU always executes this window. The following items are serviced in this window:
 Reconfiguration of expansion racks and individual modules. During the Controller
Communications Window, highest priority is given to reconfiguration. Modules are
reconfigured as needed, up to the total time allocated to this window. Several sweeps
are required to complete reconfiguration of a module.
 Communications activity involving the embedded Ethernet port and the two serial
ports of the CPU.
Time and execution of the Controller Communications Window can be configured using the
programming software. It can also be dynamically controlled from the user program using
Service Request function #3. The window time can be set to a value from 0 to 255
milliseconds (default is 10 milliseconds).
Note that if the Controller Communications Window is set to 0, there are two alternate
ways to open the window: perform a power-cycle without the battery (or Energy Pack)
attached, or go to Stop mode.
Backplane Communications with intelligent devices occur during this window. The rack-based
Communications Ethernet Interface module communicates in the Backplane Communications window.
Window During this part of the sweep the CPU communicates with intelligent modules such as the
Genius Bus Controller and TCP/IP Ethernet modules.
In this window, the CPU completes any previously unfinished request before executing any
pending requests in the queue. When the time allocated for the window expires, processing
stops.
The Backplane Communications Window defaults to Complete (Run to Completion) mode.
This means that all currently pending requests on all intelligent option modules are
processed every sweep. This window can also run in Limited mode, in which the maximum
time allocated for the window per scan is specified.
The mode and time limit can be configured and stored to the CPU, or it can be dynamically
controlled from the user program using Service Request function #4. The Backplane
Communications Window time can be set to a value from 0 to 255ms (default is 255ms).
This allows communications functions to be skipped during certain time-critical sweeps.
Background CPU self-tests occur in this window.
Window A CPU self-test is performed in this window. Included in this self-test is a verification of the
checksum for the CPU operating system software.
The Background Window time defaults to 0 milliseconds. A different value can be
configured and stored to the CPU, or it can be changed online using the programming
software.
Time and execution of the Background Window can also be dynamically controlled from
the user program using Service Request function #5. This allows background functions to
be skipped during certain time-critical sweeps.

4.1.2 CPU Sweep Modes

Normal Sweep Mode
In Normal Sweep mode, each sweep can consume a variable amount of time. The Logic window is
executed in its entirety each sweep. The Communications windows can be set to execute in a Limited
or Run-to-Completion mode. Normal Sweep is the most common sweep mode used for control
system applications.
The following figure illustrates three successive CPU sweeps in Normal Sweep mode. Note that the
total sweep times may vary due to sweep-to-sweep variations in the Logic window, Communications
windows, and Background window.
SWEEP n SWEEP n+1 SWEEP n+2
HK HK HK
INPUT INPUT INPUT
LOGIC LOGIC LOGIC
OUTPUT
CC
OUTPUT
BPC
CC
BG
BPC OUTPUT
BG CC
BPC
Abbreviations:
HK = Housekeeping BG
CC = Controller Communications Window
BPC = Backplane Communications Window
BG = Background Window
Figure 8: Typical Sweeps in Normal Sweep Mode

Constant Sweep Mode

In Constant Sweep mode, each sweep begins at a specified Constant Sweep time after the previous
sweep began. The Logic Window is executed in its entirety each sweep. If there is sufficient time at
the end of the sweep, the CPU alternates among the Controller Communications, Backplane
Communications, and Background Windows, allowing them to execute until it is time for the next
sweep to begin. Some or all of the Communications and Background Windows may not be executed.
The Communications and Background Windows terminate when the overall CPU sweep time has
reached the value specified as the Constant Sweep time.
One reason for using Constant Sweep mode is to ensure that I/O data are updated at constant
intervals.
The value of the Constant Sweep timer can be configured to be any value from 5 to 2550
milliseconds. The Constant Sweep timer value may also be set and Constant Sweep mode may be
enabled or disabled by the programming software or by the user program using Service Request
function #1. The Constant Sweep timer has no default value; a timer value must be set prior to or at
the same time Constant Sweep mode is enabled.
The Ethernet Global Data 13 page configured for either consumption or production can add up to 1
millisecond to the sweep time. This sweep impact should be taken into account when configuring the
CPU constant sweep mode and setting the CPU watchdog timeout.
If the sweep exceeds the Constant Sweep time in a given sweep, the CPU places an oversweep alarm
in the CPU fault table and sets the OV_SWP (%SA0002) status reference at the beginning of the next
sweep. Additional sweep time due to an oversweep condition in a given sweep does not affect the
time given to the next sweep.
The following figure illustrates four successive sweeps in Constant Sweep mode with a Constant
Sweep time of 100 milliseconds. Note that the total sweep time is constant, but an oversweep may
occur due to the Logic Window taking longer than normal.
SWEEP n SWEEP n+1 SWEEP n+2 SWEEP n+3
t = 0 ms t = 100 ms t = 220 ms t = 320 ms
HK HK HK HK
INPUT INPUT INPUT INPUT
LOGIC LOGIC LOGIC LOGIC
OUTPUT
Constant OUTPUT
CC
Sweep CC
Time OUTPUT
BPC
CC BPC
BPC BG
BG
SYS
SYS BG
BG
Abbreviations:
20 ms oversweep
HK = Housekeeping OUTPUT
PRG = Programmer Window.
BPC = Backplane Communications Window.
Figure 9: Typical Sweeps in Constant Sweep Mode
13For EGD configured on Embedded Ethernet interface of CPE305/CPE310, refer to A.3.6 for Constant sweep
impact.

Constant Window Mode

In Constant Window mode, each sweep can consume a variable amount of time. The Logic Window
is executed in its entirety each sweep. The CPU alternates among the three windows, allowing them
execute for a time equal to the value set for the Constant Window timer. The overall CPU sweep time
is equal to the time required to execute the Housekeeping, Input Scan, Logic Window, and Output
Scan phases of the sweep plus the value of the Constant Window timer. This time may vary due to
sweep-to-sweep variances in the execution time of the Logic Window.
An application that requires a certain amount of time between the Output Scan and the Input Scan,
permitting inputs to settle after receiving output data from the program, would be ideal for Constant
Window mode.
The value of the Constant Window timer can be configured to be any value from 3 to 255
milliseconds. The Constant Window timer value may also be set by the programming software or by
the user program using Service Request functions #3, #4, and #5.
The following figure illustrates three successive sweeps in Constant Window mode. Note that the
total sweep times may vary due to sweep-to-sweep variations in the Logic Window, but the time
given to the Communications and Background Windows is constant. Some of the Communications or
Background Windows may be skipped, suspended, or run multiple times based on the Constant
Window time.
SWEEP n SWEEP n+1 SWEEP n+2
HK HK HK
INPUT INPUT INPUT
LOGIC LOGIC LOGIC
OUTPUT
CC
OUTPUT
CC BPC
BPC OUTPUT
BG BG CC
CC CC
SYS Constant
Window
BG Time
Abbreviations: BPC
HK = Housekeeping
BPC = Backplane Communications Window
Figure 10: Typical Sweeps in Constant Window Mode

4.2. Program Scheduling Modes

The CPU supports one program scheduling mode: the Ordered mode. An ordered program is
executed in its entirety once per sweep in the Logic Window.

4.3. Window Modes

The previous section describes the phases of a typical CPU sweep. The Controller Communications,
Backplane Communications, and Background windows can be run in various modes, based on the
CPU sweep mode. (CPU sweep modes are described in detail on page 72.) The following three
window modes are available:
Run-to- In Run-to-Completion mode, all requests made when the window has started
Completion are serviced. When all pending requests in the given window have completed,
the CPU transitions to the next phase of the sweep. (This does not apply to the
Background window because it does not process requests.)
Constant In Constant Window mode, the total amount of time that the Controller
Communications window, Backplane Communications window, and
Background window run is fixed. If the time expires while in the middle of
servicing a request, these windows are closed, and communications will be
resumed the next sweep. If no requests are pending in this window, the CPU
cycles through these windows the specified amount of time polling for further
requests. If any window is put in constant window mode, all are in constant
window mode.
Limited In Limited mode, the maximum time that the window runs is fixed. If time expires
while in the middle of servicing a request, the window is closed, and
communications will be resumed the next time that the given window is run. If
no requests are pending in this window, the CPU proceeds to the next phase of
the sweep.

4.4. Data Coherency in Communications Windows

When running in Constant or Limited Window mode, the Controller and Backplane Communications
Windows may be terminated early in all CPU sweep modes. If an external device, such as CIMPLICITY
HMI, is transferring a block of data, the coherency of the data block may be disrupted if the
communications window is terminated prior to completing the request. The request will complete
during the next sweep; however, part of the data will have resulted from one sweep and the
remainder will be from the following sweep. When the CPU is in Normal Sweep mode and the
Communications Window is in Run-to-Completion mode, the data coherency problem described
above does not exist.
Note: External devices that communicate to the CPU while it is stopped will read information as it
was left in its last state. This may be misleading to operators viewing an HMI system that
does not indicate CPU Run/Stop state. Process graphics will often indicate everything is still
operating normally.
Also, note that non-retentive outputs do not clear until the CPU is changed from Stop to Run.

4.5. Run/Stop Operations

The PACSystems CPUs support four run/stop modes of operation. You can change these modes in
the following ways: the Run/Stop switch, configuration from the programming software, LD function
blocks, and system calls from C applications. Switching to and from various modes can be restricted
based on privilege levels, position of the Run/Stop switch, passwords, etc.
Mode Operation
Run/Output The CPU runs user programs and continually scans inputs and updates physical
s Enabled outputs, including Genius and Ethernet outputs. The Controller and Backplane
Communications Windows are run in Limited, Run-to-Completion, or Constant mode.
Run/Output The CPU runs user programs and continually scans inputs, but updates to physical
s Disabled outputs, including Genius and Field Control, are not performed. Physical outputs are
held in their configured default state in this mode. The Controller and Backplane
Communications Windows are run in Limited, Run-to-Completion, or Constant mode.
Stop/IO The CPU does not run user programs, but the inputs and outputs are scanned. The
Scan Controller and Backplane Communications Windows are run in Run-to-Completion
Enabled mode. The Background Window is limited to 10ms.
Stop/IO The CPU does not run user programs, and the inputs and outputs are not scanned.
Scan The Controller and Backplane Communications Windows are run in a Run-to-
Disabled Completion mode. The Background Window is limited to 10ms.
Note: Stop mode I/O scanning is always disabled for redundancy CPUs.
Note: You cannot add to the size of %P and %L reference tables in Run Mode unless the %P and %L
references are the first of their type in the block being stored or the block being stored is a
totally new block.
4.5.1 CPU Stop Modes
The CPU has two modes of operation while it is in Stop mode:
 I/O Scan Enabled - the Input and Output scans are performed each sweep
 I/O Scan Disabled - the Input and Output scans are skipped
When the CPU is in Stop mode, it does not execute the application program. You can configure
whether the I/O is scanned during Stop mode. Communications with the programmer and intelligent
option modules continue in Stop mode. Also, bus receiver module polling and rack reconfiguration
continue in Stop mode.
In both Stop modes, the Controller Communications and Backplane Communications windows run in
Run-to-Completion mode and the Background window runs in Limited mode with a 10 millisecond
limit.
The number of last scans can be configured in the hardware configuration. Last scans are completed
after the CPU has received an indication that a transition from Run to Stop or Stop Faulted mode
should occur. The default is 0.
SVCREQ13 can be used in the application program to stop the CPU after a specified number of scans.
All I/O will go to their configured default states, and a diagnostic message will be placed in the CPU
Fault Table.

Start-of-Sweep
Housekeeping
Executes in
Input Scan Stop-I/O Scan Enabled
mode only
Executes in
Output Scan Stop-I/O Scan Enabled
mode only
Controller Runs
Communications to
Window completion
Backplane Runs
Communications to
Window Completion
Limited
Background Task
(10ms)
Window
Figure 11: CPU Sweep in Stop-I/O Disabled and Stop-I/O Enabled Modes
4.5.2 Stop-to-Run Mode Transition

The CPU performs the following operations on Stop-to-Run transition:
 Validation of sweep mode and program scheduling mode selections
 Validation of references used by programs with the actual configured sizes
 Re-initialization of data areas for external blocks and standalone C programs
 Clearing of non-retentive memory
4.5.3 Run/Stop Mode Switch Operation

The Run/Stop mode switch has three positions:
Switch Position CPU and Sweep Mode Memory Protection
Run I/O Enable The CPU runs with I/O sweep enabled. User program memory is read only.
Run Output Disable The CPU runs with outputs disabled. User program memory is read only.
Stop The CPU is not allowed to go into Run mode. User program memory can be written.
The Run/Mode switch can be disabled in the programming software HWC. The memory protection
function of the switch can be disabled separately in HWC. The Run/Mode switch is enabled by
default. The memory protection functionality is disabled by default.
The Read Switch Position (Switch_Pos) function allows the logic to read the current position of the
Run/Stop switch, as well as the mode for which the switch is configured. For details, refer to Chapter
7.

4.6. Flash Memory Operation

The CPU stores the current configuration and application in user memory (either battery-backed RAM
or non-volatile user memory, depending on the CPU model). You can also store the Logic, Hardware
Configuration, and Reference Data into non-volatile flash memory. The PACSystems CPU provides
enough flash memory to hold all of user space, all reference tables that aren't counted against user
space, and any overhead required. For details on which items count against user memory space,
refer to Appendix B.
By default, the CPU reads program logic and configuration, and reference table data from user
memory at power-up. However, logic/configuration and reference tables can each be configured to
always read from flash or conditionally read from flash. To configure these parameters in the
programming software, select the CPU’s Settings tab in Hardware Configuration.
If logic/configuration and/or reference tables are configured for conditional power-up from flash,
these items are restored from flash to user memory when the user memory is corrupted or was not
preserved (for example, the memory backup battery or Energy Pack is not installed or not
operational). If logic/configuration and/or reference memory are configured for conditional power-up
from flash and user memory has been preserved, no flash operation will occur.
If logic/configuration and/or reference tables are configured to always power up from flash, these
items are restored from flash to user memory regardless of the state of the user memory.
Note: If any component (logic/configuration or reference tables) is read from flash, OEM-mode and
passwords are also read from flash.
In addition to configuring where the CPU obtains logic, configuration, and data during power-up, the
programming software provides the following flash operations:
 Write a copy of the current configuration, application program, and reference tables (excluding
overrides) to flash memory. Note that a write-to-flash operation causes all components to be
stored to flash.
 Read a previously stored configuration and application program, and/or reference table values
from flash into user memory.
 Verify that flash and user memory contain identical data.
 Clear flash contents.
Flash read and write operations copy the contents of flash memory or user memory as individual
files. The programming software displays the progress of the copy operation and allows you to
cancel a flash read or write operation during the copy process instead of waiting for the entire
transfer process to complete. The entire user memory image must be successfully transferred for the
flash copy to be considered successful. If an entire write-to-flash transfer is not completed due to
canceling, power cycle, or some other intervention, the CPU will clear flash memory. Similarly, if a
read-from-flash transfer is interrupted, user memory will be cleared.

4.7. Logic/Configuration Source and CPU Operating Mode at

Power-up
Flash and user memory can contain different values for the Logic/Configuration Power-up Source
parameter. The following tables summarize how these settings determine the logic/configuration
source after a power cycle. CPU mode is affected by the
Power-up Mode, Run/Stop Switch and Stop-Mode I/O Scanning parameters, Run/Stop mode switch
position, and the power down mode as shown in the tables on page 82.
Before Power Cycle After Power Cycle
Logic/Configuration
Logic/Configuration Origin of
Power-up Source CPU Mode
Power-up Source in RAM Logic/Configuration
in Flash
Always Flash Memory not preserved Flash See “
(i.e. no battery/Energy Pack,
or memory corrupted) CPU Mode when Memory Not
Preserved/Power-up Source is
Flash” on page 82.
Always Flash No configuration in RAM, Flash See ”CPU Mode when Memory
memory Preserved” on page 82.
preserved
Always Flash Always Flash Flash
Always Flash Conditional Flash Flash
Always Flash Always RAM Flash
Conditional Flash Memory not preserved Flash See “
(i.e. no battery/Energy Pack
or memory corrupted) CPU Mode when Memory Not
Preserved/Power-up Source is
Flash” on page 82.
Conditional Flash No configuration in RAM, Uses default Stop Disabled
memory logic/configuration
preserved
Conditional Flash Always Flash RAM See ”CPU Mode when Memory
Conditional Flash Conditional Flash RAM Preserved” on page 82.
Conditional Flash Always RAM RAM
Always RAM Memory not preserved Uses default Stop Disabled
(i.e. no battery/Energy Pack, logic/configuration
or memory corrupted)
Always RAM No configuration in RAM, Uses default Stop Disabled
memory logic/configuration
preserved
Always RAM Always Flash Flash See ”CPU Mode when Memory
Always RAM Conditional Flash RAM Preserved” on page 82.
Always RAM Always RAM RAM
No Configuration in Flash Memory not preserved Uses default Stop Disabled
(i.e. no battery/Energy Pack, logic/configuration
or memory corrupted)
No Configuration in Flash No configuration in RAM, Uses default Stop Disabled
memory preserved logic/configuration
No Configuration in Flash Always Flash RAM See ”CPU Mode when Memory

Before Power Cycle After Power Cycle

Logic/Configuration
Logic/Configuration Origin of
Power-up Source CPU Mode
Power-up Source in RAM Logic/Configuration
in Flash
No Configuration in Flash Conditional Flash RAM Preserved” on page 82.
No Configuration in Flash Always RAM RAM
4.7.1 CPU Mode when Memory Not Preserved/Power-up Source is Flash

Configuration Parameters
Power-up Mode Run/Stop Switch Run/Stop Switch Position CPU Mode
Run Enabled Stop Stop Disabled
Run Enabled Run Disabled Run Disabled
Run Enabled Run Enabled Run Enabled
Run Disabled N/A Run Disabled
Stop N/A N/A Stop Disabled
Last Enabled Stop Stop Disabled
Last Enabled Run Disabled Run Disabled
Last Enabled Run Enabled Run Disabled
Last Disabled N/A Run Disabled
4.7.2 CPU Mode when Memory Preserved

Configuration Parameters
Power-up Run/Stop Stop-Mode I/O Scanning Run/Stop Switch Power Down CPU Mode
Mode Switch Position Mode
Run Enabled Enabled Stop N/A Stop Enabled
Run Enabled Disabled Stop N/A Stop Disabled
Run Enabled N/A Run Disabled N/A Run Disabled
Run Enabled N/A Run Enabled N/A Run Enabled
Run Disabled N/A N/A N/A Run Enabled
Stop N/A Enabled N/A N/A Stop Enabled
Stop N/A Disabled N/A N/A Stop Disabled
Last Enabled Enabled Stop Stop Disabled Stop Disabled
Last Enabled Enabled Stop Stop Enabled Stop Enabled
Last Enabled Enabled Stop Run Disabled Stop Enabled
Last Enabled Enabled Stop Run Enabled Stop Enabled
Last Enabled Disabled Stop N/A Stop Disabled
Last Enabled N/A Run Disabled Stop Disabled Stop Disabled
Last Enabled Enabled Run Disabled Stop Enabled Stop Enabled
Last Enabled Disabled Run Disabled Stop Enabled Stop Disabled
Last Enabled N/A Run Disabled Run Disabled Run Disabled
Last Enabled N/A Run Disabled Run Enabled Run Disabled
Last Enabled N/A Run Enabled Stop Disabled Stop Disabled
Last Enabled Enabled Run Enabled Stop Enabled Stop Enabled
Last Enabled Disabled Run Enabled Stop Enabled Stop Disabled
Last Enabled N/A Run Enabled Run Disabled Run Disabled
Last Enabled N/A Run Enabled Run Enabled Run Enabled

Last Disabled N/A N/A Stop Disabled Stop Disabled

Last Disabled Enabled N/A Stop Enabled Stop Enabled
Last Disabled Disabled N/A Stop Enabled Stop Disabled
Last Disabled N/A N/A Run Disabled Run Disabled
Last Disabled N/A N/A Run Enabled Run Enabled

4.8. Clocks and Timers

Clocks and timers provided by the CPU include an elapsed time clock, a time-of-day clock, and
software and hardware watchdog timers.
For information on timer functions and timed contacts provided by the CPU instruction set, see
“Timers and Counters” in Chapter 8.
4.8.1 Elapsed Time Clock
The elapsed time clock tracks the time elapsed since the CPU powered on. The clock is not retentive
across a power failure; it restarts on each power-up. This seconds count rolls over (seconds count
returns to zero) approximately 100 years after the clock begins timing.
Because the elapsed time clock provides the base for system software operations and timer function
blocks, it may not be reset from the user program or the programmer. However, the application
program can read the current value of the elapsed time clock by using Service Request #16 or
Service Request #50, which provides higher resolution.
4.8.2 Time-of-Day Clock
A hardware time-of-day clock maintains the time of day (TOD) in the CPU. The time-of-day clock
maintains the following time functions:
 Year (two digits)
 Month
 Day of month
 Hour
 Minute
 Second
 Day of week
The TOD clock is battery-backed and maintains its present state across a power failure. The time-of-
day clock handles month-to-month and year-to-year transitions and automatically compensates for
leap years through year 2036.
You can read and set the hardware TOD time and date through the application program using
Service Request function #7. For details, see Chapter 9.
High-Resolution Time of Day Software Clock
A high-resolution software TOD clock is implemented in firmware to provide nanoseconds resolution.
When the high-resolution software TOD clock is set, the hardware TOD clock is set with the YYYY:
Mon: Day: Hr: Min: Sec fields in the POSIX time, the RTC is read, and the delta between the POSIX time
and the value read from the RTC is computed and saved. Thus, if 1-second resolution is desired the
hardware TOD clock is read. Otherwise, the high-resolution software TOD clock is read to provide
greater resolution. When the latter occurs, the hardware RTC is read and the saved delta added to
the value read.
When the SNTP Time Transfer feature is implemented, all SNTP time updates received at the CPU will
cause the high-resolution software TOD clock to be updated.

Synchronizing the High-resolution Time of Day Clock to an SNTP Network Time Server
In an SNTP system, a computer on the network (called an SNTP server) sends out a periodic timing
message to all SNTP-capable Ethernet Interfaces on the network, which synchronize their internal
clocks with this SNTP timing message. If SNTP is used to perform network time synchronization, the
time-stamp information typically has ±10ms accuracy between controllers on the same network.
Synchronizing the CPU TOD clock to an SNTP server allows you to set a consistent time across
multiple systems. Once the CPU TOD clock has been synchronized with the SNTP time, all produced
EGD exchanges will use the CPU TOD current value for the time-stamp.
The CPU TOD clock is set with accuracy within ±2ms of the SNTP time-stamp.
TOD clock synchronization is enabled on an Ethernet module by the advanced user parameter (AUP),
ncpu_sync. The CPU must also use a COMMREQ in user logic to select an Ethernet module as the time
master. For additional information, refer to “Time-stamping of Ethernet Global Data Exchanges” in
Chapter 4 of TCP/IP Communications for PACSystems, GFK-2224.
4.8.3 Watchdog Timer
Software Watchdog Timer
A software watchdog timer in the CPU is designed to detect “failure to complete sweep” conditions.
The timer value for the software watchdog timer is set by using the programming software. The
allowable range for this timer is 10 to 2550 milliseconds; the default value is 200 milliseconds. The
software watchdog timer always starts from zero at the beginning of each sweep.
The software watchdog timer is useful in detecting abnormal operation of the application program
that prevents the CPU sweep from completing within the user-specified time. Examples of such
abnormal application program conditions are as follows:
 Excessive recursive calling of a block
 Excessive looping (large loop count or large amounts of execution time for each iteration)
 Infinite execution loop
When selecting a software watchdog value, always set the value higher than the longest expected
sweep time to prevent accidental expiration. For Constant Sweep mode, allowance for oversweep
conditions should be considered when selecting the software watchdog timer value.
Refer to the Appendix A-3.6 for EGD Sweep impact and EGD processor utilization for EGD exchanges
configured on Embedded Ethernet interface of the CPE305/310.
The watchdog timer continues during interrupt execution. Queuing of interrupts within a single
sweep may cause watchdog timer expiration.
If the software watchdog timeout value is exceeded, the OK LED blinks, and the CPU goes to Stop-
Halt mode. Certain functions, however, are still possible. A fault is placed in the CPU fault table, and
outputs go to their default state. The CPU will only communicate with the programmer; no other
communications or operations are possible. To recover, power must be cycled on the rack or
backplane containing the CPU.
To extend the current sweep beyond the software watchdog timer value, the application program
may restart the software watchdog timer using Service Request function #8. However, the software
watchdog timer value may only be changed from the configuration software.
Note that Service Request Function #8 does not reset the output scan timer implemented on the
Genius Bus Controller.

CPE3xx CPU models only: The programmer can connect to these CPUs in Stop-Halt mode through
the embedded Ethernet port without a reset or power cycle.
Hardware Watchdog Timer
A backup circuit provides additional protection for the CPU. If this backup circuit activates, the CPU is
immediately placed in Reset mode. Outputs go to their default state and no communications of any
form are possible, and the CPU will halt.
RX3i CPE3xx CPUs Response to a Hardware Watchdog Timeout:
 The CPE3xx automatically restarts and goes into Stop-Halt mode.
 The CPE3xx retains fault tables after a hardware watchdog timeout.
 While the CPE3xx is in Stop-Halt mode, you can connect the programmer software or PACs
Analyzer to view the fault tables, including all faults logged before the timeout. (The PACS
Analyzer software can be downloaded from the Support website.)
 The CPE3xx does not retain Controller and I/O Fault tables following recovery from the Stop-Halt
state. To recover from Stop-Halt mode and return to normal operation, all non-volatile memory
must be cleared. This can be done by disconnecting the Energy Pack and power cycling the
CPE3xx. If power cycled with the Energy Pack connected, the CPE3xx returns to Stop-Halt mode
and retains all non-volatile memory, including fault tables.
 During startup following hardware watchdog reset, the CPE3xx logs an informational fault with
Error Code 446, which indicates a watchdog auto-reset occurred.
All other RX3i and RX7i CPUs’ Response to a Hardware Watchdog Timeout:
The CPU goes to Reset mode. To recover, power must be cycled.
Note: PACSystems does not support Fatal Fault Retries.

4.9. System Security

The PACSystems CPU supports two types of system security:
 Passwords/privilege levels
 OEM protection
CPU versions 7.80 and later support Enhanced Security (including merged password tables). This
provides a more secure mechanism for setting and authenticating passwords and OEM keys versus
the Legacy Security Mode. Refer to the Important Product Information document for the CPU model
and firmware version that you are using.
For Enhanced Security operation, see page 89. A summary of operational differences between
Enhanced and Legacy Security modes is provided on page 90.
4.9.1 Passwords and Privilege Levels - Legacy Mode
Passwords are a configurable feature of the PACSystems CPU. Their use is optional and is set up
using the programming software. Passwords provide different levels of access privilege for the CPU
when the programmer is Online. Passwords are not used if the programmer is in Offline mode.
The default state is no password protection. Each privilege level in the CPU may have a unique
password; however, the same password can be used for more than one level. Passwords can be
changed only through the programming software.
Passwords are one to seven ASCII characters in length.
After passwords have been set up, access to the CPU via any communications path is restricted from
the levels at which the passwords are set, unless the proper password has been entered. Once a
password has successfully been accepted, access to the highest privilege level requested and below
is granted (for example, providing the password for level 3 allows access to functions at levels 1, 2,
and 3).
Note: The Run Mode switch on the CPU overrides password protection. Even though the
programmer may not be able to switch between Run and Stop mode, the switch on the CPU
can do so.
Privilege Levels
Level Password Access Description
4 Yes Write to configuration or logic. Configuration may only be written in Stop mode; logic may
be written in Stop or Run mode. Set or delete passwords for any level.
Note: This is the default privilege for a connection to the CPU if no passwords are defined.
3 Yes Write to configuration or logic when the CPU is in Stop mode, including word-for-word
changes, addition/deletion of program logic, and the overriding of discrete I/O.
2 Yes Write to any data memory. This does not include overriding discrete I/O. The CPU can be
started or stopped. CPU and I/O Fault Tables can be cleared.
1 Yes Read any CPU data except for passwords. This includes reading fault tables, performing
datagrams, verifying logic/configuration, loading program and configuration, etc. from the
CPU. None of this data may be changed. At this level, Run/Stop mode transitions from the
programmer are not allowed.

Protection Level Request from Programmer

In Legacy mode, upon connection to the CPU, the programmer requests the CPU to move to the
highest non-protected level.
The programmer requests a privilege level change by supplying the new privilege level and the
password for that level. If the password sent by the programmer does not agree with the password
stored in the CPU’s password access table for the requested level, the privilege level change is denied
and a fault is logged in the CPU fault table. The current privilege level is maintained, and no change
occurs. A request to change to a privilege level that is not password protected is made by supplying
the new level and a null password. A privilege change may be to a lower level as well as to a higher
level.
Maintaining Passwords through a Power Cycle
Initial passwords are blank for a new controller or a controller that has its passwords cleared. For
passwords to be maintained through power cycles, the controller must either:
Store to RAM and use an Energy Pack or battery to maintain memory.
Store to User Flash with configuration set up to load from Flash at power up.
Disabling Passwords
The use of password protection is optional. Passwords can be disabled using the programming
software.
Note: To enable passwords after they have been disabled, the CPU must be power cycled with the
battery or Energy Pack removed.
4.9.2 OEM Protection – Legacy Mode
Original Equipment Manufacturer (OEM) protection provides a higher level of security than password
levels 1 through 4. This feature allows a third-party OEM to create control programs for the CPU and
then set the OEM-locked mode, which prevents the end user from reading or modifying the program.
The OEM protection feature is enabled/disabled using a 1 to 7 character password, known as the
OEM key. When OEM protection is enabled, all read and write access to the CPU program and
configuration is prohibited: any store, load, verify, or clear user program operation will fail.
OEM Protection in Systems that Load from Flash Memory

For OEM protection, it is recommended to store the program to User Flash and set configuration to
always load from Flash. When setting up OEM protection it is important to download the user
program to RAM and User Flash before enabling the OEM protection. For example, the following
steps can be used to set up OEM protection.
1. Set OEM Key password (Must be at Access Level 4 to set OEM Key)
2. Download program to both RAM and User Flash.
3. Set OEM Protection to the Locked state (see firmware note below).
If you are storing a non-blank OEM key to flash memory, you should be careful to record the OEM key
for future reference. If disabling OEM protection, be sure to clear the OEM key that is stored in flash
memory.
Note: In CPU firmware versions 7.80 or later which support Enhanced Security (with merged
password tables), OEM Protection Lock must be explicitly set.

In earlier versions, the OEM Protection could be enabled in User Flash without explicitly
setting the OEM Protection to Locked. With the earlier firmware, a non-blank OEM Key that is
loaded from User Flash at power-up would result in an automatic OEM Lock. In CPU firmware
versions 7.80 or later (i.e. with merged passwords), this is no longer supported.
In firmware versions earlier than 6.01, the OEM protection was not preserved unless a battery
was attached.
4.9.3 Enhanced Security for Passwords and OEM Protection
Enhanced Security passwords are supported by CPU firmware versions 7.80 or later. This feature
provides a cryptographically secure password protocol between an SRTP client (for example Proficy
Machine Edition) and a PACSystems controller. Enhanced Security passwords operate in a very
similar fashion to the Legacy security password operation that is supported by previous firmware
releases.
Enhanced Security passwords are enabled in Proficy Machine Edition 14. PME requires a password in
order to enable/disable the Enhanced Security mode of a target. This PME password restricts
changes to the security mode used by a specific PME target and is independent of any passwords
later configured on the controller.
Enabling Enhanced Security on a target does not force the controller to use only Enhanced Security.
The controller supports both Legacy and Enhanced Security requests concurrently. For example, one
PME target could be used to set initial passwords with Legacy security and a different PME target
with Enhanced Security could connect and authenticate with the same controller.
Passwords set with one password mechanism (Legacy or Enhanced Security) can be authenticated
and changed using the other mechanism, as long as the password is 7 characters or less. Setting
passwords with Enhanced Security that are greater than 7 characters prevents access using the
Legacy mechanism. For example, you could use Enhanced Security to set a 10 character password
for Level 4 and Level 3, but set a 7 character password for Level 2. In this case, a Legacy target could
be used to obtain Level 2 access, but the Legacy target could never access Level 4 or Level 3
because of 7-character limit of the Legacy scheme.
Password and OEM Protection in Systems that Load from Flash Memory
Caution
Be careful when setting passwords and loading passwords
from User Flash on every power-up. In this situation, it is not
possible to clear passwords back to a default state if the
Level 4 password and OEM key are forgotten.
For a recommended procedure, see “OEM Protection in Systems that Load from Flash Memory” on
page 88.
14 To determine the required Proficy Machine Edition version, refer to the Important Product Information (IPI)
document provided with the CPU firmware version you are using.

4.9.4 Legacy/Enhanced Security Comparison

Feature Legacy (less secure) Enhanced (more secure)
Level 2, 3 and 4 protection Levels 2, 3 and 4 must be set or Passwords can be set individually or
modified simultaneously. (If you only in a group. When changing
want to change one, you must enter passwords, the old password for
all three.) that level is required in order to
change it.
Maximum password length 7 characters 31 characters
Clearing passwords Passwords can be cleared back to Once a password is set, the
initial blank password values. Enhanced Security mode in PME will
not allow it to be cleared back to a
blank password. To revert to a blank
password, the CPU memory must be
cleared and power cycled.
Passwords ≤7 characters, Password verification and password Password verification and password
set with either mode changes allowed. changes allowed.
Passwords >7 characters, Password verification and password Password verification and password
set with Enhanced Security changes not allowed. changes allowed.
mode
Maximum OEM key length 7 characters. 31 characters.
OEM keys ≤7 characters, Can change OEM Protection Lock state Can change OEM Protection Lock
set with Enhanced Security Cannot change the OEM key. state and the OEM key.
OEM keys >7 characters, Cannot change OEM Protection Lock Can change OEM Protection Lock
set with Enhanced Security state or the OEM key. state and the OEM key.

4.10. PACSystems I/O System

The PACSystems I/O system provides the interface between the CPU and other devices. The
PACSystems I/O system supports:
■ I/O and Intelligent option modules.
■ Ethernet Interface
■ Motion modules (RX3i)
■ The Genius I/O system (RX7i). A Genius I/O Bus Controller (GBC) module provides the interface
between the RX7i CPU and a Genius I/O bus.
4.10.1 I/O Configuration
Module Identification
In addition to the catalog number, the programming software stores a Module ID for each configured
module in the hardware configuration that it delivers to the CPU. The CPU uses the Module ID to
determine how to communicate with a given module.
When the hardware configuration is downloaded to the CPU (and during subsequent power-ups), the
CPU compares the Module IDs stored by the programmer with the IDs of the modules physically
present in the system. If the Module IDs do not match, a System Configuration Mismatch fault will be
generated.
Because I/O modules of similar type may share the same Module ID, it is possible to download a
configuration containing a module catalog number that does not match the module that is physically
present in the slot without generating a System Configuration Mismatch.
Certain discrete modules with both reference memory inputs and reference memory outputs will
experience invalid I/O transfer if incorrect configuration is stored from a similar mixed I/O module. No
fault or error condition will be detected during configuration store and the module will be
operational, although not in the manner described by configuration.
For example, a configuration swap between the IC693MDL754 output module and IC693MDL660
input module will not be detected as a configuration mismatch, but I/O data transfer between the
module and the CPU reference memory will be invalid. If the input module (MDL660) is sent the
configuration of the output module (MDL754) with the following parameters:
Reference Address: %Q601
Module Status Reference: %I33
Hold Last State Enable
It will receive inputs at the module status reference %I33 and the status of the module will be
received at %Q601.
If the output module is sent the configuration of the input module with the following parameters:
Reference Address: %I601
Input Filter: Enable
Digital Filter Settings Reference: %I65
It will output values at the digital filter settings reference %I65 and the status of the module will be
received at %I601.

Default Conditions for I/O Modules

Interrupts
Some input modules can be configured to send an interrupt to the application program. By default,
this interrupt is disabled and the input filter is set to slow. If changed by the programming software,
the new settings are applied when the configuration is stored and during subsequent power-cycles.
Outputs
Some output modules have a configurable output default mode that can be specified as either Off or
Hold Last State. If a module does not have a configurable output default mode, its output default
mode is Off. The selected action applies when the CPU transitions from Run/Enabled to Run/Disabled
or Stop mode, or experiences a fatal fault.
At power-up, Series 90-30 discrete output modules default to all outputs off. They will retain this
default condition until the first output scan from the PACSystems controller. Analog output modules
can be configured with a jumper located on the removable terminal block of the module. The jumper
may be set to cause outputs to either “default to zero” or “retain last state”.
Inputs
Input modules that have a configurable input default mode can be configured to Hold Last State or
to set inputs to 0. If a module does not have a configurable input default mode, its input default
mode is Off. The selected action applies when the CPU transitions from Run/Enabled to Run/Disabled
or Stop mode, or experiences a fatal fault.
For details on the power-up and stop mode behavior of other modules, refer to the documentation
for that module.
Multiple I/O Scan Sets
Up to 32 I/O scan sets can be defined for a PACSystems CPU. A scan set is a group of I/O modules
that can be assigned a unique scan rate. A given I/O module can belong to one scan set. By default,
all I/O modules are assigned to scan set 1, which is scanned every sweep.
For some applications, the CPU logic does not need to have the I/O information every sweep. The I/O
scan set feature allows the scanning of I/O points to be more closely scheduled with their use in user
logic programs. If you have a large number of I/O modules, you may be able to significantly reduce
scan time by staggering the scanning of those modules.
A disadvantage of placing all modules into different scan sets appears when the CPU is transitioning
from Stop to Run. In that case, scan sets with a programmed delay are not scanned on the first
sweep. These modules' outputs are not enabled until the new data has been scanned to them,
perhaps many scans later. Therefore there is a period of time during which the user logic is executing
and some modules' outputs are disabled. During that time, outputs of those modules are in the
module’s stop-mode state. Stop-mode behavior is module-dependent. Some modules zero their
outputs, some hold their last scanned state (if any), and some force their outputs to a configured
default value. When the module's outputs are enabled, the module uses the last scanned value,
which will either be zero or the contents of the register the module uses to hold the corresponding
output values from the reference tables.

4.10.2 Genius I/O

The Genius Bus Controller (GBC) controls a single Genius I/O bus. Any type of Genius I/O device may
be attached to the bus.
In the I/O Fault Table, the rack, slot, bus, module, and I/O point number are given for a fault. Bus
number one refers to the bus on the single-channel GBC.
Genius I/O Configuration
The programming software can configure a subset of the parameters associated with Genius I/O
blocks.
Genius I/O blocks have a number of parameters that can be set using the Genius I/O Hand-Held
Monitor. These parameter values are stored in EEPROM in the block itself. The serial bus address (SBA)
and baud rate must be set using the Genius I/O Hand-Held Monitor. For specific information on
Genius I/O block types, configuration, and setup, refer to the Genius I/O System User’s Manuals, GEK-
90486-1 and -2.
Through the COMMREQ function block, the application program can request the GBC to change any
default condition on a specific block. However, the block only accepts this change if it is not in Config
Protect mode. If Config Protect mode is set, only the Hand-Held Monitor can be used to change the
defaults. The format of the COMMREQ function block for Genius I/O is described in the Series 90-70
Genius Bus Controller User’s Manual, GFK-2017 and the Series 90-30 Genius Bus Controller User’s
Manual, GFK-1034.
Genius I/O Data Mapping
Genius I/O discrete inputs and outputs are stored as bits in the CPU Bit Cache memory. Genius I/O
analog data is stored in the application RAM allocated for that purpose (%AI and %AQ). Analog data
is always stored one channel per one word (16 bit).
An analog grouped module consumes (in the input and output data memories) only the amount of
data space required for the actual inputs and outputs. For example, the Genius I/O 115 VAC Grouped
Analog Block, IC660CBA100, has four inputs and two outputs. It consumes four words of Analog Input
memory (%AI) and two words of Analog Output memory.
A discrete grouped module, each point of which is configurable with the Hand-Held Monitor (HHM) to
be input, output, or output with feedback, consumes an amount in both discrete input memory (%I)
and discrete output memory (%Q) equal to its physical size. Therefore, the eight-point Discrete
Grouped Block (IC660CBD100) requires eight bits in the %I memory and eight bits in the %Q memory,
regardless of how each point on the block is configured.
Analog Grouped Block
The six-channel Analog Grouped block contains four analog input channels and two analog output
channels. When this block gets its turn on the Genius I/O Bus, it broadcasts the data for all four input
channels in one broadcast control message. Then, when the GBC gets its turn, it sends the data for
both output channels to the block in a directed control message.
Low-Level Analog Blocks
Unlike the Analog Grouped block, the low-level analog blocks, such as the Thermocouple and RTD
blocks, are input-only blocks. All have six channels.

Genius Global Data Communications

The PACSystems RX7i supports the sharing of data among multiple control systems that share a
common Genius I/O bus. This mechanism provides a means for the automatic and repeated transfer
of %G, %I, %Q, %AI, %AQ, %R, and %W data. No special application programming is required to use
global data since it is integrated into the I/O scan. Controllers that have Genius I/O capability can
send global data to an RX7i and can receive data from an RX7i. The programming software is used to
configure the receiving and transmitting of global data on a Genius I/O bus.
Note: Genius global data communications do not continue to operate when the RX7i CPU is in Stop-
I/O Scan Disabled mode. However, if the CPU is in Stop-I/O Scan Enabled mode, Genius global
data communications continue to operate.
4.10.3 I/O System Diagnostic Data Collection
Diagnostic data in a PACSystems I/O system is obtained in either of the following two ways:
 If an I/O module has an associated bus controller, the bus controller provides the diagnostic data
from that module to the CPU. For details on GBC faults, see “PACSystems Handling of GBC Faults”
on page 95.
 For I/O modules not interfaced through a bus controller, the CPU’s I/O Scanner subsystem
generates the diagnostic bits based on data provided by the module.
The diagnostic bits are derived from the diagnostic data sent from the I/O modules to their I/O
controllers (CPU or bus controller). Diagnostic bits indicate the current fault status of the associated
module. Bits are set when faults occur and are cleared when faults are cleared.
Diagnostic data is not maintained for modules from other manufacturers. The application program
must use the BUS Read function blocks to access diagnostic information provided by those boards.
Note: At least two sweeps must occur to clear the diagnostic bits: one scan to send the %Q data to
the module and one scan to return the %I data to the CPU. Because module processing is
asynchronous to the controller sweep, more than two sweeps may be needed to clear the
bits, depending on the sweep rate and the point at which the data is made available to the
module.
Discrete I/O Diagnostic Information
The CPU maintains diagnostic information for each discrete I/O point. Two memory blocks are
allocated in application RAM for discrete diagnostic data, one for %I memory and one for %Q
memory. One bit of diagnostic memory is associated with each I/O point. This bit indicates the
validity of the associated I/O data. Each discrete point has a fault reference that can be interrogated
using two special contacts: a fault contact (-[F]-) and a no-fault contact (-[NF]-). The CPU collects this
fault data if enabled to do so by the programming software. The following table shows the state of
the fault and no-fault contacts.
Condition [FAULT] [NOFLT]
Fault Present ON OFF
Fault Absent OFF ON

Analog I/O Diagnostic Data

Diagnostic information is made available by the CPU for each analog channel associated with analog
modules and Genius analog blocks. One byte of diagnostic memory is allocated to each analog I/O
channel. Since each analog I/O channel uses two bytes of %AI and %AQ memory, the diagnostic
memory is half the size of the data memory.
The analog diagnostic data contains both diagnostics and process data with the process data being
the High Alarm and Low Alarm bits. The diagnostic data is referenced with the -[F]- and -[NF]-
contacts. The process bits are referenced with the high alarm (-[HA]- and low alarm (-[LA]-) contacts.
The memory allocation for analog diagnostic data is one byte per word of analog input and analog
output allocated by programming software. When an analog fault contact is referenced in the
application program, the CPU does an Inclusive OR on all bits in the diagnostic byte, except the
process bits. The alarm contact is closed if any diagnostic bit is ON and OFF only if all bits are OFF.
PACSystems Handling of GBC Faults
Defaulting of input data associated with failed/lost GBCs
When a GBC is missing, mismatched, or otherwise failed, the CPU applies the Input Default setting for
each device on that Genius bus when defaulting the input data. If the device is configured for HOLD
LAST STATE, the data is left alone. If the device is configured for OFF, the input data is set to 0. If a
redundant GBC is operational, the input data is not affected.
Application of default input and diagnostic data for lost redundant blocks
When a GBC reports that a redundant block is lost, the CPU updates the input data tables and input
diagnostic tables with the default data during the very next input scan. The output diagnostic data
tables are updated during the very next output scan.

4.11. Power-Up and Power-Down Sequences

4.11.1 Power-Up Sequence
System power-up consists of the following parts:
 Power-up self-test
 CPU memory validation
 System configuration
 Intelligent option module self-test completion
 Intelligent option module dual port interface tests
 I/O system initialization
Power-Up Self-Test
On system power-up, many modules in the system perform a power-up diagnostic self-test. The CPU
module executes hardware checks and software validity checks. Intelligent option modules perform
setup and verification of on-board microprocessors, software checksum verification, local hardware
verification, and notification to the CPU of self-check completion. Any failed tests are queued for
reporting to the CPU during the system configuration portion of the cycle.
If a low or failed battery (or Energy Pack fault) indication is present, a fault is logged in the CPU fault
table.
CPU Memory Validation
The next phase of system power-up is the validation of the CPU memory. First, if the system verifies
that user memory areas are still valid. A known area of user memory is checked to determine if data
was preserved. Next, if a ladder diagram program exists, a checksum is calculated across the _MAIN
ladder block. If no ladder diagram program exists, a checksum is calculated across the smallest
standalone C program.
When the system is sure that the user memory is preserved, a known area of the bit cache area is
checked to determine if the bit cache data was preserved. If this test passes, the Bit Cache memory is
left containing its power-up values. (Non-retentive outputs are cleared on a transition from Stop to
Run mode.) If the checksum is not valid or the retentive test on the user memory fails, the bit cache
memory is assumed to be in error and all areas are cleared. The CPU is now in a cleared state, the
same as if a new CPU module were installed. All logic and configuration files must be stored from the
programmer to the CPU.
System Configuration
After completing its self-test, the CPU performs the system configuration. It first clears all system
diagnostic bits in the bit cache memory. This prevents faults that were present before power-down
but are no longer present from accidentally remaining as faulted. Then it polls each module in the
system for completion of the corresponding self-test.
The CPU reads information from each module, comparing it with the stored (downloaded) rack/slot
configuration information. Any differences between actual configuration and the stored
configuration are logged in the fault tables.
Intelligent Option Module Self-Test Completion
Intelligent option modules may take a longer time to complete their self-tests than the CPU due to
the time required to test communications media or other interface devices. As an intelligent option
module completes its initial self-tests, it tells the CPU the time required to complete the remainder of
these self-tests. During this time, the CPU provides whatever additional information the module

needs to complete its self-configuration, and the module continues self-tests and configuration. If the
module does not report back in the time it specified, the CPU marks the module as faulted and makes
an entry in one of the fault tables. When all self-tests are complete, the CPU obtains reports from the
module as generated during that particular module’s power-up self-test and places fault information
(if any) in the fault tables.
Intelligent Option Module Dual Port Interface Tests
After completion of the intelligent option module self-test and results reporting, integrity tests are
jointly performed on the dual-port interface used by the CPU and intelligent option module for
communications. These tests validate that the two modules are able to pass information back and
forth, as well as verify the interrupt and semaphore capabilities needed by the communications
protocol. After dual port interface tests are complete, the communications messaging system is
initialized.
I/O System Initialization
If the module is an input module, no further configuration is required. If the module is an output
module, the module is commanded to go to its default state. The output modules default to all
outputs off at power-up and in failure mode, unless configured otherwise.
A bus transmitter module is interrogated about what expansion racks are present in the system.
Based on the bus transmitter module’s response, the CPU adds those racks and their associated slots
into the list of slots to be configured.
Finally, the I/O Scanner performs its initialization. The I/O Scanner initializes all the I/O controllers in
the system by establishing the I/O connections to each I/O bus on the I/O controller and obtaining all
I/O configuration data from that I/O controller. This configuration data is compared with the stored
I/O configuration and any differences reported in the I/O Fault Table. The I/O Scanner then sends
each I/O controller a list of the I/O modules to be configured on the I/O bus. After the I/O controllers
have been initialized, the I/O Scanner replaces the factory default settings in all I/O modules with any
application-specified settings.
4.11.2 Power-Down Sequence
System power-down occurs when the power supply detects that incoming power has dropped for
more than 15ms.
4.11.3 Retention of Data Memory Across Power Failure
The following types of data are preserved across a power cycle with an operational battery (or for
CPE3xx, an Energy Pack):
 Application program
 Fault tables and other diagnostic data
 Checksums on programs and blocks
 Override data
 Data in register (%R), local register (%L), and program register (%P) memory
 Data in analog memory (%AI and %AQ)
 State of discrete inputs (%I)
 State of retentive discrete outputs (%Q)
 State of retentive discrete internals (%M)
The following types of data are not preserved across a power cycle:
 State of discrete temporary memory (%T)
 %M and %Q memories used on non-retentive -()- coils
 State of discrete system internals (system bits, fault bits, reserved bits)

Chapter 5 Program Organization
This chapter provides information about the operation of application programs in a PACSystems CPU.
■ Structure of the Application Program
■ Controlling Program Execution
■ Interrupt-Driven Blocks

Chapter 5. Program Organization
5.1. Structure of a PACSystems Application Program

A PACSystems application consists of one block-structured application program. The application
program contains all the logic needed to control the operations of the CPU and the modules in the
system. Application programs are created using the programming software and transferred to the
CPU. Programs are stored in the CPU’s non-volatile memory.
During the CPU Sweep (described in Chapter 4), the CPU reads input data from the modules in the
system and stores the data in its configured input memory locations. The CPU then executes the
entire application program once, using this fresh input data. Executing the application program
creates new output data that is placed in the configured output memory locations.
After the application program completes its execution, the CPU writes the output data to modules in
the system.
A block-structured program always includes a _MAIN block. Program execution begins with the
_MAIN block. Counting the _MAIN block, the program can contain up to 512 blocks.
5.1.1 Blocks
A block is a named section of executable logic that can be downloaded to and run on the target
controller. The logic in a block can include functions, function blocks and calls to other blocks.
5.1.2 Functions and Function Blocks
A function is a type of instruction that has no internal storage (instance data). Therefore, it produces
the same result for the same set of input values every time it executes.
A function block defines data as a set of inputs and output parameters that can be used as software
connections to other blocks and internal variables. It has an algorithm that runs every time the
function block is executed. Because a function block has instance data, that is it can store values, it
has a defined state.
The following table describes the types of instructions that make up the PACSystems instruction set.
Instruction Type Instance Data Examples
Functions None BIT_SEQ, ADD, RANGE
Built-in function blocks WORD array. TMR, PID_IND, PID_ISA
Standard function blocks Structure variable. (See “Instance TP, TOF, TON
Data Structures” on page 106.)
Note: A user defined function block (UDFB) is a block of logic that can be called in your program
logic to create multiple instances of the block, allowing you to create a block of logic once
and reuse it as if it was a standard function block instruction. For additional information, see
pages 101 and 105.
5.1.3 How Blocks Are Called
A block executes when called from the program logic in the
_MAIN block or another block. In this example, LD_BLK1 is always
called. Conditional logic can be used to control calling a block.
For LD_BLK2 to be called, input %I00500 and output %Q00100
must be ON. For details on using the Call function, refer to
Chapter 7 (LD programming), Chapter 8 (FBD programming) or
Chapter 11 (ST programming).
Figure 12: Example of Block Call

5.1.4 Nested Calls

The CPU allows nested block calls as long as there is enough execution stack space to support the
call. If there is not enough stack space to support a given block call, an “Application Stack Overflow”
fault is logged. In these circumstances, the CPU cannot execute the block. Instead, it sets all of the
block’s Boolean outputs to FALSE, and resumes execution at the point after the block call instruction.
Note: To halt the CPU when there is not enough stack space to execute a block, there are two
choices. The best method is to add logic to detect the occurrence of any User Application
Fault by testing the diagnostic bit %SA38, and then call SVC_REQ 13 to halt the CPU. An
alternative method is to add logic that tests for a negative OK value coming out of the block
and then call SVC_REQ 13 to halt the CPU.
A call depth of eight levels or more can be expected, except in rare cases where several of the called
blocks have very large numbers of parameters. The actual call depth achieved depends on several
factors, including the amount of data (non-Boolean) flow used in the blocks, the particular functions
called by the blocks, and the number and types of parameters defined for the blocks. If blocks use
less than the maximum amount of stack resources, more than eight nested calls may be possible.
The call level nesting counts the _MAIN block as level 1.
5.1.5 Types of Blocks
PACSystems supports four types of blocks.
Programming
Block Type Local Data Size Limit Parameters
Languages
LD
0 inputs
Block Has its own local data FBD 128 KB
1 output
ST
LD
Parameterized Inherits local data 63 inputs
FBD 128 KB
Block from caller 64 outputs
ST
User Defined LD 63 inputs
Function Block Has its own local data FBD 128 KB 64 outputs
(UDFB) ST Unlimited internal member variables
Inherits local data user memory 63 inputs
External Block C
from caller size limit (10 MB) 64 outputs
All PACSystems block types automatically provide an OK output parameter. The name used to
reference the OK parameter within a block is Y0. Logic within the block can read and write the Y0
parameter. When a block is called, its Y0 parameter is automatically initialized to TRUE. This will result
in a positive power flow out of the block call instruction when the block completes execution, unless
Y0 is set to FALSE within the logic of the block.
For all block types, the maximum number of input parameters is one less than the maximum number
of output parameters. This is because the EN input to the block call is not considered to be an input
parameter to the block. It is used in LD language to determine whether or not to call the block, but is
not passed into the block if the block is called.

Program Blocks
Any block can be a program block. The _MAIN block is automatically declared when you create a
block-structured program. When you declare any other block, you must assign it a unique block
name. A block is automatically configured with no input parameters and one output parameter (OK).
When a block-structured program is executed, the _MAIN block is automatically executed. Other
blocks execute when called from the program logic in the _MAIN block, another block, or itself. In the
following example, if %M00001 is ON, the block named ProcessEGD will be executed:
Figure 13: Conditional Block Call

Program Blocks and Local Data
Program blocks support the use of %P global data. In addition, each block, except _MAIN, has its own
%L local data. Blocks do not inherit %L local data from their callers.
Using Parameters with a Program Block
Every block is automatically defined to have one formal ‘power flow’ (or OK) output parameter,
named Y0. Y0 is a BOOL parameter of LENGTH 1, passed by initial-value result. It indicates successful
execution of the block. It can be read and written to by the logic within the block.
Parameterized Blocks
Any block except _MAIN can be a parameterized block. When you declare a parameterized block,
you must assign it a unique block name. A parameterized block can be configured with up to 63
input and 64 output parameters.
A parameterized block executes when called from the program logic in the _MAIN block, another
block, or itself. In the following example, if %I00001 is set, the parameterized block named LOAD_41
will be executed.
Figure 14: Block Call with Parameters

Parameterized Blocks and Local Data

Parameterized blocks support the use of %P global data. Parameterized blocks do not have their own
%L data, but instead inherit the %L data of their calling blocks. Parameterized blocks also inherit the
FST_EXE system reference and “time-stamp” data that is used to update timer functions from their
calling blocks. If %L references are used within a parameterized block and the block is called by
_MAIN, %L references will be inherited from the %P references wherever encountered in the
parameterized block (for example, %L0005 = %P0005).
Note: It is possible, by using Online Editing in the programming software to cause a parameterized
block to use %L higher than allowed because of the way it inherits data. Using a word-for-
word change to restore this reference to a valid address does not correct the block because
the variable still exists in the variable list. Deleting the variable from the variable list does not
cause an update to the CPU, so the parameterized block still sees the reference out of range
fault. To correct this condition, you must remove the unused variables from the variable list
after deleting them from the logic.
Using Parameters with a Parameterized Block
A parameterized block may be defined to have between 0 and 63 formal input parameters, and
between 1 and 64 formal output parameters. A ‘power-flow out’ (or OK) parameter, named Y0, is
automatically defined for every parameterized block. It is a BOOL parameter of LENGTH 1, and
indicates the successful execution of the parameterized block. It can be read and written to by the
parameterized block’s logic.
The following table lists the TYPEs, LENGTHs, and parameter-passing mechanisms allowed for
parameterized block parameters. (For definitions of the parameter passing types, see “Parameter
Passing Mechanisms” on page 113.)
Type Length Default Parameter Passing Mechanism
INPUTS: by reference
BOOL 1 to 256
OUTPUTS: by value result; except Y0, which is by initial-value result
BYTE 1 to 1024
OUTPUTS: by reference
INT, UINT, and WORD 1 to 512
DINT, REAL, and DWORD 1 to 256
LREAL 1 to 128
function block 15 1
OUTPUTS: not allowed
UDFB15 1
User Defined Type (UDT) 1 to 1024
15 A maximum of 16 input parameters can be of type function block or UDFB.

The PACSystems default parameter passing mechanisms correspond to the way that parameterized
subroutine block (PSB) parameters are passed on 90-70 controllers. The parameter passing
mechanisms of formal parameters cannot be changed from their default values.
Arguments, or “actual parameters” are passed into a parameterized block when a parameterized
block call is executed. In general, arguments to formal parameters may come from any memory
type, may be data flow, and may be constants (when the formal parameter’s LENGTH is 1). The
following list contains the restrictions on arguments relative to this general rule:
 %S memory addresses cannot be used as arguments to any output parameter. This is because
user logic is not allowed to write to %S memory.
 Indirect references used as arguments are resolved immediately before the parameterized block
is called, and the corresponding direct reference is passed into the block. For example, where
%R1 contains the value 10 and @R1 is used as an argument to a call, immediately before calling
the block, @R1 is resolved to be %R10, and %R10 is passed in as the argument to the block.
During execution of the block, the argument remains as %R10, regardless of whether the value in
%R1 changes.
In general, formal parameters within a parameterized block may be used with any instruction or with
any block call, as long as their TYPE and LENGTH are compatible with what the instruction, function,
or block call requires. The following list contains the restrictions on formal parameters relative to this
general rule:
 Formal parameters cannot be used on legacy transitional contacts or coils, or on FAULT, NOFLT,
HIALM, or LOALM contacts. However, formal parameters can be used on IEC transitional contacts
and coils.
 Formal BOOL input parameters cannot be used on coils or as output arguments to a function or
to a block call.
 Formal parameters cannot be used with the DO I/O function.
 Formal parameters cannot be used with indirect referencing.

User-Defined Function Blocks (UDFBs)

Users can define their own blocks, which have parameters and instance data, instead of being
limited to the standard and built-in function blocks provided in the PACSystems instruction set. In
many cases, the use of this feature results in a reduction in total program size.
Once defined, multiple instances of a UDFB can be created by calling it within the A member
program logic. Each instance has its own unique copy of the function block’s variable is not
instance data, which consists of the function block’s internal member variables passed into or
and all of its input and output parameters except those that are passed by out of a UDFB
reference. When a UDFB is called on a given instance, the UDFB’s logic operates as a
on that instance’s copy of the instance data. The values of the instance data parameter. A
persist from one execution of the UDFB to the next.
A UDFB cannot be triggered by an interrupt.
UDFB logic is created using FBD, LD or ST. UDFB logic can make calls to all the other types of
PACSystems blocks (blocks, parameterized blocks, external blocks and other UDFBs). Blocks,
parameterized blocks, and other UDFBs can make calls to UDFBs.
Unless otherwise stated, the PACSystems implementation of UDFBs meets the IEC 61131-3
requirements for user defined function blocks.
Defining a UDFB
To create a UDFB in the programming software, create an LD, FBD or ST block in the Program Blocks
folder. In the Properties for the block, select Function Block.
To define instance data for a UDFB, select Parameters in the block’s properties. Input and output
parameters are defined in the same way as for parameterized blocks. In the following example, three
internal member variables are defined: temp, speed, and modelno.
Figure 15: Defining Member Variables for a User-Defined Function Block

Creating UDFB Instances

You create an instance of a UDFB by calling it in your logic and assigning an instance name in the
function properties.
Figure 16: Creating a User-Defined Function Block

In the following LD example, the first rung creates two instances of the UDFB, Motors. The instance
variables associated with the instances are motors.motor1 and motors.motor2. The second rung
uses the two instances of the internal variable temp in logic.
Figure 17: Use of User-Defined Function Block in Ladder Logic

Instance Data Structures
A variable with the format function_block_name.instance_name is
automatically created for each instance of a UDFB. The instance data
makes up a single composite variable that is of a structure type. The
example to the right shows the variable structures associated with two
instances of the UDFB named Motors. Each instance variable has elements
corresponding to parameters In1, Out1, and Y0, and internal variables
modelno, speed, and temp.
Instances are created as symbolic variables, never as mapped variables.
This ensures that instance data is only referenced by the instance name
and not by a memory address, which means that no aliases can be created
for the UDFB data elements. The indirect reference operator cannot be
used on an instance variable because indirect references are not permitted
on symbolic variables.
Figure 18: Display of

Instance Data Structures
UDFBs and Scope
Unlike a parameterized subroutine, a UDFB has its own %L memory.
By default, internal variables of a UDFB have local scope, making them visible only to the logic inside
the UDFB. They cannot be read or written by any external logic or by the hardware configuration. An
internal variable can be made visible outside the UDFB by changing its scope to global. Logic outside
the UDFB can read but cannot write to internal variables whose scope is global.

Note: If you give internal variables global scope, your application will not conform to IEC
requirements.
Using Parameters with UDFBs
UDFBs support up to 63 inputs and up to 64 outputs.
Each UDFB has a predefined Boolean output parameter, Y0, which the CPU sets to true upon each
invocation of the block. Y0 can be controlled by logic within the block and provides the output status
of the block.
The following table lists the TYPEs, LENGTHs, and parameter-passing mechanisms allowed for UDFB
parameters. For additional information on parameter passing, see “Parameter Passing Mechanisms”
on page 113.
Type LengthParameter Passing Mechanism Retentiveness of Instance Data for
Parameters
BOOL 1 to 256 INPUTS: by reference, constant Not Applicable if passed by
reference, value, or value result. reference, since not stored in
(Default: value) instance data.
Can be retentive (default) or non-
retentive for value or value result.
OUTPUTS: by result; except Y0, Retentive (default) or
which is by initial-value result Non-retentive
BYTE 1 to 1024 INPUTS: by reference, constant Retentive for value or value result.
reference, value, or value result. Not applicable for reference
(Default: value)
OUTPUTS: by result
INT, UINT, 1 to 512 INPUTS: by reference, constant Retentive for value or value result.
and WORD reference, value, or value result. Not applicable for reference
(Default: value)
OUTPUTS: by result
DINT, REAL, 1 to 256 INPUTS: by reference, constant Retentive for value or value result.
and DWORD reference, value, or value result. Not applicable for reference
(Default: value)
OUTPUTS: by result
LREAL 1 to 128 INPUTS: by reference, constant Retentive for value or value result.
reference, value, or value result. Not applicable for reference
(Default: value)
OUTPUTS: by result
Function 1 INPUTS: by reference, constant Not applicable since passed by
block reference, (Default: reference) reference
(standard or OUTPUTS: by result
PACMotion)
UDFB 16 1 INPUTS: by reference, constant Not applicable since passed by
reference, friend reference
16 A maximum of 16 input parameters can be of type UDFB.

Type Length Parameter Passing Mechanism Retentiveness of Instance Data for

Parameters
UDT 1 to 1024 INPUTS: by reference, constant Not applicable since passed by
reference reference
If an input parameter is passed by reference or by value result, it requires an argument. All other
parameters of a UDFB are optional. That is, they do not have to be given arguments on each instance
of the UDFB. If no argument is given for an optional parameter, the variable element associated with
the parameter retains the value it previously had.
UDFB outputs cannot be passed as arguments to input parameters that are passed by reference or
passed by value result. This restriction prevents modification of a UDFB output.
Using Internal Member Variables with UDFBs
A UDFB can have any number of internal member variables. Internal variables’ values are not passed
through the input and output parameters. An internal variable cannot have the same name as a
parameter of the UDFB it is defined in.
An internal variable can be:
 Any basic type supported by PACSystems (BOOL, INT, UINT, DINT, REAL, LREAL, BYTE, WORD, and
DWORD).
 A UDFB type. Such member variables are known as nested instances. For example, the function
block “Motor” can have an internal variable of type “Valve,” where Valve is a UDFB type. Note that
defining a member variable as a UDFB type does not create an instance.
A nested instance cannot be of the same type as the UDFB being defined because this would set up
an infinitely recursive definition. Nor can any level of a nested instance be of the same type as the
parent UDFB being defined. For example, the UDFB “Motor” cannot have an internal variable of type
“Valve,” if the Valve UDFB contains an internal variable of type “Motor.”
 A UDT. A structured, user-defined data type consisting of elements of other selected data types.
 A one-dimensional array.
Internal variables of TYPE BOOL can be retentive (default) or non-retentive. All other TYPEs must be
retentive.
Member variables corresponding to a UDFB’s input parameters cannot be read or written outside of
the UDFB. (This is more restrictive than the IEC 61131-3 requirements for user defined function
blocks.) Member variables corresponding to the UDFB’s output parameters can be read but not
written outside the UDFB.
Internal member variables that have basic types may be given initial values. The same initial values
apply to all instances of a UDFB. If an initial value isn’t given, the internal member variable is set to
zero when the application transitions to RUN mode for the first time.
An internal member variable that is a nested instance has initial values as specified by its UDFB type
definition.
Initial values are not stored during a RUN mode store. They will not take effect until a Stop mode
store is performed.

UDFB Logic
An instance of a BOOL parameter or internal variable can be forced ON or OFF, or used with
transition-detecting instructions. The exception to this is that BOOL input parameters passed by
reference cannot be forced or used with the Series 90-70 legacy transition-detecting instructions
(POSCOIL, NEGCOIL, POSCON and NEGCON) because their values are not stored in instance data.
All input parameters to a UDFB, and their corresponding instance data elements, can be read by the
logic of that particular UDFB.
Input parameters that are passed by reference or passed by value result to a UDFB can be written to
by their UDFB’s logic. Input parameters passed by value cannot be written to by their UDFB logic.
Note that the restriction on writing to input parameters passed by value does not apply to other
types of blocks.
All UDFB output parameters can be both read and written to by their logic.
UDFB Operation with Other Blocks
A UDFB instance that is of global scope can be invoked by another UDFB’s logic or any other block’s
logic.
A UDFB instance that is passed (by reference) as an argument to a UDFB can be invoked by the
UDFB’s logic.
A UDFB instance that is passed (by reference) as an argument to a parameterized block can be
invoked by the parameterized block’s logic.
The output parameters, and their corresponding instance data elements, of a UDFB instance that is
passed as an argument can be read but not modified by the receiving block’s logic. The input
parameters of a UDFB instance that is passed as an argument cannot be read or modified by the
receiving block’s logic. The internal variables of a UDFB instance that is passed as an argument
cannot be modified by the receiving block’s logic. They can be read if their scope is global, but not if
their scope is local.
External Blocks
External blocks are developed using external development tools as well as the C Programmer’s
Toolkit for PACSystems. Refer to the C Programmer’s Toolkit for PACSystems User’s Manual, GFK-2259
for detailed information regarding external blocks.
Any block except _MAIN can be an external block. When you declare an external block, you must
assign it a unique block name. It can be configured with up to 63 input parameters and 64 output
parameters.
An external block executes when called from the program logic in the _MAIN block or from the logic
in another block, parameterized block, or UDFB. External blocks themselves cannot call any other
block. In the following example, if %I00001 is set, the external block named EXT_11 is executed.
Figure 19: Calling an External Block in Ladder Logic

Note: Unlike other block types, external blocks cannot call other blocks.

External Blocks and Local Data

External blocks support the use of %P global data. External blocks do not have their own %L data,
but instead inherit the %L data of their calling blocks. They also inherit the FST_EXE system reference
and the “time-stamp” data that is used to update timer function blocks from their calling blocks. If %L
references are used within an external block and the block is called by _MAIN, %L references will be
inherited from the %P references wherever encountered in the external block (for example, %L0005 =
%P0005).
Initialization of C Variables
When an external block is stored to the CPU, a copy of the initial values for its global and static
variables is saved. However, if static variables are declared without an initial value, the initial value is
undefined and must be initialized by the C application. (Refer to “Global Variable Initialization” and
“Static Variable” in the C Programmer’s Toolkit for PACSystems, GFK-2259). The saved initial values are
used to re-initialize the block’s global and static variables whenever the CPU transitions from Stop to
Run.
Using Parameters with an External Block
An external block may be defined to have between zero and 63 formal input parameters and
between one and 64 formal output parameters. A ‘power-flow out’ (or OK) parameter, named Y0, is
automatically defined for every external block. Y0 is a BOOL parameter of LENGTH 1, and indicates
the successful execution of the block. It can be read and written to by the external block’s logic.
The following table gives the TYPEs, LENGTHs, and parameter-passing mechanisms allowed for
external block parameters.
Type Length Default Parameter Passing Mechanism
BOOL 1 to 256 INPUTS: by reference
OUTPUTS: by reference; except Y0, which is by initial-value result
BYTE 1 to 1024 INPUTS: by reference
INT, UINT, and WORD 1 to 512 INPUTS: by reference
DINT, REAL, and DWORD 1 to 256 INPUTS: by reference
LREAL 1 to 128 INPUTS: by reference
UDT 17 1 to 128 INPUTS: by reference
17 To use a UDT, you must include the UDT definition as a C structure in the external block. For details,
see "Using a UDT as a C block input parameter data type" in the online help.

The PACSystems default parameter passing mechanisms correspond to the way that external block
parameters are passed on 90-70 controllers. The parameter passing mechanisms of formal
parameters cannot be changed from their default values.
You must define a name for each formal input and output parameter.
Arguments, or “actual parameters”, are passed into an external block when an external block call is
executed.
Arguments may be any valid reference address including an indirect reference, may be flow, or may
be a constant if the corresponding parameter’s LENGTH is 1.

5.1.6 Local Data

Each block or UDFB in a block-structured program has an associated local data block. _MAIN’s data
block memory is referenced by %P; all other data block memories are referenced by %L.
The size of the data block is dependent on the highest reference in its block for %L and in all blocks
for %P.
data data
%P %L
_MAIN
Block
block 2
Data
%L
Block
3
Data
%L
Block
4
Figure 20: Relationship of %L & %P to Program Blocks

All blocks within the program can use data associated with the _MAIN block (%P). Blocks and UDFBs
can use their own %L data as well as the %P data that is available to all blocks. The _MAIN block
cannot use %L.
External blocks and parameterized blocks can use the Local Data (%L) of their calling block as well as
the %P data of the _MAIN block. If a parameterized block or external block is called by MAIN, all %L
references in the parameterized block or external block will actually be references to corresponding
%P references (for example, %L0005 = %P0005). In addition to inheriting the Local Data of their
calling blocks, parameterized blocks and external blocks inherit the FST_EXE status of their calling
blocks.
data
%P
Inherits as %L PSB 1
_MAIN or
EB 1
Block
data
%L
Inherits as %L PSB 2
or
BLOCK EB 2
1
Figure 21: Local Data (%L) Usage by Program Blocks

5.1.7 Parameter Passing Mechanisms

All blocks (except _MAIN) have at least one parameter and thus are affected by parameter passing
mechanisms. A “parameter passing mechanism” describes the way that data is passed from an
argument in a calling block to a parameter in the called block, and from the parameter in the called
block back to the argument in the calling block.
PACSystems supports the following parameter-passing mechanisms: pass by reference, pass by
constant reference, pass by value, pass by value result, pass by result and pass by initial-value result.
An additional type, pass by friend, is available when the input Data Type is a UDFB. A parameter is
defined by its TYPE, LENGTH, and parameter passing mechanism.
 When a parameter is passed by reference, the address of its argument is passed into the
function block instance or parameterized block. All logic within the called block that reads or
writes to the parameter directly reads or writes to the actual argument.
 When a parameter is passed by constant reference, the CPU passes a reference address
pointer, symbolic variable pointer, or I/O variable pointer into the function block instance or
parameterized block. The instance or block can only read the reference address or variable.
 When a parameter is passed by friend (UDFB inputs only), the CPU passes a UDFB instance
variable pointer into the function block instance or parameterized block. The instance or block
can write to any output or member, whether public or private, of the UDFB instance variable
passed as a friend.
Tip: In the logic of a UDFB, when you want to pass the UDFB as a friend, assign the pseudo-
variable "#This" to the input that expects an instance variable of that UDFB type. In the following
example, the In2 input of the LDPSB parameterized block expects a UDFB instance variable
friend of the ABC data type. Inside the logic of ABC, assign "#This" to In2 in the call to LDPSB.
Figure 22: Parameter Passing Example

 When a parameter is passed by value (UDFB inputs only), the value of its argument is copied
into a local stack memory associated with the called block. All logic within the called block that
reads or writes to the parameter is reading or writing to this stack memory. Thus no changes are
ever made to the actual argument.

 When a parameter is passed by value result (UDFB inputs only), the value of its argument is
copied into a local stack memory associated with the called block, and the address of its
argument is saved. All logic within the called block that reads or writes to the parameter is
reading or writing to this stack memory. When the called block completes its execution, the
value in the stack memory is copied back to the actual argument’s address. Thus no changes
are made to the actual argument while the called block is executing, but when it completes
execution, the actual argument is updated.

5.1.8 Languages
Ladder Diagram (LD)
Logic written in Ladder Diagram language consists of a sequence of rungs that execute from top to
bottom. The logic execution is thought of as “power flow”, which proceeds down along the left “rail”
of the ladder, and from left to right along each rung in sequence.
Figure 23: Explanation of Ladder Diagram Rung

The flow of logical power through each rung is controlled by a set of simple program instructions that
work like mechanical relays and output coils. Whether or not a relay passes logical power flow along
the rung depends on the content of a memory location with which the relay has been associated in
the program. For instance, a relay might pass positive power flow if its associated memory location
contains the value 1. The same relay passes negative power flow if the memory location contains the
value 0.
Usually an instruction that receives negative power flow does not execute and propagates the
negative power flow on to the next instruction in the rung. However, some instructions such as
timers and counters execute even when they receive negative power flow, and may even pass
positive power flow out. Once a rung completes execution, with either positive or negative power
flow, power flows down along the left rail to the next rung.
Within a rung, there are many complex functions that are part of the standard function library and
can be used for operations like moving data stored in memory, performing math operations, and
controlling communications between the CPU and other devices in the system. Some program
functions, such as the Jump function and Master Control Relay, can be used to control the execution
of the program itself. Together, this large group of Ladder Diagram instructions and standard library
functions makes up the instruction set of the CPU.

Function Block Diagram

Function Block Diagram (FBD) is an IEC 61131-3 graphical programming language that represents
the behavior of functions, function blocks and programs as a set of interconnected graphical blocks.
FBD depicts a system in terms of the flow of signals between processing elements, in a manner very
similar to signal flows depicted in electronic circuit diagrams. Instructions are shown with inputs
entering from the left and outputs exiting on the right. A function block type name is always shown
within the element and the name of the function block instance is shown above the element.
Figure 24: Illustration of Function Block Diagram

The order of execution of instructions in an FBD is determined by the following:
a) The display position of the instruction in the FBD editor
b) Whether the inputs to the FBD instruction are resolved.
To determine the order of execution of FBD instructions in the FBD editor, the FBD compiler performs
the following steps:
1. The FBD compiler scans the instructions in the FBD editor, beginning from left to right, and top to
bottom. When an instruction is encountered, the compiler attempts to resolve the instruction,
that is, the inputs are known. If the inputs are known, the instruction is solved, and scanning
continues for the next instruction.
2. If the current instruction cannot be resolved, that is, the inputs are not known, then the compiler
scans for the previous instruction, using the wire connecting the output of the previous
instruction to the input of the current instruction.
3. If the previous instruction can be resolved, the compiler calculates the output. The output of the
previous instruction then becomes the input to the current instruction, the current instruction is
resolved, and scanning continues for the next instruction.
4. If the previous instruction cannot be resolved, that is, the inputs are not known, then step 2 is
repeated until an instruction is encountered, which can be resolved.

Structured Text
The Structured Text (ST) programming language is an IEC 1131-3 textual programming language. A
structured text program consists of a series of statements, which are constructed from expressions
and language keywords. A statement directs the PLC to perform a specified action. Statements
provide variable assignments, conditional evaluations, iteration, and the ability to call other blocks.
For details on ST statements, parameters, keywords, and operators supported by PACSystems, refer
to Chapter 11, “Structured Text.”
Blocks, parameterized blocks, and UDFBs can be programmed in ST. The _MAIN program block can
also be programmed in ST.
A block programmed in ST can call blocks, parameterized blocks, and UDFBs.

5.2. Controlling Program Execution

There are many ways in which program execution can be controlled to meet the system’s timing
requirements. The PACSystems CPU instruction set contains several powerful control functions that
can be included in an application program to limit or change the way the CPU executes the program
and scans I/O. For details on using these functions, refer to Chapter 7.
The following is a partial list of the commonly used methods:
 The Jump (JUMPN) function can be used to cause program execution to move either forward or
backward in the logic. When a JUMPN function is active, the coils in the part of the program that
is skipped are left in their previous states (not executed with negative power flow, as they are
with a Master Control Relay). Jumps cannot span blocks.
 The nested Master Control Relay (MCRN) function can be used to execute a portion of the
program logic with negative power flow. Logic is executed in a forward direction and coils in that
part of the program are executed with negative power flow. Master Control Relay functions can
be nested to 255 levels deep.
 The Suspend I/O function can be used to stop both the input scan and output scan for one
sweep. I/O can be updated, as necessary, during the logic execution through the use of DO I/O
instructions.
 The Service Request function can be used to suspend or change the time allotted to the window
portions of the sweep.
 Program logic can be structured so that blocks are called more or less frequently, depending on
their importance and on timing constraints. The CALL function can be used to cause program
execution to go to a specific block. Conditional logic placed before the Call function controls the
circumstances under which the CPU executes the block logic. After the block execution is
finished, program execution resumes at the point in the logic directly after the CALL instruction.

5.3. Interrupt-Driven Blocks

Three types of interrupts can be used to start a block’s execution:
 Timed Interrupts are generated by the CPU based on a user-specified time interval with an initial
delay (if specified) applied on Stop-to-Run transition of the CPU.
 I/O Interrupts are generated by I/O modules to indicate discrete input state changes
(rising/falling edge), analog range limits (low/high alarms), and high speed signal counting events.
 Module Interrupts are generated by VME modules. A single interrupt is supported per module.
Caution
Interrupt-driven block execution can interrupt the execution
of non-interrupt-driven logic. Unexpected results may occur
if the interrupting logic and interrupted logic access the
same data. If necessary, Service Request #17 or Service
Request # 32 can be used to temporarily mask I/O and
Timed Interrupt-driven logic from executing when shared
data is being accessed.
5.3.1 Interrupt Handling

An I/O, Module, or Timed interrupt can be associated with any block except _MAIN, as long as the
block has no parameters other than an OK output. After an interrupt has been associated with a
block, that block executes each time the interrupt trigger occurs. A given block can have multiple
timed, I/O, and module interrupt triggers associated with it. It is executed each time any one of its
associated interrupts triggers. For details on how interrupt blocks are prioritized, refer to “Interrupt
Block Scheduling” on page 121.
If a parameterized block or external block is triggered by an interrupt, it inherits %P data as its %L
local data. For example, a %L00005 reference in the parameterized block or C block actually
references %P00005.
Note: Timer function blocks do not accumulate time if used in a block that is executed as a result of
an interrupt.
Blocks that are triggered by interrupts can make calls to other blocks. The application stack used
during interrupt-driven execution is different from the stack used during normal block-structured
program execution. In particular, the nested call limit is different from the limit described for calls
from the _MAIN block. If a call results in insufficient stack space to complete the call, the CPU logs an
”Application Stack Overflow” fault.
Note: We strongly recommend that interrupt-driven blocks not be called from the _MAIN block or
other non-interrupt driven blocks because the interrupt and non-interrupt driven blocks could
be reading and writing the same global memories at indeterminate times relative to each
other. In the following example (Figure 25) INT1, INT2, BLOCK5, and PB1 should not be called
from _MAIN, BLOCK2, BLOCK3, or BLOCK4.

INT Block 1
_MAIN Block INT Block 2

Block 2
Block
5
Block
3
PB
1
Block
4
Figure 25: Conflict Avoidance when using Interrupt-Driven Blocks
5.3.2 Timed Interrupts

A block can be configured to execute on a specified time interval with an initial delay (if specified)
applied on a Stop-to-Run transition of the CPU.
To configure a timed interrupt block, specify the following parameters in the scheduling properties
for the block:
Time Base The smallest unit of time that you can specify for Interval and Delay. The time base can be 1.0
second, 0.10 second, or 0.01 second, or 0.001 second.
Interval Specifies how frequently the block executes in multiples of the time base.
Delay (Optional) Specifies an additional delay for the first execution of the block in multiples of the
time base.
The first execution of a Timed Interrupt block will occur at
((delay * time base) + (interval * time base)) after the CPU is placed in Run mode.
5.3.3 I/O Interrupts
A block can be triggered by an interrupt input from certain hardware modules. For example, on the
32-Circuit 24 VDC Input Module (IC697MDL650), the first input can be configured to generate an
interrupt on either the rising or falling edge of the input signal. If the interrupt is enabled in the
module configuration, that input can serve as a trigger to cause the execution of a block.
To configure an I/O interrupt, specify a trigger in the scheduling properties for the block. The trigger
must be a global variable in %I, %AI or %AQ memory, or an I/O variable. (An I/O variable is a form of
symbolic variable that is mapped to a module I/O point in hardware configuration.)
PACSystems modules that can trigger user interrupt logic always send the interrupt to the CPU when
configured to do so. If the CPU is in Stop mode when it receives the interrupt, it does not run the user
interrupt block. The CPU does not run the user interrupt block when it transitions from Stop to Run
mode.

5.3.4 Module Interrupts

A block can be triggered by an interrupt from a module that supports I/O interrupts if the Interrupt
parameter is enabled in the module’s hardware configuration.
To configure a module interrupt, specify the module by rack/slot/interrupt ID as the Trigger in the
scheduling properties for the block.
5.3.5 Interrupt Block Scheduling
You can select one of two types of interrupt block scheduling at the target level:
 Normal block scheduling allows you to associate a maximum of 64 I/O and Module Interrupts
and 16 Timed Interrupts. With normal block scheduling, all interrupt-triggered blocks have equal
priority. This is the default scheduling mode.
 Preemptive block scheduling allows you to associate a maximum of 32 interrupt triggers. With
preemptive block scheduling, each trigger can be assigned a relative priority.
Normal Block Scheduling
Interrupt-driven logic has the highest priority of any user logic in the system. The execution of a block
triggered from an interrupt preempts the execution of the normal CPU sweep activities. Execution of
the normal CPU sweep activities is resumed after the interrupt-driven block execution completes.
If the CPU receives one or more interrupts while executing an interrupt block, it places the incoming
interrupts into the queue while it finishes executing the current interrupt block. Timed interrupt driven
blocks are queued ahead of I/O or Module driven blocks. I/O or Module interrupt driven blocks are
queued in the order in which the interrupts are received. If an interrupt driven block is already in the
queue, additional interrupts that occur for this block are ignored.
Preemptive Block Scheduling
Preemptive scheduling allows you to assign a priority to each interrupt trigger. The priority values
range from 1 to 16, with 1 being the highest. A single block can have multiple interrupts with different
priorities or the same priorities.
An incoming interrupt is handled according to its priority compared to that of the currently executing
block as follows:
 If an incoming interrupt has a higher priority than the interrupt associated with the block that is
currently executing, the currently executing block is stopped and put in the interrupt queue. The
block associated with the incoming interrupt begins executing.
 If an incoming interrupt has the same priority as the interrupt trigger associated with the block
that is currently executing, that block continues to execute and the incoming interrupt is placed
in the queue.
 If an incoming interrupt has a lower priority than the interrupt associated with the block that is
currently executing, the incoming interrupt is placed in the queue.
When the CPU completes the execution of an interrupt block, the block associated with the interrupt
trigger that has the highest priority in the queue begins execution — or resumes execution if the
block's execution was preempted by another interrupt block and was placed in the queue.
If multiple blocks in the queue have the same interrupt priority, their execution order is not
deterministic.
Note: Certain functions, such as DOIO, BUS_RD, BUS_WRT, COMMREQ, SCAN_SET_IO, and some
SVC_REQs may cause a block to yield to another queued block that has the same priority.


Chapter 6 Program Data
This chapter describes the types of data that can be used in an application program, and explains
how that data is stored in the PACSystems CPU’s memory.
 Variables
 Reference Memory
 User Reference Size and Default
 Genius Global Data
 Transitions and Overrides
 Retentiveness of Logic and Data
 Data Scope
 System Status References
 How Program Functions Handle Numerical Data
 User Defined Types (UDTs)
 Word-for-Word Changes
 Operands for Instructions

Chapter 6. Program Data
6.1. Variables
A variable is a named storage space for data values. It represents a memory location in the target
PACSystems CPU.
A variable can be mapped to a reference address (for example, %R00001). If you do not map a
variable to a specific reference address, it is considered a symbolic variable. The programming
software handles the mapping for symbolic variables in a special portion of PACSystems user space
memory.
The kinds of values a variable can store depends on its data type. For example, variables with a UINT
data type store unsigned whole numbers with no fractional part. Data types are described in “How
Program Functions Handle Numerical Data” on page 143.
In the programming software, all variables in a project are displayed in the Variables tab of the
Navigator. You create, edit, and delete variables in the Variables tab. Some variables are also created
automatically by certain components (such as TIMER variables when you add a Timer instruction to
ladder logic). The data type and other properties of a variable, such as reference address are
configured in the Inspector.
For more information about system variables, which are created when you create a target in the
programming software, refer to page 138.
6.1.1 Mapped Variables
Mapped (manually located) variables are assigned a specific reference address. For details on the
types of Reference Memory and their uses, refer to page 130.
6.1.2 Symbolic Variables
Symbolic variables are variables for which you do not specify a reference address (similar to a
variable in a typical high-level language). Except as noted in this section, you can use these in the
same ways that you use mapped variables.
In the programming software, a symbolic variable is displayed with a blank address. You can change
a mapped variable to a symbolic variable by removing the reference address from the variable’s
properties. Similarly, you can change a symbolic variable into a mapped variable by specifying a
reference address for the variable in its properties.
The memory required to support symbolic variables counts against user space. The amount of space
reserved for these variables is configured on the Memory tab in the CPU hardware configuration.
Restrictions on the Use of Symbolic Variables
 Symbolic variables cannot be used with indirect references (for example, @Name). For a
description of Indirect References, see page 130
 Only global scope Symbolic variables can be used in EGD pages.
 A variable must be globally scoped and published (internal or external) to be used in a C block.
 Symbolic variables cannot be used in the COMMREQ status word.
 Use of symbolic variables is not supported on web pages.
 Symbolic Boolean variables are not allowed on non-BOOL parameters.
 Symbolic non-discrete variables cannot be used on Series 90-70 style Transition contacts and
coils. (Symbolic discrete variables are supported.)
 Overrides and Forces cannot be used on symbolic non-discrete variables. (Symbolic discrete
variables are supported.)
 Arrays of the following data types are not supported:

o Arrays of user defined function block (UDFB) instance variables.

o Arrays of PACMotion function block instance variables.
o Arrays of TON, TOF, or TP instance variables.
o Arrays of reference ID variables (RIVs) that contain one or more linked RIV elements.
Note: An RIV array is supported when none of its elements is linked.
6.1.3 I/O Variables
An I/O variable is a symbolic variable that is mapped to a terminal in the hardware configuration. A
terminal can be one of the following: Physical discrete or analog I/O point on a PACSystems module
or on a Genius device, a discrete or analog status returned from a PACSystems module, or Global
Data. The use of I/O variables allows you to configure hardware modules without having to specify
the reference addresses to use when scanning their inputs and outputs. Instead, you can directly
associate variable names with a module’s inputs and outputs.
As with symbolic variables, memory required to support I/O variables counts against user space. You
can configure the space available for I/O variables in the Memory tab of the PACSystems CPU.
For a given module or Genius bus, you must use either I/O variables or manually located mapped
variables: you cannot use both in combination. It is not necessary to map all points on a module.
Points that are disconnected or unused can be skipped. When points are skipped, space is reserved
in user memory for that point (that is, a 32-point discrete module will always use 32 bits of memory).
The hardware configuration (HWC) and logic become coupled in a PACSystems target on your
computer as soon as you do one of the following: Enable I/O variables for a module or Genius bus
(even if you don't create any I/O variables), use one or more symbolic variables in the Ethernet Global
Data (EGD) component, or upload a coupled HWC and logic from a PACSystems PLC. The HWC and
logic become coupled in a PACSystems controller when coupled HWC and logic are downloaded to it.
Effects of coupled HWC and logic:
 Whether the HWC and logic are coupled in the PACSystems target on your computer or in the
PACSystems controller, you cannot download or upload the HWC and logic independently.
 When the HWC and logic are coupled in the PACSystems controller, you cannot clear the HWC
and the logic independently.
 As for any download, you cannot run mode store (RMS) the HWC and logic independently.
 The HWC must be completely equal for you to make word-for-word changes, launch the Online
Test mode of Test Edit, or accept the edits of Test Edit.
I/O variables can be used any place that other symbolic variables are supported, such as in logic as
parameters to built-in function blocks, user defined function blocks, parameterized function blocks, C
blocks, bit-in-word references, and transition contacts and coils.
Restrictions on the Use of I/O Variables
 Since I/O variables are a form of symbolic variable, the same restrictions that apply to other
symbolic variables of the same data type and array bounds apply to I/O variables.
 Only a global variable can become an I/O variable. A local variable cannot become an I/O
variable.
 You can map only a discrete variable to a discrete terminal.
 You can map only a non-discrete variable to an analog terminal.
 Arrays and UDT variables must fit on the number of terminals in the reference address node
counting from and including the terminal where you enter the array head or UDT variable. For
example, if you have 32 analog terminals and you have a WORD array of 12 elements, you can
map it to terminal 21 or any terminal before it (1 through 20).

 You can map a discrete array only to a terminal 8n+1, where n = 0, 1, 2, and so on. The "+1" is
there because the terminals are numbered beginning with 1. If you map it to a terminal other
than 8n+1, an error occurs upon validation.
 An I/O variable cannot be mapped to more than one location in hardware configuration.
 For the DO_IO function block, if an I/O variable is assigned to the ST parameter, then the same
I/O variable must also be assigned to the END parameter, and the entire module is scanned.
 Some I/O modules do not support the use of I/O variables. For a list of modules that support I/O
variables, please refer to the Important Product Information for Logic Developer – PLC
I/O Variable Format
To map an I/O variable, use the format %vdr.s.[z.]g.t:
v = I (input) or Q (output)
d = data type: X (discrete) or W (analog).
r = rack number
s = slot number
[z] = sub-slot number. This element and the period that follows it appear only if there is a sub-slot, for
example, the SBA number of a Genius device. For an Ethernet daughterboard, set this value to 0.
g = segment number or number of the reference address node. Set to 0 for the first reference
address node on the Terminals tab, 1 for the second reference node, and so on.
t = terminal number. One-based, that is, the numbering begins at 1.
Supported I/O Variable Types
Data Type Mnemonic Supported Data Types Number of Consecutive Terminals Required
BOOL variable 1
BOOL array Number of elements in array.
X
BYTE variable 8
BYTE array 8n, where n is the number of array elements.
DINT variable 2
DINT array Number of elements in array times 2
DWORD variable 2
DWORD array Number of elements in array times 2
INT variable 1
INT array Number of elements in array
LREAL variable 4
W
LREAL array Number of elements in array times 4
REAL variable 2
REAL array Number of elements in array times 2
UINT variable 1
UINT array Number of elements in array
WORD variable 1
WORD array Number of elements in array

I/O Variable Examples
The I/O variable, Sample_IO_Variable is mapped to a non-discrete (W) output point (Q) on the module
located in rack 0, slot 8. The variable is mapped to the first point in the first group of non-discrete
output reference addresses.
The I/O variable, IO_VAR_EXAMPLE, is mapped to a discrete (X) input point (I) on the module located in
rack 0, slot 5. The point is located in the module’s third group of discrete input points and is point 2 in
that group.
6.1.4 Arrays
An array is a complex data type composed of a series of variable elements with identical data types.
Any variable can become an array, except for another array, a variable element, or a UDFB. In
Machine Edition, you can create single-dimensional arrays and two-dimensional arrays.
In the controller CPU, each element of an array is treated as a separate variable with a separate,
read-only reference address. The "root" node of the array variable also has a reference address that
is editable. When you set or change the reference address of the "root" node of an array variable, the
reference addresses of its elements are filled in with a range of addresses starting at that reference
address and incremented for each element so as to create contiguous non-overlapping memory.
6.1.5 Variable Indexes and Arrays
PACSystems CPUs with firmware version 6.00 or later support variable indexes for arrays. With a
variable index, when logic is executed, the value of the variable is evaluated and the corresponding
array element is accessed.
Note: The numbering of array elements is zero-based.
For example, to access an element of the array named ABC, you could write ABC[DEF] in logic. When
logic is executed, if the value of DEF is 5, then ABC[DEF] is equivalent to ABC[5], and the sixth element
of array ABC is accessed.
If the value of the variable index exceeds the array boundary, a non-fatal fault is logged to the CPU
fault table. In LD, the instruction for which this occurred does not pass power to the right.
Requirements and Support
An index variable must be of the INT, UINT, or DINT data type.
The valid range of values for an index variable is 0 through Y, where Y = [the number of array
elements in the array] - 1. See Ensuring that a Variable Index does not Exceed the Upper Boundary of
an Array (page 129).
An index variable can be one of the following:
 Symbolic variable
 I/O variable
 Variable mapped to % memory areas such as %R
 Structure element
 Array element with a constant index
 Array element with a variable index
 Alias variable
 In the logic of a UDFB or parameterized block: formal parameter

The following support a variable index:

 Array elements of any data type except STRING
 Parameter array elements of any data type
 Alias variables
Dimensional support:
 One-dimensional (1D) formal parameter arrays in the logic of a UDFB or parameterized block
 2D support for the top level of an array of structures and 1D support for a structure element that
is an array. For example:
PQR[a, b].STRU[y].Zed,
where Zed is an element of the array of structures STRU, which itself is an element of the 2D
array of structures PQR.
 1D and 2D arrays for other variables
Other features:
 An array with a variable index supports a bit reference, for example
MyArray[nIndex].X[4],
where .X[4] is the fifth bit of the value stored in MyArray[nIndex]. The bit reference itself, [4] in
the example, must be a constant.
 In LD, the following word-for-word changes are supported for array elements with variable
indexes:
Replacing an index variable with another index variable
Replacing an index variable with a constant
Replacing a constant with an index variable
In LD, Diagnostic Logic Blocks support the use of array elements with variable indexes.
Where Array Elements with Variable Indexes are Not Supported:
The following do not support array elements with variable indexes:
 Indirect references
 EGD variables
 Reference ID variables (RIVs) and I/O variables when accessed in the Hardware Configuration
Note: In logic, RIVs and I/O variables support variable indexes.
 STRING variables
A variable index cannot be one of the following:
 A math expression. For example, ABC[GH+1] is not supported.
 An indirect reference. For example, W[@XYZ] is not supported.
 A bit reference. For example, ABC[DEF.X[3]] is not supported.
Note: You can use a bit reference on an array element designated by a variable index. For example,
ABC[DEF].X[3] is supported.
 An array head. For example, if MNP and QRS are arrays, MNP[QRS] is not supported, but
MNP[QRS[3]] and MNP[QRS[TUV]] are, where TUV is an index variable.
 A negative index. This generates a run-time non-fatal CPU fault.
 A value greater than Y, where Y = [number of array elements] - 1. This generates a run-time non-
fatal CPU fault.

Ensuring that a Variable Index does not Exceed the Upper Boundary of an Array
One-Dimensional Array
1. Once per scan, execute ARRAY_SIZE_DIM1 to count the number of elements in the array.
Note: The array size of a variable can be changed in a run mode store but it will not be changed
while logic is executing.
ARRAY_SIZE_DIM1 places the count value in the variable associated with its output Q.
2. Before executing an instruction that uses a variable index, compare the value of the index
variable with the number of elements in the array.
Tip: In LD, use a RANGE instruction.
Notes Checking before executing each instruction that uses an indexed variable is recommended in
case logic has modified the index value beyond the array size or in case the array size has
been reduced before the scan to less than the value of an index variable that has not been
reduced accordingly since.
Valid range of an index variable: 0 through (n–1), where n is the number of array elements.
Array indexes are zero-based.
Two-Dimensional Array
 Execute both ARRAY_SIZE_DIM1 and ARRAY_SIZE_DIM2 to count the number of elements in
respectively the first and second dimensions of the array.

6.2. Reference Memory
The CPU stores program data in bit memory and word memory. Both types of memory are divided
into different types with specific characteristics. By convention, each type is normally used for a
specific type of data, as explained below. However, there is great flexibility in actual memory
assignment.
Memory locations are indexed using alphanumeric identifiers called references. The reference’s letter
prefix identifies the memory area. The numerical value is the offset within that memory area, for
example %AQ0056.
6.2.1 Word (Register) References
Type Description
%AI The prefix %AI represents an analog input register. An analog input register holds the value
of one analog input or other non-discrete value.
%AQ The prefix %AQ represents an analog output register. An analog output register holds the
value of one analog output or other non-discrete value.
%R Use the prefix %R to assign system register references that will store program data such as
the results of calculations.
%W Retentive Bulk Memory Area, which is referenced as %W (WORD memory).
%P Use the prefix %P to assign program register references that will store program data with the
_MAIN block. This data can be accessed from all program blocks. The size of the %P data
block is based on the highest %P reference in all blocks. %P addresses are available only to
the LD program they are used in, including C blocks called from LD blocks; they are not
system-wide.
Note: All register references are retained across a power cycle to the CPU.
Indirect References
An indirect reference allows you to treat the contents of a variable assigned to an LD instruction
operand as a pointer to other data, rather than as actual data. Indirect references are used only with
word memory areas (%R, %W, %AI, %AQ, %P, and %L). An indirect reference in %W requires two %W
locations as a DWORD indirect index value. For example, @%W0001 would use the %W2:W1 as a
DWORD index into the %W memory range. The DWORD index is required because the %W size is
greater than 65K.
Indirect references cannot be used with symbolic variables.
To assign an indirect reference, type the @ character followed by a valid reference address or
variable name. For example, if %R00101 contains the value 1000, @R00101 instructs the CPU to use
the data location of %R01000.
Indirect references can be useful when you want to perform the same operation to many word
registers. Use of indirect references can also be used to avoid repetitious logic within the application
program. They can be used in loop situations where each register is incremented by a constant or by
a value specified until a maximum is reached.

Bit in Word References

Bit in word referencing allows you to specify individual bits in a word reference type as inputs and
outputs of Boolean expressions, functions, and calls that accept bit parameters (such as
parameterized blocks). This feature is restricted to word references in retentive memory. The bit
number in the bit within word construct must be a constant.
You can use the programmer or an HMI to set an individual bit on or off within a word, or monitor a
bit within a word. Also, C blocks can read, modify, and write a bit within a word.
Bit in Word references can be used in the following situations:
■ In retentive 16-bit memory (AI, AQ, R, W, P, and L) and symbolics.
■ On all contacts and coils except legacy transition contacts (POSCON/NEGCON) and transition
coils (POSCOIL/NEGCOIL).
■ On all functions and call parameters that accept single or unaligned bit parameters.
Functions that accept Parameters
unaligned discrete references
ARRAY MOVE (BIT) SR and DS
ARRAY RANGE (BIT) Q
MOVE (BIT) IN and Q
SHFR (BIT) IN, ST and Q
Restrictions
The use of Bit in Word references has the following restrictions:
■ Bit in Word references cannot be used on legacy transition contacts (POSCON/NEGCON) and
transition coils (POSCON/NEGCON).
■ The bit number (index) must be a constant; it cannot be a variable.
■ Bit addressing is not supported for a constant.
■ Indirect references cannot be used to address bits in 16-bit memory.
■ You cannot force a bit within 16-bit memory.
Examples:
%R2.X [0] addresses the first (least significant) bit of %R2
%R2.X [1] addresses the second bit of %R2. In the examples
In the examples [0] and [1] are the bit indexes. Valid bit indexes for the different variable types are:
BYTE variable [0] through [7]
WORD, INT, or UINT variable [0] through [15]
DWORD or DINT variable [0] through [31]

6.2.2 Bit (Discrete) References

Type Description
%I Represents input references. %I references are located in the input status table, which stores
the state of all inputs received from input modules during the last input scan. A reference
address is assigned to discrete input modules using your programming software. Until a
reference address is assigned, no data will be received from the module. %I memory is
always retentive.
%Q Represents physical output references. The coil check function checks for multiple uses of
%Q references with relay coils or outputs on functions. You can select the level of coil
checking desired (Single, Warn Multiple, or Multiple).
%Q references are located in the output status table, which stores the state of the output
references as last set by the application program. This output status table’s values are sent
to output modules at the end of the program scan. A reference address is assigned to
discrete output modules using your programming software. Until a reference address is
assigned, no data is sent to the module. A particular %Q reference may be either retentive or
non-retentive.
%M Represents internal references. The coil check function of your programming software
checks for multiple uses of %M references with relay coils or outputs on functions. A
particular %M reference may be either retentive or non-retentive.
%T Represents temporary references. These references are never checked for multiple coil use
and can, therefore, be used many times in the same program even when coil use checking is
enabled—this is not a recommended practice because it makes subsequent trouble-shooting
more difficult. %T may be used to prevent coil use conflicts while using the cut/paste and file
write/include functions. Because this memory is intended for temporary use, it is cleared on
Stop-to-Run transitions and cannot be used with retentive coils.
%S Represent system status references. These references are used to access special CPU data
%SA such as timers, scan information, and fault information. For example, the %SC0012 bit can be
%SB used to check the status of the CPU fault table. Once the bit is set on by an error, it will not be
%SC reset until after the sweep. %S, %SA, %SB, and %SC can be used on any contacts.
 %SA, %SB, and %SC can be used on retentive coils -(M)-.
Note: Although the programming software forces the logic to use retentive coils with %SA,
%SB, and %SC references, most of these references are not preserved across power
cycles regardless of the state of the battery or Energy Pack.
%S can be used as word or bit-string input arguments to functions or function blocks.
%SA, %SB, and %SC can be used as word or bit-string input or output arguments to
functions and function blocks.
For a description of the behavior of each bit, see System Status References on page 138.
%G Represents global data references. These references are used to access data shared among
several control systems.
Note: For details on retentiveness, refer to “Retentiveness of Logic and Data” on page 136.

6.3. User Reference Size and Default

Maximum user references and default reference sizes are listed in the table below.
Item Range Default
Reference Points
%I reference 32768 bits 32768 bits
%Q reference 32768 bits 32768 bits
%M reference 32768 bits 32768 bits
%S total (S, SA, SB, SC) 512 bits 512 bits
(128 each) (128 each)
%T reference 1024 bits 1024 bits
%G 7680 points 7680 points
Total Reference Points 107520 107520
Reference Words
%AI reference 0—32640 words 64 words
%AQ reference 0—32640 words 64 words
%R, 1K word 0—32640 words 1024 words
increments
%W 0—maximum available user RAM 0 words
Total Reference Words 0—maximum available user RAM 1152 words
%L (per block) 8192 words 8192 words
%P (per program) 8192 words 8192 words
Managed Memory
Symbolic Discrete 0—83,886,080 (bits) 32768
Symbolic Non-Discrete 0—5,242,880 (words) 65536
I/O Discrete 0 through 83,886,080 0
I/O Non-Discrete 0 through 5,242,880. 0
Total Symbolic 0—42,088,704 bytes 143360
(This is the total memory available for the combined
total of symbolic memory. This also includes other
user memory use, program etc.)
6.3.1 %G User References and CPU Memory Locations

The CPU contains one data space for all of the global data references (%G). The internal CPU memory
for this data is 7680 bits long. For Series 90-70 systems, the programming software subdivides this
range using %G, %GA, %GB, %GC, %GD, and %GE prefixes—allowing each of these prefixes to be
used with bit offsets in the range 1–1280. For PACSystems, these ranges are converted to %G.

6.4. Genius Global Data

PACSystems supports the sharing of data among multiple control systems that share a common
Genius I/O bus. This mechanism provides a means for the automatic and repeated transfer of %G,
%I, %Q, %AI, %AQ, and %R data. No special application programming is required to use global data
since it is integrated into the I/O scan. All devices that have Genius I/O capability can send and
receive global data from a PACSystems CPU.
Using I/O Variables (page 125), you can directly associate variable names to a module’s Genius global
data that is scanned as part of an input/output scan.

6.5. Transitions and Overrides

The %I, %Q, %M, and %G user references, and symbolic variables of type BOOL, have associated
transition and override bits. %T, %S, %SA, %SB, and %SC references have transition bits but not
override bits. The CPU uses transition bits for counters, transition contacts, and transitional coils.
Note that counters do not use the same kind of transition bits as contacts and coils. Transition bits
for counters are stored within the locating reference.
The transition bit for a reference tells whether the most recent value (ON, OFF) written to the
reference is the same as the previous value of the reference. Therefore when a reference is written
and its new value is the same as its previous value, its transition bit is turned OFF. When its new value
is different from its previous value, its transition bit is turned ON. The transition bit for a reference is
affected every time the reference is written to. The source of the write is immaterial; it can result from
a coil execution, an executed function’s output, the updating of reference memory after an input
scan, etc.
When override bits are set, the associated references cannot be changed from the program or the
input device; they can only be changed on command from the programmer. Overrides do not protect
transition bits. If an attempted write occurs to an overridden memory location, the corresponding
transition bit is cleared.

6.6. Retentiveness of Logic and Data

Data is defined as retentive if it is saved by the CPU when the CPU transitions from STOP mode to
RUN mode.
The following items are retentive:
 program logic
 fault tables and diagnostics
 checksums for program logic
 overrides and output forces
 word data (%R, %W, %L, %P, %AI, %AQ)
 bit data (%I, %G, fault locating references, and reserved bits)
 %Q and %M variables that are configured as retentive (%T data is non-retentive and therefore
not saved on STOP to RUN transitions.)
 symbolic variables that have a data type other than BOOL
 symbolic variables of BOOL type that are configured as retentive
 Retentive data is also preserved during power-cycles of the CPU with battery backup or Energy
Pack backup. Exceptions to this rule include the fault locating references and most of the %S,
%SA, %SB, and %SC references. These references are initialized to zero at power-up regardless of
the state of the battery or Energy Pack. (See page 138 for a description of the behavior of each
system status reference.)
When %Q or %M variables are configured as retentive, the contents are retained through power loss
and Run-to-Stop-to-Run transitions.

6.7. Data Scope

Each of the user references has “scope”; that is, it may be available throughout the system, available
to all programs, restricted to a single program, or restricted to local use within a block.
User Reference Type Range Scope
%I, %Q, %M, %T, %S, %SA, Global From any program, block, or host computer. Variables
%SB, %SC, %G, %R, %W, defined in these registers have system (global) scope by
%AI, %AQ, convenience default. However, variables with local scope can also be
references, fault locating assigned in these registers.
references
Symbolic variable Global From any program, block, or host computer. Symbolic
variables have system (global) scope by default. However,
symbolic variables with local scope can be created using
the naming conventions for local variables.
I/O variable Global From any program, block, or host computer.
%P Program From any block, but not from other programs (also
available to a host computer).
%L Local From within a block only (also available to a host
computer).
In an LD block:
 %P should be used for program references that are shared with other blocks.
 %L are local references that can be used to restrict the use of register data to that block. These
local references are not available to other parts of the program.
 %I, %Q, %M, %T, %S, %SA, %SB, %SC, %G, %R, %W, %AI, and %AQ references are available
throughout the system.

6.8. System Status References

System status references in the CPU are assigned to %S, %SA, %SB, and %SC memory. The four
timed contacts (time tick references) include #T_10MS, #T_100MS, #T_SEC, and #T_MIN. Examples of
other system status references include #FST_SCN, #ALW_ON, and #ALW_OFF
Note: %S bits are read-only bits; do not write to these bits. However, you can write to %SA, %SB,
and %SC bits.
Listed below are available system status references that can be used in an application program.
When entering logic, either the reference or the nickname can be used. Refer to Chapter 14 for
detailed fault descriptions and information on correcting faults.
6.8.1 %S References
System
Reference Definition
Variable
%S0001 #FST_SCN Current sweep is the first sweep in which the LD executed. Set the first time the user
program is executed after a Stop/Run transition and cleared upon completion of its
execution.
%S0002 #LST_SCN Set when the CPU transitions to run mode; cleared when the CPU is performing its
final sweep. The CPU clears this bit and then performs one more complete sweep
before transitioning to Stop or Stop Faulted mode. If the number of last scans set to 0,
%S0002 will be cleared after the CPU is stopped and user logic will not see this bit
cleared.
%S0003 #T_10MS 0.01 second timed contact.
%S0004 #T_100MS 0.1 second timed contact.
%S0005 #T_SEC 1.0 second timed contact.
%S0006 #T_MIN 1.0 minute timed contact.
%S0007 #ALW_ON Always ON.
%S0008 #ALW_OFF Always OFF.
%S0009 #SY_FULL Set when the CPU fault table fills up (size configurable with a default of 16 entries).
Cleared when an entry is removed from the CPU fault table and when the CPU fault
table is cleared.
%S0010 #IO_FULL Set when the I/O Fault Table fills up (size configurable with a default of 32 entries).
Cleared when an entry is removed from the I/O Fault Table and when the I/O Fault
Table is cleared.
%S0011 #OVR_PRE Set when an override exists in %I, %Q, %M, or %G, or symbolic BOOL memory.
%S0012 #FRC_PRE Set when force exists on a Genius point.
%S0013 #PRG_CHK Set when background program check is active.
%S0014 #PLC_BAT CPUs with batteries, including CPU310, CPU315, CPU/CRU320 and NIU001
 If the battery is disconnected, this contact is set to 1.
 Whenever a Smart Battery fails during operation, this contact is set to 1. If used in
conjunction with a legacy (non-smart) battery, this indication is not reliable.
Battery-less CPUs, including CPE305 and CPE310:
 Energy Pack is connected and functioning = 0
 Energy Pack is not connected or has failed = 1
Note: The #FST_EXE name is not associated with a %S address, it must be referenced by the name
“#FST_EXE” only. This bit is set when transitioning from Stop to Run and indicates that the
current sweep is the first time this block has been called.

6.8.2 %SA, %SB, and %SC References

Note: %SA, %SB, and %SC contacts are not set or reset until the input scan phase of the sweep
following the occurrence of the fault or a clearing of the fault table(s). %SA, %SB, and %SC
contacts can also be set or reset by user logic and CPU monitoring devices.
Reference System Definition
Variable
%SA0001 #PB_SUM Set when a checksum calculated on the application program does not match the
reference checksum. If the fault was due to a temporary failure, the condition can
be cleared by again storing the program to the CPU. If the fault was due to a hard
RAM failure, then the CPU must be replaced.
To clear this bit, clear the CPU fault table or power cycle the CPU.
%SA0002 #OV_SWP Set when the CPU detects that the previous sweep took longer than the time
specified by the user. To clear this bit, clear the CPU fault table or power cycle the
CPU. Only occurs if the CPU is in Constant Sweep mode.
%SA0003 #APL_FLT Set when an application fault occurs. To clear this bit, clear the CPU fault table or
power cycle the CPU.
%SA0009 #CFG_MM Set when a configuration mismatch fault is logged in the fault tables. To clear this
bit, clear the CPU fault table or power cycle the CPU.
%SA0008 #OVR_TMP Set when the operating temperature of the CPU exceeds the normal operating
temperature, 58ºC. To clear this bit, clear the CPU fault table or power cycle the CPU.
%SA0010 #HRD_CPU Set when the diagnostics detects a problem with the CPU hardware. To clear this bit,
clear the CPU fault table or power cycle the CPU.
%SA0011 #LOW_BAT The low battery indication is not supported for all CPU modules. For details, refer to
“Battery Status (Group 18)” in Chapter 14.
The CPU may set this contact when an I/O module or special-purpose module has
reported a low battery. In this case, a fault will be reported in the I/O Fault Table.
%SA0012 #LOS_RCK Set when an expansion rack stops communicating with the CPU. To clear this bit,
clear the CPU fault table or power cycle the CPU.
%SA0013 #LOS_IOC Set when a Bus Controller stops communicating with the CPU.
To clear this bit, clear the I/O Fault Table or power cycle the CPU.
%SA0014 #LOS_IOM Set when an I/O module stops communicating with the CPU.
%SA0015 #LOS_SIO Set when an option module stops communicating with the CPU.
%SA0017 #ADD_RCK Set when an expansion rack is added to the system.
%SA0018 #ADD_IOC Set when a Bus Controller is added to a rack.
%SA0019 #ADD_IOM Set when an I/O module is added to a rack.
%SA0020 #ADD_SIO Set when an intelligent option module is added to a rack.
%SA0022 #IOC_FLT Set when a Bus Controller reports a bus fault, a global memory fault, or an IOC
hardware fault. To clear this bit, clear the I/O Fault Table or power cycle the CPU.
%SA0023 #IOM_FLT Set when an I/O module reports a circuit or module fault.
%SA0027 #HRD_SIO Set when a hardware failure is detected in an option module.

Reference System Definition

Variable
%SA0029 #SFT_IOC Set when there is a software failure in the I/O Controller.
%SA0030 #PNIO_ALARM A PROFINET alarm has been received and an I/O fault has been logged in group 28.
%SA0031 #SFT_SIO Set when an option module detects an internal software error.
%SA0032 #SBUS_ER Set when a bus error occurs on the VME bus backplane
%SA0081 – Set when a user-defined fault is logged in the CPU fault table.
%SA0112 To clear these bits, clear the CPU fault table or power cycle the CPU. For more
information, see discussion of SVC_REQ 21: User-Defined Fault Logging in Chapter
10.
%SB0001 #WIND_ER Set when there is not enough time to start the Programmer Window in Constant
Sweep mode.
%SB0009 #NO_PROG Set when the CPU powers up with memory preserved, but no user program is
present. Cleared when the CPU powers up with a program present or by clearing the
CPU fault table.
%SB0010 #BAD_RAM Set when the CPU detects corrupted RAM memory at power-up. Cleared when the
CPU detects that RAM memory is valid at power-up or by clearing the CPU fault
table.
%SB0011 #BAD_PWD Set when a password access violation occurs. Cleared when
the CPU fault table is cleared or when the CPU is power cycled.
%SB0012 #NUL_CFG Set when an attempt is made to put the CPU in Run mode when there is no
configuration data present.
%SB0013 #SFT_CPU Set when the CPU detects an error in the CPU operating system software.
%SB0014 #STOR_ER Set when an error occurs during a programmer store operation.
%SB0016 #MAX_IOC Set when more than 32 IOCs are configured for the system.
%SB0017 #SBUS_FL Set when the CPU fails to gain access to the bus.
%SC0009 #ANY_FLT Set when any fault occurs that causes an entry to be placed in the CPU or I/O Fault
Table. Cleared when both fault tables are cleared or when the CPU is power cycled.
%SC0010 #SY_FLT Set when any fault occurs that causes an entry to be placed in the CPU fault table.
Cleared when the CPU fault table is cleared or when the CPU is power cycled.
%SC0011 #IO_FLT Set when any fault occurs that causes an entry to be placed in the I/O Fault Table.
Cleared when the I/O Fault Table is cleared or when the CPU is power cycled.
%SC0012 #SY_PRES Set as long as there is at least one entry in the CPU fault table. Cleared when the
CPU fault table is cleared.
%SC0013 #IO_PRES Set as long as there is at least one entry in the I/O Fault Table. Cleared when the I/O
Fault Table is cleared.
%SC0014 #HRD_FLT Set when a hardware fault occurs. Cleared when both fault tables are cleared or
when the CPU is power cycled.
%SC0015 #SFT_FLT Set when a software fault occurs. Cleared when both fault tables are cleared or
when the CPU is power cycled.

6.8.3 Fault References

The fault references are discussed in Chapter 14 of this manual but are also listed here for your
convenience.
System Fault References
System Fault Ref Description
#ANY_FLT Any new fault in either table since the last power-up or clearing of the fault tables
#SY_FLT Any new system fault in the CPU fault table since the last power-up or clearing of the
fault tables
#IO_FLT Any new fault in the I/O Fault Table since the last power-up or clearing of fault tables
#SY_PRES Indicates that there is at least one entry in the CPU fault table
#IO_PRES Indicates that there is at least one entry in the I/O Fault Table
#HRD_FLT Any hardware fault
#SFT_FLT Any software fault
Configurable Fault References

Configurable Faults
(Default Action) Description
#SBUS_ER (diagnostic) System bus error. (The BSERR signal was generated on the VME system bus.)
#SFT_IOC (diagnostic) Non-recoverable software error in a Genius Bus Controller.
#LOS_RCK (diagnostic) Loss of rack (BRM failure, loss of power) or missing a configured rack.
#LOS_IOC (diagnostic) Loss of Bus Controller missing a configured Bus Controller.
#LOS_IOM (diagnostic) Loss of I/O module (does not respond) or missing a configured I/O module.
#LOS_SIO (diagnostic) Loss of intelligent option module (does not respond) or missing a configured module.
#IOC_FLT (diagnostic) Non-fatal bus or Bus Controller error—more than 10 bus errors in 10 seconds (error
rate is configurable).
#CFG_MM (fatal) Wrong module type detected during power-up, store of configuration, or Run mode.
The CPU does not check the configuration parameters set up for individual modules
such as Genius I/O blocks.

Non-Configurable Faults
Non-Configurable Faults (Action) Description
#SBUS_FL (fatal) System bus failure. The CPU was not able to access the VME bus. BUSGRT-
NMI error.
#HRD_CPU (fatal) CPU hardware fault, such as failed memory device or failed serial port.
#HRD_SIO (diagnostic) Non-fatal hardware fault on any module in the system.
#SFT_SIO (diagnostic) Non-recoverable software error in a LAN interface module.
#PB_SUM (fatal) Program or block checksum failure during power-up or in Run mode.
#LOW_BAT (diagnostic) The low battery indication is not supported for all CPU modules. For details,
refer to “Battery Status (Group 18)” in Chapter 14.
The CPU may set this contact when an I/O module or special-purpose
module has reported a low battery. In this case, a fault will be reported in
the I/O Fault Table.
#OV_SWP (diagnostic) Constant sweep time exceeded.
#SY_FULL, IO_FULL (diagnostic) CPU fault table full
I/O Fault Table full
#IOM_FLT (diagnostic) Point or channel on an I/O module—a partial failure of the module.
#APL_FLT (diagnostic) Application fault.
#ADD_RCK (diagnostic) New rack added, extra, or previously faulted rack has returned.
#ADD_IOC (diagnostic) Extra I/O Bus Controller or reset of I/O Bus Controller.
#ADD_IOM (diagnostic) Previously faulted I/O module is no longer faulted or extra I/O module.
#ADD_SIO (diagnostic) New intelligent option module is added, extra, or reset.
#NO_PROG (information) No application program is present at power-up. Should only occur the first
time the CPU is powered up or if the user memory is not retained.
#BAD_RAM (fatal) Corrupted program memory at power-up. Program could not be read
and/or did not pass checksum tests.
#WIND_ER (information) Window completion error. Servicing of Programmer or Logic Window was
skipped. Occurs in Constant Sweep mode.
#BAD_PWD (information) Change of privilege level request to a protection level was denied; bad
password.
#NUL_CFG (fatal) No configuration present upon transition to Run mode. Running without a
configuration is similar to suspending the I/O scans.
#SFT_CPU (fatal) CPU software fault. A non-recoverable error has been detected in the CPU.
May be caused by Watchdog Timer expiring.
#MAX_IOC (fatal) The maximum number of bus controllers has been exceeded. The CPU
supports 32 bus controllers.
#STOR_ER (fatal) Download of data to CPU from the programmer failed; some data in CPU
may be corrupted.

6.9. How Program Functions Handle Numerical Data

Regardless of where data is stored in memory – in one of the bit memories or one of the word
memories – the application program can handle it as different data types.
6.9.1 Data Types
Type Name Description Data Format
BOOL Boolean The smallest unit of memory. It has two states: 1 or 0.
A BOOL array may have length N.
BYTE Byte Has an 8-bit value. Has 256 values (0–255). A BYTE
array may have length N.
WORD Word Uses 16 consecutive bits of data memory. The valid Register
range of word values is 0000 hex to FFFF hex. (16 bit states)
16 1
DWORD Double Word Has the same characteristics as a single word data Register 2 Register 1
type, except that it uses 32 consecutive bits in data
memory instead of only 16 bits. 32 17 16 1
(32 bit states)
UINT Unsigned Uses 16-bit memory data locations. They have a valid Register
Integer range of 0 to +65535 (FFFF hex). (Binary value)
16 1
INT Signed Uses 16-bit memory data locations, and are Register 1 (Two’s
Integer represented in 2’s complement notation. The valid S Complement
range of an INT data type is –32768 to +32767. 16 1 value)
s=sign bit
(0=positive, 1=negative)
DINT Double Stored in 32-bit data memory locations (two Register 2 Register 1
Precision consecutive 16-bit memory locations). Always signed s
32 17 16 1
Integer values (bit 32 is the sign bit). The valid range of a DINT (Binary value)
data type is -2147483648 to +2147483647
s=sign bit
(0=positive, 1=negative)
REAL Floating Point Uses 32 consecutive bits (two consecutive 16-bit Register 2 Register 1
memory locations).
32 17 16 1
The range of numbers that can be stored in this (IEEE format)
format is from ±1.401298E-45 to ±3.402823E+38.
For the IEEE format, refer to “Floating Point Numbers”
on page 145.
LREAL Double Uses 64 consecutive bits (four consecutive 16-bit Register 2 Register 1
Precision memory locations).
Floating Point The range of numbers that can be stored in this 32 17 16 1
format is from ±2.2250738585072020E-308 to Register 4 Register 3

±1.7976931348623157E+308.
64 49 48 33
For the IEEE format, refer to “Floating Point Numbers”
(IEEE format)
on page 145.

Type Name Description Data Format

BCD-4 Four-Digit Uses 16-bit data memory locations. Each binary Register 1
BCD coded decimal (BCD) digit uses four bits and can 4 3 2 1 (4 BCD digits)
represent numbers between 0 and 9. This BCD coding 13 9 5 1
of the 16 bits has a legal value range of 0 to 9999.
BCD-8 Eight-Digit Uses two consecutive 16-bit data memory locations Register 2 Register 1
BCD (32 consecutive bits). Each BCD digit uses 4 bits per 8 7 6 5 4 3 8 1
digit to represent numbers from 0 to 9. The complete 32 29 25 21 17 16 13 9 5 1

valid range of the 8-digit BCD data type is 0 to (8 BCD digits)
99999999.
MIXED Mixed Available only with the MUL and DIV functions. The 16 16 32
=
MUL function takes two integer inputs and produces a
32 16 16
double integer result. The DIV function takes a double =
integer dividend and an integer divisor to product an
integer result.
ASCII ASCII Eight-bit encoded characters. A single word reference
is required to make two (packed) ASCII characters. The
first character of the pair corresponds to the low byte
of the reference word. The remaining 7 bits in each
section are converted.
Note: Using functions that are not explicitly bit-typed will affect transitions for all bits in the written
byte/word/dword. For information about using floating point numbers, refer to Floating Point
Numbers on page 145.

6.9.2 Floating Point Numbers

Floating point numbers are stored in one of two IEEE 754 standard formats that uses adjacent 16-bit
words: 32-bit single precision or 64-bit double precision.
The REAL data type represents single precision floating point numbers. The LREAL data type
represents double precision floating point numbers. REAL and LREAL variables are typically used to
store data from analog I/O devices, calculated values, and constants.
Types of Floating Point Variables
Data Type Precision and Range
REAL Limited to 6 or 7 significant digits, with a range of approximately
±1.401298x10-45 through ±3.402823x1038.
LREAL Limited to 17 significant digits, with a range of approximately
±2.2250738585072020x10-308 to ±1.7976931348623157x10308.
Note: The programming software allows 32-bit and 64-bit arguments (DWORD, DINT, REAL, and
LREAL) to be placed in discrete memories such as %I, %M, and %R in the PACSystems target.
This is not allowed on Series 90-70 targets. (Note that any bit reference address that is
passed to a non-bit parameter must be byte-aligned. This is the same as the Series 90-70
CPU.)
Internal Format of REAL Numbers
Bits 17-32 Bits 1-16
32 17 16 1
23-bit mantissa
8-bit exponent
1-bit sign (Bit 32)
Register use by a single floating point number is diagrammed below. For example, if the floating
point number occupies registers R5 and R6, R5 is the least significant register and R6 is the most
significant register.
Most Significant Register Least Significant Register
Bits 17-32 Bits 1-16
32 17 16 1
Most Significant Bit Least Significant Bit Most Significant Bit Least Significant Bit
Internal Format of LREAL Numbers

Bits 49-64 Bits 33-48 Bits 17-32 Bits 1-16
52-bit mantissa
11-bit exponent
1-bit sign (Bit 64)

Errors in Floating Point Numbers and Operations

Overflow occurs when a REAL or LREAL function generates a number outside the allowed range.
When this occurs, the Enable Out output of the function is set Off, and the result is set to positive
infinity (for a number greater than the upper limit) or negative infinity (for a number less than the
lower limit). You can determine where this occurs by testing the sense of the Enable Out output.
Binary representations of Infinity and NaN values have exponents that contain all 1s.
IEEE 754 Infinity Representations
REAL LREAL
POS_INF (positive infinity) = 7F800000h = 7FF0000000000000h
NEG_INF (negative infinity) = FF800000h = 7FF0000000000001h
If the infinities produced by overflow are used as operands to other REAL or LREAL functions, they
may cause an undefined result. This undefined result is referred to as an NaN (Not a Number). For
example, the result of adding positive infinity to negative infinity is undefined. When the ADD_REAL
function is invoked with positive infinity and negative infinity as its operands, it produces an NaN. If
any operand of a function is a NaN, the result will be some NaN.
Note: For NaN, the Enable Out output is Off (not energized).
IEEE 754 Representations of NaN values:
REAL LREAL
7F800001 through 7FFFFFFF 7FF8000000000001 through 7FFFFFFFFFFFFFFF
FF800001 through FFFFFFFF FFF0000000000001 through FFFFFFFFFFFFFFFF
Note: For releases 5.0 and greater, the CPU may return slightly different values for NaN compared
to previous releases. In some cases, the result is a special type of NaN displayed as #IND in
Machine Edition. In these cases, for example, EXP(-infinity), power flow out of the function is
identical to that in previous releases.

6.10. User Defined Types (UDTs)

A UDT is a structured data type consisting of elements of other selected data types. Each top-level
UDT element can be one of the following:
Top-level UDT Element Example
Simple data type, except STRING INT
Another UDT, except any in which the current UDT A UDT named UDT_ABC has a top-level element whose
is nested at any level. data type is another UDT, named UDT_2.
Note: A UDT cannot be nested within itself.
Array of a simple data type LREAL array of length 8.
Array of UDTs A UDT named UDT_ABC has a top-level element that is an
Note: A UDT cannot be nested within itself. array whose data type is another UDT, named UDT_row.
6.10.1 Working with UDTs

1. In Machine Edition, add a UDT as a node under a target in the
Project tab of the Navigator. A UDT will be saved with the
target in which it is used.
2. Edit the UDT properties and define the elements in the UDT’s
structure.
3. Create a variable whose data type is the UDT. By default, the Figure 26: Adding a UDT to
variable resides in symbolic memory. You can convert the Project in PME Navigator
symbolic variable to an I/O variable by assigning it to an I/O
terminal.
4. Use the variable in logic.
6.10.2 UDT Properties

Name: The UDT’s name. Maximum length: 32 characters.
Description: The user-defined description of the UDT.
Memory Type: The type of symbolic or I/O variable memory in which a variable of this UDT resides.
Non-Discrete: (Default) Word-oriented memory organized in groups of 16 contiguous bits.
Discrete: Bit-oriented memory.
Notes: You cannot nest a UDT of one memory type in a UDT of a different memory type. Changing
the memory type propagates to existing variables of this UDT only after target validation.
Is Fixed Size: If set to True, you can increase the Size (Bytes) value to a maximum of 65,535 bytes to
create a buffer at the end of the UDT. The buffer is included in the memory allocated to every
downloaded variable of that UDT data type. Use of a buffer may allow run mode store of a UDT when
the size of the UDT definition has changed. For details, see page 148.
If set to False (default), the Size (Bytes) value is read-only and does not include a buffer at the end of
the UDT.
Size (bytes): (Read-only when Is Fixed Size is set to False.) The total number of bytes required to store
a structure variable of the user-defined data type (UDT).
Bytes Remaining: (Read-only; displayed if Is Fixed Size is set to True.) The UDT's buffer size; the
number of bytes available before the actual size of the UDT reaches the value of the Size (bytes)
property.

6.10.3 UDT Limits

 Maximum number of UDTs per target: 2048
 Maximum UDT size: 65,535 bytes
Note: Bit spares created to line up the end of a section of BOOL variables or arrays with the end of
a byte will count toward the maximum size.
 Maximum number of top-level UDT elements: 1024
 Maximum array size of a top-level UDT element: 1024 array elements
 UDTs do not support the following:
- Two-dimensional arrays
- Function block data types
- Enumerated data types
 You cannot nest a UDT of one memory type in a UDT of a different memory type.
 You cannot alias a variable to a UDT variable or UDT variable element.
 A FAULT contact supports a BOOL element of a UDT I/O variable, but not a BOOL element of a
UDT parameter in a UDFB or parameterized block.
 POSCON and NEGCON do not support BOOL elements of UDT parameters in parameterized
blocks or UDFBs.
6.10.4 Run Mode Store of UDTs
An RMS can be performed on a target that contains a variable of a UDT, unless:
 An operation in the UDT editor modifies the offset or bit mask of an element that has the same
name before and after the operation.
 The size of the UDT definition increases.
 Array length increases.
 The memory type of the UDT definition changes.
 There is a data type change in the UDT definition, except for the following interchangeable data
types:
- WORD, INT, UINT
- DWORD, DINT
 The UDT definition is renamed.

6.10.5 UDT Operational Notes

 By default, a UDT variable resides in symbolic memory. You can convert the symbolic variable to
an I/O variable.
 All UDT elements are public and, therefore, readable and writeable.
 Properties of elements of UDT variables:
The Input Transfer List and Output Transfer List properties are read-only and set to False.
The Retentive property is editable only for BOOLs and only if the UDT Memory Type is discrete. For
UDTs whose Memory Type is non-discrete, a BOOL variable has its Retentive property set to True
during validation.
 UDT variables are supported in LD, FBD, and ST blocks, as well as in Diagnostic Logic Blocks.
For additional operational notes, refer to the programmer Help.
Example
You want to set up six COMMREQ commands to send values to a series of six identical intelligent
modules that require individualized data of the same data types in the same format, specified by the
manual for the intelligent module. This data contains header information and several words of data.
You could proceed as follows:
1. Add a UDT named COMMREQ6 and edit it to contain the data in the required data types and
sequence.
2. Create an array of length 6, named ABC, of the COMMREQ6 data type.
3. The array resides in symbolic memory. You can convert the symbolic variable to an I/O variable.
4. Populate the variable. If the value of an element needs to be the same for all six COMMREQ6
elements, you can set up an ST for loop that uses a variable index to populate each element with
the same data, for example:
for i = 1 to 6 do
ABC[i].WaitFlag := 0;
end_for;
5. Just before issuing one or more COMMREQs, use the Move to Flat instruction to "flatten" the
COMMREQ6 array or one or more of its top-level elements from a structure to a "flat" series of
contiguous registers in an area of % memory supported by COMMREQ.
6. Issue the COMMREQs based on the % memory registers that you just populated with the Move to
Flat instruction.
Although you can populate the memory registers directly without a UDT and Move to Flat, there are
advantages when working with UDT variables:
 UDT variables reside in symbolic or I/O variable memory, which protects them from memory
overlaps and offers more protection against overwriting, whereas reference memory areas offer
no such protection. It is best to use reference memory just before issuing a COMMREQ.
 You can work with meaningful structure variable names and structure element names.
 You can set up loops with variable indexes to populate some of the values.

6.11. Operands for Instructions

The operands for PACSystems instructions can be in the following forms:
 Constants
 Variables that are located in any of the PACSystems memory areas (%I, %Q, %M, %T, %G, %S,
%SA, %SB, %SC, %R, %W, %L, %P, %AI, %AQ)
 Symbolic variables, including I/O variables
 Parameters of a Parameterized block or C block
 Power flow
 Data flow
 Computed references such as indirect references or bit-in-word references
 BOOL arrays
An operand’s type and length must be compatible with that of the parameter it is being passed into.
PACSystems instructions and functions have the following operand restrictions:
 Constants cannot be used as operands to output parameters because output values cannot be
written to constants.
 Variables located in %S memory cannot be used as operands to output parameters because %S
memory is read-only.
 Variables located in %S, %SA, %SB, and %SC memories cannot be used as operands to
numerical parameters such as INTs, DINTs, REALs, LREALs, etc.
 Data flow is prohibited on some input parameters of some functions. This occurs when the
function, during the course of its execution, actually writes a value to the input parameter. Data
flow is prohibited in these cases because data flow is stored in a temporary memory and any
updated value assigned to it would be inaccessible to the user application.
 The arguments to EN, OK, and many other BOOLEAN input and output parameters are restricted
to be power flow.
 Restrictions on using Parameterized block or External block parameters as operands to
instructions or functions are documented in Chapter 5.
 References in discrete memory (I, Q, M, and T) must be byte-aligned.
Note the following:
 Indirect references, which are available for all WORD-oriented memories (%R, %W, %P, %L, %AI,
%AQ), can be used as arguments to instructions wherever located variables in the corresponding
WORD-oriented memory are allowed. Note that indirect references are converted into their
corresponding direct references immediately before they are passed into an instruction or
function.
 Bit-in-word references are generally allowed on contact and coil instructions other than legacy
transition contacts and coils (POSCON, NEGCON, POSCOIL and NEGCOIL). They are also allowed
as arguments to function parameters that accept single or unaligned bits.

BOOL arrays can be used as parameters to an instruction instead of variables of other data types.
The array must be of sufficient length to replace the given data type. For example, instead of using a
16-bit INT variable, you could use a BOOL array of length 16 or more.
The following conditions must be met:
 The BOOL array must be byte-aligned, that is, the reference address of the first element of the
BOOL array must be 8n + 1, where n = 0, 1, 2, 3, and so on. For example, %M00033 is byte-
aligned, because 33 = (8 × 4) + 1.
 The parameter in question must support discrete memory reference addresses.
 The instruction in question must not have a Length parameter. (The Length parameter is
displayed as ?? in the LD editor until a value has been assigned.)
 The data type to be replaced with a BOOL array must be one of the following:
Data Type Minimum Length
BYTE 8
INT, UINT, WORD 16
DINT, DWORD, REAL 32
REAL 64
 Excess bits are ignored. For example, if you use a BOOL array of length 12 instead of an 8-bit
BYTE, the last four bits of the BOOL array are ignored.

6.12. Word-for-Word Changes

Many changes to the program that do not modify the size of the program are considered word-for-
word changes. Examples include changing the type of contact or coil, or changing a reference
address used for an existing function block.
The following are word-for-word changes:
 Switching between two symbolic variables
 Switching between an symbolic variable and a mapped variable
 Switching between a constant and a symbolic variable
6.12.1 Exception: Symbolic Variables

Creating, deleting, or modifying a symbolic variable definition is not a word-for-word change.

Chapter 7 Ladder Diagram (LD) Programming
This chapter describes the programming instructions that can be used to create ladder logic
programs for the PACSystems control system.
For an overview of the types of operands that can be used with instructions, refer to “Operands for
Instructions” in Chapter 6.
The ladder logic implementation of the PACSystems instruction set includes the following categories:
■ Advanced Math see page 154
■ Bit Operations 159
■ Coils 176
■ Communication
Consists of the PNIO_DEV_COMM function. For details, refer to the PACSystems RX3i PROFINET
Controller Manual, GFK-2571.
■ Contacts 184
■ Control Functions 193
■ Conversion Functions 212
■ Counters 226
■ Data Move Functions 231
■ Data Table Functions 264
■ Math Functions 281
■ Program Flow Functions 292
■ Relational Functions 301
■ Timers 306
■ Motion Functions and Function Blocks
RX3i CPUs support PLCopen compliant motion functions and function blocks. Details of these
function blocks can be found in the PACMotion Multi-Axis Motion Controller User’s Manual, GFK-
2448.

Chapter 7. Ladder Diagram (LD) Programming
7.1. Advanced Math Functions

The Advanced Math functions perform logarithmic, exponential, square root, trigonometric, and
inverse trigonometric operations.
Function Mnemonic Description
Exponential EXP_REAL Raises e to the value specified in IN (eIN). Calculates the inverse natural
EXP_LREAL logarithm of the IN operand.
EXPT_REAL Calculates IN1 to the IN2 power (IN1IN2).
EXPT_LREAL
Inverse Trig ACOS_REAL Calculates the inverse cosine of the IN operand and expresses the
ACOS_LREAL result in radians.
ASIN_REAL Calculates the inverse sine of the IN operand and expresses the result
ASIN_LREAL in radians.
ATAN_REAL Calculates the inverse tangent of the IN operand and expresses the
ATAN_LREAL result in radians.
Logarithmic LN_REAL Calculates the natural logarithm of the operand IN.
LN_LREAL
LOG_REAL Calculates the base 10 logarithm of the operand IN.
LOG_LREAL
Square Root SQRT_DINT Calculates the square root of the operand IN, a double-precision
integer, and stores in Q the double-precision integer portion of the
square root of the input IN.
SQRT_INT Calculates the square root of the operand IN, a single-precision integer,
and stores in Q the single-precision integer portion of the square root
of the input IN.
SQRT_REAL Calculates the square root of the operand IN, a real number, and stores
the real-number result in Q
SQRT_LREAL
Trig COS_REAL Calculates the cosine of the operand IN, where IN is expressed in
COS_LREAL radians.
SIN_REAL Calculates the sine of the operand IN, where IN is expressed in radians.
SIN_LREAL
TAN_REAL Calculates the tangent of the operand IN, where IN is expressed in
TAN_LREAL radians.

7.1.1 Exponential/Logarithmic Functions

When an exponential or logarithmic function receives power flow, it performs the appropriate
operation on the REAL or LREAL input value(s) and places the result in output Q.
The inverse natural log (EXP)
function raises e to the power
specified by IN.
The Power of X (EXPT) function

raises the value of input IN1 to
the power specified by the
value IN2.
The Base 10 Logarithm (LOG)

function calculates the base 10
logarithm of IN.
The Natural Logarithm (LN)

function calculates the
logarithm of IN.
The power flow output is energized when the function is performed, unless overflow or one of the
following invalid conditions occurs:
■ IN < 0, for LOG or LN
■ IN1 < 0, for EXPT
■ IN is negative infinity, for EXP
■ IN, IN1, or IN2 is a NaN (Not a Number)
Operands of the Exponential/Logarithmic Functions
Parameter Description Allowed Operands Optional
IN or IN1 For EXP, LOG, and LN, IN contains the REAL or LREAL All except variables No
value to be operated on. located in %S—%SC
The EXPT function has two inputs, IN1 and IN2. For
EXPT, IN1 is the base value and IN2 is the exponent.
IN2 (EXPT) The REAL or LREAL exponent for EXPT. All except variables No
located in %S—%SC
Q Contains the REAL or LREAL logarithmic/exponential All except constants No
value of IN or of IN1 and IN2. and variables located
in %S—%SC

7.1.2 Square Root

Mnemonics:
SQRT_DINT
SQRT_INT
SQRT_REAL
SQRT_LREAL
When the Square Root function receives power flow, it finds the square root of IN and stores the
result in Q. The output Q must be the same data type as IN.
The power flow output is energized when the function is performed without overflow, unless one of
these invalid REAL operations occurs:
■ If IN < 0, Q is set to 0 and ENO is set FALSE.
■ If IN is a NaN (Not a Number), Q will also be a NaN value and ENO will be set false.
Example
The square root of the integer number located at %AI0001 is placed into %R00003 when %I00001 is
ON.
Operands for the Square Root Function

IN The value to calculate the All except variables located in %S - %SC No
square root of. If IN < 0, the
function does not pass
power flow.
Q The calculated square root. All except constants and variables located in %S - No
%SC

7.1.3 Trig Functions

Mnemonics:
SIN_REAL
SIN_LREAL
COS_REAL
COS_LREAL
TAN_REAL
TAN_LREAL
The SIN, COS, and TAN functions are used to find the trigonometric sine, cosine, and tangent,
respectively, of an input whose units are radians. When one of these functions receives power flow, it
computes the sine (or cosine or tangent) of IN and stores the result in output Q.
The SIN, COS, and TAN functions accept a broad range of input values, where –263 < IN < 263,
(263 is approximately 9.22x1018). Input values outside this range will produce incorrect results.
The power flow output is energized unless the following invalid condition occurs:
■ IN or Q is a NaN (Not a Number)
Operands of Trig Functions
IN Number of radians. All except variables located in %S— No
–263 < IN < 263 %SC
Q Trigonometric value of IN (REAL or All except constants and variables No

LREAL) located in %S—%SC
Example
The COS of the value in V_R00001 is placed in V_R00033.

7.1.4 Inverse Trig – ASIN, ACOS, and ATAN

Mnemonics:
ASIN_REAL
ASIN_LREAL
ACOS_REAL
ACOS_LREAL
ATAN_REAL
ATAN_LREAL
When an Inverse Sine (ASIN), Inverse Cosine (ACOS), or Inverse Tangent (ATAN) function receives
power flow, it respectively computes the inverse sine, inverse cosine or inverse tangent of IN and
stores the result in radians in output Q.
The ASIN and ACOS functions accept a narrow range of input values, where –1 ≤ IN ≤ 1. Given a valid
value for the IN parameter, the ASIN function produces a result Q such that:
π π
ASIN(IN) = − ≤Q≤
2 2
The ACOS function produces a result Q such that:
ACOS(IN) = −0 ≤ Q ≤ π
The ATAN function accepts the broadest range of input values, where –∞ ≤ IN ≤ +∞. Given a valid
value for the IN parameter, the ATAN function produces a result Q such that:
π π
ATAN(IN) = − ≤Q≤
2 2
The power flow output is energized unless one of the following invalid conditions occurs:
■ IN is outside the valid range for ASIN, ACOS, or ATAN
■ IN is a NaN (Not a Number)
Operands of Inverse Trig Functions
IN The REAL or LREAL value to All except variables located in %S - %SC No
process.
ASIN and ACOS: -1 ≤ IN ≤ 1
ATAN: –∞ ≤ IN ≤ +∞
Q Trigonometric value of IN. REAL or All except constants and variables located No
LREAL value expressed in radians. in %S - %SC
ASIN: (-π/2) ≤ Q ≤ (π/2)
ACOS: 0 ≤ Q ≤ π
ATAN: (-π/2) ≤ Q ≤ (π/2)

7.2. Bit Operation Functions

The Bit Operation functions perform comparison, logical, and move operations on bit strings.
Function Mnemonics Description
Bit Position BIT_POS_DWORD Bit Position. Locates a bit set to 1 in a bit string.
BIT_POS_WORD
Bit Sequencer BIT_SEQ Bit Sequencer. Sequences a string of bit values, starting at ST.
Performs a bit sequence shift through an array of bits. The maximum
length allowed is 256 words.
Bit Set, Clear BIT_SET_DWORD Bit Set. Sets a bit in a bit string to 1.
BIT_SET_WORD
BIT_CLR_DWORD Bit Clear. Clear a bit within a string by setting that bit to 0.
BIT_CLR_WORD
Bit Test BIT_TEST_DWORD Bit Test. Tests a bit within a bit string to determine whether that bit is
BIT_TEST_WORD currently 1 or 0.
Logical AND AND_DWORD Compares the bit strings IN1 and IN2 bit by bit. When a pair of
AND_WORD corresponding bits are both 1, places a 1 in the corresponding location
in output string Q; otherwise, places a 0 in the corresponding location
in Q.
Logical NOT NOT_DWORD Logical invert. Sets the state of each bit in output bit string Q to the
NOT_WORD opposite state of the corresponding bit in bit string IN1.
Logical OR OR_DWORD Compares the bit strings IN1 and IN2 bit by bit. When a pair of
OR_WORD corresponding bits are both 0, places a 0 in the corresponding location
in output string Q; otherwise, places a 1 in the corresponding location
in Q.
Logical XOR XOR_DWORD Compares the bit strings IN1 and IN2 bit by bit. When a pair of
XOR_WORD corresponding bits are different, places a 1 in the corresponding
location in the output bit string Q; when a pair of corresponding bits
are the same, places a 0 in Q.
Masked MASK_COMP_DWORD Masked Compare. Compares the contents of two separate bit strings
Compare MASK_COMP_WORD with the ability to mask selected bits.
Rotate Bits ROL_DWORD Rotate Left. Rotates all the bits in a string a specified number of places
ROL_WORD to the left.
ROR_DWORD Rotate Right. Rotates all the bits in a string a specified number of
ROR_WORD places to the right.
Shift Bits SHIFTL_DWORD Shift Left. Shifts all the bits in a word or string of words to the left by a
SHIFTL_WORD specified number of places.
SHIFTR_DWORD Shift Right. Shifts all the bits in a word or string of words to the right by
SHIFTR_WORD a specified number of places.

7.2.1 Data Lengths for the Bit Operation Functions

The Bit Operation functions operate on a single WORD or DWORD of data or up to 256 WORDs or
DWORDs that occupy adjacent memory locations.
Bit Operation functions treat the WORD or DWORD data as a continuous string of bits, with bit 1 of
the first WORD or DWORD being the Least Significant Bit (LSB). The last bit of the last WORD or
DWORD is the Most Significant Bit (MSB). For example, if you specify three WORDs of data beginning
at reference %R0100, they are treated as 48 contiguous bits.
Warning
Overlapping input and output reference address ranges in multiword
functions is not recommended, as it can produce unexpected results
.
Note that for all functions (Bit Test, Bit Set, Bit Clear, and Bit Position) that return a bit position
indicator as an output parameter (POS), bit position numbering starts at 1, not 0, as shown in the
diagram above.

7.2.2 Bit Position
The Bit Position function locates a bit set to 1 in a bit string.

Each scan that power is received, the function scans the bit string starting at IN. When the function
stops scanning, either a bit equal to 1 has been found or the entire length of the string has been
scanned.
POS is set to the position within the bit string of the first non-zero bit; POS is set to zero if no non-zero
bit is found.
A string length of 1 to 256 WORDs or DWORDs can be selected. The function passes power flow to
the right whenever it receives power.
Operands of Bit Position
Length The number of WORDs or DWORDs in the bit Constants No
(displayed as string. 1 ≤ Length ≤ 256.
??)
IN The data to operate on All. Constants may only be No
used when Length is 1.
Q Energized if a bit set to 1 is found Flow Yes

POS An unsigned integer giving the position of the All except constants and No
first nonzero bit found, or zero if no non-zero variables located in %S -
bit is found %SC
Examples
When V_I00001 is set, the bit string starting at V_M00001 is searched until a bit equal to 1 is found, or
6 words have been searched. Coil V_Q00001 is turned on. If a bit equal to 1 is found, its location
within the bit string is written to V_AQ0001 and V_Q00002 is turned on. For example, if V_00001 is
set, bit V_M00001 is 0, and bit V_M0002 is 1, the value written to V_AQ0001 is 2.

7.2.3 Bit Sequencer

The Bit Sequencer (BIT_SEQ) function performs a bit sequence shift through a series
of contiguous bits.
The operation of BIT_SEQ depends on the value of the reset input (R), and both the
current value and previous value of the enabling power flow input (EN):
R Current EN Previous EN Current Bit Sequencer Execution

Execution Execution Execution
ON ON/OFF ON/OFF Bit sequencer resets
OFF OFF ON Bit sequencer increments/decrements
by 1
OFF Bit sequencer does not execute
ON ON/OFF Bit sequencer does not execute
The reset input (R) overrides the enabling power flow (EN) and always resets the sequencer. When R is
active, the current step number is set to the value of the optional N operand. If you did not specify N,
the step number is set to 1. All bits in the bit sequencer, ST, are set to 0, except for the bit pointed to
by the current step, which is set to 1.
When EN is active and R is not active, and the previous EN was OFF, the bit pointed to by the current
step number is cleared. The current step number is incremented or decremented, based on the
direction (DIR) operand. Then the bit pointed to by the new step number is set to 1.
■ When the step number is being incremented and it goes outside the range of
(1 ≤ step number ≤ Length), it is set back to 1.
■ When the step number is being decremented and it goes outside the range of
(1 ≤ step number ≤ Length), it is set to Length.
The parameter ST is optional. If it is not used, BIT_SEQ operates as described above, except that no
bits are set or cleared. The function just cycles the current step number through its allowed range.
BIT_SEQ passes power to the right whenever it receives power.
Note: Before using the BIT_SEQUENCER function block, the current step number (Word 1 in the
control block) must be set to an integer value between 1 and the length, as defined in the
function block properties. Failure to properly initialize the step number in the BIT_SEQUENCER
function block may result in the CPU going to STOP-HALT mode.
Asserting the Reset parameter (R), before using the BIT SEQUENCER function block assures
that the current step number is set to a valid value.

Memory Required for Bit Sequencer

Each bit sequencer uses a three word array of control block information. The control block can be a
symbolic variable or it can be located in %R, %W, %L, or %P memory:
Word 1 current step number
Word 2 length of sequence (in bits)
Word 3 control word
Note: Do not write to the control block memory registers from other functions.
Word 3 (the control word) stores the state of the Boolean inputs and outputs of its associated
function in the following format:
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Reserved
Reserved
OK (status input
EN (enable input
Notes:
Bits 0 through 13 are not used.
In the N operand, bits are entered as 1 through 16, not 0 through 15.
Operands for Bit Sequencer
Warning
Do not write to the Control Block memory with other instructions.
Overlapping references may cause erratic operation of BIT_SEQ.

Address Beginning address of the Control Block, which is a three- Symbolic variables, variables No
(????) word array: located in %R, %W, %P, or %L
Word 1: current step number
Word 2: length of sequence in bits
Word 3: control word, which tracks the status of the last
enabling power flow and the status of the power flow to
the right.
Length (??) The number of bits in the bit sequencer, ST, that BIT_SEQ Constants No
will step through. 1 ≤ Length ≤ 256.
R When R is energized, the step number of BIT_SEQ is set to Flow No
the value in N (default = 1), and the bit sequencer, ST, is
filled with zeroes, except for the current step number bit.


DIR (Direction) When DIR is energized, the step number of Flow No
BIT_SEQ is incremented prior to the shift. Otherwise, it is
decremented.
N The value that the step number is set to when R is All except variables located in Yes
energized. Default value is 1. 1 ≤ N ≤ Length. If N < 1, the %S - %SC
step number will be reset to 1 when R is energized. If N >
Length, the step number will be reset to Length. Must be
an integer variable or constant.
ST Contains the first word of the bit sequencer. All except constants, flow, and Yes
If ST is not used, the Bit Sequencer function operates as variables located in %S
described above, except that no bits are set or cleared.
The function just cycles the current step number (in word
1 of the control block) through its allowed range.
If ST is in %M memory and the Length is 3, the bit
sequencer occupies 3 bits; the other 5 bits of the byte are
not used. If ST is in %R memory, and the Length is 17, the
bit sequencer uses 4 bytes, all of %R1 and %R2.
Example
In the following example, a #FST_SCN system variable is used to set CLEAR to ON for one scan. This
sets the step number in Word 1 of the Bit Sequencer’s control block to an initial value of 3.
The Bit Sequencer operates on register memory %R00001. Its control block is stored in registers
%R0010, %R0011, and %R0012. When CLEAR is active, the sequencer is reset and the current step is
set to step number 3, as specified in N. The third bit of %R0001 is set to one and the other seven bits
are set to zero.
When NXT_CYC is active and CLEAR is not active, the bit for step number 3 is cleared and the bit for
step number 2 or 4 (depending on whether DIRECTION is energized) is set.

7.2.4 Bit Set, Bit Clear

Mnemonics
BIT_SET_DWORD
BIT_SET_WORD
BIT_CLR_DWORD
BIT_CLR_WORD
The Bit Set (BIT_SET_DWORD and BIT_SET_WORD) function sets a bit in a bit string to 1. The Bit Clear
(BIT_CLR_DWORD and BIT_CLR_WORD) function clears a bit in a string by setting the bit to 0.
Each scan that power is received; the function sets or clears the specified bit. If a variable rather than
a constant is used to specify the bit number, the same function can set or clear different bits on
successive scans. Only one bit is set or cleared, and the transition information for that bit is updated.
The transition status of all the other bits in the bit string is not affected.
The function passes power flow to the right, unless the value for BIT is outside the specified range.
Operands for Bit Set, Bit Clear
Length (??) The number of WORDs or DWORDs in Constants No
the bit string. 1 ≤ Length ≤ 256.
IN The first WORD or DWORD of the data All except constants, flow, and variables No
to process located in %S
BIT The number of the bit to set or clear in All except variables located in %S - %SC No
IN. 1 ≤ BIT ≤ (16 × Length) for WORD.
1 ≤ BIT ≤ (32 × length) for DWORD
Example 1
Whenever input V_I0001 is set, bit 12 of the string beginning at reference
%R00040 (as specified by variable V_R0040) is set to 1.
Example 2
Whenever V_I00001 is set, %M00043, the third bit of the string beginning at
%M00041, is set to 1. Note that neither the status nor the transition value of
any of the other bits in the same byte as %M00043 (e.g., %M00041, %M00042,
%M00044, etc.) is affected by the BIT_SET function

7.2.5 Bit Test

When the Bit Test function receives power flow, it tests a bit within a bit string to
determine whether that bit is currently 1 or 0. The result of the test is placed in
output Q.
Each scan that power is received, the Bit Test function sets its output Q to the
same state as the specified bit. If a register rather than a constant is used to
specify the bit number, the same function can test different bits on successive
sweeps. If the value of BIT is outside the range (1 ≤ BIT ≤ (16 × length) for a WORD
and 1 ≤ BIT ≤ (32 × length) for a DWORD), then Q is set OFF.
You can specify a string length of 1 to 256 WORDs or DWORDs.
Note: When using the Bit Test function, the bits are numbered 1 through 16 for a WORD, not 0
through 15. They are numbered 1 through 32 for a DWORD.
Operands for Bit Test
Length (??) The number of WORDs or DWORDs in the data Constant No
string to test. 1 ≤ Length ≤ 256.
IN The first WORD or DWORD in the data to test All No
BIT The number of the bit to test in IN. 1 ≤ BIT ≤ All except variables located No
(16×Length). in %S - %SC
Q The state of the specific bit tested; Q is energized if Flow No
the bit tested is a 1.
Example 1
When input V_I0001 is set, the bit at the location
contained in reference PICKBIT is tested.
The bit is part of string PRD_CDE.
If it is 1, output Q passes power flow to the ADD
function, causing 1 to be added to the current
value of the ADD function input IN1.
Example 2
When input V_I0001 is set, the bit at the location
contained in reference PICKBIT is tested.
The bit is part of string PRD_CDE.
If it is 1, output Q passes power flow and the coil
V_Q0001 is turned on

7.2.6 Logical AND, Logical OR, and Logical XOR
Each scan that power is received, the Logical function examines each bit in bit string IN1 and the
corresponding bit in bit string IN2, beginning with the least significant bit in each. You can specify a
string length of 1 to 256 WORDs or DWORDs. The IN1 and IN2 bit strings specified may overlap.
Logical AND
If both bits examined by the Logical AND function are 1, AND places a 1 in the corresponding location
in output string Q. If either bit is 0 or both bits are 0, AND places a 0 in string Q in that location.
AND passes power flow to the right whenever it receives power.
Tip: You can use the Logical AND function to build masks or screens, where only certain bits are
passed (the bits opposite a 1 in the mask), and all other bits are set to 0.
Logical OR
If either bit examined by the Logical OR function is 1, OR places a 1 in the corresponding location in
output string Q. If both bits are 0, Logical OR places a 0 in string Q in that location. The function
passes power flow to the right whenever it receives power.
Tips:
■ You can use the Logical OR function to combine strings or to control many outputs with one
simple logical structure. The Logical OR function is the equivalent of two relay contacts in parallel
multiplied by the number of bits in the string.
■ You can use the Logical OR function to drive indicator lamps directly from input states or to
superimpose blinking conditions on status lights.
Logical XOR
When the Exclusive OR (XOR) function receives power flow, it compares each bit in bit string IN1 with
the corresponding bit in string IN2. If the bits are different, a 1 is placed in the corresponding position
in the output bit string.
For each pair of bits examined, if only one bit is 1, then XOR places a 1 in the corresponding location
in bit string Q. XOR passes power flow to the right whenever it receives power.
Tips for Logical XOR
■ If string IN2 and output string Q begin at the same reference, a 1 placed in string IN1 will cause
the corresponding bit in string IN2 to alternate between 0 and 1, changing state with each scan
as long as power is received.
■ You can program longer cycles by pulsing the power flow to the function at twice the desired
rate of flashing. The power flow pulse should be one scan long (one-shot type coil or self resetting
timer).
■ You can use XOR to quickly compare two bit strings, or to blink a group of bits at the rate of one
ON state per two scans.
■ XOR is useful for transparency masks.

Operands for Logical AND, OR, and XOR

Length (??) The number of words in the bit string Constant No
on which to perform the logical
operation. 1 ≤ Length ≤ 256.
IN1 The first WORD or DWORD of the first All No
string operate on.
IN2 (Must be the same The first WORD or DWORD of the All No
data type as IN1.) second string to operate on.
Q (Must be the same The first WORD or DWORD of the All except constants and No
data type as IN1.) operation’s result. variables located in %S
memory
Example: Logical AND

When input v_I0001 is set, the 16bit strings represented by variables WORD1 and WORD2 are
examined. The logical AND places the results in output string RESULT.
Example: Logical XOR

Whenever V_I0001 is set, the bit string represented by the variable WORD3 is cleared (set to all
zeroes).

7.2.7 Logical NOT
When the Logical Not or Logical Invert (NOT) function receives power flow, it sets the state of each bit
in the output bit string Q to the opposite of the state of the corresponding bit in bit string IN1.
All bits are altered on each scan that power is received, making output string Q the logical
complement of input string IN1. Logical NOT passes power flow to the right whenever it receives
power. You can specify a string length of 1 to 256 WORDs or DWORDs
Operands for Logical NOT
Length (??) The number of WORDs or DWORDs Constant No
in the bit string to NOT. 1 ≤ Length
≤ 256.
IN1 The first WORD or DWORD of the All No
input string to NOT.
Q (Must be the same The first WORD or DWORD of the All except constants and No
data type as IN1) NOT's result. variables located in %S
memory
Example
When input V_I0001 is set, the bit string represented by the variable A is negated. Logical NOT stores
the resulting inverse bit string in variable B. Variable A retains its original bit string value.

7.2.8 Masked Compare

The Masked Compare (MASK_COMP_DWORD and MASK_COMP_WORD)
function compares the contents of two bit strings. It provides the ability to
mask selected bits
Tip: Input string 1 might contain the states of outputs such as solenoids
or motor starters. Input string 2 might contain their input state
feedback, such as limit switches or contacts.
When the function receives power flow, it begins comparing the bits in the first string with the
corresponding bits in the second string. Comparison continues until a miscompare is found or until
the end of the string is reached.
The BIT input stores the bit number where the next comparison should start. Ordinarily, this is the
same as the number where the last miscompare occurred. Because the bit number of the last
miscompare is stored in output BN, the same reference can be used for both BIT and BN. The
comparison actually begins 1 bit following BIT; therefore, the initial value of BIT should be 1 less first
bit to be compared (for example, zero (0) to begin comparison at %I00001). Using the same reference
for BIT and BN causes the compare to start at the next bit position after a miscompare; or, if all bits
compared successfully upon the next invocation of the function, the compare starts at the beginning.
Tip: If you want to start the next comparison at some other location in the string, you can enter
different references for BIT and BN. If the value of BIT is a location that is beyond the end of
the string, BIT is reset to 0 before starting the next comparison.
The function passes power flow whenever it receives power. The other outputs of the function
depend on the state of the corresponding mask bit.
If all corresponding bits in strings IN1 and IN2 match, the function sets the miscompare output MC
to 0 and BN to the highest bit number in the input strings. The comparison then stops. On the next
invocation of a Masked Compare, it is reset to 0.
If a Miscompare is found, that is, if the two bits being compared are not the same, the function
checks the correspondingly numbered bit in string M (the mask).
If the mask bit is a 1, the comparison continues until it reaches another miscompare or the end of the
input strings.
If a miscompare is detected and the corresponding mask bit is a 0, the function does the following:
1. Sets the corresponding mask bit in M to 1.
2. Sets the miscompare (MC) output to 1.
3. Updates the output bit string Q to match the new content of mask string M.
4. Sets the bit number output (BN) to the number of the miscompared bit.
5. Stops the comparison.

Operands for Masked Compare Function

Length (??) The number of DWORDs or WORDs in the two Constant No
compared strings.
DWORD: 1 ≤ Length ≤ 2,048
WORD: 1 ≤ Length ≤ 4,096
IN1 The first bit string to be compared All. Constants are legal only when No
Length is 1
IN2 The second bit string to be compared All. Constants are legal only when No
Length is 1
M The bit string mask containing the ongoing All except flow or variables in %S No
status of the compare memory. Constants are legal only
when Length is 1
BIT BIT+1=the bit number where the next All except variables in %S - %SC No
comparison starts memories
Q The output copy of the compare mask bit string All except constants No
BN The number of the bit where the latest All except constants and variables in No
miscompare occurred, or the highest bit %S memory
number in the inputs if no miscompare occurred
MC Can be used to determine if a miscompare has flow Yes
occurred.
Masked Compare Example 1

When %I00001 is set, MASK_COMP_WORD compares the bits
represented by the reference VALUES against the bits represented
by the reference EXPECT. Comparison begins at BITNUM+1. If an
unmasked miscompare is detected, the comparison stops. The
corresponding bit is set in the mask RESULT. BITNUM is updated to
contain the bit number of the miscompared bit. In addition, the
output string NEWVALS is updated with the new value of RESULT,
and coil %Q00002 is turned on. Coil %Q00001 is turned on whenever
MASK_COMP_WORD receives power flow.

Masked Compare Example 2

On the first scan, the Masked
Compare Word function executes.
%M0001 through %M0016 is
compared with %M0017 through
%M0032. %M0033 through %M0048
contains the mask value. The value in
%R0001 determines the bit position
in the two input strings where the
comparison starts.
Before the function is executed, the contents of the above references are:
The #FST_SCN contact forces one and only one execution; otherwise, the function would repeat with
possibly unexpected results.

7.2.9 Rotate Bits

Mnemonics:
ROL_DWORD
ROL_WORD
ROR_DWORD
ROR_WORD
When receiving power flow, the Rotate Bits Right (ROR_DWORD and ROR_WORD) and Rotate Bits Left
(ROL_DWORD and ROL_WORD) functions rotate all the bits in a string of WORDs or DWORDs N
positions respectively to the right or to the left. When rotation occurs, the specified number of bits is
rotated out of the input string respectively to the right or to the left and back into the string on the
other side.
The Rotate Bits function passes power flow to the right, unless the number of bits to rotate is less
than 0, or is greater than the total length of the string. The result is placed in output string Q. If you
want the input string to be rotated, the output parameter Q must use the same memory location as
the input parameter IN. The entire rotated string is written on each scan that power is received.
A string length of 1 to 256 words or double words can be specified.
Operands for Rotate Bits
Length (??) The number of WORDs or DWORDs Constant No
in the string to be rotated. 1 ≤ Length
≤ 256.
IN The string to rotate All. Constants are legal when Length is 1 No
N The number of positions to rotate. All except variables in %S - %SC memories No
0 ≤ N ≤ Length.
Q The resulting rotated string All except constants and variables in %S No
memory
Example
Whenever input V_I0001 is set, the input bit string in location
%R0001 is rotated left 3 bits and the result is placed in %R00002.
The actual input bit string %R0001 is left unchanged. If the same
reference had been used for IN and Q, a rotation would have
occurred in place.
MSB
%R0001
MSB
%R0002 (after %I00001 is
set)

7.2.10 Shift Bits

Mnemonics:
SHIFTL_DWORD
SHIFTL_WORD
SHIFTR_DWORD
SHIFTR_WORD
Shift Left
When the Shift Left (SHIFTL_WORD) function receives power flow, it shifts all the bits in a word or
group of words to the left by a specified number of places, N. When the shift occurs, the specified
number of bits is shifted out of the output string to the left. As bits are shifted out of the high end of
the string (Most Significant Bit (MSB)), the same number of bits is shifted in at the low end (Least
Significant Bit (LSB)). The SHIFTL_DWORD function operates in a similar manner on DWORDs instead
of WORDs.
Shift Right
When the Shift Right (SHIFTR_WORD) function receives power flow, it shifts all the bits in a word or
group of words a specified number of places to the right (N). When the shift occurs, the specified
number of bits is shifted out of the output string to the right. As bits are shifted out of the low end of
the string (LSB), the same number of bits is shifted in at the high end (MSB).
Shift Left and Shift Right

A string length (Length) of 1 to 256 words can be specified.
The bits being shifted into the beginning of the string are specified via input parameter B1. If the
value of N is greater than 1, each bit is filled with the same value (0 or 1). This can be:
■ The Boolean output of another program function.
■ All 1s. To do this, use the #AWL_ON (always on) system bit (in memory location %S7), as a
permissive to input B1.
■ All 0s. To do this, use the #ALW_OFF (always off) system bit (in memory location %S8), as a
permissive to input B1.
The Shift Bits function passes power flow to the right, unless the number of bits specified to shift is
zero or is greater than the array size.
Output Q is the shifted copy of the input string. If you want the input string to be shifted, the output
parameter Q must use the same memory location as the input parameter IN. The entire shifted string
is written on each scan that power is received. Output B2 is the last bit shifted out. For example, if
four bits were shifted, B2 would be the fourth bit shifted out.

Operands for Shift Left, Shift Right, Shift Left and Shift Right
Length (??) The number of WORDs or DWORDs in the Constants. No
string. 1 ≤ Length ≤ 256.
IN The string of WORDs or DWORDs to shift All. Constants are legal No
only when Length = 1.
N The number of places (bits) to shift the array. All except variables in No
0 ≤ N ≤ Length %S— %SC memories
If N is 0, no shift occurs, but power flow is
generated.
If N is greater than the number of bits in the
string (Length), all bits in Q are set to the
value B1, OK is set FALSE, and B2 is set to B1.
B1 The bit value to shift into the array flow No
B2 The bit value of the last bit shifted out of the flow Yes
array.
Q The first WORD or DWORD of the shifted All except constants and No
(Must be the same array variables in %S memory.
data type as IN)
Example
Whenever input V_I0001 is set, the bits in the input string that begins at
WORD1 are copied to the output bit string that starts at WORD2. WORD2
is left-shifted by 8 bits, as specified by the input N. The resulting open
bits at the beginning of the output string are set to the value of V_I0002.

7.3. Coils
Coils are used to control the discrete (BOOL) references assigned to them. Conditional logic must be
used to control the flow of power to a coil. Coils cause action directly. They do not pass power flow to
the right. If additional logic in the program should be executed as a result of the coil condition, you
can use an internal reference for the coil or a continuation coil/contact combination.
A continuation coil does not use an internal reference. It must be followed by a continuation contact
at the beginning of any rung following the continuation coil.
Coils are always located at the rightmost position of a line of logic.
7.3.1 Coil Checking
The level of coil checking is set to “Show as error” by default. If you want a coil conflict to result in a
warning instead of this error, or if you want no warning at all, edit the Controller option: Multiple Coil
Use Warning in the programming software.
The “Show as warning” option enables you to use any coil reference with multiple Coils, Set Coils, and
Reset Coils, but you will be warned at validation time every time you do so. With both the “Show as
warning” and the “no warning” options, a reference can be set ON by either a Set Coil or a normal
Coil and can be set OFF by a Reset Coil or by a normal Coil.
7.3.2 Graphical Representation of Coils
The programming software displays the COIL, NCCOIL, SETCOIL, and RESETCOIL instructions
differently depending on the retentive state of the BOOL variables assigned to them. Examples are
provided in the discussion of each type of coil. For a discussion of retentiveness, refer to
“Retentiveness of Logic and Data” in Chapter 6.
Coil (Normally Open)
A retentive variable is assigned to the coil A non-retentive variable is assigned to the coil
When a COIL receives power flow, it sets its associated BOOL variable ON (1). When it receives no
power flow, it sets the associated BOOL variable OFF (0). COIL can be assigned a retentive variable or
a non-retentive variable.
Valid memory areas: %I, %Q, %M, %T, %SA - %SC, and %G. Symbolic discrete variables are
permitted. Bit-in-word references on any word-oriented memory except %AI, including symbolic non-
discrete memory, are also permitted.
Continuation Coil
A continuation coil instructs the PLC to continue the present rung's LD logic power flow value
(TRUE or FALSE) at the continuation contact on a following rung.
The flow state of the continuation coil is passed to the continuation contact.
Notes:
■ If the flow of logic does not execute a continuation coil before it executes a continuation contact,
the state of the continuation contact is no flow (FALSE).
■ The continuation coil and the continuation contact do not use parameters and do not have
associated variables.
■ You can have multiple rungs with continuation contacts after a single continuation coil.
■ You can have multiple rungs with continuation coils before one rung with a continuation contact.

Negated Coil
A retentive variable is assigned to the negated A non-retentive variable is assigned to the negated
coil coil
When it does not receive power flow, a negated coil (NCCOIL) sets a discrete reference ON. When it
does receive power flow, NCCOIL sets a discrete reference OFF. NCCOIL can be assigned a retentive
variable or a non-retentive variable.

7.3.3 Set Coil, Reset Coil
Set Coil and Reset Coil with a retentive variable Set Coil and Reset Coil with a non-retentive variable
assigned assigned
The SET and RESET coils can be used to keep (“latch”) the state of a reference either ON or OFF.
Warning
SET / RESET coils write an undefined result to the transition
bit for the given reference. This result differs from that
written by Series 90-70 CPUs and could change for future
PACSystems CPU models.
Because they write an undefined result to transition bits, do
not use SET or RESET coils with references used on POSCON
or NEGCON transition contacts.
When a SET coil receives power flow, it sets its discrete reference ON. When a SET coil does not
receive power flow, it does not change the value of its discrete reference. Therefore, whether or not
the coil itself continues to receive power flow, the reference stays ON until the reference is reset by
other logic, such as a RESET coil.
When a RESET coil receives power flow, it resets a discrete reference to OFF. When a RESET coil does
not receive power flow, it does not change the value of its discrete reference. Therefore, its reference
remains OFF until it is set ON by other logic, such as a SET coil.
The last solved SET coil or RESET coil of a pair takes precedence.
The SET and RESET coils can be assigned a retentive variable or a non-retentive variable.
Example of Set Coil, Reset Coil
The coil represented by E1 is turned ON when reference E2 or E6 is ON and is turned OFF when
reference E5 or E3 is ON.


7.3.4 Transition Coils

PACSystems controllers provide four transition coils: PTCOIL, NTCOIL, POSCOIL, and NEGCOIL.
POSCOIL and NEGCOIL are updated every time they are called.
PTCOIL and NTCOIL are updated once per CPU scan.
For examples showing the differences in the operation of the two types of transition coils, see page
183.
POSCOIL and NEGCOIL
Warning
■ These transition coil instructions should not be used in a
parameterized block or user-defined function block (UDFB)
with a parameter or member. In these cases, an R_TRIG or
F_TRIG should be used instead.
■ Do not override a transition coil by putting a force on its
reference bit. If a transition coil is overridden, the coil has no
effect on the bit, and if the override is then removed, the coil
might be set ON for one sweep. . This can cause unexpected
behavior in the Controller logic and in field devices attached
to the Controller.
■ Do not write to the reference bit of a transition coil using
any other instruction or from an external device. Doing so
will destroy the coil’s one-shot nature and the coil may not
behave as described.
■ Do not use a transition contact with the same reference
address used on a transition coil because the value of the
transition bit, which stores the power flow value into the
coil, will be affected.
Positive Transition Coil (POSCOIL) Negative Transition Coil (NEGCOIL)

If: If:
■ the transition bit is OFF, and ■ the transition bit is OFF, and
■ the input power flow is ON, ■ the input power flow input is OFF,
the POSCOIL sets the reference bit of its the NEGCOIL sets the reference bit of its
associated variable ON until the coil is executed associated variable ON until the coil is executed
again. When the coil is executed again, it sets its again. When the coil is executed again, it sets its
reference bit OFF. reference bit OFF.
Note: When the Positive Transition Coil sets its Note: When the Negative Transition Coil sets its
reference bit ON, it also sets its transition reference bit ON, it also sets its transition
bit to ON. The next time the Positive bit to ON. The next time the Negative
Transition coil executes, it finds its Transition Coil executes, it finds the
transition bit set to ON and sets its transition bit set to ON and sets its
reference bit to OFF. reference bit to OFF.

Operands for POSCOIL and NEGCOIL

BOOL_V The variable associated with POSCOIL or BOOL variable: I, Q, M, T, G, SA, No
NEGCOIL SB, SC, symbolic discrete
variables, and I/O variable.
Bit reference in BOOL variable:
I, Q, M, T, G, SA, SB, SC
Example for POSCOIL and NEGCOIL

When reference E1 goes from OFF to ON, coils E2 and E3 receive power flow, turning E2 ON. When E1
goes from ON to OFF, power flow is removed from E2 and E3, turning coil E3 ON.

PTCOIL and NTCOIL

Because the behavior of PTCOILs and NTCOILs is determined only by the current power flow into the
coil and the previous power flow into the coil (i.e., the transition bit), it is not affected by writes to its
associated BOOL variable by other coils or instructions in the logic. Therefore, many of the cautions
that apply to POSCOILs and NEGCOILs do not apply to PTCOILs and NTCOILs.
Warning
■ PTCOIL and NTCOIL instructions should not be used in a
parameterized block or user-defined function block (UDFB) with
a parameter or member. In these cases, an R_TRIG or F_TRIG
should be used instead.
■ The transition bit of a given PTCOIL or NTCOIL is changed only
once per CPU scan. Therefore, using a PTCOIL or NTCOIL in a
block that can be called multiple times per scan can have
adverse effects on all calls after the first one because the
PTCOIL or NTCOIL cannot detect the transition on the second
and subsequent calls.
■ Do not override a transition coil by putting a force on its
reference bit. If a transition coil is overridden, the coil has no
effect on the bit, and if the override is then removed, the coil
might be set ON for one sweep. . This can cause unexpected
consequences in the Controller logic and in field devices
attached to the Controller.
■ Do not use a transition contact with the same reference address
used on a transition coil because the value of the transition bit,
which stores the power flow value into the coil, will be affected.
Positive Transition Coil (PTCOIL) Negative Transition Coil (NTCOIL)
If: If:
■ the transition bit is OFF, and ■ the transition bit is OFF, and
■ the input power flow is ON ■ the input power flow is OFF
the PTCOIL sets the reference bit and transition bit the NTCOIL sets the reference bit and transition
of its associated variable ON. bit of its associated variable ON.
The transition bit depends on the value of the input power flow the last time the PTCOIL or NTCOIL
was executed.
Notes:
■ As soon as a PTCOIL or NTCOIL is set to ON or OFF, it updates its transition bit.
■ Multiple instances of PTCOIL and/or NTCOIL can be associated with the same BOOL variable,
but the transition status of each instance of the PTCOIL or NTCOIL associated with the BOOL
variable is unique, that is, it is tracked independently.
■ The transition bit is non-retentive, that is, it is cleared to OFF when the CPU transitions from
stop to run. As a result, the first time a PTCOIL executes with its input power flow set to ON its
associated BOOL variable will be set to ON.

Operands for PTCOIL and NTCOIL

BOOL_V The variable associated Variables in I, Q, M, T, SA, SB, SC, or G memories as No
with well as symbolic discrete variables. In addition,
PTCOIL or NTCOIL bit-in-word references on any non-discrete
memory (e.g., %R) or on symbolic non-discrete
variables are allowed.
Examples Comparing PTCOIL and POSCOIL

PTCOIL
In the example below, the power flow into the PTCOIL alternates between OFF and ON. On the first
sweep the power flow in is OFF, on the second sweep it is ON, and so forth. Each time the power flow
into the PTCOIL changes from OFF to ON, the value of Xsition is turned ON. Therefore, on the first
sweep, the PTCOIL turns Xsition OFF, on the second sweep it turns it ON, on the third sweep it turns it
OFF, and so forth. Notice that the behavior of the PTCOIL is not affected by the presence of the fourth
rung, which also writes to Xsition. PTCOIL behaves the same way when the fourth rung is removed.
POSCOIL
If a POSCOIL is used in place of the PTCOIL in the example below (keeping the rest of the logic
identical and same alternation of power flow into the POSCOIL), the behavior of the logic will be
different. The behavior of the POSCOIL is affected by the execution of the fourth rung, which writes to
Xsition and changes both its value and its transition bit. In this example, the POSCOIL never turns
Xsition ON. If the fourth rung is removed, POSCOIL will behave exactly as the PTCOIL behaves, turning
Xsition OFF on the first sweep, ON on the second sweep, and so forth.

7.4. Contacts
A contact is used to monitor the state of a reference address. Whether the contact passes power
flow depends on positive power flow into the contact, the state or status of the reference address
being monitored, and the contact type.
A reference address is ON if its state is 1; it is OFF if its state is 0.
Contact Display Mnemonic Contact Passes Power to Right...
Continuation CONTCON if the preceding continuation coil is set ON
Contact
Fault Contact FAULT if its associated BOOL or WORD variable has a point fault
High Alarm HIALR if the high alarm bit associated with the analog (WORD) reference is ON
Contact
Low Alarm LOALR if the low alarm bit associated with the analog (WORD) reference is ON
Contact
No Fault NOFLT if its associated BOOL or WORD variable does not have a point fault
Contact
Normally Closed NCCON if associated BOOL variable is OFF
Contact
Normally Open NOCON if associated BOOL variable is ON
Contact
Transition NEGCON (negative transition contact) if BOOL reference transitions from ON
Contacts to OFF. Updated every time it is called.
NTCON (negative transition contact) if BOOL reference transitions from
ON to OFF. Updated once per scan.
POSCON (positive transition contact) if BOOL reference transitions from OFF
to ON. Updated every time it is called.
PTCON (positive transition contact) if BOOL reference transitions from OFF
to ON. Updated once per scan.

7.4.1 Continuation Contact
A continuation contact continues the LD logic from the last previously-executed rung in the block
that contained a continuation coil.
The flow state of the continuation contact is the same as the preceding executed continuation coil. A
continuation contact has no associated variable.
Notes:
■ If the flow of logic does not execute a continuation coil before it executes a continuation contact,
the state of the continuation contact is no flow.
■ The state of the continuation contact is cleared (set to no flow) each time a block begins
execution.
■ The continuation coil and the continuation contact do not use parameters and do not have
associated variables.
■ You can have multiple rungs with continuation contacts after a single continuation coil.
■ You can have multiple rungs with continuation coils before one rung with a continuation contact.
7.4.2 Fault Contact
A Fault contact (FAULT) detects faults in discrete or analog reference addresses, or locates faults
(rack, slot, bus, module).
■ To guarantee correct indication of module status, use the reference address (%I, %Q, %AI, %AQ) with the
FAULT/NOFLT contacts.
■ To locate a fault, use the rack, slot, bus, module fault locating system variable with a FAULT/NOFLT contact.
Note: The fault indication of a given module is cleared when the associated fault is cleared from the
fault table.
■ For I/O point fault reporting, you must enable point fault references in Hardware Configuration.
FAULT passes power flow if its associated variable or location has a point fault.
Operands
BWVAR The variable associated with variables in %I, %Q, %AI, and %AQ memories, and No
the FAULT contact predefined fault-locating references

7.4.3 High and Low Alarm Contacts
The high alarm contact (HIALR) is used to detect a high alarm associated with an analog reference.
Use of this contact and the low alarm contact must be enabled during CPU configuration.
A high alarm contact passes power flow if the high alarm bit associated with the analog reference is
ON.
The low alarm contact (LOALR) detects a low alarm associated with an analog reference. Use of this
contact must be enabled during CPU configuration.
A low alarm contact passes power flow if the low alarm bit associated with the analog reference is
ON.
Operands
WORDV The variable associated with the HIALR or LOALR variables in AI and AQ No
contact memories
7.4.4 No Fault Contact
A No Fault (NOFLT) contact detects faults in discrete or analog reference addresses, or locates faults
(rack, slot, bus, module). NOFLT passes power flow if its associated variable or location does not have
a point fault.
■ To guarantee correct indication of module status, use the reference address (%I, %Q, %AI, %AQ)
with the FAULT/NOFLT contacts.
■ To locate a fault, use the rack, slot, bus, module fault locating system variables with a
FAULT/NOFLT contact.
■ For I/O point fault reporting, you must configure your Hardware Configuration (HWC) to enable
the PLC point faults.
Note: The fault indication of a given module is cleared when the associated fault is cleared from the
fault table.
Operands
BWVAR The variable associated with variables in %I, %Q, %AI, and %AQ memories, and No
the NOFLT contact predefined fault-locating references

7.4.5 Normally Closed and Normally Open Contacts
A normally closed contact (NCCON) acts as a switch that passes power flow if the BOOLV operand is
OFF (false, 0).
A normally open contact (NOCON) acts as a switch that passes power flow if the BOOLV operand is
ON (true, 1).
Operands
BOOLV BOOLV may be a predefined system variable or a discrete variables in I, Q, M, No
user-defined variable. T, S, SA, SB, SC, and G
NCCON: memories; symbolic discrete
variables; bit-in-word
If BOOLV is ON, the normally closed contact
references on variables in
does not pass power flow.
any non-discrete memory
If BOOLV is OFF, the contact passes power (e.g., %L) or on symbolic non-
flow. discrete variables.
NOCON:
If BOOLV is ON, the normally open contact
passes power flow.
If BOOLV is OFF, the contact does not pass
power flow.

7.4.6 Transition Contacts

PACSystems controllers provide four transition contacts: POSCON, NEGCON, PTCON and NTCON.
■ The power flow out of the POSCON and NEGCON transition contacts is determined by the last
write to the BOOL variable associated with the contact. The associated transition bit is updated
every time the function is called.
■ The power flow out of the PTCON and NTCON transition contacts is determined by the value that
the associated BOOL variable had the last time the contact was executed. The associated
transition bit is updated once per scan.
For an example showing the differences in the operation of the two types of transition contacts, see
page 192.
POSCON and NEGCON
Warning
■ These transition contact instructions should not be used in a
parameterized block or user-defined function block (UDFB)
with a parameter or member. In these cases, an R_TRIG or
F_TRIG should be used instead.
■ Do not use POSCON or NEGCON transition contacts for
references used with transition coils (also called one-shot
coils) or with SET and RESET coils.
■ If a SETCOIL or RESETCOIL receives positive power flow and
its associated variable is not overridden, the SETCOIL or
RESETCOIL writes the expected result to the transition bit for
the associated variable (that is, the transition bit is set if the
variable’s value is set from ON to OFF or is set from OFF to
ON, and is cleared when its value remains the same).
However, if the SETCOIL or RESETCOIL receives positive
power flow and its associated variable is overridden, the
SETCOIL or RESETCOIL causes the transition bit to be
cleared.
■ Do not use a transition contact with the same reference
address used on a transition coil because the value of the
transition bit, which stores the power flow value into the
coil, will be affected.
Positive Transition Contact POSCON Negative Transition Contact NEGCON

POSCON starts passing power flow and NEGCON starts passing power flow and continues
continues passing power flow to the right only passing power flow to the right only when all of the
when all of the following conditions are met: following conditions are met:
■ the input power flow to POSCON is ON, ■ the input power flow to NEGCON is ON
■ the value of the associated variable is ON, ■ the value of the associated variable is OFF, and
and ■ the transition bit for the associated variable is
■ the transition bit for the associated variable ON
is ON The NEGCON’s transition bit is set to ON when the
The POSCON’s transition bit is set to ON when the variable associated with the NEGCON transitions
variable associated with the POSCON transitions from ON to OFF.
from OFF to ON.
The transition bit is set to OFF when the associated variable is written to while the POSCON or
NEGCON contact is passing power flow, regardless of whether the value written is ON or OFF. Power
flow stops when the transition bit is set to OFF.
Depending on the logic flow, writes to the POSCON’s or NEGCON's associated variable can occur at
different intervals within the Controller scan:
■ multiple times during a Controller scan, resulting in the transition bit being ON for only a portion
of the scan.
■ several Controller scans apart, resulting in the transition bit being ON for more than one scan.
■ once per scan, for example if the POSCON or NEGCON's associated variable is a %I input bit.
The source of the write is immaterial; it can be an output coil, a function block output, the input scan,
an input interrupt, a data change from the program, or external communications. When the variable
is written, the transition bit is immediately affected. The scan does not affect the transition bit. The
only way to clear the transition bit is to write to the associated variable.
Overrides
Overrides do not protect transition bits. If a write is attempted to an overridden point, the point’s
transition bit is cleared. As a result, any associated POSCON or NEGCON contacts will stop passing
power flow.
Transition to Run Mode
 Variables that are non-retentive and not overridden will have values and transitions cleared to 0.
 Variables that are non-retentive and overridden will retain their values and transition bits.
 Variables that are retentive will retain their values and transition bits.
Operands for POSCON and NEGCON
BOOLV The variable associated with the BOOL variable: I, Q, M, T, S, SA, SB, SC, and G, No
transition contact symbolic discrete variables, I/O variables
Bit reference in BOOL variable: I, Q, M, T, S, SA, SB, SC.

POSCON and NEGCON Example 1

Coil E2 is turned ON when the value of the variable E1 transitions
from OFF to ON. It stays ON until E1 is written to again, causing the
POSCON to stop passing power flow.
Coil E4 is turned ON when the value of the variable E3 transitions
from ON to OFF. It stays ON until E3 is written to again, causing the
NEGCON to stop passing power flow.
POSCON and NEGCON Example 2

Bit %M00017 is set by a BIT_SET function and then cleared by a
BIT_CLR function. The positive transition contact X1 activates the
BIT_SET, and the negative transition X2 activates the BIT_CLR.
The positive transition associated with bit %M00017 will be on
until %M00017 is reset by the BIT_CLR function. This occurs
because the bit is only written when contact X1 goes from OFF to
ON. Similarly, the negative transition associated with bit
%M00017 will be ON until %M00017 is set by the BIT_SET
function.

PTCON and NTCON
Warning
PTCON or NTCON instructions should not be used in a
parameterized block or user-defined function block with a
parameter or member. In these cases, an R_TRIG or F_TRIG
should be used instead.
The transition bit of a given PTCON or NTCON is updated only
once per CPU scan. Therefore, using a PTCON or NTCON in a
block that can be called multiple times per scan may have
adverse effects on all calls after the first one because the
PTCON or NTCON cannot detect the transition on the second
and subsequent calls.
Positive Transition Contact PTCON Negative Transition Contact NTCON

PTCON passes power flow to the right only when NTCON passes power flow to the right only when
all of the following conditions are met: all of the following conditions are met:
■ The input power flow to PTCON is ON. ■ The input power flow to NTCON is ON.
■ The value of the BOOL variable associated ■ The value of the BOOL variable associated
with PTCON is ON. with NTCON is OFF.
■ The transition bit associated with the PTCON is ■ The transition bit associated with the NTCON
OFF is ON
The transition bit depends on the value of the BOOL variable associated with this PTCON or NTCON
when it was last executed.
Notes:
■ As soon as a PTCON or NTCON is set to ON or OFF, it updates its transition bit.
■ Multiple instances of PTCON and/or NTCON can be associated with the same BOOL variable, but
the instance data of each instance of the PTCON or NTCON associated with the BOOL variable is
unique, that is, it is tracked independently.
■ Transition data is non-retentive, that is, it is cleared to OFF when the CPU transitions from stop to
run. As a result, the first time a PTCON executes with its input power flow set to ON and its
associated BOOL variable also set to ON, it passes power flow to the right.
Operands for PTCON and NTCON
BOOL_V The variable associated with BOOL variable: I, Q, M, T, S, SA, SB, SC, and G No
PTCON or NTCON contact memories, symbolic discrete variables, I/O
variables.
Bit reference in non-BOOL variable: R, AI, AQ, L, P,
W, and on symbolic non-discrete variables.

Examples Comparing PTCON and POSCON

PTCON
The logic in the following example starts execution with all variables set to 0. Before the second
sweep begins, the Xsition variable used on the PTCON instruction is set to 1. It retains that value for
sweeps 2, 3, and 4. Then it is reset back to 0 before sweep 5 begins and retains its 0 value for sweeps
5, 6, and 7. This pattern repeats. The PTCON instruction in rung two passes power flow on the 2nd
sweep, the 8th sweep, the 14th sweep, and so on. These are sweeps where the Xsition variable’s value
becomes a 1, after having been a 0 on the previous sweep. On all other sweeps, the PTCON
instruction does not pass power flow.
POSCON
If a POSCON is used in place of the PTCON in the following example (keeping the rest of the logic
identical), the same alternation of the Xsition variable’s value occurs. The POSCON instruction passes
power flow on sweeps 2, 3, and 4; then again on sweeps 8, 9, and 10; and so forth. The POSCON’s
behavior is dependent on Xsition’s transition bit. Since Xsition’s value is written once and then simply
retained for three sweeps, its transition bit retains its same value for three sweeps. Thus the POSCON
will pass or not pass power flow for three sweeps in a row. Note that if Xsition’s value is actually
written on each sweep, the POSCON and the PTCON behave identically.
Logic Example Using PTCON

7.5. Control Functions

The control functions limit program execution and change the way the CPU executes the application
program.
Do I/O DO_IO For one scan, immediately services a specified range of inputs or outputs. (All
inputs or outputs on a module are serviced if any reference locations on that
module are included in the DO I/O function. Partial I/O module updates are not
performed.) Optionally, a copy of the scanned I/O can be placed in internal
memory, rather than at the real input points.
Drum DRUM Provides predefined On/Off patterns to a set of 16 discrete outputs in the
manner of a mechanical drum sequencer.
Edge Detectors F_TRIG Detect the changing state of a Boolean signal.
R_TRIG
For Loop FOR_LOOP For loop. Repeats the logic between the FOR_LOOP instruction and END_FOR
EXIT_FOR instruction a specified number of times or until EXIT_FOR is encountered.
END_FOR
Mask I/O MASK_IO_INTR Mask or unmask an interrupt from an I/O module when using I/O variables. If
Interrupt not using I/O variables, use SVC_REQ 17, described in Chapter 9.
Proportional PID_ISA Provides two PID (Proportional/Integral/Derivative) closed-loop control
Integral PID_IND algorithms:
Derivative Standard ISA PID algorithm (PID_ISA)
Control
Independent term algorithm (PID_IND)
Note: For details, refer to Chapter 10.
Read Switch SWITCH_POS Reads position of the Run/Stop switch and the mode for which the switch is
Position configured.
Scan Set IO SCAN_SET_IO Scans the IO of a specified scan set.
Service Request SVC_REQ Requests a special PLC service.
Suspend IO SUS_IO Suspends for one sweep all normal I/O updates, except those specified by DO
I/O instructions.
Suspend or SUSP_IO_INTR Suspend or resume an I/O interrupt when using I/O variables. If not using I/O
Resume I/O variables, use SVC_REQ 32, described in Chapter 9.
Interrupt

7.5.1 Do I/O
When the DO I/O (DO_IO) function receives power flow, it updates inputs or outputs for
one scan while the program is running. You can also use DO_ IO to update selected I/O
during the program in addition to the normal I/O scan.
You can use DO_IO in conjunction with a Suspend IO (SUS_IO) function, which stops the
normal I/O scan. For details, see page 209.
If input references are specified, DO_IO allows the most recent values of inputs to be
obtained for program logic. If output references are specified, DO I/O updates outputs
based on the most current values stored in I/O memory. I/O is serviced in increments of
entire I/O modules; the PLC adjusts the references, if necessary, while DO_IO executes. DO_IO does
not scan I/O modules that are not configured.
DO_IO continues to execute until all inputs in the selected range have reported or all outputs have
been serviced on the I/O modules. Program execution then returns to the function that follows the
DO_IO.
If the range of references includes an option module (HSC, APM, etc.), all the input data (%I and %AI)
or all the output data (%Q and %AQ) for that module are scanned. The ALT parameter is ignored
while scanning option modules.
DO_IO passes power to the right whenever it receives power unless:
■ Not all references of the type specified are present within the selected range.
■ The CPU is not able to properly handle the temporary list of I/O created by the function.
■ The range specified includes I/O modules that are associated with a “Loss of I/O” fault.
Warning
If DO_IO is used with timed or I/O interrupts, transition
contacts associated with scanned inputs may not operate
as expected.
Note: The Do I/O function skips modules that do not support DO_IO scanning:
IC693BEM331 90-30 Genius Bus Controller
IC694BEM331 RX3i Genius Bus Controller
IC693BEM341 90-30 2.5 GHz FIP Bus Controller
IC693DNM200 90-30 DeviceNet Master
IC695PBM300 RX3i PROFIBUS Master
IC695PBS301 RX3i PROFIBUS Slave
IC687BEM731 90-70 Genius Bus Controller
IC697BEM731 90-70 Standard Width Genius Bus Controller

Do I/O for Inputs

When DO_IO receives power flow and input references are specified, the PLC scans input points from
the starting reference (ST) to the ending reference (END). If a reference is specified for ALT, a copy of
the new input values is placed in memory beginning at that reference, and the real input values are
not updated. ALT must be the same size as the reference type scanned. If a discrete reference is used
for ST and END, ALT must also be discrete.
If no reference is specified for ALT, the real input values are updated. This allows inputs to be
scanned one or more times during the program execution portion of the CPU scan.
Do I/O for Outputs
When DO_IO receives power flow and output references are specified, the PLC writes to the output
points. If no value is specified in ALT, the range of outputs written to the output modules is specified
by the starting reference (ST) and the ending reference (END). If outputs should be written to the
output points from internal memory other than %Q or %AQ, the beginning reference is specified for
ALT and the end reference is automatically calculated from the length of the END—ST range.
Operands
ST The starting address of the set of input or output points or words I, Q, AI, AQ, I/O Variable No
to be serviced. ST and END must be in the same memory area.
 If ST and END are placed in BOOL memory, ST must be byte-
aligned. That is, its reference address must start at (8n+1),
for example, %I01, %Q09, %Q49.
 If ST and END are mapped to analog memory, they can have
the same reference address.
 If ST is mapped to an I/O variable, the same I/O variable
must also be assigned to the END parameter, and the entire
module is scanned.
END The address of the end bit of input or output points or words to I, Q, AI, AQ, I/O Variable No
be serviced. Must be in the same memory area as ST.
 If ST and END are placed in BOOL memory, END's reference
address must be 8n, for example, %I08, %Q16.
 If ST and END are mapped to analog memory, they can have
the same reference address.
 If ST is mapped to an I/O variable, the same I/O variable
must also be assigned to the END parameter, and the entire
module is scanned.
ALT For an input scan, ALT specifies the address to store scanned I, Q, M, T, G, R, AI, AQ Yes
input point/word values. For an output scan, ALT specifies the
address to get output point/word values from, to send to the I/O
modules.
Note: ALT can be a WORD only if ST and END are in analog
memory.

Example - Do I/O for Inputs

When DO_IO receives power flow, the PLC scans references
%I0001—64 and %Q0001 is turned on. A copy of the scanned inputs
is placed in internal memory from %M0001-64. Because a reference
is specified for ALT, the real inputs are not updated. This allows the
current values of inputs to be compared with their values at the
beginning of the scan. This form of DO_IO allows input points to be
scanned one or more times during the program execution portion of
the CPU scan.
Example - Do I/O for Outputs
Because a reference is entered for ALT, the values at %AQ001—004
are not written to output modules. When DO_IO receives power flow,
the PLC writes the values from references %R0001-0004 to the
analog output modules and %Q0001 is turned on.

7.5.2 Edge Detectors
Falling Edge Trigger Rising Edge Trigger

These function blocks detect the changing state of a Boolean signal and produce a single pulse when
an edge is detected.
When transitional instructions, such as Transition Coils (page 180) or Transition Contacts (page 188),
are used inside a function block, there is a problem when the same function block is called more than
once per scan. The first call executes the transition correctly but subsequent calls do not because
they see the state as adjusted from the first call. The rising and falling edge trigger instructions solve
this problem. These instructions have their own instance data that can be a member or an input of
the function block so that the transition state follows that of the function block instance and not the
function block.
If an edge detector function block is used within a UDFB, its instance data must be a member
variable of the UDFB.
Operands
???? Instance data for function block. This is a F_TRIG, R_TRIG No
structure variable, described below.
CLK Input to be monitored for a change in state. All Yes
Q Edge detection output. Must be flow in LD. In other languages all Yes
types allowed except S, SA, SB, SC and
constants.
Instance Data Structure

These elements cannot be published or written to.
Element Name Type Description
CLK BOOL Edge detection input. Not accessible in user
logic.
Q BOOL Edge detection output. Accessible in user
logic. Read only.
STATE BOOL Internal value. Not accessible in user logic.
ENO BOOL Enable Output. User logic can access as
read-only.

F_TRIG Operation
When the CLK input goes from true to false, the output Q is
true for one function block instance execution. The output Q
CLK
then remains false until a new falling edge is detected.
When the Controller transitions from stop to run mode and the
CLK input is false and the instance memory is non-retentive, Q
the output Q is true after the function block’s first execution.
After the next execution, the output is false.
The F_TRIG output Q will be true for one function block
instance execution at a stop-to-run transition after the first Function Block Execution
download, whether or not instance memory is retentive.
R_TRIG Operation
When the CLK input transitions from false to true, the
output Q is true for one function block execution. The
CLK
output Q then remains false until a new rising edge is
detected.
When the Controller transitions from stop to run Q mode
and the CLK input is true and the instance memory
is non-retentive, the output Q is set to true after the
function block’s first execution. After the second
Function Block Execution
execution, the output is false.
If the CLK input is initialized on, the R_TRIG output Q will be true for one function block instance
execution at a stop-to-run transition after the first download, whether or not instance memory is
retentive.
Example
In the following example, when Input1 transitions from false to true, the coil, Detected, is set ON for
one function block execution. The output Q remains false until a new rising edge is detected.

7.5.3 Drum
The Drum function operates like a mechanical drum sequencer, which steps
through a set of potential output bit patterns and selects one based on inputs to
the function. The selected value is copied to a group of 16 discrete output
references.
When the Drum function receives power flow, it copies the contents of a selected
reference to the Q reference.
Power flow to the R (Reset) input or to the S (Step) input selects the reference to be
copied.
The function passes power to the right only if it receives power from the left and no
error condition is detected.
The DTO (Dwell Timeout Output) bit is cleared the first time the drum is in a new step. This is true:
 Whether the drum is introduced to a new step by changing the Active Step or by using the S
(Step) Input.
 Regardless of the DT (Dwell Time array) value associated with the step (even if it is 0).
 During the first sweep the Active Step is initialized.
Using Drum in Parameterized Blocks
The Drum dwell and fault timer features use an internal timer that is implemented in the same
manner as for the OFDT, ONDTR, and TMR timers. Therefore, special care must be taken when
programming Drum in parameterized blocks. Drum functions in parameterized blocks can be
programmed to track true real-time as long as the guidelines and rules below are followed. If the
guidelines and rules described here are not followed, the operation of the Drum function in
parameterized blocks is undefined.
Note: These rules are not enforced by the programming software. It is your responsibility to ensure
these rules are followed.
The best use of a Drum function is to invoke it with a particular reference address exactly one time
each scan. With parameterized blocks, it is important to use the appropriate reference memory with
the Drum function and to call the parameterized block an appropriate number of times.
Finding the Source Block
The source block is either the _MAIN block or the lowest logic block of type Block that appears above
the parameterized block in the call tree. To determine the source block for a given parameterized
block, determine which block invoked that parameterized block. If the calling block is _MAIN or of
type Block, it is the source block. If the calling block is any other type (parameterized block or function
block), apply the same test to the block that invoked this block. Continue back up the call tree until
the _MAIN block or a block of type Block is found. This is the source block for the parameterized
block.
Programming Drum in Parameterized Blocks
Different guidelines and rules apply depending on whether you want to use the parameterized block
in more than one place in your program logic.

Parameterized block called from one block

If your parameterized block that contains a Drum function will be called from only one logic block,
follow these rules:
1. Call the parameterized block exactly one time per execution of its source block.
2. Choose a reference address for the Drum control block that will not be manipulated anywhere
else. The reference address may be %R, %P, %L, %W, or symbolic.
Note: %L memory is the same %L memory available to the source block of type Block. %L memory
corresponds to %P memory when the source block is _MAIN.
Parameterized block called from multiple blocks
When calling the parameterized block from multiple blocks, it is imperative to separate the Drum
reference memory used by each call to the parameterized block. Follow these rules and guidelines:
1. Call the parameterized block exactly one time per execution of each source block that it appears
in.
2. Choose a %L reference or parameterized block formal parameter for the Drum control block. Do
not use a %R, %P, %W, or symbolic memory reference.
Notes:
■ The strongly recommended choice is a %L location, which is inherited from the parameterized
block’s source block. Each source block has its own %L memory space except the _MAIN block,
which has a %P memory area instead. When the _MAIN block calls another block, the %P
mappings from the _MAIN block are accessed by the called block as %L mappings.
■ If you use a parameterized block formal parameter (word array passed-by-reference), the actual
parameter that corresponds to this formal parameter must be a %L, %R, %P, %W, or symbolic
reference. If the actual parameter is a %R, %P, %W, or symbolic reference, a unique reference
address must be used by each source block.
Recursion
If you use recursion (that is, if you have a block call itself either directly or indirectly) and your
parameterized block contains a Drum function, you must follow two additional rules:
■ Program the source block so that it invokes the parameterized block before making any recursive
calls to itself.
■ Do not program the parameterized block to call itself directly.
Using Drum in UDFBs
UDFBs are user-defined logic blocks that have parameters and instance data. For details on these
and other types of blocks, refer to Chapter 5.
When a Drum function is present inside a UDFB, and a member variable is used for the control block
of a Drum function, the behavior of the Drum function may not match your expectations. If multiple
instances of the UDFB are called during a logic sweep, only the first-executed instance will update
the timer in the Drum function. If a different instance is then executed, the timer value will remain
unchanged.
In the case of multiple calls to a UDFB during a logic scan, only the first call will add elapsed time to
its timer functions. This behavior matches the behavior of the Drum function timer in a normal
program block.

Example
A UDFB is defined that uses a member variable for a Drum function block. Two instances of the
function block are created: Drum_A and Drum_B. During each logic scan, both Drum_A and Drum_B
are executed. However, only the member variable in Drum_A is updated and the member variable in
Drum_B always remains at 0.
Operands for Drum
???? (Control Block) The beginning address of a five-word array that R, P, L, W, Symbolic No
contains the Drum Sequencer's control block. The contents of the
control block are described below.
?? (Length) Value between 1 and 128 that specifies the number of Constant No
steps.
S Step input. Used to go one step forward in the sequence. When flow No
the function receives power flow and S makes an OFF to ON
transition, the Drum Sequencer moves one step. When R (Reset) is
active, the function ignores S.
R Reset input. Used to select a specific step in the sequence. When flow No
the DRUM function and Reset both receive power flow, DRUM
copies the Preset Step value in the Control Block to the Active
Step reference in the Control Block. Then the function copies the
value in the Preset Step reference to the Q reference bits. When R
is active, the function ignores S.
PTN (Pattern) The starting address of an array of words. The number of All except constant No
words is specified by the Length (??) operand. Each word and S, SA—SC
represents one step of the Drum Sequencer. The value of each numerical data.
word represents the desired combination of outputs for a
particular value of the Active Step word in the control block. The
first element corresponds to an Active Step value of 1; the last
element corresponds to an Active Step value of Length. The
programming software does not create an array for you. You
must ensure you have enough memory for PTN.
DT (Dwell Time ) If you use the DT operand, you must also use the All except S, SA, SB, Yes
DTO operand and vice-versa. The DT operand is the starting SC and constant
address of Length words of memory, where Length is the number
of steps. Each DT word corresponds to one word of PTN. The
value of each word represents the dwell time for the
corresponding step of the Drum Sequencer in 0.1 second units.
When the dwell time expires for a given step the DTO bit is set.
If a Dwell Time is specified, the drum cannot sequence into its
next step until the Dwell Time has expired. The programming
software does not create an array for you. You must ensure you
allocate enough memory for DT.


FTT (Fault Timeout) If you use the FTT operand, you must also use the All except S, SA, SB, Yes
TFT operand, and vice-versa. The FTT operand is the starting SC and constant
address of Length words of memory, where Length is the number
of steps. Each FTT word corresponds to one word of PTN. The
value of each word represents the fault timeout for the
corresponding step of the Drum Sequencer in 0.1 second units.
When the fault timeout has expired the Fault Timeout bit is set.
The programming software does not create an array for you. You
must ensure you allocate enough memory for FTT.
Q A word of memory containing the element of the PTN that All except S and No
corresponds to the current Active Step. constant
DRC (Drum Coil) Bit reference that is set whenever the function is All except S Yes
enabled and Active Step is not equal to Preset Step.
DTO (Dwell Timeout) If you use the DTO operand, you must also use DT All except S and Yes
and vice-versa. This bit reference is set if the dwell time for the constant
current step has expired.
TFT (Timeout Fault ) If you use the TFT operand, you must also use the All except S and Yes
FTT operand and vice-versa. Bit reference that is set if the drum constant
has been in a particular step longer than the step’s specified Fault
Timeout.
FF (First Follower ) The starting address of (Length/8+1) bytes of All except S and Yes
memory, where Length is the number of steps. If MOD constant
(Length/8+1)>0, FF has (Length/8+1) bytes. Each bit in the bytes of
FF corresponds to one word of PTN. No more than one bit in the
FF bytes is ON at any time, and that bit corresponds to the value
of the Active Step. The first bit corresponds to an Active Step
value of one. The last used bit corresponds to an Active Step
value of Length.
Control Block for the Drum Sequencer Function

The control block for the Drum Sequencer function contains information needed to operate the Drum
Sequencer.
address Active Step
address + 1 Preset Step
address + 2 Step Control
address + 3 Timer Control
Active Step The active step value specifies the element in the Pattern array to copy to the Out
output memory location. This is used as the array index into the Pattern, Dwell Time, Fault Timeout,
and First Follower arrays.
Preset Step A word input that is copied to the Active Step output when the Reset is On.
Step Control A word that is used to detect Off to On transitions on both the Step input and the
Enable input. The Step Control word is reserved for use by the function, and must not be written to.
Timer Control Two words of data that hold values needed to run the timer. These values are
reserved for use by the function and must not be written to.

For Loop
A FOR loop repeats rung logic a specified number of times while
varying the value of the INDEX variable in the loop.
A FOR loop begins with a FOR_LOOP instruction and ends with
an END_FOR instruction.
The logic to be repeated must be placed between the FOR and
END_FOR instructions.
The optional EXIT_FOR instruction enables you to exit the loop if
a condition is met before the FOR loop ends normally.
When FOR_LOOP receives power flow, it saves the START, END, and INC (Increment) operands and
uses them to evaluate the number of times the rungs between the FOR_LOOP and its END_FOR
instructions are executed. Changing the START and END operands while the FOR loop is executing
does not affect its operation.
When an END_FOR receives power flow, the FOR loop is terminated and power flow jumps directly to
the statement following the END_FOR instruction.
There can be nothing after the FOR_LOOP instruction in the rung and the FOR_LOOP instruction must
be the last instruction to be executed in the rung. An EXIT_FOR statement can be placed only
between a FOR instruction and an END_FOR instruction. The END_FOR statement must be the only
instruction in its rung.
A FOR_LOOP can assign decreasing values to its index variable by setting the increment to a
negative number. For example, if the START value is 21, the END value is 1, and the increment value is
–5, the statements of the FOR loop are executed five times, and the index variable is decremented by
5 in each pass. The values of the index variable will be 21, 16, 11, 6, and 1.
When the START and END values are set equal, the statements of the FOR loop are executed only
once.
When START cannot be incremented or decremented to reach the END, the statements within the
FOR loop are not executed. For example, if the value of START is 10, the value of END is 5, and the
INCREMENT is 1, power flow jumps directly from the FOR statement to the statement after the
END_FOR statement.
Note: If the FOR_LOOP instruction has power flow when it is first tested, the rungs between the FOR
and its corresponding END_FOR statement are executed the number of times initially
specified by START, END, and INCREMENT. This repeated execution occurs on a single sweep
of the PLC and may cause the watchdog timer to expire if the loop is long.
Nesting of FOR loops is allowed, but it is restricted to five FOR/END_FOR pairs. Each FOR instruction
must have a matching END_FOR statement following it.
Nesting with JUMPs and MCRs is allowed, provided that they are properly nested. MCRs and
ENDMCRs must be completely within or completely outside the scope of a FOR_LOOP/END_FOR pair.
JUMPs and LABEL instructions must also be completely within or completely outside the scope of a
FOR_LOOP/END_FOR pair. Jumping into or out of the scope of a FOR/END_FOR is not allowed.

Operands
Only the FOR_LOOP function requires operands.
INDEX The index variable. When the loop has completed, this All except constants, flow, and No
value is undefined. variables in %S - %SC
Note: Changing the value of the index variable
within the scope of the FOR loop is not
recommended.
START The index start value. All except variables in %S - %SC No
END The index end value. All except variables in %S - %SC No
INC The increment value. (Default: 1.) Constants Yes
For Loop Example 1

The value for %M00001 (START) is 1 and the value for %M00017 (END)
is 10. The INDEX (%R00001) increments by the value of the INC
operand (which is assumed to be 1 when omitted) starting at 1 until it
reaches the ending value 10. The ADD function of the loop is executed
10 times, adding the current value of I1 (%R00001), which will vary
from 1 to 10, to the value of I2 (%R00002).

For Loop Example 2

The value for %T00001 (START) is -100 and the value for %T00017
(END) is 100. The INDEX (%R00001) increments by tens, starting at -100
until it reaches it end value of +100. The EQ function of the loop tries to
execute 21 times, with the INDEX (%R00001) being equal to –100, –90,
–80, –70, –60, –50, –40, –30, –20, –10, 0, 10, 20, 30, 40, 50, 60, 70, 80,
90, and 100. However, when the INDEX (%R00001) is 0, the EXIT
statement is enabled and power flow jumps directly to the statement
after the END_FOR statement.

7.5.4 Mask I/O Interrupt

Mask or unmask an interrupt from an I/O board when using I/O variables. If
not using I/O variables, use SVC_REQ 17.
When the interrupt is masked, the CPU processes the interrupt but does not
schedule the associated logic for execution. When the interrupt is
unmasked, the CPU processes the interrupt and schedules the associated
logic for execution.
When the CPU transitions from Stop to Run, the interrupt is unmasked
The function passes power to the right when it executes successfully.
Operands
Parameter Description Allowed Types Allowed Operands Optional
MASK Selects unmask or mask operation. BOOL variable data flow, I, Q, M, T, G, S, SA, No
Unmask=0; Mask=1 or Bit reference in SB, SC, R, P, L, AI, AQ, W,
non-discrete memory symbolic, I/O variable
IN1 The interrupt trigger to be masked BOOL or WORD I, Q, M, T, G, R, P, L, AI, AQ, W, No
or unmasked. variable I/O variable
 The I/O board must be a
supported input module.
 The reference address specified
must correspond to a valid
interrupt trigger reference.
 The interrupt for the specified
channel must be enabled in the
configuration.
Example
In the following example, the variable Mod_Int is mapped to an I/O point on a hardware module and
is configured as an I/O interrupt to a program block. When the BOOL variable MaskOn_Off transitions
from OFF to ON and A1 is set to ON, the interrupt Mod_Int is masked (not executed) for one scan.

7.5.5 Read Switch Position

Read Switch Position (SWITCH_POS) allows the logic to read the current position of the
RUN/STOP switch, as well as the mode for which the switch is configured.
Operands
POS Memory location at which to write current switch position value. All except S, SA, SB, SC No
1 - Run I/O Enabled
2 - Run Outputs Disabled
3 - Stop Mode
MODE Memory location to which switch configuration value is written. All except S, SA, SB, SC No
0 - Switch configuration not supported
1 - Switch controls run/stop mode
2 - Switch not used, or is used by the user application
3 - Switch controls both memory protection and run/stop mode
4 - Switch controls memory protection

7.5.6 Scan Set IO

The Scan_Set_IO function scans the I/O of a specified scan set
number. (Modules can be assigned to scan sets in hardware
configuration.) You can specify whether the Inputs and/or Outputs of
the associated scan set will be scanned.
Execution of this function block does not affect the normal scanning
process of the corresponding scan set. If the corresponding scan set is
configured for non-default Number of Sweeps or Output Delay
settings, they remain in effect regardless of how many executions of
the Scan Set IO function occur in any given sweep.
The Scan Set IO function skips those modules that do not support DO_IO scanning (page 194).
Operands for SCAN_SET_IO
IN If true the inputs will be scanned. BOOL variable or bit Power flow No
reference in a non-BOOL
variable
OUT If true the outputs will be scanned. BOOL variable or bit Power flow No
reference in a non-BOOL
variable
SET Number of the scan set to be scanned. UINT All except %S No
Scan sets are specified in the CPU memory types.
hardware configuration and assigned to
modules in the module hardware
configuration.
ENO Energized when all arguments to the BOOL variable or bit Power flow. Yes
function are valid and there are no errors reference in a non-BOOL
in scanning. variable
Example
By using the Scan Set IO function block in an
interrupt block, you can create a custom I/O
scan. For example, two Scan Set IO function
blocks can be used in an interrupt block to
scan the inputs of a scan set at the beginning
of the block and the outputs of the same scan
set at the end of the block.
In the example at right:
■ When ScanInputs is ON, input data for all
I/O modules assigned to Scan Set 2 is
updated.
■ When ScanOutputs is ON, output data for
all I/O modules assigned to Scan Set 2 is
updated

7.5.7 Suspend I/O

The Suspend I/O (SUS_IO) function stops normal I/O scans from occurring for one CPU
sweep. During the next output scan, all outputs are held at their current states. During the
next input scan, the input references are not updated with data from inputs. However,
during the input scan portion of the sweep, the CPU verifies that Genius bus controllers have
completed their previous output updates.
Note: The PACSystems SUS_IO function suspends analog and discrete I/O, whether integrated I/O
or Genius I/O. It does not suspend Ethernet Global Data. For details, refer to TCP/IP Ethernet
When SUS_IO receives power flow, all I/O servicing stops except that provided by DO_IO functions.
Warning
If SUS_IO were placed at the left rail of the ladder, without
enabling logic to regulate its execution, no regular I/O scan
would ever be performed.
SUS_IO passes power flow to the right whenever it receives
power.

Example
The example at right shows a SUS_IO function and a DO_IO
function used to stop I/O scans, then cause certain I/O to be
scanned from the program.
Inputs %I00010 and %I00011 form a latch circuit with the
contact from %M00001. This keeps the SUS_IO function
active on each sweep until %I00011 goes on. If this input
were not scanned by DO_IO after SUS_IO went active,
SUS_IO could only be disabled by powering down the PLC.
Output %Q00002 is set when both DO_IO functions execute
successfully. The rung is constructed so that both DO_IO
functions execute even if one does not set its OK output.
With normal I/O suspended, output %Q00002 is not updated
until a DO_IO function with %Q00002 in its range executes.
This does not occur until the sweep after the setting of
%Q00002. Outputs that are set after a DO_IO function
executes are not updated until another DO_IO function
executes, typically in the next sweep. Because of this delay,
most programs that use SUS_IO and DO_IO place the SUS_IO
function in the first rung of the program, the DO_IO function
that processes inputs in the next rung, and the DO_IO
function that processes outputs in the last rung.
The range of the DO_IO function doing outputs is %Q00001
through %Q00030. If the module in this range were a
32-point module, the DO_IO function would actually perform
a scan of the entire module. A DO_IO function will not break
the scan in the middle of an I/O module.

7.5.8 Suspend or Resume I/O Interrupt

Suspend or resume an I/O interrupt when using I/O variables.
If not using I/O variables, use SVC_REQ 32.
The function executes successfully and passes power to the right unless:
 The I/O module associated with the interrupt trigger specified in IN1 is not supported.
 The reference address specified does not correspond to a valid interrupt trigger reference.
 The specified channel does not have its interrupt enabled in the configuration.
Operands
SUSP Selects a suspend or resume BOOL variable or bit data flow, I, Q, M, T, G, S, SA, No
operation. reference in a non-BOOL SB, SC, R, P, L, discrete
1 (ON)=suspend variable symbolic, I/O variable
0 (OFF)=resume
IN1 The interrupt trigger to be BOOL or WORD variable I, Q, M, T, G, R, P, L, AI, AQ, W, No
suspended or resumed. I/O variable
Example
In the following example, the variable Mod_Int is mapped to an I/O point on a hardware module and
is configured as an I/O interrupt to a program block. When the BOOL variable SuspOn_Off is set to
ON and A1 is set to ON, interrupts from Mod_Int are suspended until SuspOn_Off is reset.

7.6. Conversion Functions

The Conversion functions change a data item from one number format (data type) to another. Many
programming instructions, such as math functions, must be used with data of one type. As a result,
data conversion is often required before using those instructions.
Function Description
Convert Angles
DEG_TO_RAD Converts degrees to radians
RAD_TO_DEG Converts radians to degrees
Convert to BCD4 (4-digit Binary-Coded-Decimal)
UINT_TO_BCD4 Converts UINT (16-bit unsigned integer) to BCD4
INT_TO_BCD4 Converts INT (16-bit signed integer) to BCD4
DINT_TO_BCD8 Converts DINT (32-bit signed integer) to BCD8
Convert to INT (16-bit signed integer)
BCD4_TO_INT Converts BCD4 to INT
UINT_TO_INT Converts UINT to INT
DINT_TO_INT Converts DINT to INT
REAL_TO_INT Converts REAL to INT
Convert to UINT (16-bit unsigned integer)
BCD4_TO_UINT Converts BCD4 to UINT
INT_TO_UINT Converts INT to UINT
DINT_TO_UINT Converts DINT to UINT
REAL_TO_UINT Converts REAL to UINT
Convert to DINT (32-bit signed integer)
BCD8_TO_DINT Converts 8-digit Binary-Coded-Decimal (BCD8) to DINT
UINT_TO_DINT Converts UINT to DINT
INT_TO_DINT Converts INT to DINT
REAL_TO_DINT Converts REAL (32-bit signed real or floating-point values) to DINT
LREAL_TO_DINT Converts REAL (64-bit signed real or floating-point values) to DINT
Convert to REAL (32-bit signed real or floating-point values)
BCD4_TO_REAL Converts BCD4 to REAL
BCD8_TO_REAL Converts BCD8 to REAL
UINT_TO_REAL Converts UINT to REAL
INT_TO_REAL Converts INT to REAL
DINT_TO_REAL Converts DINT to REAL
LREAL_TO_REAL Converts LREAL to REAL
Convert to LREAL(64-bit signed real or floating-point values)
DINT_TO_LREAL Converts DINT to LREAL
REAL_TO_LREAL Converts REAL to LREAL
Truncate
TRUNC_DINT Rounds a REAL number down to a DINT (32-bit signed integer) number
TRUNC_INT Rounds a REAL number down to an INT (16-bit signed integer) number

7.6.1 Convert Angles

Mnemonics:
DEG_TO_RAD_REAL
DEG_TO_RAD_LREAL
RAD_TO_DEG_REAL
RAD_TO_DEG_LREAL
When the Degrees to Radians (DEG_TO_RAD) or the Radians to Degrees (RAD_TO_DEG) function
receives power flow, it performs the appropriate angle conversion on the REAL or LREAL value in
input IN and places the result in output Q.
DEG_TO_RAD and RAD_TO_DEG pass power flow to the right when they execute, unless IN is NaN
(Not a Number).
Operands
IN The value to convert. All except S, SA, SB, and SC No
Q The converted value. All except S, SA, SB, and SC No
Example
A value of +1500 radians is converted to degrees. The result is placed
in %R00001 and %R00002.

7.6.2 Convert UINT or INT to BCD4

When this function receives power flow, it converts the input unsigned
(UINT) or signed single-precision integer (INT) data into the equivalent
4-digit Binary-Coded-Decimal (BCD) values, which it outputs to Q.
This function does not change the original input data. The output data can
be used directly as input for another program function.
The function passes power flow when power is received, unless the conversion would result in a
value that is outside the range 0 to 9,999.
Tip: Data can be converted to BCD format to drive BCD-encoded LED displays or presets to
external devices such as high-speed counters.
Operands
IN The UINT or INT value to convert to All except S, SA, SB, and SC No
BCD4.
Q The BCD4 equivalent value of the All except S, SA, SB, and SC No
original UINT or INT value in IN.
Example - UINT to BDC4

Whenever input %I00002 is set and no errors exist, the UINT
at input location %I00017 through %I00032 is converted to
four BCD digits and the result is stored in memory locations
%Q00033 through %Q00048. Coil %M01432 is used to check
for successful conversion.
Example - INT to BCD4

Whenever input %I0002 is set and no errors exist, the INT
values at input locations %I0017 through %I0032 are
converted to four BCD digits, and the result is stored in
memory locations %Q0033 through %Q0048. Coil %Q1432 is
used to check for successful conversion.

7.6.3 Convert DINT to BCD8

When DINT_TO_BCD8 receives power flow, it converts the input signed double-
precision integer (DINT) data into the equivalent 8-digit Binary-Coded-Decimal (BCD)
values, which it outputs to Q. DINT_TO_BCD8 does not change the original DINT data.
Note: The output data can be used directly as input for another program function.
value that is outside the range 0 to 99,999,999.
Operands
IN The DINT value to convert to BCD8 All except S, SA, SB, and SC No
Q The BCD8 equivalent value of the original DINT value in IN All except S, SA, SB, and SC No
Example
Whenever input %I00002 is set and no errors exist, the double-
precision signed integer (DINT) at input location %AI0003 is
converted to eight BCD digits and the result is stored in
memory locations %L00001 through %L00002.

7.6.4 Convert BCD4, UINT, DINT, or REAL to INT
BDC4, UINT, and DINT

When this function receives power flow, it converts the input data into the equivalent single-precision
signed integer (INT) value, which it outputs to Q. This function does not change the original input
data. The output data can be used directly as input for another program function, as in the examples.
The function passes power flow when power is received, unless the data is out of range.
REAL
When REAL_TO_INT receives power flow, it rounds the input REAL data up or down to the nearest
single-precision signed integer (INT) value, which it outputs to Q. REAL_TO_INT does not change the
original REAL data.
The function passes power flow when power is received, unless the data is out of range or NaN (Not
a Number).
Warning
Converting from REAL to INT may result in overflow. For
example, REAL 7.4E15, which equals 7.4 × 1015, converts to
INT OVERFLOW.
Tip: To truncate a REAL value and express the result as an INT, i.e., to remove the fractional part
of the REAL number and express the remaining integer value as an INT, use TRUNC_INT.
Operands
IN The value to convert to INT. All except S, SA, SB, and SC No
Q The INT equivalent value of the original value in IN. All except S, SA, SB, and SC No
Example: BCD4 to INT

Whenever input %I0002 is set, the BCD-4 value
in PARTS is converted to a signed integer (INT)
and passed to the ADD_INT function, where it is
added to the INT value represented by the
reference RUNNING. The sum is output by
ADD_INT to the reference TOTAL.

Example: UINT to INT

Whenever input %M00344 is set, the UINT value in
%R00234 is converted to a signed integer (INT) and
passed to the ADD function, where it is added to the
INT value in %R06488. The sum is output by the
ADD function to the reference CARGO.
Example: DINT to INT

Whenever input %M00031 is set, the DINT value in
%R00055 is converted to a signed integer (INT) and
passed to the ADD function, where it is added to the
INT at %R02345. The sum is output by the ADD
function to %R08004.

7.6.5 Convert BCD4, INT, DINT, or REAL to UINT

When this function receives power flow, it
converts the input data into the equivalent single-
precision unsigned integer (UINT) value, which it
outputs to Q.
The conversion to UINT does not change the original data. The output data can be used directly as
input for another program function, as in the example.
The function passes power flow when power is received, unless the resulting data is outside the
range 0 to +65,535.
Warning
Converting from REAL to UINT may result in overflow. For
example, REAL 7.2E17, which equals 7.2 × 1017, converts to
UINT OVERFLOW.
Operands
IN The value to convert to UINT. All except S, SA, SB, and SC No
Q The UINT equivalent value of the original input value in IN. All except S, SA, SB, and SC No
Example: BCD4 to UINT

Tip: One use of BCD4_TO_UINT is to convert BCD data from the I/O structure into integer data
and store it in memory. This can provide an interface to BCD thumbwheels or external BCD
electronics, such as high-speed counters and position encoders.
In the example at right, whenever input %I0002 is
set, the BCD4 value in PARTS is converted to an
unsigned single-precision integer (UINT) and passed
to the ADD_UINT function, where it is added to the
UINT value represented by the reference RUNNING.
The sum is output by ADD_UINT to the reference
TOTAL.
Example: INT to UINT
Whenever input %I0002 is set, the INT value in
%L00050 is converted to an unsigned single-
precision integer (UINT) and passed to the
ADD_UINT function, where it is added to the UINT
value in %R08833. The sum is output by ADD_UINT
to the reference TOTAL.

Example: DINT to UINT

Whenever input %I00002 is set and no errors
exist, the double precision signed integer (DINT) at
input location %R00007 is converted to an
unsigned integer (UINT) and passed to the SUB
function, where the constant value 145 is
subtracted from it. The result of the subtraction is
stored in the output reference location %Q00033.
Example: REAL to UINT
Whenever input %I00045 is set, the REAL value in
%L00045 is converted to an unsigned single-
precision integer (UINT) and passed to the
ADD_UINT function, where it is added to the UINT
value in %R00045. The sum is output by ADD_UINT
to the reference TOTAL.

7.6.6 Convert BCD8, UINT, INT, REAL or LREAL to DINT
BCD8, UINT, and INT

When this function receives power flow, it converts the data into the equivalent signed double-
precision integer (DINT) value, which it outputs to Q. The conversion to DINT does not change the
original data.
The output data can be used directly as input for another program function. The function passes
power flow when power is received, unless the data is out of range.
REAL and LREAL
When REAL_TO_DINT or LREAL_TO_DINT receives power flow, it rounds the input data to the nearest
double-precision signed integer (DINT) value, which it outputs to Q. These functions do not change
the original REAL or LREAL data.
power flow when power is received, unless the conversion would result in an out-of-range DINT
value.
Warning
Converting from LREAL or REAL to DINT may result in
overflow. For example, REAL 5.7E20, which equals 5.7 × 1020,
converts to DINT OVERFLOW.
Tip: To truncate a REAL value and express the result as a DINT, i.e., to remove the fractional part
of the REAL number and express the remaining integer value as a DINT, use TRUNC_DINT.
Operands
IN The value to convert to DINT. All except S, SA, SB, and SC No
Q The DINT equivalent value of the original input value in IN. All except S, SA, SB, and SC No
Example: UINT to DINT

Whenever input %M01478 is set, the unsigned single-precision
integer (UINT) value at input location %R00654 is converted to
a double-precision signed integer (DINT) and the result is
placed in location %L00049. The output %M00065 is set
whenever the function executes successfully.

Example: BCD8 to DINT

Whenever input %I00025 is set, the BCD-8 value in
%L00046 is converted to a signed double-precision
integer (DINT) and passed to the ADD_DINT function,
where it is added to the DINT value in %R00797. The
sum is output by ADD_DINT to the reference TOTAL.
Example: INT to DINT

Whenever input %I00002 is set, the signed single-precision
integer (INT) value at input location %I00017 is converted to
a double-precision signed integer (DINT) and the result is
placed in location %L00001. The output %Q01001 is set
whenever the function executes successfully.
Example: REAL to DINT

Whenever input %I0002 is set, the REAL value at input
location %R0017 is converted to a double precision signed
integer (DINT) and the result is placed in location %R0001.
The output %Q1001 is set whenever the function executes
successfully.

7.6.7 Convert BCD4, BCD8, UINT, INT, DINT, and LREAL to REAL
When this function receives power flow, it converts the input data into the equivalent 32-bit floating-
point (REAL) value, which it outputs to Q. The conversion to REAL does not change the original input
data.
The output data can be used directly as input for another program function.
value that is out of range.
Warning
Converting from BCD8 to REAL may result in the loss of
significant digits.
This is because a BCD8 value is stored in a DWORD, which
uses 32 bits to store a value, whereas a REAL (32-bit IEEE
floating point number) uses 8 bits to store the exponent and
the sign and only 24 bits to store the mantissa.
Warning
Converting from DINT to REAL may result in the loss of
significant digits for numbers with more than 7 significant
base-10 digits.
This is because a DINT value uses 32 bits to store a value,
which is the equivalent of up to 10 significant base-10 digits,
whereas a REAL (32-bit IEEE floating point number) uses 8
bits to store the exponent and the sign and only 24 bits to
store the mantissa, which is the equivalent of 7 or 8
significant base-10 digits. When the REAL result is displayed
as a base-10 number, it may have up to 10 digits, but these
are converted from the rounded 24-bit mantissa, so that the
last 2 or 3 digits may be inaccurate.
Operands
IN The value to convert to REAL. All except S, SA, SB, and SC No
Q The REAL equivalent value of the original input value in IN. All except S, SA, SB, and SC No

Example: UINT to REAL

The unsigned integer value in %L00001 is 825. The value
placed in %L00016 is 825.000.
Example: INT to REAL

The integer value of input IN is -678. The value placed in
%R00010 is -678.000.
Example: LREAL to REAL

The double-precision floating
point value of the square root of
2 is rounded to the nearest
single-precision floating point
value and placed in R00300.

7.6.8 Convert REAL to LREAL

When REAL_TO_LREAL receives power flow, it converts the 32-bit single precision
floating point REAL data to the equivalent 64-bit double-precision floating point data.
REAL_TO_LREAL does not change the original REAL data.
Operands
IN The REAL value to convert to LREAL. All except S, SA, SB, and SC No
Q The LREAL equivalent value of the original REAL value. All except S, SA, SB, and SC No
Example
The REAL value of the square root of 2 is converted to the LREAL data type and placed in R00200.
Because the actual precision of the data in Result_Real is seven decimal places, the additional
decimal places in the data in R00200 are not valid.

7.6.9 Convert DINT to LREAL

When DINT_TO_LREAL receives power flow, it converts the double-precision
input data to 64-bit double-precision floating point data.
7.6.10 Truncate
When power is received, the Truncate functions TRUNC_DINT and
TRUNC_INT round a floating-point (REAL) value down respectively to the
nearest signed double-precision signed integer (DINT) or signed single-
precision integer (INT) value. TRUNC_DINT and TRUNC_INT output the
converted value to Q. The original data is not changed.
TRUNC_DINT and TRUNC_INT pass power flow when power is received, unless the specified
conversion would result in a value that is out of range or unless IN is NaN (Not a Number).
Operands
IN The REAL value whose copy is to be converted and All except S, SA, SB, and SC No
truncated. The original is left intact.
Q The truncated value of the original REAL value in IN. All except S, SA, SB, and SC No
Example
The displayed constant is truncated and the integer result 562 is placed in %T0001.

7.7. Counters
Down Counter DNCTR Counts down from a preset value. The output is ON whenever the
Current Value is ≤ 0.
Up Counter UPCTR Counts up to a designated value. The output is ON whenever the
Current Value is ≥ the Preset Value.
7.7.1 Data Required for Counter Function Blocks
Warning
Do not use two consecutive words (registers) as the starting
addresses of two counters. Logic Developer - PLC does not
check or warn you if register blocks overlap. Timers will not
work if you place the current value of a second timer on top
of the preset value for the previous timer.
Each counter uses a one-dimensional, three-word array of %R, %W, %P, %L, or symbolic memory to
store the following information:
Current value (CV) Word 1
Warning
The first word (CV) can be read but should not be written to,
or the function may not work properly.
Preset value (PV) Word 2 When the Preset Value (PV) operand is a variable, it is normally set to a
different location than word 2 in the timer’s or counter’s three-word
array.
■ If you use a different address and you change word 2 directly, your
change will have no effect, as PV will overwrite word 2.
■ If you use the same address for the PV operand and word 2, you can
change the Preset Value in word 2 while the timer or counter is
running and the change will be effective.
Control word Word 3
The control word stores the state of the Boolean inputs and outputs of its
associated timer or counter, as shown in the following diagram:
Warning
The third word (Control) can be read but should not be
written to; otherwise, the function will not work.

Word 3: Control Word Structure

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Reserved
Reset input
Enable input, previous execution
Q (counter/timer status output)
EN (enable input
Note: Bits 0 through 13 are not used for counters.

7.7.2 Down Counter

The Down Counter (DNCTR) function counts down from a preset value. The minimum
Preset Value (PV) is zero; the maximum PV is +32,767 counts. When the Current Value (CV)
reaches the minimum value, -32,768, it stays there until reset. When DNCTR is reset, CV is
set to PV. When the power flow input transitions from OFF to ON, CV is decremented by
one. The output is ON whenever CV ≤ 0.
The output state of DNCTR is retentive on power failure; no automatic initialization occurs
at power-up.
Warning
Do not use the Address of the down counter with other
instructions. Overlapping references cause erratic counter
operation.
Note: For DNCTR to function properly, you must provide an initial reset to set the CV to the value in
PV. If DNCTR is not initially reset, CV will decrement from 0 and the output of DNCTR will be
set to ON immediately.
Operands
Address The beginning address of a three-word WORD array: R, W, P, L, symbolic No
(????) Word 1: Current Value (CV)
Word 2: Preset Value (PV)%
Word 3: Control word
R When R receives power flow, it resets the counter's CV to PV. Power flow No
PV Preset Value to copy into word 2 of the counter's address when All except S, SA, SB, SC No
the counter is enabled or reset. 0 ≤PV ≤ 32,767. If PV is out of
range, word 2 cannot be reset.
CV The current value of the counter All except S, SA, SB, SC No
and constant
Example – Down Counter

DNCTR counts 5000 new parts before energizing output %Q00005.

7.7.3 Up Counter
The Up Counter (UPCTR) function counts up to the Preset Value (PV). The range is 0 to
+32,767 counts. When the Current Value (CV) of the counter reaches 32,767, it remains there
until reset. When the UPCTR reset is ON, CV resets to 0. Each time the power flow input
transitions from OFF to ON, CV increments by 1. CV can be incremented past the Preset
Value (PV). The output is ON whenever CV ≥ PV. The output (Q) stays ON until the R input
receives power flow to reset CV to zero.
The state of UPCTR is retentive on power failure; no automatic initialization occurs at power-up.
Warning
Do not use the Address of the up counter with other
instructions. Overlapping references cause erratic counter
operation.
Operands
(???? ) Word 1: Current Value (CV)
Word 2: Preset Value (PV)
R When R is ON, it resets the counter's CV to 0. Power flow No
PV Preset Value to copy into word 2 of the counter's address when the All except S, SA, SB, No
counter is enabled or reset. 0 ≤ PV ≤ 32,767. If PV is out of range, it and SC
does not affect word 2.
CV The current value of the counter All except S, SA, SB, No
SC and constant
Example – Up Counter
Every time input %I0012 transitions from OFF to ON, the Up Counter counts up by 1; internal coil
%M0001 is energized whenever 100 parts have been counted. Whenever %M0001 is ON, the
accumulated count is reset to zero.

Example – Up Counter and Down Counter

This example uses an up/down counter pair with a shared register for the accumulated or current
value. When the parts enter the storage area, the up counter increments by 1, increasing the current
value of the parts in storage by a value of 1. When a part leaves the storage area, the down counter
decrements by 1, decreasing the inventory storage value by 1. To avoid conflict with the shared
register, both counters use different register addresses but each has a current value (CV) address
that is the same as the accumulated value for the other register.

7.8. Data Move Functions

The Data Move functions provide basic data move capabilities.
Array Size ARRAY_SIZE Counts the number of elements in an array.
Array Size ARRAY_SIZE_DIM1 Returns the value of the Array Dimension 1 property of a one- or
Dimension 1 two-dimensional array.
Array Size ARRAY_SIZE_DIM2 Returns the value of the Array Dimension 2 property of a two-
Dimension 2 dimensional array.
Block Clear BLK_CLR_WORD Replaces all the contents of a block of data with zeroes. Can be used
to clear an area of WORD or analog memory.
Block Move BLKMOV_DINT Copies a block of seven constants to a specified memory location.
BLKMOV_DWORD The constants are input as part of the function.
BLKMOV_INT
BLKMOV_REAL
BLKMOV_UINT
BLKMOV_WORD
Bus Read BUS_RD_BYTE Reads data from a module on the bus.
BUS_RD_DWORD
BUS_RD_WORD
Bus Read Modify BUS_RMW_BYTE Uses a read/modify/write cycle to update a data element in a
Write BUS_RMW_DWORD module on the bus.
BUS_RMW_WORD
Bus Test and Set BUS_TS_BYTE Handles semaphores on the bus.
BUS_TS_WORD
Bus Write BUS_WRT_BYTE Writes data to a module on the bus.
BUS_WRT_DWORD
BUS_WRT_WORD
Communication COMMREQ Allows the program to communicate with an intelligent module, such
Request as a Genius Bus Controller or a High Speed Counter.
Data Initialization DATA_INIT_DINT Copies a block of constant data to a reference range. The mnemonic
DATA_INIT_DWORD specifies the data type.
DATA_INIT_INT
DATA_INIT_REAL
DATA_INIT_LREAL
DATA_INIT_UINT
DATA_INIT_WORD
Data Initialize ASCII DATA_INIT_ASCII Copies a block of constant ASCII text to a reference range.
Data Initialize DLAN DATA_INIT_DLAN Used with a DLAN Interface module.
Data Initialize DATA_INIT_COMM Initializes a COMMREQ function with a block of constant data. The
Communications length should equal the size of the COMMREQ function’s entire
Request command block.


Move MOVE_BOOL Copies data as individual bits, so the new location does not have to
MOVE_DATA be the same data type. Data can be moved into a different data type
MOVE_DINT without prior conversion.
MOVE_DWORD
MOVE_INT
MOVE_REAL
MOVE_LREAL
MOVE_UINT
MOVE_WORD
Move Data Explicit MOVE_DATA_EX Provides an input that allows for data coherency by locking symbolic
memory being written to during the copy operation.
Move from Flat MOVE_FROM_FLAT Copies reference memory data to a UDT variable or UDT array.
Provides the option of locking the symbolic or I/O variable memory
area being written to during the copy operation.
Move to Flat MOVE_TO_FLAT Copies data from symbolic or I/O variable memory to reference
memory. Copies across mismatching data types.
Shift Register SHFR_BIT Shifts one or more data bits, data WORDs or data DWORDs from a
SHFR_DWORD reference location into a specified area of memory. Data already in
SHFR_WORD the area is shifted out.
Size Of SIZE_OF Counts the number of bits used by a variable.

Swap SWAP_DWORD Swaps two BYTEs of data within a WORD or two WORDs within a
SWAP_WORD DWORD.

7.8.1 Array Size

Counts the number of elements in the array assigned to input IN and writes
the number to output Q.
In an array of structure variables, the number of structure variables is written
to Q; the elements in the structure variables are not counted.
Tip: If the array assigned to input IN of ARRAY_SIZE is passed to a parameterized C block for
processing, also pass the value of output Q to the block. In the C block logic, use the value of output
Q to ensure all array elements are processed without exceeding the end of the array. For a two-
dimensional array, this method works only if all elements are treated identically; for example, all are
initialized to the same value.
Operands
IN Array of any data type whose elements are counted. Data flow, I, Q, M, T, S, SA, SB, SC, No
If a non-array variable is assigned to IN, the value of G, discrete symbolic, I/O variable
Q is 1.
Q Number of elements in the array assigned to input IN. DINT or DWORD variable. No
Data flow, I, Q, M, T, G, R, P, L, AI,
AQ, W, symbolic, I/O variable
Example
The two-dimensional array TestArray has its Array Dimension 1 property set to 4 and its Array
Dimension 2 property set to 3. ARRAY_SIZE calculates 4 × 3 and writes the value 12 to the variable
Elements.

7.8.2 Array Size Dimension Function Blocks

Array Size Dimension 1
Returns the value of the Array Dimension 1 property of an array and writes
the value to output Q. If a non-array variable is assigned to IN, the value of Q
is 0.
In an LD or ST block that is not a parameterized block or a User Defined
Function Block (UDFB), you can use the output Q value to ensure that a loop
using a variable index to access array elements does not exceed the array's
first dimension.
Operands
IN Array of any data type. Data flow, I, Q, M, T, S, No
SA, SB, SC, G, discrete
symbolic, I/O variable
Q The value of the Array Dimension 1 property of the array DINT or DWORD No
assigned to input IN. The value is set to 0 if a non-array is variable.
assigned to IN. Data flow, I, Q, M, T, G, R,
Note: Because the index of the first element of an array is P, L, AI, AQ, W, symbolic,
zero, the index of the last element is one less than the I/O variable
value assigned to Q.
Array Size Dimension 2

Returns the value of the Array Dimension 2 property of an array and writes
the value to output Q. If a non-array variable is assigned to IN, the value of Q
is 0.
In an LD or ST block that is not a parameterized block or a User Defined
Function Block (UDFB), you can use the output Q value to ensure that a loop
using a variable index to access array elements does not exceed the array's
second dimension.
Operands
IN Array of any data type. Data flow, I, Q, M, T, S, No
SA, SB, SC, G, discrete
Q The value of the Array Dimension 2 property of the array DINT or DWORD No
assigned to input IN. The value is set to 0 if a non-array is variable.
assigned to IN. Data flow, I, Q, M, T, G, R,
Note: Because the index of the first element of an array is P, L, AI, AQ, W, symbolic,
zero, the index of the last element is one less than the I/O variable
value assigned to Q.

Example - FOR_LOOP that Iterates Through Dimension 1 of an Array

To use a FOR_LOOP to access array elements by means of a variable index, you must ensure that the
FOR_LOOP does not iterate beyond the last element of the array.
In the following logic, MOVE_DINT initializes the variable D1_temp to 0. ARRAY_SIZE_DIM1 counts the
number of elements of a one-dimensional array named D1_Array and outputs the result to output Q.
Because the index of the first element of an array is zero, the loop must iterate (Q - 1) times.
SUB_DINT performs the subtraction and the result is converted to an INT value and assigned to
variable D1_size.
In the following rungs, the FOR_LOOP executes when D1ON is set to On. The variable index D1_Index
increments by 1 from 0 through D1_size, the value calculated by ARRAY_SIZE_DIM1 and SUB_DINT. In
each loop, the value of D1_temp is assigned to the element D1_Array[D1_Index] and D1_temp is
increased by 1.
You can use a FOR_LOOP to iterate through an array’s second dimension in a method similar to this
example. You can also use nested FOR_LOOPs to ensure that operations on elements using two
variable indexes each do not exceed their array dimension. For additional examples, refer to the
online help.

7.8.3 Block Clear

When the Block Clear (BLKCLR_WORD) function receives power flow, it fills the specified
block of data with zeroes, beginning at the reference specified by IN. When the data to be
cleared is from BOOL (discrete) memory (%I, %Q, %M, %G, or %T), the transition
information associated with the references is updated. BLKCLR_WORD passes power to
the right whenever it receives power.
Note: The input parameter IN is not included in coil checking.
Operands
Length (??) The number of words to clear, starting at the IN Constant No
location. 1 ≤ Length ≤ 256 words.
IN The first WORD of the memory block to clear to 0. All except %S and data flow. No
Example
At power-up, 32 words of %Q memory (512 points) beginning at %Q0001 are filled with zeroes. The
transition information associated with these references will also be updated.
7.8.4 Block Move

When the Block Move (BLKMOV) function receives power flow, it Mnemonics:
copies a block of seven constants into consecutive locations BLKMOV_DINT
beginning at the destination specified in output Q. BLKMOV
BLKMOV_DWORD
passes power to the right whenever it receives power.
BLKMOV_INT
BLKMOV_REAL
BLKMOV_UINT
BLKMOV_WORD

Operands
Note: For each mnemonic, use the corresponding data type for the Q operand. For example,
BLKMOV_DINT requires Q to be a DINT variable.
IN1 to IN7 The seven constant values to move. Constants. Constant type must match function type. No
Q The first memory location of the All except %S. No
destination for the moved values. %SA, SB, SC are also prohibited on BLKMOV REAL,
IN1 is moved to Q. BLK_MOV_INT, and BLK_MOV_UINT.
Example
When the enabling input represented by the name #FST_SCN is ON,
BLKMOV_INT copies the seven input constants into memory locations
%R0010 through %R0016.

7.8.5 BUS_ Functions

Four program functions allow the PACSystems CPU to communicate with modules in the system.
■ Bus Read (BUS_RD)
■ Bus Write (BUS_WRT)
■ Bus Read/Modify/Write (BUS_RMW)
■ Bus Test and Set (BUS_TS)
These functions use the same parameters to specify which module on the bus will exchange data
with the CPU.
Note: Additional information related to addressing modules is required to use the BUS_ functions.
For open VME modules in an RX7i system, refer to the PACSystems RX7i User’s Guide to
Integration of VME Modules, GFK-2235. For other modules, refer to the product
documentation provided by the manufacturer.
Rack, Slot, Subslot, Region, and Offset Parameters
The rack and slot parameters refer to a module in the hardware configuration. The region parameter
refers to a memory region configured for that module. The sub-slot is ordinarily set to 0. The offset is
a 0-based number that the function adds to the module’s base address (which is part of the memory
region configuration) to compute the address to be read or written.
BUS Read
The BUS_RD function reads data from the bus. Mnemonics:
This function should be executed before the data is needed in the BUS_RD_DINT
program. If the amount of data to be read is greater than 32767 BUS_RD_DWORD
BYTES, WORDS, or DWORDS, use multiple instructions to read the data.
BUS_RD_WORD
When BUS_RD receives power flow, it accesses the module at the
specified rack (R), slot (S), subslot (SS), address region (RGN) and offset
(OFF). BUS_RD copies the specified number (Length) of data units
(DWORDS, WORDs or BYTEs) from the module to the CPU, beginning at
output reference (Q).
The function passes power to the right when its operation is
successful. The status of the operation is reported in the status
location (ST).
Note: For each BUS_RD function type, use the corresponding data
type for the Q operand. For example, BUS_RD_BYTE requires Q
to be a BYTE variable.
Note: An interrupt block can preempt the execution of a BUS_RD
function. On the bus, only 256 bytes are read coherently (i.e.,
read without being preempted by an interrupt).

Operands for BUS READ

Length (??) The number of BYTEs, DWORDs, or WORDs. 1 to 32,767. Constant No
R Rack number. UINT constant or variable. All except %S—%SC No
S Slot number. UINT constant or variable. All except %S—%SC No
SS Subslot number (defaults to 0). UINT constant or variable. All except %S—%SC Yes
RGN Region (defaults to 1). WORD constant or variable. All except %S—%SC Yes
OFF The offset in bytes. DWORD constant or variable. All except %S—%SC No
ST The status of the operation. WORD variable. All except variables located Yes
in %S—%SC, and constants
Q Reference for data read from the module. DWORD variable. All except variables located No
in %S—%SC, and constants
BUS_RD Status in the ST Output

The BUS_RD function returns one of the following values to the ST output:
0 Operation successful.
1 Bus error
2 Module does not exist at rack/slot location.
3 Module at rack/slot location is an invalid type.
4 Start address outside the configured range.
5 End address outside the configured address range.
6 Absolute address even but interface configured as odd byte only
8 Region not enabled
10 Function parameter invalid.

BUS Read Modify Write

The BUS_RMW function updates one byte, word, or double word of Other mnemonic:
data on the bus. This function locks the bus while performing the BUS_RMW_WORD
read-modify-write operation.
When the BUS_RMW function receives power flow through its enable
input, the function reads a dword, word or byte of data from the
module at the specified rack (R), slot (S), subslot (SS) and optional
address region (RGN) and offset (OFF). The original value is stored in
parameter (OV).
The function combines the data with the data mask (MSK). The
operation performed (AND / OR) is selected with the OP parameter.
The mask value is dword data. When operating on a word of data,
only the lower 16 bits are used. When operating on a byte of data,
only the lower 8 bits of the mask data are used. The result is then
written back to the same address from which it was read.
The BUS_RMW function passes power to the right when its operation
is successful, and returns a status value to the ST output.

Operands for BUS_RMW

For BUS_RMW_WORD, the absolute bus address must be a multiple of 2. For BUS_RMW_DWORD, it
must be a multiple of 4.
The absolute bus address is equal to the base address plus the offset value.
OP Type of operation: No
0 = AND Constant
1 = OR
MSK The data mask. DWORD constant or variable. All except %S—%SC No
SS Subslot number (optional, defaults to 0). UINT constant or variable. All except %S—%SC Yes
ST The status of the operation. WORD variable. All except variables Yes
located in %S—%SC,
and constants
OV Original value. DWORD variable. All except variables Yes
and constants
BUS_RMW Status in the ST Output

The BUS_RMW function returns one of the following values to the ST output:
0 Operation successful.
1 Bus error
2 Module does not exist at rack/slot location.
3 Module at rack/slot location is an invalid type.
4 Start address outside the configured range.
5 End address outside the configured address range.
6 Absolute address even but interface configured as odd byte only
7 For WORD type, absolute bus address is not a multiple of 2. For DWORD type, absolute bus address is not
a multiple of 4.
8 Region not enabled
9 Function type too large for configured access type.
10 Function parameter invalid.

BUS Test and Set

The BUS_TS function uses semaphores to control access to specific Other
memory in a module located on the bus. mnemonic:
The BUS_TS function exchanges a Boolean TRUE (1) for the value BUS_TS_WORD
currently at the semaphore location. If that value was already a 1,
then the BUSTST function does not acquire the semaphore. If the
existing value was 0, the semaphore is set and the BUS_TS function
has the semaphore and the use of the memory area it controls. The
semaphore can be cleared and ownership relinquished by using the
BUSWRT function to write a 0 to the semaphore location. This
function locks the bus while performing the operation.
When the BUS_TS function receives power flow through its enable
input, the function exchanges a Boolean TRUE (1) with the address
specified by the RACK, SLOT, SUBSLOT, RGN, and OFF parameters.
The function sets the Q output on if the semaphore was available (0)
and was acquired. It passes power flow to the right whenever power
is received and no errors occur during execution.
Operands for BUS Test and Set

BUS_TS can be programmed as BUS_TS_BYTE or BUS_TS_WORD. For BUS_TS_WORD, the absolute
address of the module must be a multiple of 2. The absolute address is equal to the base address
plus the offset value.
SS Subslot number (defaults to 0). UINT constant or variable. All except %S—%SC Yes
ST The status of the bus test and set operation. WORD variable. All except variables Yes
located in %S—
%SC, and constant
Q Output set on if the semaphore was available (0). Otherwise, Q is set Yes
Power flow
off.

BUS Write
When the BUS_WRT function receives power flow through its Mnemonics:
enable input, it writes the data located at reference (IN) to the BUS_WRT_DINT
module at the specified rack (R), slot (S), subslot (SS) and optional
BUS_WRT_DWORD
address region (RGN) and offset (OFF). BUSWRT writes the
specified length (LEN) of data units (DWORDS, WORDs or BYTEs). BUS_WRT_WORD
The BUS_WRT function passes power to the right when its
operation is successful. The status of the operation is reported in
the status location (ST).
Note: For each BUS_WRT function type, use the corresponding
data type for the IN operand. For example,
BUS_WRT_BYTE requires IN to be a BYTE variable.
Note: An interrupt block can preempt the execution of a
BUS_WRT function. On the bus, only 256 bytes are written
coherently (i.e., written without being preempted by an
interrupt).
Operands for Bus Write

Parameter Description Allowed Optional
Length (??) Length. The number of BYTEs, DWORDs, or WORDs. 1 to 32,767. Constant No
IN Reference for data to be written to the module. DWORD All except variables No
variable. located in %S—%SC,
and constant
SS Subslot number (defaults to 0) UINT constant or variable. All except %S—%SC Yes
RGN Region. (defaults to 1) WORD constant or variable. All except %S—%SC Yes
ST The status of the operation. WORD variable. All except variables Yes
and constant

7.8.6 Communication Request (COMMREQ)

The Communication Request (COMMREQ) function communicates with an intelligent
module, such as a Genius Communications Module or High Speed Counter.
Notes:
 The information presented in this section shows only the basic format of the COMMREQ function.
Many types of COMMREQs have been defined. You will need additional information to program
the COMMREQ for each type of device. Programming requirements for each module that uses the
COMMREQ function are described in the specialty module's user documentation.
 If you are using serial communications, refer to Chapter 13, “Serial I/O, SNP & RTU Protocols”.
 A COMMREQ instruction inside an interrupt block being executed may cause the block to be
preempted when a new, incoming interrupt has the same priority.
When COMMREQ receives power flow, it sends the command block of data specified by the IN
operand to the communications TASK in the intelligent or specialty module, at the rack/slot location
specified by the SYSID operand. The command block contents are sent to the receiving device and
the program execution resumes immediately. (Because PACSystems does not support WAIT mode
COMMREQs, the timeout value is ignored.)
The COMMREQ passes power flow unless the following fault conditions exist. The Function Faulted
(FT) output may be set ON if:
 Control block is invalid
 Destination is invalid (target module is not present or is faulted)
 Target module cannot receive mail because its queue is full
The Function Faulted output may have these states:
Enable Error? Function Faulted Output
active no OFF
active yes ON
not active no execution OFF
Command Block
The command block provides information to the intelligent module on the command to be
performed. The command block starts at the reference specified by the operand IN. This address
may be in any word-oriented area of memory (%R, %P, %L, %W, %AI, %AQ, or symbolic non-discrete
variables). The length of the command block depends on the amount of data sent to the device.
The Command Block contains the data to be communicated to the other device, plus information
related to the execution of the COMMREQ. Information required for the command block can be
placed in the designated memory area using a programming function such as MOVE, BLKMOV, or
DATA_INIT_COMM.

Command Block Structure

Address Data Block Length The number of data words starting with the data at address+6 to the
(in words) end of the command block, inclusive. The data block length ranges
from 1 to 128 words. Each COMMREQ command has its own data
block length. When entering the data block length, you must ensure
that the command block fits within the register limits
Address + 1 Wait/No Wait Flag Must be set to 0 (No Wait)
Address + 2 Status Pointer Specifies the memory type for the location where the COMMREQ
Memory Type status word (CSR) returned by the device will be written when the
COMMREQ completes.
Address + 3 Status Pointer Offset The word at address + 3 contains the offset for the status word within
the selected memory type.
Note: The status pointer offset is a zero-based value. For example,
%R00001is at offset zero in the register table.
Address + 4 Idle Timeout Value This parameter is ignored in No Wait mode.
Address + 5 Maximum This parameter is ignored in No Wait mode.
Communication Time
Address + 6 Data Block The data block contains the command's parameters. The data block
to Address + 133 begins with a command number in address + 6, which identifies the
type of communications function to be performed. Refer to the
specific device manual for COMMREQ command formats.
Status Pointer Memory Type

Status pointer memory type contains a numeric code that specifies the user reference memory type
for the status word. The table below shows the code for each reference type:
For this memory type Enter this decimal value
%I Discrete input table (BIT mode) 70
%Q Discrete output table (BIT mode) 72
%I Discrete input table (BYTE mode) 16
%Q Discrete output table (BYTE mode) 18
%R Register memory 8
%W Word memory 196
%AI Analog input table 10
%AQ Analog output table 12
Notes:
■ The value entered determines the mode. For example, if you enter the %I bit mode is 70, then the
offset will be viewed as that bit. On the other hand, if the %I value is 16, then the offset will be
viewed as that byte.
■ The high byte at address + 2 should contain zero.

Operands for COMMREQ

IN The reference of the first WORD of the command block. Variables in %R, No
%P, %L, %AI, %AQ,
%W, and symbolic
non-discrete
variables
SYSID The rack number (most significant byte) and slot number (least All except flow and No
significant byte) of the target device (intelligent module). variables in %S -
Note: For systems that do not have expansion racks, SYSID must %SC
be zero for the main rack.
TASK The task ID of the process on the target device Constants; No
variables in %R, %P,
%L, %AI, %AQ, %W,
and symbolic non-
discrete variables
FT Function Faulted output. FT is energized if an error is detected Power flow Yes
processing the COMMREQ:
 This is a WAIT mode COMMREQ and the CPU does not support it
 The specified target address (SYSID operand) is not present.
 The specified task (TASK operand) is not valid for the device.
 The data length is 0.
 The device's status pointer address (part of the command block)
does not exist. This may be due to an incorrect memory type
selection, or an address within that memory type that is out of
range.
COMMREQ Status Word

The CRS word consists of two byte CRS Word
values, a major code and a minor code. (hexadecimal)
Refer to the specific device manual for High Low
CRS major and minor codes used by 00 01
COMMREQ commands at that device.
Minor Error Code (high byte)
Success and Major Error Code (low byte)
COMMREQ Example 1
When enabling input %M0020 is ON, a command block
starting at %R0016 is sent to communications task 1 in
the device located at rack 1, slot 2 of the PLC. If an error
occurs processing the COMMREQ, %Q0100 is set.

COMMREQ Example 2
The MOVE function can be used to enter the command block contents for the COMMREQ described in
example 1.
Input IN of the COMMREQ specifies %R00016 as the beginning reference for the command block.
Successive references contain the following:
%R00016 Data Block Length
%R00017 Wait/No Wait Flag
%R00018 Status Pointer Memory Type
%R00019 Status Pointer Offset
%R00020 Idle Timeout Value (Because this parameter is ignored in NO WAIT mode, no value is
input).
%R00021 Maximum Communication Time Value (Because this parameter is ignored in NO WAIT
mode, no value is input).
%R00022 to end of data Data Block
MOVE functions supply the following command block data for the COMMREQ.
 The first MOVE function places the length of the data being communicated in %R00016.
 The second MOVE function places the constant 0 in %R00017. This specifies NO WAIT mode.
 The third MOVE function places the constant 8 in %R00018. This specifies the register table as the
location for the status pointer.
 The fourth MOVE function places the constant 512 in reference %R00019. Therefore, the status
pointer is located at %R00513.
The programming logic displayed in example 2 can be simplified by replacing the six MOVE functions
with one DATA_INIT_COMM function.


7.8.7 Data Initialization

The Data Initialization (DATA_INIT) function copies a block of constant Mnemonics:
data to a reference range. DATA_INIT_DWORD
When the DATA_INIT instruction is first programmed, the constants DATA_INIT_DWORD
are initialized to zeroes. To specify the constant data to copy, double-
DATA_INIT_INT
click the DATA_INIT instruction in the LD editor.
DATA_INIT_UINT
Note: The mnemonics DATA_INIT_ASCII (page 250) and
DATA_INIT_COMM (page 251) operate differently from the DATA_INIT_REAL
other six functions. DATA_INIT_LREAL
DATA_INIT_WORD
When DATA_INIT receives power flow, it copies the constant data to output Q. DATA_INIT's constant
data length (LEN) specifies how much constant data of the function type is copied to consecutive
reference addresses starting at output Q. DATA_INIT passes power to the right whenever it receives
power.
Notes:
 The output parameter is not included in coil checking.
 If you replace one DATA_INIT instruction (except DATA_INIT_ASCII or DATA_INIT_COMM) with
another (except DATA_INIT_ASCII or DATA_INIT_COMM), Logic Developer - PLC attempts to keep
the same data. For example, configuring a DATA_INIT_INT with eight rows and then replacing the
instruction with a DATA_INIT_DINT would keep the data for the eight rows. Some precision may
be lost when replacing a DATA_INIT_ instruction, and a warning message will be displayed when
this case is detected.
Operands
Note: For each mnemonic, use the corresponding data type for the Q operand. For example,
DATA_INIT_DINT requires Q to be a DINT variable.
Length The quantity (default 1) of constant data copied to Constants No
consecutive reference addresses starting at output Q.
Q The beginning address of the area to which the data is All, except %S. SA, SB, and SC are No
copied. not allowed for REAL, LREAL, INT,
and UINT versions.
Example
On the first scan (as restricted by the #FST_SCN system
variable), 100 words of initial data are copied to %R00005
through %R00104.

7.8.8 Data Initialize ASCII

The Data Initialize ASCII (DATA_INIT_ASCII) function copies a block of constant ASCII text
to a reference range.
When DATA_INIT_ASCII is first programmed, the constants are initialized to zeroes. To
specify the constant data to copy, double-click the DATA_INIT_ASCII instruction in the LD
editor.
When DATA_INIT_ASCII receives power flow, it copies the constant data to output Q.
DATA_INIT_ASCII’s constant data length (LEN) specifies how many bytes of constant text are copied
to consecutive reference addresses starting at output Q. LEN must be an even number.
DATA_INIT_ASCII passes power to the right whenever it receives power.
Note: The output parameter is not included in coil checking.
Operands
Length The number (default 1) of bytes of constant text copied to Constants No
consecutive reference addresses starting at output Q. LEN must be
an even number.
Q The beginning address of the area where the data is copied. All except %S. No
Example
variable) the decimal equivalent of 100 bytes of ASCII text is
copied to %R00050 through %R00149. %Q00002 receives
power.

7.8.9 Data Initialize Communications Request

The Data Initialize Communications Request (DATA_INIT_COMM) function initializes a
COMMREQ function with a block of constant data. The IN parameter of the COMMREQ
must correspond with output Q of this DATA_INIT_COMM function.
When DATA_INIT_COMM is first programmed, the constants are initialized to zeroes. To specify the
constant data to copy, double-click the DATA_INIT_COMM instruction in the LD editor.
When DATA_INIT_COMM receives power flow, it copies the constant data to output Q.
DATA_INIT_COMM’s constant data length operand specifies how many words of constant data to
copy to consecutive reference addresses starting at output Q. The length should be equal to the size
of the COMMREQ function’s entire command block. DATA_INIT_COMM passes power to the right
whenever it receives power.
Note: The output parameter is not included in coil checking.
Operands
Length The number of WORDs (default 7) of constant data Constant No
copied to consecutive reference addresses starting at
output Q. Must equal the size of the COMMREQ
function’s entire command block, including the header
(words 0-5).
Q The beginning address of the area where the data is R, W, P, L, AI, AQ, and symbolic No
copied. non-discrete variables
Example
variable), a command block consisting of 100 words of data,
including the 6 header words, is copied to %P00001 through
%P00100. %Q00002 receives power.
7.8.10 Data Initialize DLAN

The Data Initialize DLAN (DATA_INIT_DLAN) function is used with a DLAN Interface module, which is a
limited availability, specialty system. If you have a DLAN system, refer to the DLAN/DLAN+ Interface
Module User’s Manual, GFK-0729, for details.
Operands
Q The beginning address of the area where the data is flow, R, W, P, L, AI, AQ, and No
copied. symbolic non-discrete variables

7.8.11 Move
When the MOVE function receives power flow, it copies data as individual Mnemonics:
bits from one location in PLC memory to another. Because the data is MOVE_BOOL
copied in bit format, the new location does not need to be the same data MOVE_DINT
type as the original. MOVE_DWORD
The MOVE function copies data from input operand IN to output operand MOVE_INT
Q as bits. If data is moved from one location in BOOL (discrete) memory to MOVE_REAL
another, for example, from %I memory to %T memory, the transition MOVE_UINT
information associated with the BOOL memory elements is updated to MOVE_WORD
indicate whether or not the MOVE operation caused any BOOL memory
elements to change state. Data at the input operand does not change
unless there is an overlap in the source and destination.
Note: If an array of BOOL-type data specified in the Q operand does not include all the bits in a
byte, the transition bits associated with that byte (which are not in the array) are cleared
when the Move function receives power flow. The input IN can be either a variable providing
a reference for the data to be moved or a constant. If a constant is specified, then the
constant value is placed in the location specified by the output reference. For example, if a
constant value of 4 is specified for IN, then 4 is placed in the memory location specified by Q.
If the length is greater than 1 and a constant is specified, then the constant is placed in the
memory location specified by Q and the locations following, up to the length specified. Do not
allow overlapping of IN and Q operands.
The result of the MOVE depends on the data type selected for the function, as shown below. For
example, if the constant value 9 is specified for IN and the length is 4, then 9 is placed in the bit
memory location specified by Q and the three locations following:
MOVE BOOL MOVE WORD
Enable MOVE OK Enable MOVE OK

WORD
BOOL
4
4
9 IN Q Output
9 IN Q Output
MSB LSB 9
9
1 2 3 4
9
(Length = 4 bits) 9
(Length = 4 words)
The MOVE function passes power to the right whenever it receives power.

MOVE Operands
Length (??) The length of IN; the number of bits, words, or double Constant No
words to copy.
If IN is a constant and Q is BOOL, then 1 ≤ Length ≤ 16;
otherwise, 1 ≤ Length ≤ 256.
1 ≤ Length ≤ 32,767
IN The location of the first data item to copy. All. %S, %SA, %SB, %SC No
For MOVE_BOOL, any discrete reference may be used. allowed only for WORD,
It does not need to be byte-aligned. However 16 bits DWORD, BOOL types.
beginning with the reference address specified are
displayed online.
If IN is a constant, it is treated as an array of bits. The
value of the least significant bit is copied into the
memory location specified by Q. If Length is greater
than one, the bits are copied in order from the least
significant to the most significant into successive
memory locations, up to the length specified.
Q The location of the first destination data item. No
For MOVE_BOOL, any discrete reference may be used. All except %S. Also no %SA, SB,
It does not need to be byte-aligned. However 16 bits SC except for WORD, DWORD,
beginning with the reference address specified are BOOL types.
displayed online.
MOVE_BOOL Example
When %I00003 is set, the three bits %M00001, %M00002, and
%M00003 are moved to %M00100, %M00101, and %M00102,
respectively. Coil %Q00001 is turned on.
MOVE_WORD Example
V_M00001 and V_M00033 are both WORD arrays of length 3, for
a total of 48 bits in each array. Since PLCs do not recognize
arrays, Length has to be set at 3, for the total number of WORDs
to be moved. When enabling input V_Q0014 is ON, MOVE_WORD
moves 48 bits from the memory location %M00001 to memory
location %M00033. Even though the destination overlaps the
source for 16 bits, the move is done correctly.

7.8.12 Move Data

The MOVE_DATA function copies the variable assigned to the input, IN to the Mnemonic:
variable assigned to the output, Q. If the constant 0 is assigned to IN, the MOVE_DATA
variable assigned to Q is initialized to its default value.
MOVE_DATA Operands
Length (??) The length of IN; the number of elements Constant No
to copy.
1 ≤ Length ≤ 32,767
IN The location of the data item to copy. Enumerated variable, structure variable, or No
If IN is 0, Q is set to its default value. array of these types; the constant 0.
For details, refer to “Data Types and
Structures” in the PACMotion Multi-Axis
Motion Controller User’s Manual, GFK-2448.
Q The location of the data copied from IN. Enumerated variable, structure variable, or No
Q must be the same data type as IN, array of these types.
unless IN is the constant 0.

7.8.13 Move Data Explicit

MOVE_DATA_EX provides optional data coherency by locking the symbolic
memory being written to during the copy operation. This allows data to be
copied coherently when accessed by multiple logic threads (i.e. interrupt
blocks). Note that copying large amounts of data with coherency enabled
can increase interrupt latency.
MOVE_DATA_EX Operands
Length (??) The length of IN; the number of elements to copy. Constant No
1 ≤ Length ≤ 32,767
DC Data coherency. Data flow. Yes
If True memory being written to is locked, enabling
coherent copying of data from one Controller memory area
to another.
If False (default), data is copied normally from one
Controller memory area to another without data
coherency.
 The input DC should be used only when using interrupt
blocks and is required only when the same memory is
used in more than one interrupt block, or in the main
program and an interrupt block.
 If DC is True, an interrupt block cannot preempt the
copy operation.
 If DC is False or not present, then interrupts can
preempt the copy.
 Using DC can impact interrupt latency if the amount of
data copied is large.
IN The location of the data item to copy. Enumerated variable or No
If IN is 0 (LD only), length is assigned the constant 1 and the structure variable, or array of
variable or structure assigned to Q is set to its default value. these types; the constant 0.
Q Variable or array to which IN is copied. Enumerated variable or No
Q must be the same data type as IN, unless IN is the structure variable, or array of
constant 0. these types.
Example
Enum_Array and Enum_Array_Out are arrays of
enumerated variables, with three elements each.
To copy all elements in Enum_Array, input Length
should be 3. When the enabling input Q00014 is
on, MOVE_DATA_EX copies three elements from
memory location Enum_Array to memory location
Enum_Array_Out.

7.8.14 Move From Flat

MOVE_FROM_FLAT copies reference memory data to a User-defined Data
Type (UDT) variable or UDT array.
MOVE_FROM_FLAT provides optional data coherency by locking the data
being written to during the copy operation. This allows data to be copied
coherently when accessed by multiple logic threads (i.e. interrupt blocks).
Note that copying large amounts of data with coherency enabled can
increase interrupt latency.
Operation
Copying arrays and array elements
The constant value assigned to input LEN (Length) determines the number of UDT array elements to
be filled by copying data from reference memory to output Q.
Example:
If constant value 6 is assigned to input LEN (Length), there should be a UDT array of at least six
elements assigned to output Q. During logic execution, n bytes of data are copied from reference
memory to the first six UDT array elements, where n is the length of the UDT array element (in bytes)
times six.
Copying to specified array elements
For output Q, a single element of a UDT array can be specified, for example, myUDT_array[4] (5th
element of myUDT_array). In this case, the input LEN (Length) operand applies to the array elements
starting from and including myUDT_array[4].
Example:
myUDT_array is a UDT array of ten elements, of which each element is a UDT variable, and
myUDT_array[4] is assigned to output Q. This restricts the value of input LEN (Length) to six or less
because there are six remaining UDT array elements that can be filled in myUDT_array.
Notes:
 Length determines how many UDT variable elements to overwrite in Q.
 If an array head is assigned to input IN, the Length determines how many UDT array elements
assigned to Q are filled by copying data from reference memory.

MOVE_FROM_FLAT Operands
Length (??) Determines the number of UDT array elements to be filled by Constant No
copying data from reference memory to output Q.
1 ≤ Length ≤ 32,767
If True, memory being written to is locked, enabling coherent
copying of data from one Controller memory area to another.
If False (default), data is copied normally from one Controller
memory area to another; that is without data coherency.
 The input DC should be used only when using interrupt
blocks and is required only when the same memory is
used in more than one interrupt block, or in the main
 If DC is True, an interrupt block cannot preempt the copy
operation.
 If DC is False or not present, then interrupts can preempt
the copy.
 Using DC can impact interrupt latency if the amount of
data copied is large.
IN Reference memory data being copied to UDT variable All except %S, symbolic, or No
elements in output Q as determined by the Length. I/O variable.
Q UDT variable or UDT array to which IN is copied. Discrete or non-discrete No
symbolic, discrete or non-
discrete I/O variable.
Example
A WORD variable mapped to %R1 is assigned to input IN and a value of 1 is assigned to Length. A
UDT variable or UDT array is assigned to output Q.
When MOVE_FROM_FLAT executes, n bytes of data are copied, starting at %R1 to a UDT variable or
UDT array, where n is the UDT array element length (in bytes). If a UDT array is assigned to output Q,
n bytes of data are copied to the first UDT array element.

7.8.15 Move to Flat

MOVE_TO_FLAT instruction copies data from symbolic or I/O variable
memory to reference memory. MOVE_TO_FLAT copies across mismatched
data types for an operation such as a Modbus transfer.
MOVE_TO_FLAT provides optional data coherency by locking the reference
memory being written to during the copy operation. This allows data to be
copied coherently when accessed by multiple logic threads (i.e. interrupt
blocks). Note that copying large amounts of data with coherency enabled
can increase interrupt latency.
Notes:
■ The Data Coherency (DC) input should be used only when using interrupt
blocks and is required only when the same memory is used in more than
one interrupt block, or in the main program and an interrupt block.
■ If DC is True, an interrupt block cannot preempt the copy operation.
■ If DC is False or not present, then interrupts can preempt the copy.
■ Using DC can impact interrupt latency if the amount of data copied is
large.
Copying Arrays and Array Elements
The Length determines the number of UDT array elements to be copied to the reference memory of
the variable assigned to output Q.
Example: If the value 6 is assigned to Length, there should be a UDT array of at least six elements
assigned to input IN. When logic executes, n bytes of data are copied from the UDT array elements to
the reference memory of the variable assigned to output Q, where n is the length of the UDT array
element (in bytes) times six.

MOVE_TO_FLAT Operands
Length (??) The length of IN; the number of elements to copy. Constant No
1 ≤ Length ≤ 32,767
If True, the memory being written to is locked. This
enables a coherent copy of a UDT to reference memory.
If False (default), data is copied normally from one
Controller memory area to another; that is without data
coherency.
 DC should be used only when using interrupt blocks
and is required only when the same memory is used
in more than one interrupt block, or in the main
 If DC is True, an interrupt block cannot preempt the
copy operation.
 If DC is False or not present, interrupts can preempt
the copy.
 Using DC can impact interrupt latency if the amount
of data copied is large.
IN UDT variable or UDT array. The data copied to the Discrete or non-discrete No
reference memory mapped to the variable assigned to Q. symbolic, discrete or non-
If IN is 0, length is assigned the constant 1 and the discrete I/O variable.
variable or structure assigned to Q is set to its default
value.
Q Variable or array to which IN is copied. The amount of All memory areas except %S, No
data copied is determined by the constant value discrete symbolic, discrete I/O
assigned to input LEN (Length). variable.
 Indirect referencing is
available for all register
references (%R, %P, %L,
%W, %AI, and %AQ).
 BYTE arrays must be
packed; that is, they must
be in discrete memory.
Example
A UDT variable or UDT array is assigned to input IN.
The constant value 8 is assigned to input LEN (Length).
A DWORD variable mapped to %R1 is assigned to output Q.
If the constant value 8 is assigned to LEN (length), there should be a UDT array of at least eight
elements assigned to IN. When MOVE_TO_FLAT executes, n bytes of data are copied from the UDT
variable or array to %R memory, starting at %R1 in the example, where n is the length of a UDT array
element (in bytes) times eight.

7.8.16 Shift Register

When the Shift Register (SHFR_BIT, SHFR_DWORD, or SHFR_WORD) function Mnemonics:
receives power and the R operand does not, SHFR shifts one or more data SHFR_BIT
BITs, data DWORDs, or data WORDs from a reference location into a
SHFR_DWORD
specified area of memory. A contiguous section of memory serves as a shift
register. For example, one word might be shifted into an area of memory SHFR_WORD
with a specified length of five words. As a result of this shift, another word
of data would be shifted out of the end of the memory area.
Warning
The use of overlapping input and output reference address
ranges in multiword functions is not recommended, as it
may produce unexpected results.
The reset input (R) takes precedence over the function enable input. When the reset is active, all
references beginning at the shift register (ST) up to the length specified, are filled with zeroes.
If the function receives power flow and R is not active, each BIT, DWORD, or WORD of the shift
register is moved to the next highest reference. The elements shifted out of ST are shifted into Q. The
highest reference of IN is shifted into the vacated element starting at ST.
Note: The contents of the shift register are accessible throughout the program because they are
overlaid on absolute locations in logic addressable memory.
The function passes power to the right whenever it receives power flow and the R operand does not.
Operands for Shift Register
Length (??) The number of data items in the shift register, ST. 1 ≤ Length ≤ 256 No
R Reset. When R is ON, the shift register located at ST is filled with Power flow No
zeroes.
N The number of data items to shift into ST. Constants No
IN The value to shift into the first data item of ST. All No
SHFR_BIT: For %I, %Q, %M and %T memory, any BOOL reference
may be used; it does not need to be byte-aligned. However, 1 bit,
beginning with the reference address specified, is displayed online.
ST The first data item of the shift register. All except data No
Note: For %I, %Q, %M and %T memory, any BOOL reference flow, constants, S
may be used; it does not need to be byte-aligned.
However, 16 bits, beginning with the reference address
specified, are displayed online.


Q The data shifted out of ST. The same number of data items will be All except S No
shifted into Q as were shifted out of ST.
SHFR_BIT: For %I, %Q, %M and %T memory, any BOOL reference
may be used; it does not need to be byte-aligned. However, 1 bit,
beginning with the reference address specified, is displayed online.
Example
SHFR_WORD operates on register memory locations %R0001
through %R0100. When the reset reference CLEAR is active,
the Shift Register words are set to zero.
When the NXT_CYC reference is active and CLEAR is not, the
two words at the starting address V_Q00033 are shifted into
the Shift Register at %R0001. The words shifted out of the
Shift Register from %R0100 are stored in output %M0005.
Note that, for this example, the length specified and the
amount of data to be shifted (N) are not the same.

7.8.17 Size Of
Counts the number of bits used by the variable assigned to input Mnemonics:
IN and writes the number of bits to output Q. SIZE_OF
Operands
IN The variable whose size in bits is Variable of any data type except BYTE No
calculated. arrays in non-discrete memory and
double-segment structures.
Q The number of bits used by the variable DINT or DWORD variable. No
assigned to input IN. ST also supports INT and WORD variables.
Example
The single-segment structure named Var assigned to
input IN contains eight BOOL elements (8 × 1 = 8 bits)
and twelve WORD elements (12 × 16 = 192 bits).
SIZE_OF outputs the value 8 + 192 = 200 to the variable
R00001 assigned to output Q.

7.8.18 Swap
The SWAP function is used to swap two bytes within a word (SWAP WORD) Other
or two words within a double word (SWAP DWORD). The SWAP can be mnemonic:
performed over a wide range of memory by specifying a length greater SWAP_WORD
than 1. If that is done, the data in each word or double word within the
specified length is swapped.
When the SWAP function receives power flow, it swaps the data in reference IN and places the
swapped data into output reference Q. The function passes power to the right whenever it receives
power.
PACSystems CPUs use the Intel convention for storing word data in bytes. They store the least
significant byte of a word in address n and the most significant byte in address n+1. Many VME
modules follow the Motorola convention of storing the most significant byte in address n and the
least significant byte in address n+1.
The PACSystems CPU assigns byte address 1 to the same storage location regardless of the byte
convention used by the other device. However, because of the difference in byte significance, word
and multiword data, for example, 16 bit integers (INT, UINT), 32 bit integers (DINT) or floating point
(REAL) numbers, must be adjusted when being transferred to or from Motorola-convention modules.
In these cases, the two bytes in each word must be swapped, either before or after the transfer. In
addition, for multiword data items, the words must be swapped end-for-end on a word basis. For
example, a 64-bit real number transferred to the PACSystems CPU from a Motorola-convention
module must be byte-swapped and word-reversed, either before or after reading, as shown below:
B1 B2 B3 B4 B5 B6 B7 B8
Character (ASCII) strings or BCD data require no adjustment since the Intel and Motorola conventions
for storage of character strings are identical.
Operands for Swap
The two parameters, IN and Q, must both be the same type, WORD or DWORD.
Length (??) The number of WORDs or DWORDs to operate on. 1 ≤ Length ≤ 256 Constant No
IN Reference for data to be swapped. (must be the same type as Q) All No
Q Reference for swapped data. (must be the same type as IN) All except S No
Example for Swap

Two bytes located in bits %I00033 through %I00048 are swapped.
The result is stored in %L00007.

7.8.19 Data Table Functions

Array Move ARRAY_MOVE_BOOL Copies a specified number of data elements from a source memory
ARRAY_MOVE_BYTE block to a destination memory block.
ARRAY_MOVE_DINT Note: The memory blocks do not need to be defined as arrays. You
ARRAY_MOVE_INT must supply a starting address and the number of contiguous
ARRAY_MOVE_WORD registers to use for the move.
Array Range ARRAY_RANGE_DINT Determines if a value is between the range specified in two tables
ARRAY_RANGE_DWORD
ARRAY_RANGE_INT
ARRAY_RANGE_UINT
ARRAY_RANGE_WORD
FIFO Read FIFO_RD_DINT Removes the entry at the bottom of the First In First Out (FIFO) table,
FIFO_RD_DWORD and decrements the pointer by one
FIFO_RD_INT
FIFO_RD_UINT
FIFO_RD_WORD
FIFO Write FIFO_WRT_DINT Increments the table pointer and writes data to the bottom of the FIFO
FIFO_WRT_DWORD table
FIFO_WRT_INT
FIFO_WRT_UINT
FIFO_WRT_WORD
LIFO Read LIFO_RD_DINT Removes the entry at the pointer location in the LIFO (Last In First Out)
LIFO_RD_DWORD table, and decrements the pointer by one
LIFO_RD_INT
LIFO_RD_UINT
LIFO_RD_WORD
LIFO Write LIFO_WRT_DINT Increments the LIFO table's pointer and writes data to the table
LIFO_WRT_DWORD
LIFO_WRT_INT
LIFO_WRT_UINT
LIFO_WRT_WORD
Search SEARCH_EQ_BYTE Searches for all array values equal to a specified value
SEARCH_EQ_DINT
SEARCH_EQ_DWORD
SEARCH_EQ_INT
SEARCH_EQ_UINT
SEARCH_EQ_WORD
SEARCH_GE_BYTE Searches for all array values greater than or equal to a specified value
SEARCH_GE_DINT
SEARCH_GE_DWORD
SEARCH_GE_INT
SEARCH_GE_UINT
SEARCH_GE_WORD


SEARCH_GT_BYTE Searches for all array values greater than a specified value
SEARCH_GT_DINT
SEARCH_GT_DWORD
SEARCH_GT_INT
SEARCH_GT_UINT
SEARCH_GT_WORD
SEARCH_LE_BYTE Searches for all array values less than or equal to a specified value
SEARCH_LE_DINT
SEARCH_LE_DWORD
SEARCH_LE_INT
SEARCH_LE_UINT
SEARCH_LE_WORD
SEARCH_LT_BYTE Searches for all array values less than a specified value
SEARCH_LT_DINT
SEARCH_LT_DWORD
SEARCH_LT_INT
SEARCH_LT_UINT
SEARCH_LT_WORD
SEARCH_NE_BYTE Searches for all array values not equal to a specified value
SEARCH_NE_DINT
SEARCH_NE_DWORD
SEARCH_NE_INT
SEARCH_NE_UINT
SEARCH_NE_WORD
Sort SORT_INT Sorts a memory block in ascending order
SORT_UINT
SORT_WORD
Table Read TBL_RD_DINT Copies a value from a specified table location to an output reference
TBL_RD_DWORD
TBL_RD_INT
TBL_RD_UINT
TBL_RD_WORD
Table Write TBL_WRT_DINT Copies a value from an input reference to a specified table location
TBL_WRT_DWORD
TBL_WRT_INT
TBL_WRT_UINT
TBL_WRT_WORD

7.8.20 Array Move

When the Array Move function receives power flow, it Mnemonics:
copies a specified number of elements from a source ARRAY_MOVE_BOOL
memory block to a destination memory block. Starting
ARRAY_MOVE_BYTE
at the indexed location (SR+SNX-1) of the input memory
block, it copies N elements to the output memory block, ARRAY_MOVE_DINT
starting at the indexed location (DS+DNX-1) of the ARRAY_MOVE_DWORD
output memory block. ARRAY_MOVE_INT
ARRAY_MOVE_UINT
ARRAY_MOVE_WORD
Note: For ARRAY_MOVE_BOOL, when 16-bit registers are selected for the operands of the source
memory block and/or destination memory block starting address, the least significant bit of
the specified 16-bit register is the first bit of the memory block. The value displayed contains
16 bits, regardless of the length of the memory block.
The indices in an Array Move instruction are 1-based. In using an Array Move, no element outside
either the source or destination memory blocks (as specified by their starting address and length)
may be referenced.
The function passes power flow unless one of the following conditions occurs:
 It receives no power flow.
 (N + SNX - 1) is greater than Length.
 (N + DNX - 1) is greater than Length.
Note: For each mnemonic, use the corresponding data type for the SR and DS operands. For
example, ARRAY_MOVE_BYTE requires SR and DS to be BYTE variables.
Operands for Array Move
Length (??) The length of each memory block (source and Constant No
destination); the number of elements in each memory
block. 1 ≤ Length ≤ 32,767.
SR The starting address of the source memory block. All except constants. %S - %SC No
(must be Note: For an Array Move with the data type BOOL, allowed only for BYTE, WORD,
the same any reference may be used; it does not need DWORD types.
data type to be byte-aligned. Sixteen bits, beginning
as DS) with the reference address specified, are
displayed online.
SNX The index of the source memory block All except variables in %S - %SC. No
DNX The index of the destination memory block All except variables in %S - %SC. No
N Count indicator All except variables in %S - %SC No
DS The starting address of the destination memory block. All, except S and constants. %SA No
(must be Note: For an Array Move with the data type BOOL, - %SC allowed only for BYTE,
the same any reference may be used; it does not need WORD, DWORD types
data type to be byte-aligned. Sixteen bits, beginning
as SR) with the reference address specified, are
displayed online.

Array Move Example 1

To define the input memory block %R0001 - %R0016 and the
output memory block %R0100 - %R0115, SR is set as %R0001, DS
is set as %R0100, and Length is set to 16.
To copy the five registers %R0003 - %R0007 to the registers
%R0104 - %R0108, N is set to 5, SNX=%R0100 is set to 3 (to
designate the third register, %R0003, of the block starting at
%R0001), and DNX is set to 5 (to designate the fifth register,
%R0104, of the block starting at %R0100).

Using bit memory blocks, the input block starts at SR=%M0009,
the output block starts at %Q0022, and the length of both blocks
is 16 one-bit registers (Length=16).
To copy the seven registers %M0011 - %M0017 to %Q0026 -
%Q0032, N is set to 7, SNX is set to 3 (to designate the third
register, %M0011, of the block starting at %M0009), and DNX is
set to 5 (to designate the fifth register, %Q0026, of the block
starting at %Q0022).

Sixteen (=N) bits that are not byte-aligned are moved from the two
16-bit registers that start at %R00001 (SR) to the two 16-bit
registers that begin at %R00100 (DS). For the purposes of this
Boolean move, Length is set to 20, because the other 12 bits in
either memory block are not considered.
By setting SNX to 3, N to 16, and DNX to 5, the third (SNX) least
significant bit of %R0001 through the second least significant bit of
%R0002 (for a total of 16 bits=N) are written into the fifth (DNX)
least significant bit of %R0100 through the fourth least significant
bit of %R0101 (for the same total of 16 bits).

7.8.21 Array Range

The ARRAY_RANGE function compares a single input value Mnemonics:
against two arrays of delimiters that specify an upper and ARRAY_RANGE_DINT
lower bound to determine if the input value falls within the
ARRAY_RANGE_DWORD
range specified by the delimiters. The output is an array of bits
that is set ON (1) when the input value is greater than or equal ARRAY_RANGE_INT
to the lower limit and less than or equal to the upper limit. The ARRAY_RANGE_UINT
output is set OFF (0) when the input is outside this range or ARRAY_RANGE_WORD
when the range is invalid, as when the lower limit exceeds the
upper limit.
The ARRAY_RANGE function compares a single input value against two arrays of delimiters that
specify an upper and lower bound to determine if the input value falls within the range specified by
the delimiters. The output is an array of bits that is set ON (1) when the input value is greater than or
equal to the lower limit and less than or equal to the upper limit. The output is set OFF (0) when the
input is outside this range or when the range is invalid, as when the lower limit exceeds the upper
limit.
When ARRAY_RANGE receives power, it compares the value in input parameter IN against each
range specified by the array element values of LL and UL. Output Q sets a bit ON (1) for each
corresponding array element where the value of IN is greater than or equal to the value of LL and is
less than or equal to the value of UL. Output Q sets a bit OFF (0) for each corresponding array
element where the value of IN is not within this range or when the range is invalid, as when the value
of LL exceeds the value of UL. If the operation is successful, ARRAY_RANGE passes power flow to the
right.
Operands for Array Range
Notes:
 For each mnemonic, use the corresponding data type for the LL, UL, and Q operands. For
example, ARRAY_RANGE_DINT requires LL, UL, and Q to be DINT variables.
 Q is not aligned. It is displayed in bit format. It displays either a 1 (ON) or a 0 (OFF) for the first
array element. For BOOL references, it represents the reference displayed. For other references, it
represents the low order bit of the reference displayed.
Length (??) The number of elements in each array. Constant No
LL The lower limit of the range All except constants and %S - %SC for INT, DINT. No
UL The upper limit of the range All except constants and %S - %SC for INT, DINT. No
IN The value to compare against each All except constants and %S - %SC for INT, DINT. No
range specified by LL and UL
Q Energized when the value in IN is All except S No
within the range specified by LL and
UL, inclusive.

Array Range Example 1

The lower limit (LL) values of %R00001 through %R00008 are 1,
20, 30, 100, 25, 50, 10, and 200. The upper limit (UL) values of
%R00100 through %R00108 are 40, 50, 150, 2, 45, 90, 250, and
47. The resulting Q values will be placed in the first 8 bits of
%R00200. The bit values low order to high are: 1, 1, 1, 0, 1, 0, 1,
and 0. The bit value displayed will be set ON (1) for the low order
bit of %R00200. The ok output will be set ON (1).
Array Range Example 2

The lower limit (LL) array contains %T00001 through %T00016,
%T00017 through %T00032, and %T00033 through %T00048.
The lower limit values are 100, 65, and 1. The upper limit (UL)
values are 29, 165, and 2. The resulting Q values of 0, 1, and 0 will
be placed in %Q00001 through %Q00003. The bit value displayed
will be 0 (OFF), representing the value of %Q00001. The power
output will be set ON (1).

7.8.22 FIFO Read

The First-In-First-Out (FIFO) Read (FIFO_RD) function moves data out of Mnemonics:
tables. Values are always moved out of the bottom of the table. If the FIFO_RD_DINT
pointer reaches the last location and the table becomes full, FIFO_RD
FIFO_RD_DWORD
must be used to remove the entry at the pointer location and decrement
the pointer by one. FIFO_RD is used in conjunction with the FIFO_WRT FIFO_RD_INT
function, which increments the pointer and writes entries into the table. FIFO_RD_UINT
FIFO_RD_WORD
1. FIFO_RD copies the top location (entry 0) of the table to output parameter Q. Additional program
logic must then be used to place the data in the input reference.
2. The remaining items in the table are copied to a lower numbered position in the table.
3. FIFO_RD decrements the pointer by one.
4. Steps 1, 2, and 3 are repeated each time FIFO_RD is executed, until the table is empty (PTR = 0).
The pointer does not wrap around when the table is full.
When FIFO_RD receives power flow, the data at the first location of the table is copied to output Q.
Next, each item in the table is moved down to the next lower location. This begins with item 2 in the
table, which is moved into position 1. Finally, the pointer is decremented. If this causes the pointer
location to become 0, the output EM is set ON, i.e., EM indicates whether or not the table is empty.
FIFO_RD passes power to the right if the pointer is greater than zero and less than the value specified
for LEN.
Note: A FIFO table is a queue. A LIFO table is a stack.
Operands for FIFO Read
Note: For each mnemonic, use the corresponding data type for the TB and Q operands. For
example, FIFO_RD_DINT requires TB and Q to be DINT variables.
Length (??) 1 ≤ Length ≤ 32,767. Constants No
TB (must be the same type as Q) The elements in the FIFO table All except constants No
PTR Pointer. Index of the last All except constants, data flow, No
element of the FIFO table. and variables in %S -%SC
EM Energized when the last Flow No
element of the table is read
Q (must be the same type as TB) The element read from the FIFO All except constants, S; SA, SB, SC No
table allowed only for WORD, DWORD

Example for FIFO Read

PRODUCT is a FIFO table with 100 word-sized elements. When the
enabling input PACK_IT is ON, the PRODUCT data item in the table
location pointed to by STK_PTR is copied to the reference location
specified in CART. This table location pointed to would be the bottom,
or oldest data item in the table. The number in STK_PTR is then
decremented. A copy of the oldest data item in the PRODUCT table is
left behind in each table location as the current data is copied out
during successive PACK_IT triggers. Output node EM passes power
when the PTR = 0, firing the coil EMPTY. No further data from the
PRODUCT table can be read without first copying data in using the
FIFO_WRT function.

7.8.23 FIFO Write

The First-In-First-Out (FIFO) Write (FIFO_WRT) function moves data Mnemonics:
into tables. The function increments the table pointer by one and FIFO_WRT_DINT
adds an entry at the new pointer location in a FIFO table. Values are
FIFO_WRT_DWORD
always moved in at the bottom of the table. If the pointer reaches the
last location and the table becomes full, FIFO_WRT can add no FIFO_WRT_INT
further values. The FIFO_RD function must then be used to remove FIFO_WRT_UINT
the entry at the pointer location and decrement the pointer by one. FIFO_WRT_WORD
1. FIFO_WRT increments the pointer by one.

2. FIFO_WRT copies data from input parameter IN to the position in the table indicated by the
pointer. (It writes over any value currently at that location.) Additional program logic must then be
used to place the data in the input reference.
3. Steps 1 and 2 are repeated each time FIFO_WRT is executed, until the table is full (PTR=0).
When FIFO_WRT receives power flow, the pointer is incremented by 1. Then, input data is written into
the table at the pointer location. If the pointer was already at the last location in the table, no data is
written and FIFO_WRT does not pass power to the right. The pointer always indicates the last item
entered into the table. If the table becomes full, it is not possible to add more entries to it.
FIFO_WRT passes power to the right after a successful execution (PTR < LEN).

Operands for FIFO Write

Note: For each mnemonic, use the corresponding data type for the TB and IN operands. For
example, FIFO_WRT_DINT requires TB and IN to be DINT variables.
TB (must be the same data The elements in the All except constants, data flow, and S. No
type as IN) FIFO table SA - SC allowed only for WORD, DWORD types
PTR Pointer. Index of the last All except constants, data flow, S - SC. No
element of the FIFO
table.
IN (must be the same data The element to write to All. S – SC allowed only for WORD, DWORD No
type as TB) the FIFO table types.
FL Energized when IN is Power flow No
written to the last
element of the table
Example for FIFO Write

PRODUCT is a FIFO table with 100 word-sized elements. When the
enabling input UNPACK is ON, a data item from P_CODE is copied to
the table location pointed to by the value in STK_PTR. Output node FL
passes power when PTR = LEN, firing the FULL coil. No further data
from P_CODE can be added to the table without first copying data
out, using the FIFO_RD function.

7.8.24 LIFO Read

The Last-In-First-Out (LIFO) Read (LIFO_RD) function moves data out of Mnemonics:
tables. Values are always moved out of the top of the table. If the LIFO_RD_DINT
pointer reaches the last location and the table becomes full, LIFO_RD
LIFO_RD_DWORD
must be used to remove the entry at the pointer location and
decrement the pointer by one. LIFO_RD is used in conjunction with the LIFO_RD_INT
LIFO_WRT function, which increments the pointer and writes entries LIFO_RD_UINT
into the table. LIFO_RD_WORD
1. LIFO_RD copies data indicated by the pointer to output parameter Q. Additional program logic
must then be used to place the data in the input reference.
2. LIFO_RD decrements the pointer by one.
3. Steps 1 and 2 are repeated each time the instruction is executed, until the table is empty (PTR =
LEN).
When LIFO_RD receives power flow, the data at the pointer location is copied to output Q, then the
pointer is decremented. If this causes the pointer location to become 0, the output EM is set ON, i.e.,
EM indicates whether or not the table is empty. If the table is empty when LIFO_RD receives power
flow, no read occurs. The pointer always indicates the last item entered into the table.
LIFO_RD passes power to the right if the pointer was in range for an element to be read.
Note: A LIFO table is a stack. A FIFO table is a queue.
Operands for LIFO Read
example, LIFO_RD_DINT requires TB and Q to be DINT variables.
Length (??) 1 ≤ Length ≤ 32,767. Constant No
TB (must be the same The elements in the table All except constants No
type as Q)
PTR Pointer. Index of the next All except constants, S - SC, and data flow No
element to read.
EM Energized when the last Power flow No
element of the table is read
Q (must be the same The element read from the All except constants and S. SA, SB, SC No
type as TB) table allowed only for WORD, DWORD.
Example for LIFO Read

PRODUCT is a LIFO table with 100 word-sized elements. When the
enabling input PACK_IT is ON, the data item at the top of the table
is copied into the reference indicated by the nickname CART. The
reference identified by STK_PTR contains the table pointer. Output
coil EMPTY indicates when the table is empty.

7.8.25 LIFO Write

The Last-In-First-Out (LIFO) Write (LIFO_WRT) function increments Mnemonics:
the table pointer by one and then adds an entry at the new pointer LIFO_WRT_DINT
location in a table. Values are always moved in at the top of the
LIFO_WRT_DWORD
table. If the pointer reaches the last location and the table becomes
full, LIFO_WRT cannot add further values. LIFO_RD must then be LIFO_WRT_INT
used to remove the entry at the pointer location and decrement the LIFO_WRT_UINT
pointer by one. LIFO_WRT_WORD
1. LIFO_WRT increments the table pointer by one.

2. LIFO_WRT copies data from input parameter IN to the position in the table indicated by the
3. Steps 1 and 2 are repeated each time LIFO_WRT is executed, until the table is full (PTR=LEN).
When LIFO_WRT receives power flow, the pointer increments by 1; then the new data is written at the
pointer location. If the pointer was already at the last location in the table, no data is written and
LIFO_WRT does not pass power to the right. The pointer always indicates the last item entered into
the table. If the table is full, it is not possible to add more entries to it.
LIFO_WRT passes power to the right after a successful execution (PTR < LEN).
Note: A LIFO table is a stack. A FIFO table is a queue.
Operands for LIFO Write
example, LIFO_WRT_DINT requires TB and Q to be DINT variables.
TB (must be the The elements in the table All except constants, S, data flow. SA - SC No
same type as IN) allowed only for WORD, DWORD.
PTR Pointer. Index of the next element to All except constants, S - SC, and data No
write. flow
IN (must be the The element to write to the table All. S – SC allowed only for WORD, No
same type as TB) DWORD
FL Energized when IN is written to the last All No
element of the table
Example for LIFO Write
PRODUCT is a LIFO table with 100 word-sized elements. When the
enabling input STORE is ON, a data item from NEW_ITEM is copied to
the table location pointed to by the value in STK_PTR. Output FL
passes power when PTR = LEN, firing the FULL coil. No further data
from NEW_ITEM can be added to the table without first copying data
out, using the LIFO_RD function.

7.8.26 Search
When the Search function receives power, it searches the specified memory block for
a value that satisfies the search criteria. For example, SEARCH_GE_DWORD searches
for a DWORD that is greater than or equal to the specified value (the IN operand).
Search can evaluate six different relationships for six data types, for a total of thirty-
six mnemonics.
Search Relationships:
SEARCH_EQ_ searches for a value of the specified data type equal to the IN operand.
SEARCH_GE_ searches for a value of the specified data type greater than or equal to IN.
SEARCH_GT_ searches for a value of the specified data type greater than IN.
SEARCH_LE_ searches for a value of the specified data type less than or equal to IN.
SEARCH_LT_ searches for a value of the specified data type less than IN.
SEARCH_NE_ searches for a value of the specified data type that is not equal to IN.
Data types:
BYTE, DINT, DWORD, INT, UINT, WORD
Searching begins at AR+INX, where AR is the starting address and INX is the index value into the
memory block. The search continues either until a register that satisfies the search criteria is found or
until the end of the memory block is reached.
 If a register is found, the Found Indication (FD) is set ON and the Output Index (ONX) is set to the
relative position of this register within the block.
 If no register is found before the end of the block is reached, the Found Indication (FD) is set OFF
and the Output Index (ONX) is set to zero.
The input index (INX) is zero-based, that is, 0 the means first reference, whereas the output index
(ONX) is one-based, that is, 1 means the first reference.
The valid values for INX are 0 to (Length - 1). The valid values for ONX are 1 to Length.
INX should be set to zero to begin searching at the memory block's first register. This value
increments by one at the time of execution. If the value of input INX is outofrange,
(< 0 or > Length-1), INX is set to the default value of zero.
SEARCH passes power flow to the right when it performs without error. If INX is out of range, SEARCH
does not pass power flow to the right.

Operands for the Search Function

Note: For each mnemonic, use the corresponding data type for the AR and IN operands. For
example, SEARCH_EQ_BYTE requires AR and IN to be BYTE variables.
Length (??) The number of registers starting at AR that make up the Constants No
memory block to search. 1 ≤ Length ≤ 32,767 8-bit or 16-bit
registers.
AR (must be the The starting address of the memory block to search; the All except constants No
same type as IN) address of the first register in the memory block.
INX The zero-based index into the memory block at which to begin All except constants No
the search. Zero points to the first reference.
Valid range: 0 ≤ INX ≤ (Length-1).
If INX is out of range, it is set to the default value of 0.
IN (must be the The value that the search is based on. For example: All No
same type as SEARCH_GT_DINT searches for a DINT value that is greater
AR) than IN.
SEARCH_NE_UINT searches for a UINT value that is not equal to
IN.
SEARCH_GE_WORD searches for a WORD value that is greater
than or equal to IN.
ONX The one-based position within the memory block of the search data flow, I, Q, M, T, No
target. A value of 1 points to the first reference. G, R, P, L, AI, AQ
Valid range: 1 ≤ ONX ≤ Length
FD Found indicator. This power flow indicator is energized when a Power flow No
register that satisfies the search criteria is found and the
function was successful.
Example for the Search Function

To search the memory block %AI00001 - %AI00016, AR is set as
%AI00001 and Length is set as 16. The values of the 16 registers
are 100, 20, 0, 5, 90, 200, 0, 79, 102, 80, 24, 34, 987, 8, 0, and 500.
Initially, the search index into AR, %AQ0001, is 5. When power
flow input is ON, each scan searches the memory block looking
for a match to the IN value of 0. The first scan starts searching at
%AI00006 and finds a match at %AI00007, so FD turns ON and
%AQ00001 becomes 7. The second scan starts searching at
%AI00008 and finds a match at %AI00015, so FD remains ON and
%AQ0001 becomes 15. The next scan starts at %AI00016. Since
the end of the memory block is reached without a match, FD is
set OFF and %AQ0001 is set to zero. The next scan starts
searching at the beginning of the memory block.

7.8.27 Sort
When it receives power flow, the SORT function sorts the elements of the Mnemonics:
memory block 'IN' in ascending order. The output memory block Q contains SORT_INT
integers that give the index that the sorted elements had in the original
SORT_UINT
memory block or list. Q is exactly the same size as IN. It also has a
specification (LEN) of the number of elements to be sorted. SORT_WORD
SORT operates on memory blocks of no more than 64 elements. When EN is ON, all of the elements of
IN are sorted into ascending order, based on their data type. The array Q is also created, giving the
original position that each sorted element held in the unsorted array. OK is always set ON.
Notes: The SORT function is executed each scan it is enabled.
Do not use the SORT function in a timed or triggered input program block.
Operands
Note: For each mnemonic, use the corresponding data type for the IN and Q operands. For
example, SORT_INT requires IN and Q to be INT variables.
Length (??) The number (1—64) of elements that make Constants No
up the memory block to sort.
IN The memory block that contains the All except data flow, S, No
elements to sort. After the sort, IN contains constants. SA – SC valid
the elements in the sorted order. only for WORD type
Q (must be the same type An array of indexes that gives the position of All except S - SC and No
as IN) the sorted elements in the original memory constants
block
Example
New part numbers (%I00017 - %I00032) are
pushed onto a parts array PLIST every time
%Q00014 is ON. When the array is filled, it is sorted
and the output %Q00025 is turned on. The array
PPOSN then contains the original position that the
now-sorted elements held before the sort was
done on PLIST.
If PLIST were an array of five elements and
contained the values 25, 67, 12, 35, 14 before the
sort, then after the sort it would contain the values
12, 14, 25, 35, 67. PPOSN would contain the values
3, 5, 1, 4, 2.

7.8.28 Table Read

The Table Read (TBL_RD) function sequentially reads values in a table. Mnemonics:
When the pointer reaches the end of the table, it wraps around to the TBL_RD_DINT
beginning of the table. (TBL_RD is like FIFO_RD with a wrap-around.)
TBL_RD_DWORD
TBL_RD_INT
TBL_RD_UINT
TBL_RD_WORD
When TBL_RD receives power flow:
1. TBL_RD increments the pointer by one.
2. TBL_RD copies data indicated by the pointer to output parameter Q. Additional program logic
must then be used to capture the data from the output reference.
3. Steps 1 and 2 are repeated each time the instruction is executed, until the end of the table is
reached (PTR=the length specified in Length). When the end of the table is reached, the pointer
wraps around to the beginning of the table.
When TBL_RD receives power flow, the pointer (PTR) increments by one. If this new pointer location is
the last item in the table, the output EM is set ON. The next time TBL_RD executes, PTR is
automatically set back to 1. After PTR is incremented, the content at the new pointer location is
copied to output Q.
TBL_RD always passes power to the right when it receives power.
Note: The TBL_RD and TBL_WRT functions can operate on the same or different tables. By
specifying a different reference for the pointer, these functions can access the same data
table at different locations or at different rates.
Operands
example, TBL_RD_DINT requires TB and Q to be DINT variables.
Length 1 ≤ Length ≤ 32,767 Constants No
TB (must be the same The elements in the table All except constants No
type as Q)
PTR Pointer. Index of the next element. All except data flow, S - SC, constants No
EM Energized when the last element Power flow No
of the table is read
Q (must be the same The element read from the table All except constants, S. SA, SB, SC allowed No
type as TB) only for WORD, DWORD
Table Read Example
WIDGETS is a table with 20 integer elements. When the
enabling input %M00346 is ON, the pointer increments and
the contents of the next element of the table are copied into
ITEM_CT. %L00001 functions as the pointer into the data
table. %M01001 is used to signal when all items of the data
table have been accessed.

7.8.29 Table Write

The Table Write (TBL_WRT) function sequentially updates values in a Mnemonics:
table that never becomes full. When the pointer (PTR) reaches the end of TBL_WRT_DINT
the table, it automatically returns to the beginning of the table.
TBL_WRT_DWORD
TBL_WRT_INT
TBL_WRT_UINT
TBL_WRT_WORD
1. TBL_WRT increments the pointer by one.

2. TBL_WRT copies data from input parameter IN to the position in the table indicated by the
3. Steps 1 and 2 are repeated each time the instruction is executed, until the table is full (PTR=LEN).
When the table is full, the pointer wraps around to the beginning of the table.
Note: The TBL_WRT and TBL_RD functions can operate on the same or different tables. By
specifying a different reference for the pointer, these functions can access the same data
table at different locations or at different rates.
When TBL_WRT receives power flow, the pointer (PTR) increments by 1. If this new pointer location is
the last item in the table, the output FL is set to ON. The next time TBL_WRT executes, PTR is
automatically set back to 1. After incrementing PTR, TBL_WRT writes the content of the input
reference to the current pointer location, overwriting data already stored there.
TBL_WRT always passes power to the right when it receives power.
Note: TBL_WRT is like FIFO_WRT with a wrap-around.
Operands
example, TBL_WRT_DINT requires TB and IN to be DINT variables.
Length 1 ≤ Length ≤ 32,767. Constants No
TB (must be the same The elements in the table All except S, constants, data flow. SA – SC No
data type as IN) allowed only for WORD, DWORD
PTR Pointer. Index of the next element. All except constants, data flow, %S - %SC No
IN (must be the same The element to write to the table All. %S - %SC allowed only for WORD, No
data type as TB) DWORD
FL Energized when IN is written to the Power flow No
last element of the table
Table Write Example
WIDGETS is a table with 20 integer elements. When the enabling input
%I00012 is ON, the pointer increments and the contents of %P00077
are written into the table at the pointer location. %L00001 functions as
the pointer into the data table.

7.9. Math Functions

Your program may need to include logic to convert data to a different type before using a Math or
Numerical function. The description of each function includes information about appropriate data
types. The “Conversion Functions” section on page 212 explains how to convert data to a different
type.
Absolute ABS_DINT, ABS_INT, Finds the absolute value of a double- precision integer (DINT), signed single-
Value ABS_REAL, ABS_LREAL precision integer (INT), or floating-point (REAL or LREAL) value. The
mnemonic specifies the value's data type.
Add ADD_DINT, ADD_INT, Addition. Adds two numbers.
ADD_REAL, ADD_LREAL,
ADD_UINT
Divide† DIV_DINT, DIV_INT, Division. Divides one number by another and outputs the quotient.
DIV_MIXED, DIV_REAL, Note: Take care to avoid overflow conditions when performing divisions.
DIV_LREAL, DIV_UINT
Modulus MOD_DINT, MOD_INT, Modulo Division. Divides one number by another and outputs the
MOD_UINT remainder.
Multiply† MUL_DINT, MUL_INT, Multiplication. Multiplies two numbers.
MUL_MIXED, MUL_REAL, Note: Take care to avoid overflow conditions when performing
MUL_LREAL, MUL_UINT multiplications.
Scale SCALE Scales an input parameter and places the result in an output location.
Subtract SUB_DINT, SUB_INT, Subtraction. Subtracts one number from another.
SUB_REAL, SUB_LREAL,
SUB_UINT
† To avoid overflows when multiplying or dividing 16-bit numbers, use the Conversion Functions
described on page 212 to convert the numbers to a 32-bit format.
Overflow
When an operation results in overflow, there is no power flow.
If an operation on signed operands (INT, DINT, REAL) results in overflow, the output reference is set to
its largest possible value for the data type. For signed numbers, the sign is set to show the direction
of the overflow. If signed or double precision integers are used, the sign of the result for DIV and MUL
functions depends on the signs of I1 and I2.
Maximum MAXINT16 Maximum signed 16-bit 7FFF hex 32,767
Values
MAXUINT16 Maximum unsigned 16-bit FFFF hex 65,535
MAXINT32 Maximum signed 32-bit 7FFFFFFF hex 2,147,483,647
Minimum MININT16 Minimum signed 16-bit 8000 hex –32,768
Values
MININT32 Minimum signed 32-bit 80000000 hex –2,147,483,648
If an operation on unsigned operands (UINT) results in overflow or underflow, the output value wraps
around. For example the ADD_UINT operation, 65535+16, yields a result of 15.

7.9.1 Absolute Value

When the function receives power flow, it places the absolute value of Mnemonics:
input IN into output Q. ABS_DINT
ABS_INT
ABS_REAL
ABS_LREAL
The function outputs power flow, unless one of the following conditions occurs:
■ For INT type, IN is –32,768.
■ For DINT type, IN is –2,147,483,648.
■ For REAL or LREAL type, IN is NaN (Not a Number).
Operands
IN (must be same type as Q) The value to process. All except S, SA, SB, SC No
Q (must be same type as IN) The absolute value of IN. All except S, SA, SB, SC and constant No
Example
The absolute value of –2,976, which is 2,976, is placed in %R00010:

7.9.2 Add
When the ADD function receives power flow, it adds the two operands Mnemonics:
IN1 and IN2 of the same data type and stores the sum in the output ADD_DINT
variable assigned to Q, also of the same data type. ADD_INT
ADD_REAL
ADD_LREAL
ADD_UINT
The power flow output is energized when ADD is performed, unless an invalid operation or overflow
occurs. (For more information, see “Overflow” on page 281.)
Mnemonic Operation Displays as
ADD_INT Q(16 bit) = IN1(16 bit) + IN2(16 bit) base 10 number with sign, up to 5 digits long
ADD_DINT Q(32 bit) = IN1(32 bit) + IN2(32 bit) base 10 number with sign, up to 10 digits long
ADD_REAL Q(32 bit) = IN1(32 bit) + IN2(32 bit) base 10 number, sign and decimals, up to 8 digits long
(excluding the decimals)
ADD_LREAL Q(64 bit) = IN1(64 bit) + IN2(64 bit) base 10 number, sign and decimals, up to 17 digits long
ADD_UINT Q(16 bit) = IN1(16 bit) + IN2(16 bit) base 10 number, unsigned, up to 5 digits long
Operands of the ADD Function

Operand Description Allowed Operands Optional
IN1 The value to the left of the plus sign (+) in the equation IN1+IN2=Q. All except S, SA, SB, SC No
IN2 The value to the right of the plus sign (+) in the equation All except S, SA, SB, SC No
IN1+IN2=Q.
Q The result of IN1+IN2. If an ADD of signed operands results in All except S, SA, SB, SC No
overflow, Q is set to the largest possible value and there is no and constant.
power flow.
If an ADD_UINT operation results in overflow, Q wraps around.
Example1 for ADD

The first example is a failed attempt to create a counter
circuit that would count the number of times switch %I00001
closes. The running total is stored in register %R00002. The
intent of this design is that when %I0001 closes, the ADD
instruction should add one to the value in %R00002 and place
the new value right back into %R0002. The problem with this
design is that the ADD instruction executes once every PLC
scan while %I0001 is closed. For example, if %I0001 stays
closed for five scans, the output increments five times, even
though %I00001 only closed once during that period.

Example2 for ADD

To correct the above problem, the enable input to the ADD
instruction should come from a transition (“one-shot”) coil, as
shown below. In the improved circuit, the %I0001 input switch
controls a transition coil, %M0001, whose contact turns on
the enable input of the ADD function for only one scan each
time contact %I00001 closes. In order for the %M00001
contact to close again, contact %I0001 has to open and close
again.
Note: If IN1 and/or IN2 is NaN (Not a Number), ADD_REAL
passes no power flow.

7.9.3 Divide
When the DIV function receives power flow, it divides the operand IN1 by the Mnemonics:
operand IN2 of the same data type as IN1 and stores the quotient in the output DIV_DINT
variable assigned to Q, also of the same data type as IN1 and IN2. DIV_INT
The power flow output is energized when DIV is performed, unless an invalid DIV_MIXED
operation or overflow occurs. (For more information, see “Overflow” on page DIV_REAL
281.) DIV_LREAL
DIV_UINT
Notes:
 DIV rounds down; it does not round to the closest integer. For example,
24 DIV 5 = 4.
 DIV_MIXED uses mixed data types.
 Be careful to avoid overflows.
The following REAL and LREAL operations are invalid for DIV:
 Any number divided by 0. This operation yields a result of 65535.
 ∞ divided by ∞
 I1 and/or I2 is NaN (Not a Number)
DIV_UINT Q(16 bit) = IN1(16 bit) / IN2(16 bit) base 10 number, unsigned, up to 5 digits long
DIV_INT Q(16 bit) = IN1(16 bit) / IN2(16 bit) base 10 number with sign, up to 5 digits long
DIV_DINT Q(32 bit) = IN1(32 bit) / IN2(32 bit) base 10 number with sign, up to 10 digits long
DIV_MIXED Q(16 bit) = IN1(32 bit) / IN2(16 bit) base 10 number with sign, up to 5 digits long
DIV_REAL Q(32 bit) = IN1(32 bit) / IN2(32 bit) base 10 number, sign and decimals, up to 8 digits long
DIV_LREAL Q(64 bit) = IN1(64 bit) / IN2(64 bit) base 10 number, sign and decimals, up to 17 digits long
Operands for the DIV Function

IN1 The value to be divided; the value to the left of “DIV” in the All except S, SA, SB, SC No
equation IN1 DIV IN2=Q.
IN2 The value to divide IN1 with; the value to the right of “DIV” in All except S, SA, SB, SC No
the equation IN1 DIV IN2=Q.
Q The quotient of IN1/IN2. If a DIV operation on signed All except S, SA, SB, SC and No
operands results in overflow, Q is set to the largest possible constant
value and there is no power flow.
If a DIV_UINT operation results in overflow, Q wraps around.

DIV_MIXED Operands
IN1 The value to be divided; the value to the left of “DIV” in the All except S, SA, SB, SC No
equation IN1 DIV IN2=Q.
IN2 The value to divide IN1 with; the value to the right of “DIV” All except S, SA, SB, SC No
in the equation IN1 DIV IN2=Q.
Q The quotient of IN1/IN2. If an overflow occurs, the result is All except S, SA, SB, SC and No
the largest value with the proper sign and no power flow. constant
DIV_MIXED Example
DIV_DINT can be used in conjunction with a MUL_DINT function to scale a ±10 volt input to ±25,000
engineering units. See “Example – Scaling Analog Input Values” on page 289.

7.9.4 Modulus
When the Modulo Division (MOD) function receives power flow, it divides Mnemonics:
input IN1 by input IN2 and outputs the remainder of the division to Q. MOD_DINT
MOD_INT
MOD_UINT
All three operands must be of the same data type. The sign of the result is always the same as the
sign of input parameter IN1. Output Q is calculated using the formula:
Q = IN1-((IN1 DIV IN2) × IN2)
where DIV produces an integer number.
The power flow output is always ON when the function receives power flow, unless there is an
attempt to divide by zero. In that case, the power flow output is set to OFF.
Operands for Modulus Function
IN1 The value to be divided to obtain the remainder; All except S, SA, SB, SC No
the value to the left of “MOD” in the equation
IN1 MOD IN2=Q.
IN2 The value to divide IN1 with; the value to the right All except S, SA, SB, SC No
of “MOD” in the equation IN1 MOD IN2=Q.
Q The remainder of IN1/IN2. All except S, SA, SB, SC and constant No

7.9.5 Multiply
When the MUL function receives power flow, it multiplies the two operands IN1 Mnemonics:
and IN2 of the same data type and stores the result in the output variable MUL_DINT
assigned to Q, also of the same data type. MUL_INT
The power flow output is energized when the function is performed, unless an MUL_MIXED
invalid operation or overflow occurs. (For more information, see “Overflow” on MUL_REAL
page 281.) MUL_LREAL
MUL_UINT
Note: MUL_MIXED uses mixed data types. Be careful to avoid overflows.
The following REAL and LREAL operations are invalid for MUL:
 0x∞
 I1 and/or I2 is NaN (Not a Number).

MUL_INT Q(16 bit) = IN1(16 bit) × IN2(16 bit) base 10 number with sign, up to 5 digits long
MUL_DINT Q(32 bit) = IN1(32 bit) × IN2(32 bit) base 10 number with sign, up to 10 digits long
MUL_REAL Q(32 bit) = IN1(32 bit) × IN2(32 bit) base 10 number, sign and decimals, up to 8 digits long
MUL_LREAL Q(64 bit) = IN1(64 bit) × IN2(64 bit) base 10 number, sign and decimals, up to 17 digits long
MUL_UINT Q(16 bit) = IN1(16 bit) × IN2(16 bit) base 10 number, unsigned, up to 5 digits long
MUL_MIXED Q(32 bit) = IN1(16 bit) × IN2(16 bit) base 10 number with sign, up to 10 digits long
Operands for Multiply

IN1 The first value to multiply; the value to the left of the multiply All except S, SA, SB, SC No
sign (×) in the equation IN1 × IN2=Q.
IN2 The second value to multiply; the value to the right of the All except S, SA, SB, SC No
multiply sign (×) in the equation IN1 × IN2=Q.
Q The result of IN1 × IN2. If a MUL operation on signed operands All except S, SA, SB, SC No
results in overflow, Q is set to the largest possible value and and constant
there is no power flow.
If a MUL_UINT operation results in overflow, Q wraps around.

Example – Scaling Analog Input Values

A common application is to scale analog input values with a MUL operation followed by a DIV and
possibly an ADD operation. A 0 to ±10 volt analog input will place values of 0 to ±32,000 in its
corresponding %AI input register. Multiplying this input register using an MUL_INT function will result
in an overflow since an INT type instruction has an input and output range of 32,767 to –32,768.
Using the %AI value as in input to a MUL_DINT also does not work as the 32-bit IN1 will combine 2
analog inputs at the same time. To solve this problem, you can move the analog input to the low
word of a double register, then test the sign and set the second register to 0 if the sign tests positive
or –1 if negative. Then use the double register just created with a MUL_DINT which gives a 32-bit
result, and which can be used with a following DIV_DINT function.
For example, the following logic could be used to scale a ±10 volt input %AI1 to ±25000 engineering
units in %R5.
An alternate, but less accurate, way of programming this circuit using INT values involves placing the
DIV_DINT instruction first, followed by the MUL_DINT instruction. The value of IN2 for the DIV
instruction would be 32, and the value of IN2 for the MUL would be 25. This maintains the scaling
proportion of the above circuit and keeps the values within the working range of the INT type
instructions. However, the DIV instruction inherently discards any remainder value, so when the DIV
output is multiplied by the MUL instruction, the error introduced by a discarded remainder is
multiplied. The percent of error is non-linear over the full range of input values and is greater at lower
input values.
By contrast, in the example above, the results are more accurate because the DIV operation is
performed last, so the discarded remainder is not multiplied. If even greater precision is required,
substitute REAL type math instructions in this example so that the remainder is not discarded.

7.9.6 Scale
When the SCALE function receives power flow, it scales the input Mnemonics:
operand IN and places the result in the output variable assigned to SCALE_DINT
output operand OUT. The power flow output is energized when
SCALE_INT
SCALE is performed without overflow.
SCALE_DINT
SCALE_UINT
Operands
IHI (Inputs High) Maximum input value (module-related). The upper All except S, SA, SB, SC No
limit of the unscaled data. IHI is used with ILO, OHI and OLO to
calculate the scaling factor applied to the input value IN.
ILO (Inputs Low) Minimum input value (module-related). The lower All except S, SA, SB, SC No
limit of the unscaled data. Must be the same data type as IHI.
OHI (Outputs High) Maximum output value. The upper limit of the All except S, SA, SB, SC No
scaled data. Must be the same data type as IHI. When the IN
input is at the IHI value, the OUT value is the same as the OHI
value.
OLO (Outputs Low) Minimum output value. The lower limit of the All except S, SA, SB, SC No
scaled data. Must be the same data type as IHI. When the IN
input is at the ILO value, the OUT value is the same as the OLO
value.
IN (INput value) The value to be scaled. Must be the same data All except S, SA, SB, SC No
type as IHI
OUT (OUTput value) The scaled equivalent of the input value. Must All except S, SA, SB, SC No
be the same data type as IHI.
Example
In the example at right, the registers %R0120 through %R0123 are used to
store the high and low scaling values. The input value to be scaled is analog
input %AI0017. The scaled output data is used to control analog output
%AQ0017. The scaling is performed whenever %I0001 is ON.

7.9.7 Subtract
When the SUB function receives power flow, it subtracts the operand Mnemonics:
IN2 from the operand IN1 of the same data type as IN2 and stores the SUB_DINT
result in the output variable assigned to Q, also of the same data type. SUB_INT
SUB_REAL
SUB_LREAL
SUB_UINT
The power flow output is energized when SUB is performed, unless an invalid operation or overflow
occurs. (For more information, see “Overflow” on page 281.)
If a SUB_UINT operation results in a negative number, Q wraps around, yielding a result that is the
highest possible value (65535) minus the absolute value of the difference -1.
The following REAL and LREAL operations are invalid for SUB:
 (± ∞) – (± ∞)
 I1 and/or I2 is NaN (Not a Number)

SUB_INT Q(16 bit) = IN1(16 bit) – IN2(16 bit) base 10 number with sign, up to 5 digits long
SUB_DINT Q(32 bit) = IN1(32 bit) – IN2(32 bit) base 10 number with sign, up to 10 digits long
SUB_REAL Q(32 bit) = IN1(32 bit) – IN2(32 bit) base 10 number, sign and decimals, up to 8 digits long
SUB_LREAL Q(64 bit) = IN1(64 bit) – IN2(64 bit) base 10 number, sign and decimals, up to 17 digits long
SUB_UINT Q(16 bit) = IN1(16 bit) – IN2(16 bit) base 10 number, unsigned, up to 5 digits long
Operands for Subtract

IN1 The value to subtract from; the value to the left of the minus sign All except S, SA, SB, SC No
(-) in the equation IN1-IN2=Q.
IN2 The value to subtract from IN1; the value to the right of the All except S, SA, SB, SC No
minus sign (-) in the equation IN1-IN2=Q.
Q The result of IN1-IN2. If a SUB operation on signed operands All except S, SA, SB, SC No
results in underflow, Q is set to the smallest possible value and and constant
there is no power flow.
If a SUB_UINT operation results in overflow, Q wraps around. For
example,
The SUB_UINT operation 600 – 601 = –1 sets Q to 65535
The SUB_UINT operation 600 – 602 = –2 sets Q to 65534

7.10. Program Flow Functions

The program flow functions limit program execution or change the way the CPU executes the
application program.
Argument ARG_PRES Determines whether an input or output parameter value was present when the
Present function block instance of the parameter was invoked. For example, a parameter
can be optional (pass by value).
Call CALL Causes program execution to go to a specified block.
Comment COMMENT Places a text explanation in the program.
End Master ENDMCRN Nested End Master Control Relay. Indicates that the subsequent logic is to be
Control Relay executed with normal power flow.
End of Logic END Provides an unconditional end of logic. The program executes from the first rung to
the last rung or the END instruction, whichever is encountered first.
Jump JUMPN Nested jump. Causes program execution to jump to a specified location indicated by
a LABELN. JUMPN/LABELN pairs can be nested within one another. Multiple JUMPNs
can share the same LABELN.
Label LABELN Nested label. Specifies the target location of a JUMPN instruction.
Master MCRN Nested Master Control Relay. Causes all rungs between the MCR and its subsequent
Control Relay ENDMCRN to be executed without power flow. Up to MCRN/ENDMCRN pairs can be
nested within one another. All the MCRNs share the same ENDMCRN.
Wires H_WIRE Horizontally connects elements of a line of LD logic, to complete the power flow.
V_WIRE Vertically connects elements of a line of LD logic, to complete the power flow.

7.10.1 Argument Present

The ARG_PRES function determines whether an input parameter value
was present when the function block instance of the parameter was
invoked. This may be necessary if the parameter is optional.
This function must be called from a function block instance or a
parameterized block.
The standard output parameter ENO is false only when EN is false.
Operands for ARG_PRES

IN Parameter name. Must be a parameter of the function All except flow and constants. No
block that contains the ARG_PRES instruction. Cannot
be an array element or structure element. An alias to a
parameter should resolve only to the parameter name.
Q True if the parameter is present, otherwise false. Must be flow in LD. In other No
languages all types allowed
except S, SA, SB, SC and
constants.
Example for ARG_PRES

The following sample rung calls the user defined function block, ReadTemp, which has two
parameters, TempVal and Temp1.
The function block ReadTemp contains the following logic, which uses an ARG_PRES function to
determine whether a value for TempVal is present. If TempVal does not have a value, Temp_Pres is
OFF and Idle is ON. If a value exists for TempVal, the ARG_PRES function sets Temp_Pres ON. When
Temp_Pres and Switch are both ON, Start is set ON.

7.10.2 Call
Non-parameterized Parameterized. May call a parameterized external block or a parameterized

block. May have up to 7 input and 8 output parameters.
When the CALL function receives power flow, it causes the logic execution to go immediately to the
designated program block, external C block (parameterized or not), or parameterized block and
execute it. After the block’s execution is complete, control returns to the point in the logic
immediately following the CALL instruction.
Notes:
 A CALL function can be used in any program block, including the _MAIN block, or a
parameterized block. It cannot be used in an external block.
 You cannot call a _MAIN block.
 The called block must exist in the target before making the call.
 There is no limit to the number of calls that can be made from or to a given block.
 You can set up recursive subroutines by having a block call itself. When stack size is configured
to be the default (64K), the PLC guarantees a minimum of eight nested calls before an
“Application Stack Overflow” fault is logged.
 Each block has a predefined parameter, Y0, which the CPU sets to 1 upon each invocation of the
block. Y0 can be controlled by logic within the block and provides the output status of the block.
When the Y0 parameter of a Program Block, parameterized block, or external C block returns ON,
the CALL passes power to the right; when it returns OFF, the CALL does not pass power to the
right.

Operands for Call

Parameter Description
Block Name (????) Block name; the name of the block to transfer to.
You cannot CALL the _MAIN block.
A program block or a parameterized block can call itself.
(Parameterized calls only) Notes for External (C) blocks:
■ You must define the TYPE, LENGTH, and NAME for each external C block
Input parameters (0 – 7) parameter.
■ The valid data type, value range, and memory area for each parameter are
Output parameters (1 – 8)
stated in the external block's written documentation.
■ Data flow is permitted for any parameter.
■ For additional information, see the section on External Blocks in Chapter 5.
Notes for Parameterized Blocks:
■ You must define the TYPE, LENGTH, and NAME for each parameter. Valid
operands on the CALL instruction include variables, flow, and indirect
references. Input operands can also be constants.
■ If a formal parameter is an array of BOOL type and has a length evenly
divisible by 16, then a variable or array residing in word-oriented memory can
be passed on to the parameterized block as an operand. For example, if a
parameterized block has a formal parameter Y1 of data type BIT and length
48, you can pass a WORD array of length 3 to Y1.
■ The BOOL parameter Y0 is automatically defined for all parameterized blocks
and can be used in the parameterized block's logic. When the parameterized
block stops executing and Y0 is ON, the CALL passes power flow to the right. If
Y0 is OFF, the CALL passes no power flow.
■ A parameterized block is not required to have the same number of inputs and
outputs.
■ For additional information, see “Using Parameters with a Parameterized
Block” in Chapter 5.
Example 1 for Call

In the example at right, if Enable is
set, the C block named C_123 is
executed. C_123 operates on the
input data located at reference
addresses Data1, Data2, and Data 3,
and produces values located at
reference addresses Data4, Data5,
and Data6. Logic within C_123
controls the power flow output.

Example 2 for Call

Parameterized blocks are useful for building libraries of user-defined
functions. For example, if you have an equation such as:
E=(A+B+C+D)/4, a parameterized block named AVG_4 could be called
as shown in the example to the right.
In this example, the average of the values in R00001, R00002, R00003,
and R00004 would be placed in R00005.
The logic within the parameterized block would be defined as shown
below.
Logic for AVG_4 Parameterized Block

7.10.3 Comment
The Comment function is used to enter a text explanation in the program. When you insert a
Comment instruction into the LD logic, it displays ????. After you key in a comment, the first few
words are displayed.
You can set the Comment mode option to Brief or Full.

Notes:
 Editing a comment makes the Programmer lose equality.
 Comment text is downloaded to the controller and retrieved upon Logic Upload.
7.10.4 JumpN
Description Always associated with... Mnemonic
Nested form of Jump instruction. a LABELN instruction JUMPN
A JUMPN instruction causes a portion of the program logic to be bypassed. Program execution
continues at the LABELN specified in the same block. Power flow jumps directly from the JUMPN to
the rung with the named LABELN.
When the Jump is active, any functions between the jump and the label are not executed. All coils
between JUMPN and its associated LABELN are left at their previous states. This includes coils
associated with timers, counters, latches, and relays.
Any JUMPN can be either a forward or a backward jump, i.e., its LABELN can be either in a further or
previous rung. The LABELN must be in the same block.
Note: To avoid creating an endless loop with forward and backward JUMPN instructions, a
backward JUMPN should contain a way to make it conditional.
A JUMPN and its associated LABELN can be placed anywhere in a program, as long as the JUMPN /
LABELN range:
■ does not overlap the range of a MCRN / ENDMCRN pair.
■ does not overlap the range of a FOR_LOOP / END_FOR pair.
Nothing can be connected to the right side of a JUMPN instruction.
Operands
Parameter Description Optional
Label (????) Label name; the name assigned to the destination LABEL(N). No

7.10.5 Master Control Relay/End Master Control Relay
Description Always associated with... Mnemonics

Nested form of the Master Control Relay an ENDMCRN instruction MCRN
Nested End Master Control Relay an MCRN instruction ENDMCRN
MCRN
An MCRN instruction marks the beginning of a section of logic that will be executed with no power
flow. The end of an MCRN section must be marked with an ENDMCRN having the same name as the
MCRN. ENDMCRNs must follow their corresponding MCRNs in the logic.
All rungs between an active MCRN and its corresponding ENDMCRN are executed with negative
power flow from the power rail. The ENDMCRN function associated with the MCRN causes normal
program execution to resume, with positive power flow coming from the power rail.
With a Master Control Relay, functions within the scope of the Master Control Relay are executed
without power flow, and coils are turned off.
Block calls within the scope of an active Master Control Relay will not execute. However, any timers in
the block will continue to accumulate time.
A rung may not contain anything after an MCRN.
Unlike JUMP instructions, MCRNs can only move forward. An ENDMCRN instruction must appear after
its corresponding MCRN instruction in a program.
The following controls are imposed by an MCRN:
 Timers do not increment or decrement. TMR types are reset. For an ONDTR function, the
accumulator holds its value.
 Normal outputs are off; negated outputs are on.
Note: When an MCRN is energized, the logic it controls is scanned and contact status is displayed,
but no outputs are energized. If you are not aware that an MCRN is controlling the logic being
observed, this might appear to be a faulty condition.
An MCRN and its associated ENDMCRN can be placed anywhere in a program, as long as the MCRN /
ENDMCRN range:
 Is completely nested within another MCRN / ENDMCRN range, up to a maximum 255 levels of
nesting, or is completely outside of the range of another MCRN / ENDMCRN range.
 Is completely nested within a FOR_LOOP / END_FOR range or is completely outside of the range
of a FOR_LOOP / END_FOR.

EndMCRN
The End Master Control Relay instruction marks the end of a section of logic begun with a Master
Control Relay instruction. When the MCRN associated with the ENDMCRN is active, the ENDMCRN
causes program execution to resume with normal power flow. When the MCRN associated with the
ENDMCRN is not active, the ENDMCRN has no effect.
ENDMCRN must be tied to the power rail; there can be no logic before it in the rung; execution cannot
be conditional.
ENDMCRN has a name that identifies it and associates it with the corresponding MCRN(s). The
ENDMCRN function has no outputs; there can be nothing after an ENDMCR instruction in a rung.
Operands for MCRN/ENDMCRN
The Master Control Relay function has a single operand, a name that identifies the MCRN. This name
is used again with an ENDMCRN instruction. The MCRN has no output.
Parameter Description Optional
Name The name associated with the MCRN that starts the section of logic. No
(???? )
Example of MCRN/ENDMCRN
The example at right an MCRN named “Sec_MCRN”
nested inside the MCRN named “First_MCRN.”
Whenever the V_I0002 contact allows power flow into
the MCRN function, program execution will continue
without power flow to the coils until the associated
ENDMCRN is reached. If the V_I0001 and V_I0003
contacts are ON, the V_Q0001 coil is turned OFF and the
SET coil V_Q0003 maintains its current state.

7.10.6 Wires
Horizontal and vertical wires (H_WIRE and V_WIRE)
are used to connect elements of a line of LD logic
between functions. Their purpose is to complete the
flow of logic (“power”) from left to right in a line of
logic.
A horizontal wire transmits the BOOLEAN ON/OFF
state of the element on its immediate left to the
element on its immediate right.
A vertical wire may intersect with one or more
horizontal wires on each side. The state of the
vertical wire is the inclusive OR of the ON states of
the horizontal wires on its left side. The state of the
vertical wire is copied to all of the attached
horizontal wires on its right side.
Note: Wires can be used for data flow, but you cannot route data flow leftwards. Nor can two
separate data flow lines come into the left side of the same vertical wire.

7.11. Relational Functions

Relational functions compare two values of the same data type or determine whether a number lies
within a specified range. The original values are unaffected.
Compare CMP_DINT Compares two numbers, IN1 and IN2, of the data type specified by the
CMP_INT mnemonic.
CMP_REAL ■ If IN1 < IN2, the LT output is turned ON.
CMP_LREAL ■ If IN1 = IN2, the EQ output is turned ON.
CMP_UINT ■ If IN1 > IN2, the GT output is turned ON.
Equal EQ_DATA Tests two numbers for equality
EQ_DINT
EQ_INT
EQ_REAL
EQ_LREAL
EQ_UINT
Greater or Equal GE_DINT Tests whether one number is greater than or equal to another
GE_INT
GE_REAL
GE_LREAL
GE_UINT
Greater Than GT_DINT Tests whether one number is greater than another
GT_INT
GT_REAL
GT_LREAL
GT_UINT
Less or Equal LE_DINT Tests whether one number is less than or equal to another
LE_INT
LE_REAL
LE_LREAL
LE_UINT
Less Than LT_DINT Tests whether one number is less than another
LT_INT
LT_REAL
LT_LREAL
LT_UINT
Not Equal NE_DINT Tests two numbers for nonequality
NE_INT
NE_REAL
NE_LREAL
NE_UINT
Range RANGE_DINT Tests whether one number is within the range defined by two other
RANGE_DWORD supplied numbers
RANGE_INT
RANGE_UINT
RANGE_WORD

7.11.1 Compare
When the Compare (CMP) function receives power flow, it compares Mnemonics:
the value IN1 to the value IN2. CMP_DINT
■ If IN1 < IN2, CMP energizes the LT (Less Than) output. CMP_INT
■ If IN1 = IN2, CMP energizes the EQ (Equal) output. CMP_REAL
■ If IN1 > IN2, CMP energizes the GT (Greater Than) output. CMP_LREAL
CMP_UINT
IN1 and IN2 must be the same data type.

CMP compares data of the following types: DINT, INT, REAL, LREAL, and UINT.
Tip: To compare values of different data types, first use conversion functions to make the types
the same.
When it receives power flow, CMP always passes power flow to the right, unless IN1 and/or IN2 is
NaN (Not a Number).
Operands
IN1 The first value to compare. All except S, SA, SB, SC No
IN2 The second value to compare. All except S, SA, SB, SC No
LT Output LT is energized when I1 < I2. Power flow No
EQ Output EQ is energized when I1 = I2. Power flow No
GT Output GT is energized when I1 > I2. Power flow No
Example
When %I00001 is ON, the integer variable SHIPS is compared with
the variable BOATS. Internal coils %M0001, %M0002, and
%M0003 are set to the results of the compare.

7.11.2 Equal, Not Equal, Greater or Equal, Greater Than, Less or Equal,
Less Than
Other data types:
_INT
_REAL
_LREAL
_UINT
When the relational function receives power flow, it compares input IN1 to input IN2. These operands
must be the same data type. If inputs IN1 and IN2 are equal, the function passes power to the right,
unless IN1 and/or IN2 is NaN (Not a Number). The following relational functions can be used to
compare two numbers:
Function Definition Relational Statement
EQ Equal IN1=IN2
NE Not Equal IN1≠IN2
GE Greater Than or Equal IN1≥IN2
GT Greater Than IN1>IN2
LE Less Than or Equal IN1≤IN2
LT Less Than IN1<IN2
Note: If an overflow occurs with a _UINT operation, the result wraps around – see “Overflow” on
page 281.
If the _DINT or _INT operations are fed the largest possible value with any sign, they cannot
determine if it is an overflow value. The power flow output of the previous operation would
need to be checked. If an overflow occurred on a previous DINT, or INT operation, the result
was the largest possible value with the proper sign and no power flow.
the same. The relational functions require data to be one of the following types: DINT, INT,
REAL, LREAL, or UINT.
Operands
IN1 The first value to be compared; the value on the left side of the All except S, SA, SB, SC No
relational statement.
IN2 The second value to be compared; the value on the right side of All except S, SA, SB, SC No
the relational statement. IN2 must be the same data type as IN1.
Q The power flow. If the relational statement is true, Q is energized, Power flow No
unless IN1 or IN2 is NaN.

7.11.3 EQ_DATA
The EQ_DATA function compares two input variables, IN1 and IN2 of the Mnemonic:
same data type. If IN1 and IN2 are equal, output Q is energized. If they are EQ_DATA
not equal, Q is cleared.
Operands
IN1 The first value to be compared; the value on the left side PACMotion ENUM variable or No
of the relational statement. structure variable.
For details, refer to “Data Types
and Structures” in the
PACMotion Multi-Axis Motion
Controller User’s Manual, GFK-
2448.
IN2 The second value to be compared; the value on the PACMotion ENUM variable or No
right side of the relational statement. IN2 must be the structure variable.
same data type as IN1.
Q If IN1 or IN2 is true, Q is energized. Power flow No

7.11.4 Range
When the Range function is enabled, it compares the value of input IN Mnemonics:
against the range delimited by operands L1 and L2. Either L1 or L2 can RANGE_DINT
be the high or low limit. When L1 ≤ IN ≤ L2 or L2 ≤ IN ≤ L1, output RANGE_DWORD
parameter Q is set ON (1). Otherwise, Q is set OFF (0).
RANGE_INT
If the operation is successful, it passes power flow to the right.
RANGE_UINT
RANGE_WORD
Operands
IN The value to compare against the range delimited by L1 and L2. All except S, SA, SB, SC No
Must be the same data type as L1 and L2.
L1 The start point of the range. May be the upper limit or the lower All except S, SA, SB, SC No
limit. Must be the same data type as IN and L2.
L2 The end point of the range. May be the lower or upper limit. Must All except S, SA, SB, SC No
be the same data type as IN and L1.
Q If L1 ≤ IN ≤ L2 or L2 ≤ IN ≤ L1, Q is energized; otherwise, Q is off. Power flow No
Example
When RANGE_INT receives power flow from the normally open
contact %I0001, it determines whether the value in %R00003 is
within the range 0 to 100 inclusively. Output coil %M00002 is ON
only if 0 ≤ %AI0050 ≤ 100.

7.12. Timers
This section describes the PACSystems timed contacts and timer function blocks that are
implemented in the LD language.
7.12.1 Timed Contacts
The PACSystems has four timed contacts that can be used to provide regular pulses of power flow to
other program functions. Timed contacts cycle on and off, in square-wave form, every 0.01 second,
0.1 second, 1.0 second, and 1 minute. Timed contacts can be read by an external communications
device to monitor the state of the CPU and the communications link. Timed contacts are also often
used to blink pilot lights and LEDs.
The timed contacts are referenced as T_10MS (0.01 second), T_100MS (0.1 second), T_SEC (1.0
second), and T_MIN (1 minute). These contacts represent specific locations in %S memory:
#T_10MS 0.01 second timed contact %S0003
#T_100MS 0.1 second timed contact %S0004
#T_SEC 1.0 second timed contact %S0005
#T_MIN 1.0 minute timed contact %S0006
These contacts provide a pulse having an equal on and off time duration. The following timing
diagram illustrates the on/off time duration of these contacts.
X
T XXXXX SEC
X/2 X/2
SEC SEC
Caution
Do not use timed contacts for applications requiring
accurate measurement of elapsed time. Timers, time-based
subroutines, and PID blocks are preferred for these types of
applications.
The CPU updates the timed contact references based on a
free-running timer that has no relationship to the start of
the CPU sweep. If the sweep time remains in phase with the
timed contact clock, the contact will always appear to be in
the same state. For example, if the CPU is in constant sweep
mode with a sweep time setting of 100ms, the T_10MS and
T_100MS bits will never toggle.

7.12.2 Timer Function Blocks

Function Function Block Type Mnemonic Description
Off Delay Timer Built-in OFDT_HUNDS The Current Value (CV) of the timer resets to zero
(instance data is OFDT_SEC when power flow input is on. CV increments while
WORD array) OFDT_TENTHS power flow is off. When CV=PV (Preset Value),
OFDT_THOUS power flow is no longer passed to the right until
See page 307.
power flow input is on again.
On Delay ONDTR_HUNDS Retentive on delay timer. Increments while it
Stopwatch ONDTR_SEC receives power flow and holds its value when
Timer ONDTR_TENTHS power flow stops.
ONDTR_THOUS
On Delay Timer TMR_HUNDS Simple on delay timer. Increments while it receives
TMR_SEC power flow and resets to zero when power flow
TMR_TENTHS stops.
TMR_THOUS
Timer Off Delay Standard TOF When the input IN transitions from ON to OFF, the
(instance data is a timer starts timing until a specified period of time
structure variable) has elapsed, then sets the output Q to OFF.
Timer On Delay See page 321. TON When the input IN transitions from OFF to ON, the
timer starts timing until a specified period of time
has elapsed, then sets the output Q to ON.
Timer Pulse TP When the input IN transitions from OFF to ON, the
timer sets the output Q to ON for a specified time
interval.
Built-In Timer Function Blocks

Note: Special care must be taken when programming timers in program blocks that are not called
every sweep, and in parameterized blocks and UDFBs. For details, see:
“Using OFDT, ONDTR and TMR in Program Blocks not Called Every Sweep”, page 310.
“Timers that are Skipped by the Jump Instruction”, page 310.
“Using OFDT, ONDTR and TMR in Parameterized Blocks” page 310, and
“Using OFDT, ONDTR and TMR in UDFBs”, page 312.

Data Required for Built-in Timer Function Blocks

The data associated with these functions is retentive through power cycles. Each timer uses a three-
word array of %R, %W, %P, %L or symbolic memory to store the following information:
Current value (CV) Word 1
Preset value (PV) Word 2
Control word Word 3
Warning
Do not use two consecutive words (registers) as the starting
addresses of two timers. Logic Developer - PLC does not
check or warn you if register blocks overlap. Timers will not
work if you place the current value of a second timer on top
of the preset value for the previous timer.
Word 1: Current value (CV)
Warning
The first word (CV) can be read but should not be written to,
or the function may not work properly.
Word 2: Preset value (PV)

When the Preset Value (PV) operand is a variable, it is normally set to a different location than word 2
in the timer’s or counter’s three-word array.
 If you use a different address and you change word 2 directly, your change will have no effect, as
PV will overwrite word 2.
 If you use the same address for the PV operand and word 2, you can change the Preset Value in
word 2 while the timer or counter is running and the change will be effective.
The control word stores the state of the Boolean inputs and outputs of its associated timer or
counter, as shown in the following diagram:
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Reserved
Reset input
Enable input, previous execution
Q (counter/timer status output)
EN (enable input

Warning
The third word (Control) can be read but should not be
written to; otherwise, the function will not work.
Note: Bits 0 through 13 are used for timer accuracy.

Using OFDT, ONDTR and TMR in Program Blocks not Called Every Sweep
Care should be taken when timers (ONDTR, TMR, and OFDTR) are used in program blocks that are not
called every sweep. The timers accumulate time across calls to the sub-block unless they are reset.
This means that they function like timers operating in a program with a much slower sweep than the
timers in the main program block. For program blocks that are inactive for large periods of time, the
timers should be programmed in such a manner as to account for this catch up feature.
Timers that are Skipped by the Jump Instruction
You should not program a Jump around an instance of OFTD, ONDTR or TMR. Timers that are skipped
will not catch up and will therefore not accumulate time in the same manner as if they were
executed every sweep.
Note: Timer function blocks do not accumulate time if used in a block that is executed as a result of
an interrupt.
Using OFDT, ONDTR and TMR in Parameterized Blocks
Special care must be taken when programming timers in PACSystems parameterized blocks. Timers
in parameterized blocks can be programmed to track true real-time as long as the guidelines and
rules below are followed. If the guidelines and rules described here are not followed, the operation of
the timer functions in parameterized blocks is undefined.
Note: These rules are not enforced by the programming software. It is your responsibility to ensure
these rules are followed.
The best use of a timer function is to invoke it with a particular reference address exactly one time
each scan. With parameterized blocks, it is important to use the appropriate reference memory with
the timer function and to call the parameterized block an appropriate number of times.
Finding the Source Block
The source block is either the _MAIN block or the lowest logic block of type Block that appears above
the parameterized block in the call tree. To determine the source block for a given parameterized
block, determine which block invoked that parameterized block. If the calling block is _MAIN or of
type Block, it is the source block. If the calling block is any other type (parameterized block or function
block), apply the same test to the block that invoked this block. Continue back up the call tree until
the _MAIN block or a block of type Block is found. This is the source block for the parameterized
block.

Programming OFDT, ONDTR and TMR in Parameterized Blocks

Different guidelines and rules apply depending on whether you want to use the parameterized block
in more than one place in your program logic.
Parameterized block called from one block
If your parameterized block that contains a timer will be called from only one logic block, follow these
rules:
1. Call the parameterized block exactly one time per execution of its source block.
2. Choose a reference address for the timer that will not be manipulated anywhere else. The
reference address may be %R, %P, %L, %W, or symbolic.
Note: %L memory is the same %L memory available to the source block of type Block. %L memory
corresponds to %P memory when the source block is _MAIN.
Parameterized block called from multiple blocks
When calling the parameterized block from multiple blocks, it is imperative to separate the timer
reference memory used by each call to the parameterized block. Follow these rules and guidelines:
1. Call the parameterized block exactly one time per execution of each source block in which it
appears.
2. Choose a %L reference or parameterized block formal parameter for the timer reference
memory. Do not use a %R, %P, %W, or symbolic memory reference.
Notes:
 The strongly recommended choice is a %L location, which is inherited from the parameterized
block’s source block. Each source block has its own %L memory space except the _MAIN block,
which has a %P memory area instead. When the _MAIN block calls another block, the %P
mappings from the _MAIN block are accessed by the called block as %L mappings.
 If you use a parameterized block formal parameter (word array passed-by-reference), the actual
parameter that corresponds to this formal parameter must be a %L, %R, %P, %W, or symbolic
reference. If the actual parameter is a %R, %P, %W, or symbolic reference, a unique reference
address must be used by each source block.
Recursion
If you use recursion (that is, if you have a block call itself either directly or indirectly) and your
parameterized block contains an OFDT, ONDTR, or TMR, you must follow two additional rules:
 Program the source block so that it invokes the parameterized block before making any recursive
calls to itself.
 Do not program the parameterized block to call itself directly.

Using OFDT, ONDTR and TMR in UDFBs

UDFBs are user-defined logic blocks that have parameters and instance data. For details on these
and other types of blocks, refer to Chapter 5.
When a timer function is present inside a UDFB, and a member variable is used for the control block
of a timer, the behavior of the timer may not match your expectations. If multiple instances of the
UDFB are called during a logic sweep, only the first-executed instance will update its timer. If a
different instance is then executed, its timer value will remain unchanged.
In the case of multiple calls to a UDFB during a logic scan, only the first call will add elapsed time to
its timer functions. This behavior matches the behavior of timers in a normal program block.
Example
A UDFB is defined that uses a member variable for a timer function block. Two instances of the
function block are created: timer_A and timer_B. During each logic scan, both timer_A and timer_B
are executed. However, only the member variable in timer_A is updated and the member variable in
timer_B always remains at 0.

Off Delay Timer

The Off-Delay Timer (OFDT) increments while power flow is off, and Mnemonics:
the timer's Current Value (CV) resets to zero when power flow is on. OFDT_SEC
OFDT passes power until the specified interval PV (Preset Value) has OFDT_TENTHS
elapsed. OFDT_HUNDS
OFDT_THOUS
Time may be counted in the following increments:
 Seconds
 Tenths (0.1) of a second
 Hundredths (0.01) of a second
 Thousandths (0.001) of a second
The range for PV is 0 to +32,767 time units. If PV is out of range, it has no effect on the timer's word 2.
The state of this timer is retentive on power failure; no automatic initialization occurs at power-up.
When OFDT receives power flow, CV is set to zero and the timer passes power to the right. The output
remains on as long as OFDT receives power flow.
Each time the OFDT is invoked with its power flow input turned OFF, CV is updated to reflect the
elapsed time since the timer was reset. OFDT continues passing power to the right until CV equals or
exceeds PV. When this happens, OFDT stops passing power flow to the right and stops accumulating
time. If PV is 0 or negative, the timer stops passing power flow to the right the first time that it is
invoked with its power flow input OFF.
When the function receives power flow again, CV resets to zero.
Notes:
 The best way to use an OFDT function is to invoke it with a particular reference address exactly
one time each scan. Do not invoke an OFDT with the same reference address more than once per
scan (inappropriate accumulation of time would result). When an OFDT appears in a program
block, it accumulates time once per scan. Subsequent calls to that program block within the
same scan will have no effect on its OFDTs.
 Do not program an OFDT function with the same reference address in two different blocks. You
should not program a JUMP around a timer function. Also, if you use recursion (where a block
calls itself either directly or indirectly), program the program block so that it invokes the timer
before it makes any recursive calls to itself.
 For information on using timers inside parameterized blocks, see page 310.
 An OFDT expires (turns OFF power flow to the right) the first scan that it does not receive power
flow if the previous scan time was greater than PV.
 When OFDT is used in a program block that is not called every scan, the timer accumulates time
between calls to the program block unless it is reset. This means that OFDT functions like a timer
operating in a program with a much slower scan than the timer in the main program block. For
program blocks that are inactive for a long time, OFDT should be programmed to allow for this
catch-up feature. For example, if a timer in a program block is reset and the program block is not
called (is inactive) for four minutes, when the program block is called, four minutes of time will
already have accumulated. If the enable input is OFF, these four minutes are applied to the timer
(that is, CV is set to 4 minutes).

Timing diagram
ENABLE
A B C D E F G H
A. ENABLE and Q both go high; timer is reset (CV = 0).

B. ENABLE goes low; timer starts accumulating time.
C. CV reaches PV; Q goes low and timer stops accumulating time.
D. ENABLE goes high; timer is reset (CV = 0).
E. ENABLE goes low; timer starts accumulating time.
F. ENABLE goes high; timer is reset (CV = 0) before CV had a chance to reach PV. (The diagram is not
to scale.)
G. ENABLE goes low; timer begins accumulating time.
H. CV reaches PV; Q goes low and timer stops accumulating time.
Operands for OFDT
Warning
Do not use the Address, Address+1, or Address+2 addresses
with other instructions. Overlapping references cause
erratic timer operation.

(????) Word 1: Current value (CV)
PV The Preset Value, used when the timer is enabled or reset. All except S, SA, SB, SC Optional
0 ≤ PV ≤ +32,767. If PV is out of range, it has no effect on Word 2.
CV The current value of the timer. All except S, SA, SB, SC, Optional
constant
Example for OFDT

The output action is reversed by the use of a negated output coil.
In this circuit, the OFDT timer turns off negated output coil
%Q0001 whenever contact %I0001 is closed. After %I0001 opens,
%Q0001 stays off for 2 seconds then turns on.

On Delay Stopwatch Timer

The retentive On-Delay Stopwatch Timer (ONDTR) increments while it Mnemonics:
receives power flow and holds its value when power flow stops. ONDTR_SEC
Time may be counted in the following increments: ONDTR_TENTHS
■ Seconds ONDTR_HUNDS
■ Tenths (0.1) of a second ONDTR_THOUS
■ Hundredths (0.01) of a second
■ Thousandths (0.001) of a second
The range is 0 to +32,767 time units. The state of this timer is retentive on power failure; no automatic
initialization occurs at power-up.
When ONDTR first receives power flow, it starts accumulating time (Current Value (CV)). When the CV
equals or exceeds Preset Value (PV), output Q is energized, regardless of the state of the power flow
input.
As long as the timer continues to receive power flow, it continues accumulating until CV equals the
maximum value (+32,767 time units). Once the maximum value is reached, it is retained and Q
remains energized regardless of the state of the enable input.
When power flow to the timer stops, CV stops incrementing and is retained. Output Q, if energized,
will remain energized. When ONDTR receives power flow again, CV again increments, beginning at
the retained value.
When reset (R) receives power flow and PV is not equal to zero, CV is set back to zero and output Q is
de-energized.
Note: If PV equals zero, the time is disabled and the reset is activated, and the output of the time
becomes high. Subsequent removal of the reset or activation of input will have no effect on
the timer output; the output of the time remains high.
ONDTR passes power flow to the right when CV is greater than or equal to PV. Since no automatic
initialization to the outgoing power flow state occurs at power-up, the power flow state is retentive
across power failure.
Notes:
 The best way to use an ONDTR function is to invoke it with a particular reference address exactly
one time each scan. Do not invoke an ONDTR with the same reference address more than once
per scan (inappropriate accumulation of time would result). When an ONDTR appears in a
program block, it will only accumulate time once per scan. Subsequent calls to that same
program block within the same scan will have no effect on its ONDTRs. Do not program an
ONDTR function with the same reference address in two different blocks. You should not program
a JUMPN around a timer function. Also, if you use recursion (that is, having a block call itself
either directly or indirectly), program the program block so that it invokes the timer before it
makes any recursive calls to itself.
 An ONDTR expires (passes power flow to the right) the first scan that is enabled and not reset if
the previous scan time was greater than PV.
 When ONDTR is used in a program block that is not called every scan, it accumulates time
between calls to the program block unless it is reset. This means that ONDTR functions like a
timer operating in a program with a much slower scan than the timer in the main program block.
For program blocks that are inactive for a long time, ONDTR should be programmed to allow for
this catch-up feature. For example, if a timer in a program block is reset and the program block is

not called (is inactive) for four minutes, when the program block is called, four minutes of time will
already have accumulated. If the enable input is ON and the reset input is OFF, these four
minutes are applied to the timer (that is, CV is set to 4 minutes).
Timing diagram
ENABLE
RESET
A B C D E F G H
A. ENABLE goes high; timer starts accumulating.

B. Current value (CV) reaches preset value (PV); Q goes high. Timer continues to accumulate time
until ENABLE goes low, RESET goes high or current value becomes equal to the maximum time.
C. RESET goes high; Q goes low, accumulated time is reset (CV=0).
D. RESET goes low; timer then starts accumulating again, as ENABLE is high.
E. ENABLE goes low; timer stops accumulating. Accumulated time stays the same.
F. ENABLE goes high again; timer continues accumulating time.
G. CV becomes equal to PV; Q goes high. Timer continues to accumulate time until ENABLE goes
low, RESET goes high or CV becomes equal to the maximum time.
H. ENABLE goes low; timer stops accumulating time.
Operands for On Delay Stopwatch Timer
Warning

Address Beginning address of a three-word WORD array: R, W, P, L, symbolic No
(????) Word 1: Current value (CV)
R When R is ON, it resets the Current Value (Word 1) to zero. Power flow Optional
PV The Preset Value, used when the timer is enabled or reset. All except S, SA, SB, Optional
0 ≤ PV ≤ +32,767. If PV is out of range, it has no effect on Word 2. SC
CV Current Value of the timer All except S, SA, SB, Optional
SC and constant

Example for On Delay Stopwatch Timer

A retentive on-delay timer is used to create a signal (%Q0011)
that turns on 8.0 seconds after %Q0010 turns on, and turns off
when %Q0010 turns off.

On Delay Timer
The On-Delay Timer (TMR) increments while it receives power flow and Mnemonics:
resets to zero when power flow stops. The timer passes power after the TMR_SEC
specified interval PV (Preset Value) has elapsed, as long as power is TMR_TENTHS
received. TMR_HUNDS
TMR_THOUS
The range for PV is 0 to +32,767 time units. If PV is out of range, it has no effect on the timer's word 2.
The state of this timer is retentive on power failure; no automatic initialization occurs at power-up.
Time may be counted in the following increments:
 Seconds
 Tenths (0.1) of a second
 Hundredths (0.01) of a second
 Thousandths (0.001) of a second
When TMR is invoked with its power flow input turned OFF, its Current Value (CV) is reset to zero, and
the timer does not pass power flow to the right. Each time the TMR is invoked with its power flow
input turned ON, CV is updated to reflect the elapsed time since the timer was reset. When CV
reaches PV, the timer function passes power flow to the right.
Notes:
 The best way to use a TMR function is to invoke it with a particular reference address exactly one
time each scan. Do not invoke a TMR with the same reference address more than once per scan
(inappropriate accumulation of time would result). When a TMR appears in a program block, it will
only accumulate time once per scan. Subsequent calls to that same program block within the
same scan will have no effect on its TMRs. Do not program a TMR function with the same
reference address in two different blocks. You should not program a JUMP around a timer
function. Also, if you use recursion (that is, having a block call itself either directly or indirectly),
program the program block so that it invokes the timer before it makes any recursive calls to
itself.
 A TMR timer expires (passes power flow to the right) the first scan that it is enabled if the previous
scan time was greater than PV.
 When TMR is used in a program block that is not called every scan, TMR accumulates time
between calls to the program block unless it is reset. This means that it functions like a timer
operating in a program with a much slower sweep than the timer in the main program block. For
program blocks that are inactive for a long time, TMR should be programmed to allow for this
catch-up feature. For example, if a timer in a program block is reset and the program block is not
called (is inactive) for 4 minutes, when the program block is called, four minutes of time will
already have accumulated. If the enable input is ON, these four minutes are applied to the timer
(i.e. CV is set to 4 minutes).

Timing Diagram
ENABLE goes high; timer begins accumulating time.

CV reaches PV; Q goes high and timer continues accumulating time.
ENABLE goes low; Q goes low; timer stops accumulating time and CV is cleared.
ENABLE goes high; timer starts accumulating time.
ENABLE goes low before current value reaches PV; Q remains low; timer stops accumulating time
and is cleared to zero (CV=0).
Operands for On Delay Timer
Warning

???? The beginning address of a three-word WORD array: R, W, P, L, symbolic No
Word 1: Current value (CV)
PV The Preset Value, used when the timer is enabled or reset. All except S, SA, SB, SC Yes
0 ≤ PV ≤ +32,767. If PV is out of range, it has no effect on Word 2.
CV The current value of the timer. All except S, SA, SB, SC Yes
and constant

Example for On Delay Timer

An on-delay timer with address TMRID is used to
control the length of time that a coil is on. This coil has
been assigned the variable DWELL. When the normally
open (momentary) contact DO_DWL is ON, coil DWELL
is energized.
The contact of coil DWELL keeps coil DWELL energized
(when contact DO_DWL is released) and also starts the
timer TMRID. When TMRID reaches its preset value of
five tenths of a second, coil REL energizes, interrupting
the latched-on condition of coil DWELL. The contact
DWELL interrupts power flow to TMRID, resetting its
current value and de-energizing coil REL. The circuit is
then ready for another momentary activation of
contact DO_DWL.

7.12.3 Standard Timer Function Blocks

The standard timers are a pulse timer (TP), an on-delay timer (TON), and an off-delay timer (TOF). The
pulse timer block can be used to generate output pulses of a given duration. The on-delay timer can
be used to delay setting an output ON for a fixed period after an input is set ON. The off-delay timer
can be used to delay setting an output OFF for a fixed period after an input goes OFF so that the
output is held on for a given period longer than the input.
Notes:
 Any block type can contain calls to the standard timers. (See Chapter 5 for a discussion of the
various block types.)
 Interrupt blocks can contain standard timers.
 An instance of a timer can be passed by reference to a parameterized block or UDFB.
 When the timer stops timing as a result of reaching its Preset Time (PT), the Elapsed Time (ET)
contains the actual timer duration. For example, if the Preset Time was specified as 333ms, but
the timer actually timed to 350ms, the 350ms value is saved in ET.
Data Required for Standard Timer Function Blocks
Each invocation of a timer has associated instance data that persists from one execution of the timer
to the next. Instance variables are automatically located in symbolic memory. (You cannot specify an
address.) You can specify a stored value for each element. The user logic cannot modify the values.
Each timer instance variable has the following structure. Elements of a timer structure cannot be
published.
The instance data type for each timer must be the same as the timer type:
The TOF timer requires an instance variable of type TOF.
The TON timer requires an instance variable of type TON.
The TP timer requires an instance variable of type TP.
Element Type Description Details
IN BOOL Timer input Cannot be accessed in user logic.
PT DINT Preset time Cannot be accessed in user logic.
ET DINT Elapsed time Read only. Accessible in user logic.
Q BOOL Set ON when timer finishes timing Read only. Accessible in user logic.
ENO BOOL Enable output Read only. Accessible in user logic.
TI BOOL Set ON when the timer instance is timing Read only. Accessible in user logic.
(that is, ET is incrementing).
Resetting the Timer

The preset time (PT) may be changed while the timer is timing to affect the duration.
When the timer reaches PT, the timer stops timing and the elapsed time parameter (ET) contains the
actual timer duration.
To reset the timer function block, set the PT input to 0. When the function block resets:
 ET is set to 0
 Q is set to off (0)
 The TI element is set to 0
 The IN parameter is ignored

Operands
TOF, TON and TP have the same input and output parameters, except for the instance variable, which
must be the same type as the instruction.
Note: Writing or forcing values to the instance data elements IN, PT, Q, ET, ENO or TI may cause
erratic operation of the timer function block.

???? Structure variable containing the internal data TOF, TON, or TP. Must NA No
for the timer instance. (See “Data Required for be same type as the
Standard Timer Function Blocks” on page 321.) instruction.
IN Timer input. Controls when the timer will Flow NA Yes
accumulate time.
TON and TP will begin to time when IN
transitions from OFF to ON.
TOF will begin to time when IN transitions from
ON to OFF.
PT Preset time (in milliseconds). Indicates the DINT All except S, SA, Yes
amount of time the timer will time until turning SB, SC
Q either ON or OFF, depending on the timer
type.
Setting PT to 0 resets the timer.
Q Timer output. Action depends on the timer type. Flow NA Yes
When TP is timing, Q is ON.
When TON is done timing, Q turns ON.
When TOF is done timing, Q turns OFF.
ET Elapsed time. Indicates the length of time, in DINT All except S, SA, Yes
milliseconds, that the timer has been measuring SB, SC and
time. constants

Timer Off Delay

When the input IN transitions from ON to OFF, the timer starts timing until a specified
period of time (PT) has elapsed, then sets the output Q to OFF.
Timing Diagram
IN
Q
PT PT
ET
t0 t1 t2 t3 t4 t5
t0 When input IN is set to ON, the output Q follows and remains ON. The elapsed time, ET, does not
increment.
t1 When IN goes OFF, the timer starts to measure time and ET increments. ET continues to
increment until its value equals the preset time, PT.
t2 When ET equals PT, Q is set to OFF and ET remains at the preset time, PT.
t3 When input IN is set to ON, the output Q follows and remains ON. ET is set to 0.
t4 When IN is set to OFF, ET, begins incrementing. When IN is OFF for a period shorter than that
specified by PT, Q remains ON.
t5 When IN is set to ON, ET is set to 0.
Example
In the following sample rung, a TOF function block is used to keep Light ON for 30,000ms (30 seconds)
after Door_Open is set to OFF. As long as Door_Open is ON, Light remains ON.

Timer On Delay
When the input IN transitions from OFF to ON, the timer starts timing until a specified
period of time (PT) has elapsed, then sets the output Q to ON.
Timing Diagram
IN
Q
PT PT
ET
t0 t1 t2 t3 t4
t0 When input IN is set to ON, the timer starts to measure time and the elapsed time output ET
starts to increment. The output Q remains OFF and ET continues to increment until its value
equals the preset time, PT.
t1 When ET equals PT, the output Q is goes ON, and ET remains at the preset time, PT. Q remains
ON until IN goes OFF.
t2 When IN is set to OFF, Q goes OFF and ET is set to 0.
t3 When IN is set to ON, ET starts to increment.
t4 If IN is ON for a shorter time than the delay specified in PT, the output Q remains OFF. ET is set to
0 when IN is set to OFF.
Example
In the following sample rung, a TON function block is used to delay setting Start to ON for 1 minute
(60,000ms) after Preheat is set to ON.

Timer Pulse
When the input IN transitions from OFF to ON, the timer sets the output Q to ON for
the specified time interval, PT
Timing Diagram
IN
Q
PT PT
ET
t0 t1 t2 t3 t4 t5
t0 When input IN is set to ON, the timer starts to measure time and the elapsed time output, ET,
increments until its value equals that of the specified preset time, PT. Q is set to 0 on until ET
equals PT.
t1 When ET equals PT, Q is set to OFF. The value of ET is held until IN is set to OFF.
t2 When IN is set to OFF, ET is set to 0.
t3 When IN is set to ON, the timer starts to measure time and ET begins incrementing. Q is set to
ON.
t4 If the input is OFF for a period shorter than the input PT, the output Q remains on and ET
continues incrementing.
t5 When ET equals PT, Q is set to OFF and ET is set to 0.
Example
In the following sample rung, a TP function block is used to set Sprayers to ON for a 5-second
(5000ms) pulse.


Chapter 8 Function Block Diagram (FBD)
Function Block Diagram (FBD) is an IEC 61131-3 graphical programming language that represents
the behavior of functions, function blocks and programs as a set of interconnected graphical blocks.
The block types Block, Parameterized Block, and Function Block can be programmed in FBD. The
_MAIN program block can also be programmed in FBD. For details on blocks, refer to Chapter 6,
“Program Data”. For information on using the FBD editor in the programming software, refer to the
online help.
For an overview of the types of operands that can be used with instructions, refer to “Operands for
Instructions” in Chapter 6.
Most functions and function blocks implemented in FBD are the same as their LD counterparts.
Instructions that are implemented differently are discussed in detail in this chapter. FBD has the
following general differences compared to LD:
 In FBD, except for timers and counters, functions and function blocks do not have EN or ENO
parameters.
 In FBD, all functions and function blocks display a solve order, which is calculated by the FBD
editor.
Note on Reentrancy
When a function block is created using the FBD language, the wires are created as global variables,
not as members. This has two consequences. First, if there are multiple instances of that block in the
program, the wires will show the values from the last instance executed during the sweep, not the
values for the instance being viewed. This will give the appearance of incorrect operation while
actually working properly.
The second consequence is that function blocks written in FBD are not reentrant. If you have multiple
instances of a block, and one of them can be called by an interrupt, then it is possible for the
interrupt to trigger while one instance of the block is in process, change the values of the wires, and
then return control to the original block. This will result in improper operation.
There is a work-around for both of these symptoms, which is to create the wires as member
variables rather than global variables. This must be done manually by creating member variables of
the appropriate types. You can then right-click on each wire in the FBD diagram and use the Replace
Variable command to change the wire from a global variable to a member variable.
Caution
Blocks written in the FBD language are not reentrant.
Because of this, if the block is called directly, or indirectly,
from an interrupt, the block must not be called anywhere
else in the program, except when steps are taken to
explicitly make it reentrant (see above). Doing so can lead to
unexpected operation. This applies to basic blocks,
parameterized blocks, and user-defined function blocks
written in FBD.

Chapter 8. Function Block Diagram (FBD)
The FBD implementation of the PACSystems instruction set includes the following categories:
 Advanced Math page 351
 Bit Operations 332
 Comment Block 337
 Communication
Consists of the PNIO_DEV_COMM function. For details, refer to the PACSystems RX3i PROFINET
Controller Manual, GFK-2571.
 Comparison Functions 338
 Control Functions 341
 Counters 343
 Data Move Functions 344
 Math Functions 351
 Program Flow Functions 359
 Timers 360
 Type Conversion Functions 362

8.1. Advanced Math Functions

The Advanced Math functions perform logarithmic, exponential, square root, trigonometric, and
inverse trigonometric operations.
Absolute value. Finds the absolute value of a double- precision integer (DINT), signed single-
precision integer (INT), REAL or LREAL (floating-point) value. The mnemonic specifies the
value's data type.
For details, see “
Absolute Value” in Chapter 7.
Exponential. Raises e to the value specified in IN (eIN). Calculates the inverse natural logarithm
of the IN operand.
Exponential/Logarithmic Functions” in Chapter 7.

Exponential. Calculates IN1 to the IN2 power (IN1IN2).
For details, see page 331.
Inverse trig. Calculates the inverse cosine of the IN operand and expresses the result in
radians.
For details, see “Inverse Trig – ASIN, ACOS, and ATAN” in Chapter 7.
Inverse trig. Calculates the inverse sine of the IN operand and expresses the result in radians.
Inverse trig. Calculates the inverse tangent of the IN operand and expresses the result in
radians.
Logarithmic. Calculates the natural logarithm of the operand IN.


Logarithmic. Calculates the base 10 logarithm of the operand IN.

Square root. Calculates the square root of the operand IN and stores the result in Q.
For details, see “Square Root” in Chapter 7.

Trig. Calculates the cosine of the operand IN, where IN is expressed in radians.
For details, see “Trig Functions” in Chapter 7.
Calculates the sine of the operand IN, where IN is expressed in radians.

Calculates the tangent of the operand IN, where IN is expressed in radians.


8.1.1 EXPT Function
The Power of X (EXPT) function raises the value of input IN1 to the power
specified by the value IN2 and places the result in Q. The EXPT function operates
on REAL or LREAL input value(s) and place the result in output Q. The instruction
is not carried out if one of the following invalid conditions occurs:
 IN1 < 0, for EXPT
 IN1 or IN2 is a NaN (Not a Number)
Invalid operations (error cases) may yield results that are different from those in
the LD implementation of this function.
Operands of the EXPT Function

Solve Order Calculated by the FBD editor. NA NA No
IN or IN1 For EXP, LOG, and LN, IN contains the REAL REAL, LREAL All except variables No
value to be operated on. located in %S—%SC
The EXPT function has two inputs, IN1 and IN2.
For EXPT, IN1 is the base value and IN2 is the
exponent.
IN2 (EXPT) The REAL exponent for EXPT. REAL, LREAL All except variables No
located in %S—%SC
Q Contains the REAL logarithmic/exponential REAL, LREAL All except constants No
value of IN or of IN1 and IN2. and variables
located in %S—%SC

8.2. Bit Operation Functions

The Bit Operation functions perform comparison, logical, and move operations on bit strings. Bit
Operation functions treat each WORD or DWORD data as a continuous string of bits, with bit 1 of the
WORD or DWORD being the Least Significant Bit (LSB). The last bit of the WORD or DWORD is the Most
Significant Bit (MSB).
Warning
Overlapping input and output reference address ranges in
multiword functions is not recommended, as it can produce
unexpected results.
Logical AND. Compares the bit strings IN1 and IN2 bit by bit. When the corresponding bits
are both 1, places a 1 in the corresponding location in output string Q; otherwise, places a 0
in the corresponding location in Q.
If additional inputs (IN3 through IN8) are used, each additional bit string is compared to the
string in Q and the result is placed in Q.
Logical OR. Compares the bit strings IN1 and IN2 bit by bit. When a pair of corresponding
bits are both 0, places a 0 in the corresponding location in output string Q; otherwise,
places a 1 in the corresponding location in Q.
Logical XOR. Compares the bit strings IN1 and IN2 bit by bit. When a pair of corresponding
bits are different, places a 1 in the corresponding location in the output bit string Q; when a
pair of corresponding bits are the same, places a 0 in Q.
Logical NOT. Sets the state of each bit in output bit string Q to the opposite state of the
corresponding bit in bit string IN1.
Rotate Bits Left. Rotates all the bits in a string a specified number of places to the left.
For details, see “Bit Operation Functions” in Chapter 7.

Rotate Bits Right. Rotates all the bits in a string a specified number of places to the right.
Shift Bits Left. Shifts all the bits in a word or string of words to the left by a specified number
of places.
Shift Bits Right. Shifts all the bits in a word or string of words to the right by a specified
number of places.

8.2.1 Logical AND, Logical OR, and Logical XOR

The Logical functions examine each bit in bit string IN1 and the corresponding bit in bit string IN2,
beginning with the least significant bit in each string, and places the result in Q. If additional inputs
(IN3 up to IN8) are used, the function compares each bit in the input with the corresponding bit in Q
and places the result in Q. The comparison is repeated for each input that is used. The input bit
strings specified in IN1 … IN8 may overlap.
Logical AND
If both bits examined by the Logical AND function are 1, AND
places a 1 in the corresponding location in output string Q. If
either bit is 0 or both bits are 0, AND places a 0 in string Q in
that location.
Tip: You can use the Logical AND function to build masks
or screens, where only certain bits are passed (the
bits opposite a 1 in the mask), and all other bits are
set to 0.
Minimum number of inputs = 2
Maximum number of inputs = 8
Logical OR
If either bit examined by the Logical OR function is 1, OR
places a 1 in the corresponding location in output string Q. If
both bits are 0, Logical OR places a 0 in string Q in that
location.
Minimum number Tips:
of inputs = 2  You can use the Logical OR function to combine strings
or to control many outputs with one simple logical
structure. The Logical OR function is the equivalent of
two relay contacts in parallel multiplied by the number of
bits in the string.
 You can use the Logical OR function to drive indicator
lamps directly from input states or to superimpose
blinking conditions on status lights.
Maximum number
of inputs = 8

Logical XOR
If the bits in the strings examined by XOR are different, a 1 is
placed in the corresponding position in the output bit string.
For each pair of bits examined, if only one bit is 1, XOR places
a 1 in the corresponding location in string Q.
Minimum number If both bits are 0, XOR places a 0 in the corresponding
of inputs = 2 location in string Q.
Tips:
 If string IN2 and output string Q begin at the same
reference, a 1 placed in string IN1 will cause the
corresponding bit in string IN2 to alternate between 0
and 1, changing state with each scan as long as input is
received.
 You can program longer cycles by pulsing the input to
the function at twice the desired rate of flashing. The
Maximum number
input pulse should be one scan long (oneshot type coil
of inputs = 8
or self resetting timer).
 You can use XOR to quickly compare two bit strings, or to
blink a group of bits at the rate of one ON state per two
scans.
 XOR is useful for transparency masks.
Operands for AND, OR, and XOR

IN1 The value to operate on. BOOL, WORD All No
DWORD
IN2 (Must be the same data The value to operate on. BOOL, WORD All No
type as IN1.) DWORD
IN3 … IN8 (Must be the same Values to operate on. BOOL, WORD All Yes
data type as IN1.) DWORD
Q (Must be the same data type The operation’s result. BOOL, WORD All except constants No
as IN1 and IN2.) DWORD and variables located
in %S memory
Properties for AND, OR, and XOR

Property Valid Range
Number of Inputs 2 to 8

8.2.2 Logical NOT

The Logical Not or Logical Invert (NOT) function sets the state of each bit in the
output bit string Q to the opposite of the state of the corresponding bit in bit string
IN1.
All bits are altered on each scan that input is received, making output string Q the
logical complement of input string IN1.
Operands
IN1 The input string to NOT. WORD All No
DWORD
Q (Must be the same The NOT's result. WORD All except constants No
data type as IN1) DWORD and variables located
in %S memory

8.3. Comments
8.3.1 Text Block
The Text block is used to place an explanation in the program. When

you type in a comment, the first few words are displayed.
To increase the size of the text box and display more text, select the
box and drag one of the handles.
There are no operands for the Text block.

 Editing a comment makes the Programmer lose equality.
 Comment text is downloaded to the controller and retrieved upon Logic Upload.

8.4. Comparison Functions

Comparison functions compare two values of the same data type or determine whether a number
lies within a specified range. The original values are unaffected.
Compare. Compares two numbers, IN1 and IN2.
For details, see “Relational Functions” in Chapter 7.
Equal. Tests two numbers for equality.

Greater Than or Equal. Tests whether one number is greater than or equal to another.
Greater Than. Tests whether one number is greater than another.

Less Than or Equal. Tests whether one number is less than or equal to another.
Less Than. Tests whether one number is less than another.


Not Equal. Tests whether two numbers are not equal.
Range. Tests whether one number is within the range defined by two other supplied
numbers.
For details, see “Relational Functions” in Chapter 7.

8.4.1 Equal, Not Equal, Greater or Equal, Greater Than, Less or Equal,
Less Than
The relational functions compare input IN1 to input IN2. These operands must be the same data type.
If inputs IN1 and IN2 are equal, the function outputs the result to Q, unless IN1 and/or IN2 is NaN (Not
a Number). The following relational functions can be used to compare two numbers:
Function Definition Relational Statement
EQ Equal IN1=IN2
NE Not Equal IN1≠IN2
GE Greater Than or Equal IN1≥IN2
GT Greater Than IN1>IN2
LE Less Than or Equal IN1≤IN2
LT Less Than IN1<IN2
the same.
Operands
IN1 The first value to be compared; No
the value on the left side of the
relational statement. BOOL (for EQ and NE functions
IN2 The second value to be compared; only), BYTE, DINT, DWORD, INT, All except S, SA, SB, SC No
the value on the right side of the REAL, LREAL, UINT, WORD
relational statement. IN2 must be
the same data type as IN1.
BOOL I, Q, G, M, T, SA, SB, SC
If the relational statement is true,
Q Bit reference in a non-BOOL All except constants. No
Q=1.
variable.

8.5. Control Functions

The control functions limit program execution and change the way the CPU executes the application
program.
Do I/O Interrupt. For one scan, immediately services a specified range of inputs
or outputs. (All inputs or outputs on a module are serviced if any reference
locations on that module are included in the DO I/O function. Partial I/O module
updates are not performed.) Optionally, a copy of the scanned I/O can be placed
in internal memory, rather than at the real input points.
For details, see “Control Functions” in Chapter 7.
Mask I/O Interrupt. Mask or unmask an interrupt from an I/O board when using
I/O variables. If not using I/O variables, use SVC_REQ 17: Mask/Unmask I/O
Interrupt, described in Chapter 9.
Proportional Integral Derivative (PID) Control.

Provides two PID closed-loop control algorithms:
Standard ISA PID algorithm (PID_ISA)
Independent term algorithm (PID_IND)
Service Request. Requests a special control system service.


Scan Set I/O. Scans the IO of a specified scan set.
Suspend I/O. Suspends for one sweep all normal I/O updates, except those
specified by DO I/O instructions.
Suspend I/O Interrupt. Suspend or resume an I/O interrupt when using I/O
variables. If not using I/O variables, use SVC_REQ 32: Suspend/Resume I/O
Interrupt, described in Chapter 9.
Falling Edge Trigger. Detects a high-to-low transition of a Boolean input.

Produces a single output pulse when a falling edge is detected.
Rising Edge Trigger. Detects a low-to-high transition of a Boolean input.

Produces a single output pulse when a rising edge is detected.

8.6. Counters
Down Counter. Counts down from a preset value. The output is ON whenever
the Current Value is ≤ 0.
The parameter that appears above the function block is a one-dimensional,
three-word array in %R, %W, %P, %L, or symbolic memory that the counter
uses to store its current value, preset value and control word.
For details, see “Counters” in Chapter 7.
Up Counter. Counts up to a designated value. The output is ON whenever the

Current Value is ≥ the Preset Value.
The parameter that appears above the function block is a one-dimensional,
three-word array in %R, %W, %P, %L, or symbolic memory that the counter
uses to store its current value, preset value and control word.
For details, see “Counters” in Chapter 7.

8.7. Data Move Functions

The Data Move functions provide basic data move capabilities.
Array Size. Counts the number of elements in an array.
For details, see “Data Move Functions” in Chapter 7.
Array Size Dim1. Returns the value of the Array Dimension 1

property of an array.
Array Size Dim2. Returns the value of the Array Dimension 2

property of an array.
Bus Read. Reads data from the bus.


Bus Read Modify Write. Uses a read/modify/write cycle to update
a data element in a module on the bus.
Other BUS_RMW functions:
BUS_RMW_DWORD
BUS_RMW_WORD
Bus Test and Set. Handles semaphores on the bus.

Other BUS_TS function:
BUS_TS_WORD
Bus Write. Writes data to a module on the bus.


Communication Request. Allows the program to communicate
with an intelligent module, such as a Genius Bus Controller or a
High Speed Counter.
For details, see “Communication Request” in Chapter 7.
Fan Out. Copies the input value

to multiple outputs of the same
data type as the input.
Minimum Outputs = 2
Maximum Outputs = 8
Move Data. Copies data as individual bits, so the new location
does not have to be the same data type. Data can be moved into
a different data type without prior conversion.
Move Data Explicit. Provides data coherency by locking symbolic

memory being written to during the copy operation.
Note: FBD and ST do not support the constant 0 as a value for
the input IN.

Move From Flat. Copies reference memory data to a UDT variable
or UDT array. Provides the option of locking the symbolic or I/O
variable memory area being written to during the copy operation.
Move to Flat. Copies data from symbolic or I/O variable memory to

reference memory. Copies across mismatching data types.
Size Of. Counts the number of bits used by a variable.


8.10.1 Fan Out

Copies the input IN to multiple outputs.
Operands
IN The input to copy to the BOOL, DINT, DWORD, INT, REAL, All except SA, SB, SC. No
outputs. UINT, or WORD variable or
constant
OUT1 Variables of the same data Must be same type as IN. All except S, SA, SB, No
…OUT8 type as the IN operand. The SC and constant.
outputs. Minimum: two
outputs. Maximum: eight
outputs.

8.10.2 Move Data

When the input operand, EN, is set to ON, the MOVE instruction copies data as bits
from one location in PACSystems controller memory to another. Because the data
is copied as bits, the new location does not need to use the same type of memory
area as the source. For example, you can copy data from an analog memory area
into a discrete memory area, or vice versa.
MOV sets its output, ENO, whenever it receives data unless one of the following occurs:
 When the input, EN, is set to OFF, then the output, ENO, is set to OFF.
 When the input, EN is set to ON, and the input, IN, contains an indirect reference, and the
memory of IN is out of range, then the output, ENO, is set to OFF.
The value to store at the destination Q is acquired from the IN parameter. If IN is a variable, the value
to store in Q is the value stored at the IN address. If IN is a constant, the value to store in Q is that
constant
The result of the MOVE depends on whether the data type for the Q operand is a bit reference or a
non-bit reference:
 If Q is a non-bit reference, LEN (the length) indicates the number of memory locations in which
the IN value should be repeated, starting at the location specified by Q.
 If Q is a bit reference, IN is treated as an array of bits. LEN therefore indicates the number of bits
to acquire from the IN parameter to make up the stored value. If IN is a constant, bits are
counted from the least-significant bit. If IN is a variable, LEN indicates the number of bits to
acquire starting at the IN location. Regardless, only LEN bits are stored starting at address Q.
For example, if IN was the constant value 29 and LEN is 4, the results of a MOV operation are as
follows:
 Q is a WORD reference: The value 29 is repeatedly stored in locations Q, Q+1, Q+2, and Q+3.
 Q is a BOOL reference: The binary representation of 29 is 11101. Since LEN is 4, only the four
least-significant bits are used (1101). This value is stored at location Q in the same order, so 1 is
stored in Q, 1 is stored in Q+1, 0 is stored in Q+2, and 1 is stored in Q+3.
If data is moved from one location in discrete memory to another, such as from %I memory to %T
memory, the transition information associated with the discrete memory elements is updated to
indicate whether or not the MOVE operation caused any discrete memory elements to change state.
Note: If an array of BOOL-type data specified in the Q operand does not include all the bits in a
byte, the transition bits associated with that byte (which are not in the array) are cleared
when the Move instruction receives data.
Data at the IN operand does not change unless there is an overlap in the source and destination—a
situation that is to be avoided.

MOV Operands
EN Enable BOOL variable data flow, I, Q, M, T, G, No
S, SA, SB, SC, discrete
Bit reference in R, P, L, AI, AQ, W, non-
a non-BOOL discrete symbolic, I/O
variable variable
IN The source of the data to copy into the output Q. DINT, DWORD, All. S, SA, SB, SC No
This can be either a constant or a variable INT, REAL, allowed only for
whose reference address is the location of the LREAL, UINT, WORD, DWORD,
first source data item to move. WORD, or bit BOOL types.
IN must have the same data type as the variable reference in a
in the Q parameter. non-BOOL
variable
If IN is a BOOL variable or a bit reference, an %I,
%Q, %M, or %T reference address need not be
byte-aligned, but 16 bits beginning with the
reference address specified are displayed
online.
LEN The length of IN; the number of bits to move. Constant Constant No
If IN is a constant and Q is BOOL:
1 ≤ LEN ≤ 16;
If IN is a constant and Q is not BOOL:
1 ≤ LEN ≤ 256.
All other cases: 1 ≤ LEN ≤ 32,767
LEN is also interpreted differently depending on
the data type of the Q location. For details, see
discussion on page 349.
ENO Indicates whether the operation was BOOL variable data flow, I, Q, M, T, G, Yes
successfully completed. discrete symbolic, I/O
If ENO = ON (1), the operation was initiated. variable
Results of the operation are indicated in the FT Bit reference in I, Q, M, T, G, R, P, L, AI,
output. a non-BOOL AQ, W, non-discrete
If ENO = OFF (0), the operation was not variable symbolic, I/O variable
performed. If EN was ON, the FT output indicates
an error condition. If EN was OFF, FT is not
changed.
Q The location of the first destination data item. Q DINT, DWORD, data flow, I, Q, M, T, S, No
must have the same data type as the variable in INT, REAL, SA, SB, SC, G, R, P, L,
the IN parameter. LREAL, UINT, AI, AQ, W, symbolic,
If Q is a BOOL variable or a bit reference, an %I, WORD, or bit I/O variable
%Q, %M, or %T reference address does not reference in a
need to be byte-aligned, but 16 bits beginning non-BOOL
with the specified reference address are variable
displayed online.

8.8. Math Functions

Your program may need to include logic to convert data to a different type before using a Math or
Numerical function. The description of each function includes information about appropriate data
types. The Type Conversion Functions section on page 362 explains how to convert data to a
different type.
Addition. Adds two or up to eight numbers.
Division. 18 Divides one number by another and outputs the quotient.

Note: Take care to avoid overflow conditions when performing divisions.
Modulo Division. Divides one number by another and outputs the remainder.
Multiplication.18 Multiplies two or up to eight numbers.

Note: Take care to avoid overflow conditions when performing multiplications.
Negate. Multiplies a number by –1 and places the result in an output location.

18 To avoid overflows when multiplying or dividing 16-bit numbers, use the Type Conversion
Functions described on page 336 to convert the numbers to a 32-bit format.

Scales an input parameter and places the result in an output location.
For details, see “Math Functions” in Chapter 7.
Subtraction. Subtracts one or up to seven numbers from the input IN1 and places
the result in an output location.
The output is calculated when the instruction is performed without overflow, unless an invalid
operation occurs.
Overflow
If an operation on integer operands results in overflow, the output value wraps around.
Examples:
 If the ADD operation, 32767 + 1, is performed on signed integer operands, the result is -32768
 If the SUB operation, -32767 – 1, is performed on signed integer operands, the result is 32767
 If an ADD_UINT operation is performed on 65535 + 16, the result is 15.

8.11.1 Add
Adds the operands IN1 and IN2 … IN8 and stores the sum in Q.
IN1 … IN8 and Q must be of the same data type.
The result is output to Q when ADD is performed without
overflow, unless one of the following invalid conditions occurs:
 (+ ∞)
 IN1 and/or IN2 … IN8 is NaN (Not a Number).
If an ADD operation results in overflow, the result wraps
around. For example:
 If an ADD_DINT, ADD_INT or ADD_REAL operation is
performed on 32767 + 1, Q will be set to -32768.
 If an ADD_UINT operation is performed on 65535 + 16, Q
will be set to 15.
Minimum number of Maximum number

inputs = 2 of inputs = 8.
Operands of the ADD Function

Operand Description Allowed Types Allowed Operands Optional
Solve Calculated by the FBD NA NA No
Order editor.
IN1 … IN8 The values to be added. INT, DINT, REAL, LREAL, UINT All except S, SA, SB, No
Must be same data type as Q. SC and data flow
Q The sum of IN1 … IN8. If an INT, DINT, REAL, LREAL, UINT variable All except S, SA, SB, No
overflow occurs, Q wraps Must be same data type as IN1 …. IN8. SC, constant and
around. data flow
Properties for ADD


8.11.2 Divide
Divides the operand IN1 by the operand IN2 of the same data type as IN1 and stores
the quotient in the output variable assigned to Q, also of the same data type as IN1
and IN2.
The result is output to Q when DIV is performed without overflow, unless one of the
following invalid conditions occurs:
 0 divided by 0 (Results in an application fault.)
 IN1 and/or IN2 is NaN (Not a Number).
If an overflow occurs, the result wraps around.
Notes:
 DIV rounds down; it does not round to the closest integer. For example, 24 DIV 5 = 4.
 Be careful to avoid overflows.
Operands for DIV_UINT, DIV_INT, DIV_DINT, and DIV_REAL
IN1 The value to be divided; the value to the left of INT, DINT, UINT, All except S, SA, SB, No
“DIV” in the equation IN1 DIV IN2=Q. REAL, LREAL SC
IN2 The value to divide IN1 with; the value to the INT, DINT, UINT, All except S, SA, SB, No
right of “DIV” in the equation IN1 DIV IN2=Q. REAL, LREAL SC
Q The quotient of IN1/IN2. If an overflow occurs, INT, DINT, UINT, All except S, SA, SB, No
the result is the largest value with the proper REAL or LREAL SC and constant
sign. variable

8.11.3 Modulus
Divides input IN1 by input IN2 and outputs the remainder of the division to Q.
All three operands must be of the same data type. The sign of the result is always
the same as the sign of input parameter IN1. Output Q is calculated using the
formula:
Q = IN1-((IN1 DIV IN2) * IN2)
where DIV produces an integer number.
The result is output to Q unless one of the following invalid conditions occurs:
 0 divided by 0 (Results in an application fault.)
 IN1 and/or IN2 is NaN (Not a Number)
Operands for Modulus Function

IN1 The value to be divided to obtain the INT, DINT, UINT All except S, SA, SB, SC No
remainder; the value to the left of “MOD” in
the equation IN1 MOD IN2=Q.
IN2 The value to divide IN1 with; the value to the INT, DINT, UINT All except S, SA, SB, SC No
right of “MOD” in the equation IN1 MOD
IN2=Q.
Q The remainder of IN1/IN2. INT, DINT, UINT All except S, SA, SB, SC No
variable and constant

8.11.4 Multiply
Multiplies two through eight operands (IN1 … IN8) of the
same data type and stores the result in the output variable
assigned to Q, also of the same data type.
The output is calculated when the function is performed
without overflow, unless an invalid operation occurs.
If an overflow occurs, the result wraps around.
Minimum number of Maximum number of

inputs = 2 inputs = 8.

INT Q(16 bit) = IN1(16 bit) * IN2(16 bit) base 10 number with sign, up to 5 digits long
DINT Q(32 bit) = IN1(32 bit) * IN2(32 bit) base 10 number with sign, up to 10 digits long
REAL Q(32 bit) = IN1(32 bit) * IN2(32 bit) base 10 number, sign and decimals, up to 8 digits long
UINT Q(16 bit) = IN1(16 bit) * IN2(16 bit) base 10 number, unsigned, up to 5 digits long
Operands for Multiply

IN1 … IN8 The values to multiply. Must be the INT, DINT, UINT, REAL All except S, SA, SB, SC No
same data type as Q.
Q The result of the multiplication. INT, DINT, UINT, REAL All except S, SA, SB, SC No
variable and constant
Properties for Multiply


8.11.5 Negate
Multiplies a number by –1 and places the result in the output location, Q.
Operands
IN The value to be negated. INT, DINT, REAL All except S, SA, SB, SC No
Q The result, -1(IN) INT, DINT, REAL variable All except S, SA, SB, SC No
and constant

8.11.6 Subtract
Subtracts the operands IN2 …IN8 from the operand IN1
and stores the result in the output variable assigned to
Q.
The calculation is carried out when SUB is performed
without overflow, unless an invalid operation occurs.
If a SUB operation results in overflow, the result wraps
around. For example:
 If a SUB_DINT, SUB_INT or SUB_REAL operation is
performed on 32768 - 1, Q will be set to -32767.
If a SUB_UINT operation results in a negative number,
Q wraps around. (For example, a result of –1 sets Q to
65535.)
Minimum number of Maximum number of

inputs = 2 inputs = 8.

SUB_INT Q(16 bit) = IN1(16 bit) – IN2(16 bit) base 10 number with sign, up to 5 digits long
SUB_DINT Q(32 bit) = IN1(32 bit) – IN2(32 bit) base 10 number with sign, up to 10 digits long
SUB_REAL Q(32 bit) = IN1(32 bit) – IN2(32 bit) base 10 number, sign and decimals, up to 8 digits long
SUB_UINT Q(16 bit) = IN1(16 bit) – IN2(16 bit) base 10 number, unsigned, up to 5 digits long
Operands for Subtract

IN1 The value to subtract from. DINT, INT, REAL, All except S, SA, SB, SC No
UINT
IN2 … IN8 The value(s) to subtract from IN1. Must be the All except S, SA, SB, SC No
same data type as IN1.
Q The result of the subtraction. Must be the DINT, INT, REAL, All except S, SA, SB, SC No
same data type as IN1. UINT variable and constant
Properties for Subtract


8.9. Program Flow Functions

The program flow functions limit program execution or change the way the CPU executes the
The CALL function causes the logic execution to go
immediately to the designated program block, external
C block (parameterized or not), or parameterized block
and execute it. After the block’s execution is complete,
control returns to the point in the logic immediately
following the CALL instruction.
For details, see “Program Flow Functions” in Chapter 7.
Non-parameterized Parameterized CALL.

CALL May call a
parameterized
external block or a
parameterized block.
The ARG_PRES (Argument Present) function determines
whether a parameter value was present when the
function block instance of the parameter was invoked.
For details, see “Program Flow Functions” in Chapter 7.

8.10. Timers
This section describes the PACSystems timing functions that are implemented in the FBD language.
8.13.1 Built-in Timer Function Blocks
These function blocks use WORD Array instance data. The parameter that appears above the
function block is a one-dimensional, three-word array in %R, %W, %P, %L, or symbolic memory that
the timer uses to store its current value, preset value and control word.
Off Delay Timer. The timer's Current Value (CV) resets to zero when its enable
parameter (EN) is set to ON.. CV increments while EN is OFF. When CV=PV
(Preset Value), ENO is set to OFF until EN is set to ON again.
Other OFDT functions:
OFDT_SEC
OFDT_TENTHS
OFDT_THOUS
For details, see “Timers” in Chapter 7.
On Delay Stopwatch Timer. Retentive on delay timer. Increments while EN is
ON and holds its value when EN is OFF.
ONDTR_SEC
ONDTR_TENTHS
ONDTR_THOUS
On Delay Timer. Simple on delay timer. Increments while EN is ON and resets

to zero when EN is OFF.
TMR_SEC
TMR_TENTHS
TMR_THOUS

8.13.2 Standard Timer Function Blocks

These functions blocks use Structure Variable instance data. Each invocation of a timer has
associated instance data that persists from one execution of the timer to the next. Instance variables
are automatically located in symbolic memory. (You cannot specify an address.) You can specify a
stored value for each element. The user logic cannot modify the values.
Timer Off Delay. When the input IN transitions from ON to OFF, the timer
starts timing until a specified period of time has elapsed, then sets the
output Q to OFF.
Timer On Delay. When the input IN transitions from OFF to ON, the timer
starts timing until a specified period of time has elapsed, then sets the
output Q to ON.
Timer Pulse. When the input IN transitions from OFF to ON, the timer sets
the output Q to ON for a specified time interval.

8.11. Type Conversion Functions

The Conversion functions change a data item from one number format (data type) to another. Many
programming instructions, such as math functions, must be used with data of one type. As a result,
data conversion is often required before using those instructions.
Convert Angles
DEG_TO_RAD: Converts degrees to radians.
RAD_TO_DEG: Converts radians to degrees.
For details, see “Conversion Functions” in Chapter 7.

UINT_TO_BDC4: Converts UINT (16-bit unsigned integer) to BCD4.
INT_TO_BCD4: Converts INT (16-bit signed integer) to BCD4.
Convert to BCD8 (8-digit Binary-Coded-Decimal )

DINT_TO_BD8: Converts DINT (32-bit signed integer) to BCD8.
Convert to INT (16-bit signed integer)

BCD4_TO_INT: Converts BCD to INT.
UINT_TO_INT: Converts UINT to INT
DINT_TO_INT: Converts DINT to INT..
REAL_TO_INT: Converts REAL to INT.
Converts a 16-bit string (WORD) value to INT.
Convert to UINT (16-bit unsigned integer)

BCD4_TO_UINT: Converts BCD4 to UINT.
INT_TO_UINT: Converts INT to UINT.
DINT_TO_UINT: Converts DINT to UINT.
REAL_TO_UINT: Converts REAL to UINT.
WORD_TO_UINT: Converts a 16-bit string (WORD) value to UINT.
Convert to DINT (32-bit signed integer)

BCD8_TO_DINT: Converts BCD8 to DINT.
UINT_TO_DINT: Converts UINT to DINT.

INT_TO_DINT: Converts INT to DINT.
REAL_TO_DINT: Converts REAL (32-bit signed real or floating-point values) to
DINT.
DWORD_TO_DINT: Converts a 32-bit bit string (DWORD) value to DINT.
Convert to REAL (32-bit signed real or floating-point values)

BCD4_TO_REAL: Converts BCD4 to REAL.
BCD8_TO_REAL: Converts BCD8 to REAL.
UINT_TO_REAL: Converts UINT to REAL.
INT_TO_REAL: Converts INT to REAL.
DINT_TO_REAL: Converts DINT to REAL.
LREAL_TO_REAL: Converts LREAL to REAL.
Convert to LREAL(64-bit signed real or floating-point values)
Converts a REAL value to LREAL.
Convert to WORD (16-bit string)

Converts an INT (16-bit signed integer) value to a WORD value.
Converts an unsigned single-precision integer (UINT) to WORD.

Convert to DWORD (32-bit bit string)

Converts a double-precision signed integer (DINT) value to DWORD.
For details, see page 366
Truncate
Rounds a REAL (32-bit signed real or floating-point) number down to a DINT
number
Rounds a REAL (32-bit signed real or floating-point) number down to an INT

number

8.14.1 Convert WORD to INT
Converts the input data into the equivalent single-precision signed integer
(INT) value, which it outputs to Q. This function does not change the original
input data. The output data can be used directly as input for another
program function, as in the examples.
The function passes data to Q, unless the data is out of range (0 through
+65,535).
Operands
IN The value to convert to INT. WORD All except S, SA, SB, and SC No
Q The INT equivalent value of the original INT All except S, SA, SB, SC and No
value in IN. constant
8.14.2 Convert WORD to UINT
These functions convert the input data into the equivalent single-precision
unsigned integer (UINT) value, which it outputs to Q.
The conversion to UINT does not change the original data. The output data can
be used directly as input for another program function, as in the example.
The function passes the converted data to Q, unless the resulting data is
outside the range 0 to +65,535.
Operands
IN The value to convert to UINT. WORD All except S, SA, SB, and SC No
Q The UINT equivalent value of the original UINT All except S, SA, SB, SC and No
input value in IN. constant

8.14.3 Convert DWORD to DINT
Converts DWORD data into the equivalent signed double-precision integer

(DINT) value and stores the result in Q. The conversion to DINT does not
change the original data.
The function passes data to Q unless the data is out of range.
Operands
IN The value to convert to DINT. DWORD All except S, SA, SB, and No
SC
Q The DINT equivalent value of the UINT All except S, SA, SB, SC No
original input value in IN. and constant
8.14.4 Convert INT or UINT to WORD
Converts an unsigned single-precision integer (UINT) operand IN to a 16-bit

bit string (WORD) value and stores the result in the variable assigned to Q.
Converts a 16-bit signed integer (INT) operand IN to a 16-bit bit string (WORD)
value and stores the result in the variable assigned to Q.
data to Q unless the data is out of range.
Operands
IN The value to convert to WORD. INT or UINT, depending All except S, SA, SB, and No
on function SC
Q The WORD equivalent value of the WORD All except S, SA, SB, SC No
original value in IN. 0 ≤ Q ≤ 65,535. and constant

8.14.5 Convert DINT to DWORD
When DINT_TO_DWORD receives data, it converts the input double-

precision signed integer (DINT) data into the equivalent DWORD (32-bit bit
string) value, which it outputs to Q. DINT_TO_DWORD does not change the
original DINT data.
The function passes data to Q unless the data is out of range.
Operands
IN The value to convert to DWORD. DINT All except S, SA, SB, and SC No
Q The DWORD equivalent value of the DWORD All except S, SA, SB, SC and No
original value in IN. 0 ≤ Q ≤ 4,294,967,295. constant

Chapter 9 Service Request Function
Use a Service Request function to request one of the following control system services:
Service Request Description Page
SVC_REQ 1 Change/read constant sweep timer 370
SVC_REQ 2 Read window modes and time values 372
SVC_REQ 3 Change controller communications window mode and timer value 373
SVC_REQ 4 Change backplane communications window mode and timer value 374
SVC_REQ 5 Change background task window mode and timer value 375
SVC_REQ 6 Change/read number of words to checksum 376
SVC_REQ 7 Read or change the time-of-day clock 378
SVC_REQ 8 Reset watchdog timer 385
SVC_REQ 9 Read sweep time from beginning of sweep - milliseconds 386
SVC_REQ 10 Read target name 387
SVC_REQ 11 Read controller ID 388
SVC_REQ 12 Read controller run state 389
SVC_REQ 13 Shut down (stop) controller 390
SVC_REQ 14 Clear controller or I/O Fault Tables 391
SVC_REQ 15 Read last-logged fault table entry 392
SVC_REQ 16 Read elapsed time clock - microseconds 395
SVC_REQ 17 Mask/unmask I/O interrupt 397
SVC_REQ 18 Read I/O Force status 399
SVC_REQ 19 Set run enable/disable 400
SVC_REQ 20 Read fault tables 401
SVC_REQ 21 User-defined fault logging 406
SVC_REQ 22 Mask/unmask timed interrupts 408
SVC_REQ 23 Read master checksum 409
SVC_REQ 24 Reset module 410
SVC_REQ 25 Disable/enable EXE Block and standalone C program checksums 411
SVC_REQ 26 Role switch (redundancy) 19
SVC_REQ 27 Write to reverse transfer area (Hot Standby Redundancy) 19
SVC_REQ 28 Read from reverse transfer area (Hot Standby Redundancy) 19
SVC_REQ 29 Read elapsed power down time 412

SVC_REQ 32 Suspend/resume I/O interrupt 413
SVC_REQ 43 Disable data transfer copy in backup unit (Hot Standby Redundancy) 19
SVC_REQ 45 Skip next I/O scan 414

SVC_REQ 50 Read elapsed time clock – nanoseconds 415
SVC_REQ 51 Read sweep time from beginning of sweep - nanoseconds 417
SVC_REQ 55 Set application redundancy mode (non-Hot Standby Redundancy) 19
SVC_REQ 56 Read from nonvolatile storage 418

SVC_REQ 57 Write to nonvolatile storage 422
19 For information on Service Requests used in CPU HSB redundancy applications, refer to the PACSystems Hot Standby CPU
Redundancy User’s Guide, GFK-2308. For non-HSB applications, refer to TCP/IP Ethernet Communications for PACSystems,
GFK-2224.

Chapter 9. Service Request Function
9.1. Operation of SVC_REQ Function

PACSystems supports the Service Request function in LD and FBD.
9.1.1 Ladder Diagram
When SVC_REQ receives power flow, it requests the CPU to perform the special service
identified by the FNC operand.
Parameters for SVC_REQ are located in the parameter block, which begins at the
reference identified by the PRM operand. The number of 16-bit references required
depends on the type of special controller service being requested. The parameter block is
used to store both the function's inputs and outputs.
SVC_REQ passes power flow unless an incorrect function number, incorrect parameters, or out-of-
range references are specified. Specific SVC_REQ functions may have additional causes for failure.
Because the service request continues to be invoked each time power flow is enabled to the function,
additional enable/disable logic preceding the request may be necessary, depending upon the
application. (For example, repeated calling of SVC_REQ 24 would continually reset a module,
probably not the intended behavior.) In many cases a transition contact or coil will be sufficient.
Alternatively, you could use more complex logic, such as having the function contained within a block
that is only called a single time.
Operands
Note: Indirect referencing is available for all register references (%R, %P, %L, %W, %AI, and %AQ).
Operand Data Type Memory Area Description
FNC INT variable or All except %S - %SC Function number; Service Request number. The
constant constant or reference that identifies the requested
service.
PRM WORD variable All except flow, %S - %SC The first WORD in the parameter block for the
and constant requested service. Successive 16-bit locations
store additional parameters.
Example
When the enabling input %I0001 is ON, SVC_REQ function
number 7 is called, with the parameter block starting at %R0001.
If the operation succeeds, output coil %Q0001 is set ON.

9.1.2 Function Block Diagram

The SVC_REQ function requests the CPU to perform the special service identified
by the FNC operand.
Parameters for SVC_REQ are located in the parameter block, which begins at
the reference identified by the PRM operand. The number of 16-bit references
required depends on the type of special controller service being requested. The
parameter block is used to store both the function's inputs and outputs.
Operands
Note: Indirect referencing is available for all register references (%R, %P, %L, %W, %AI, and %AQ).
EN Enable input. When set to ON, the SVC_REQ BOOL data flow, I, Q, M, T, G, S, SA, No
executes SB, SC, discrete symbolic, I/O
variable
Bit reference in I, Q, M, T, G, R, P, L, AI, AQ, W,
a non-BOOL non-discrete symbolic, I/O
variable variable
FNC Function number; Service Request number. INT, DINT, UINT, All except %S - %SC No
The constant or variable that identifies the WORD, DWORD You can use data flow only if
requested service. the parameter block
requires only one WORD
If you use a symbolic
variable or an I/O variable,
ensure that its Array
Dimension 1 property is set
to a value large enough to
contain the entire
parameter block.
PRM The first word in the parameter block for INT, DINT, UINT, All except flow, %S - %SC No
the requested service. Successive 16-bit WORD, DWORD and constant
locations store additional parameters.
ENO Set to ON unless an incorrect function BOOL data flow, I, Q, M, T, G, non- Yes
number, incorrect parameters, or out-of- discrete symbolic, I/O
range references are specified. Specific variable
SVC_REQ functions may have additional
Bit reference in I, Q, M, T, G, R, P, L, AI, AQ, W,
causes for failure.
a non-BOOL non-discrete symbolic, I/O
variable. variable

9.2. SVC_REQ 1: Change/Read Constant Sweep Timer

Use SVC_REQ function 1 to:
 Disable Constant Sweep mode
 Enable Constant Sweep mode and use the old Constant Sweep timer value
 Enable Constant Sweep mode and use a new Constant Sweep timer value
 Set a new Constant Sweep timer value only
 Read Constant Sweep mode state and timer value.
The parameter block has a length of two words used for both input and output.
SVC_REQ executes successfully unless:
 A number other than 0, 1, 2, or 3 is entered as the requested operation:
 The scan time value is greater than 2550ms (2.55 seconds)
 Constant sweep time is enabled with no timer value programmed or with an old value of 0 for the
timer.
To disable Constant Sweep mode:
Enter SVC_REQ 1 with this parameter block:
Address 0
Address + 1 Ignored
To enable Constant Sweep mode and use the old timer value:
Address 1
Address + 1 0
If the timer value does not already exist, entering 0 causes the function to set the OK output to OFF.
To enable Constant Sweep mode and use a new timer value:
Address 1
Address + 1 New timer value
Note: If the timer value does not already exist, entering 0 causes the function to set the OK
output to OFF.
To change the timer value without changing the selection for sweep mode state:
Address 2
Address + 1 New timer value

To read the current timer state and value without changing either:
Address 3
Address + 1 ignored
Output
SVC_REQ 1 returns the timer state and value in the same parameter block references:
Address 0 = Normal Sweep
1 = Constant Sweep
Address + 1 Current timer value
If the word address + 1 contains the hexadecimal value FFFF, no timer value has been programmed.
Example
If contact OV_SWP is set, the Constant Sweep Timer is read, the timer is increased by two
milliseconds, and the new timer value is sent back to the CPU. The parameter block is at location
%R3050. The example logic uses discrete internal coil %M0001 as a temporary location to hold the
successful result of the first rung line. On any sweep in which OV_SWP is not set, %M00001 is turned
off.

9.3. SVC_REQ 2: Read Window Modes and Time Values

Use SVC_REQ 2 to obtain the current window mode and time values for the controller
communications window and the backplane communications and the background task window.
The parameter block has a length of three words. All parameters are output parameters. It is not
necessary to enter values in the parameter block to program this function.
Output
Address Window High Byte Low Byte
Address Controller Communications Window Mode Value in ms
Address + 1 Backplane Communications Window Mode Value in ms
Address + 2 Background Window Mode Value in ms
Note: A window is disabled when the time value is zero.

Mode Values
Mode Name Value Description
Limited Mode 0 The execution time of the window is limited to its respective default value or
to a value defined using SVC_REQ 3 for the controller communications
window or SVC_REQ 4 for the systems communications window. The
window will terminate when it has no more tasks to complete.
Constant Mode 1 Each window will operate in a Run to Completion mode, and the CPU will
alternate among the three windows for a time equal to the sum of each
window's respective time value. If one window is placed in Constant mode,
the remaining two windows are automatically placed in Constant mode. If
the CPU is operating in Constant Window mode and a particular window's
execution time is not defined using the associated SVC_REQ function, the
default time for that window is used in the constant window time
calculation.
Run to Completion Mode 2 Regardless of the window time associated with a particular window,
whether default or defined using a service request function, the window will
run until all tasks within that window are completed.
Example
When %Q00102 is set, the CPU places the current time values of the
windows in the parameter block starting at location %R0010.

9.4. SVC_REQ 3: Change Controller Communications Window

Mode
Use SVC_REQ 3 to change the controller communications window mode and timer value. The change
takes place during the next CPU sweep after the function is called.
The parameter block has a length of one word.
SVC_REQ 3 executes unless a mode other than 0 (Limited) or 2 (Run to Completion) is selected.
To disable the controller communications window:
Address High Byte Low Byte
Address 0 0
To re-enable or change the controller communications window mode:

Address Mode: 0 = Limited 1ms ≤ value ≤ 255ms in 1ms increments
2 = Run to Completion
Example
When enabling input %I00125 transitions
on, the controller communications window
is enabled and assigned a value of 25ms.
When the contact transitions off, the
window is disabled. The parameter block is
in global memory location %P00051.

9.5. SVC_REQ 4: Change Backplane Communications Window

Mode and Timer Value
Use SVC_REQ 4 to change the Backplane Communications window mode and timer value. The
change takes place during the next CPU sweep after the function is called.
SVC_REQ 4 executes unless a mode other than 0 (Limited) or 2 (Run to Completion) is selected.
To disable the Backplane Communications window:
Address 0 0
To enable the Backplane Communications window mode:

Address Mode 0 = Limited 1ms ≤ value ≤ 255ms
Example
When enabling output %M0125 transitions on, the mode and timer value of the Backplane
Communications window is read. If the timer value is greater than or equal to 25ms, the value is not
changed. If it is less than 25ms, the value is changed to 25ms. In either case, when the rung
completes execution the window is enabled. The parameter block for all three windows is at location
%R5051. Since the mode and timer for the Backplane Communications window is the second value
in the parameter block returned from the Read Window Values function (SVC_REQ 2), the location of
the existing window time for the Backplane Communications window is in the low byte of %R5052.

9.6. SVC_REQ 5: Change Background Task Window Mode and

Timer Value
Use SVC_REQ 5 to change the Background Task window mode and timer value. The change takes
place during the next CPU sweep after the function is called.
SVC_REQ 5 executes unless a mode other than 0 (Limited) or 2 (Run-to-Completion) is selected.
To disable the Background Task window:
Address 0 0
To enable the Background Task window mode:

Address Mode 0 = Limited 1ms ≤ value ≤ 255ms
Example
When enabling contact #FST_SCN is set in the first scan, the MOVE function establishes a value of
20ms for the Background task window, using a parameter block beginning at %P00050. Later in the
program, when input %I00500 transitions on, the state of the Background task window toggles on
and off. The parameter block for all three windows is at location %P00051. The time for the
Background task window is the third value in the parameter block returned from the Read Window
Values function (function #2); therefore, the location of the existing window time for the Background
window is %P00053.

9.7. SVC_REQ 6: Change/Read Number of Words to Checksum

Use SVC_REQ 6 to read the current word count in the program to be check-summed or set a new
word count. By default, 16 words are checked. The function is successful unless some number other
than 0 or 1 is entered as the requested operation.
The parameter block has a length of 2 words.
To read the word count:
Enter a zero in the first word of the parameter block.
Address 0
Address + 1 Ignored
The function returns the current checksum (word count) in the second word of the parameter block.
No range is specified for the read function; the value returned is the number of words currently being
check-summed.
Address 0
Address + 1 Current word count
To set a new word count:

Enter a one in the first word of the parameter block and the new word count in the second word.
Address 1
Address + 1 New word count
The CPU changes the number of words to be check-summed to the value given in the second word
of the parameter block, rounded up to the next multiple of 8. To disable check-summing, set the new
word count to 0.

Example
When enabling contact
#FST_SCN is set, the
parameter blocks for the
checksum task function are
built. Later in the program,
when input %I00137
transitions on, the number of
words being check-summed
is read from the CPU
operating system. This
number is increased by 16,
with the results of the
ADD_UINT function being
placed in the “hold new count
for set” parameter. The
second service request block
requests the CPU to set the
new word count.
The example parameter blocks are located at address %L00150. They have the following contents:
%L00150 0 = read current count
%L00151 hold current count
%L00152 1 = set current count
%L00153 hold new count for set

9.8. SVC_REQ 7: Read or Change the Time-of-Day Clock

Use SVC_REQ 7 to read or change the time of day clock in the CPU. The function is successful unless:
 An invalid number is entered for the requested operation.
 An invalid data format is specified.
 Data is provided in an unexpected format.
9.8.1 Parameter Block Formats
In the first two words of the parameter block, you specify whether to read or set the time and date,
and which format to use.
Address 2-Digit Year Format 4-Digit Year Format
Address (word 1) 0 = read time and date 0 = read time and date
1 = set time and date 1 = set time and date
Address+1 (word 2) 0 = numeric data format 80h – numeric data format
1 = BCD format 81h = BCD format
2 = unpacked BCD format 82h = unpacked BCD format
3 = packed ASCII format (with embedded spaces and colons) 83h = packed ASCII format
4 = POSIX format n/a
Address+2 (word 3) Data Data
to the end
Words 3 to the end of the parameter block contain output data returned by a read function, or new
data being supplied by a change function. In both cases, format of these data words is the same.
When reading the date and time, words (address + 2) to the end of the parameter block are ignored
on input.
The format and length of the parameter block depends on the data format and number of digits
required for the year:
Data Format and N-digit Year Length of parameter block
(number of words)
BCD, 2-digit year 6
BCD, 4-digit year 6
POSIX format 6
Unpacked BCD 2 9
Unpacked BCD 4 10
Numeric (2 and 4 digit years) 9
Packed ASCII, 2-digit year 12
Packed ASCII, 4-digit year 13
In any format:
 Hours are stored in 24-hour format.
 Day of the week is a numeric value ranging from 1 (Sunday) to 7 (Saturday).

Value Day of the Week

1 Sunday
2 Monday
3 Tuesday
4 Wednesday
5 Thursday
6 Friday
7 Saturday
BCD, 2-Digit Year

In BCD format, each time and date item occupies one byte, so the parameter block has six words.
The last byte of the sixth word is not used. When setting the date and time, this byte is ignored; when
reading date and time, the function returns a null character (00).
Parameter Block Format Address Example
(Sun., July 3, 2005, at 2:45:30 p.m.
= 14:45:30 in 24-hour format)
1 = change or 0 = read Address 0 (read)
1 (BCD format) Address+1 1 (BCD format)
High Byte Low Byte Address High Byte Low Byte

month year Address+2 07 (July) 05 (year)
hours day of month Address+3 14 (hours) 03 (day)
seconds minutes Address+4 30 (seconds) 45 (minutes)
(null) day of week Address+5 00 01 (Sunday)
BCD, 4-Digit Year

In this format, all bytes are used.
(Sun., July 3, 2005, at 2:45:30 p.m.
= 14:45:30 in 24-hour format)
1 = change or 0 = read Address 00 (read)
81h (BCD format, 4-digit) Address+1 81h (BCD format, 4-digit)
High Byte Low Byte Address High Byte Low Byte

year year Address+2 20 (year) 05 (year)
day of month month Address+3 03 (day) 07 (July)
minutes hours Address+4 45 (minutes) 14 (hours)
day of week seconds Address+5 01 (Sunday) 30 (seconds)

POSIX
The POSIX format of the Time-of-Day clock uses two signed 32-bit integers (two DINTs) to represent
the number of seconds and nanoseconds since midnight January 1, 1970. Reading the clock in POSIX
format might make it easier for your application to calculate time differences. This format can also
be useful if your application communicates to other devices using the POSIX time format. To read
and/or change the date and time using POSIX format, enter SVC_REQ 7 with this parameter block:
Parameter Block Format Address Example: December 1, 2000 at 12 noon
1 = change or 0 = read Address 0
4 (POSIX format) Address+1 4
Seconds (LSW) Address+2 975,672,000
(MSW) Address+3
Nanoseconds (LSW) Address+4 0
(MSW) Address+5
The PACSystems CPU’s maximum POSIX clock value is F48656FE (hexadecimal) seconds and
999,999,999 (decimal) nanoseconds, which corresponds to December 31st, 2099 at 11:59 pm. This is
the maximum POSIX value that SVC_REQ 7 will accept for changing the clock. This is also the
maximum POSIX value SVC_REQ 7 will return once the Time-Of-Day clock passes this date.
If SVC_REQ 7 receives an invalid POSIX time to write to the clock, it does not change the Time-Of-Day
clock and disables its power-flow output.
Note: When reading the PACSystems CPU clock in POSIX format, the data returned is not easily
interpreted by a human viewer. If desired, it is up to the application logic to convert the POSIX
time into year, month, day of month, hour, and seconds.
Unpacked BCD (2-Digit Year)
In Unpacked BCD format, each digit of the time and date items occupies the low-order four bits of a
byte. The upper four bits of each byte are always zero. This format requires nine words. Values are
hexadecimal.
(Thurs., Dec. 8, 2002, at 9:34:57 a.m.)
1 = change or 0 = read Address 0h
2 (Unpacked BCD format) Address+1 2h
High Byte Low Byte High Byte Low Byte

year Address+2 00h 02h
month Address+3 01h 02h
day of month Address+4 02h 08h
hours Address+5 00h 09h
minutes Address+6 03h 04h
seconds Address+7 05h 07h
day of week Address+8 00h 05h

Unpacked BCD (4-Digit Year)

In Unpacked BCD format, each digit of the time and date items occupies the low-order four bits of a
byte. The upper four bits of each byte are always zero. This format requires nine words. Values are
hexadecimal.
(Thurs., Dec. 8, 2002, at 9:34:57 a.m.)
1 = change or 0 = read Address 0h
82h (Unpacked 4-digit BCD format) Address+1 82h

year Address+2 00h 02h
month Address+3 01h 02h
day of month Address+4 00h 08h
hours Address+5 00h 09h
minutes Address+6 03h 04h
seconds Address+7 05h 07h
day of week Address+8 00h 05h
Numeric, 2-Digit Year

In numeric format, the year, month, day of month, hours, minutes, seconds and day of week each
occupy one unsigned integer. To read and/or change the date and time using the numeric format,
enter SVC_REQ function #7 with this parameter block:
Wed., June 15, 2005, at 12:15:30 a.m.
0 (Numeric format, 2-digit year) Address+1 0
High Byte Low Byte Value

year Address+2 05
month Address+3 06
day of month Address+4 15
hours Address+5 12
minutes Address+6 15
seconds Address+7 30
day of week Address+8 04

Numeric, 4-Digit Year

In numeric format, the year, month, day of month, hours, minutes, seconds and day of week each
occupy one unsigned integer. To read and/or change the date and time using the numeric format,
enter SVC_REQ function #7 with this parameter block:
Parameter Block Format Address Example: Wed., June 15, 2005, at 12:15:30 a.m.
80h (Numeric format, 4 digit year) Address+1 80h
High Byte Low Byte Value

year Address+2 2005
month Address+3 06
day of month Address+4 15
hours Address+5 12
minutes Address+6 15
seconds Address+7 30
day of week Address+8 04
Packed ASCII, 2-Digit Year

In Packed ASCII format, each digit of the time and date items is an ASCII formatted byte. Spaces and
colons are embedded into the data to format it for printing or display. ASCII format for a 2-digit year
requires 12 words in the parameter block. Values are hexadecimal.
(Mon., Oct. 5, 2005, at 11:13:25 p.m. = 23:13:25 in 24-hour format)
1 = change or 0 = read Address 0h (read)
3 (ASCII format) Address+1 3h (ASCII format)

year year Address+2 35h (5) 30h (0)
month (space) Address+3 31h (1) 20h (space)
(space) month Address+4 20h (space) 30h (0)
day of month day of month Address+5 35h (5) 30h (leading 0)
hours (space) Address+6 32h (2) 20h (space)
: (colon) hours Address+7 3Ah (:) 33h (3)
minutes minutes Address+8 33h (3) 31h (1)
seconds : (colon) Address+9 32h (2) 3Ah (:)
(space) seconds Address+10 20h (space) 35h (5)
day of week day of week Address+11 32h (2 = Mon.) 30h (leading 0)

Packed ASCII, 4-Digit Year

ASCII format for a 4-digit year requires 13 words in the parameter block. Values are hexadecimal.
(Mon., Oct. 5, 2005, at 11:13:25 p.m. = 23:13:25 in
24-hour format)
1 = change or 0 = read Address 0h (read)
83 (ASCII format) Address+1 83h (ASCII format, 4-digit)

year (hundreds) year (thousands) Address+2 30h (0) 32h (2)
year (ones) year (tens) Address+3 35h (5) 30h (0)
month (tens) (space) Address+4 31h (1) 20h (space)
(space) month (ones) Address+5 20h (space) 30h (0)
day of month (ones) day of month (tens) Address+6 35h (5) 30h (leading 0)
hours (tens) (space) Address+7 32h (2) 20h (space)
: (colon) hours (ones) Address+8 3Ah (:) 33h (3)
minutes (ones) minutes (tens) Address+9 33h (3) 31h (1)
seconds (tens) : (colon) Address+10 32h (2) 3Ah (A)
(space) seconds (ones) Address+11 20 (space) 35 (5)
day of week (ones) day of week (tens) Address+12 32h (2 = Mon.) 30h (leading 0)

Example: SVC_REQ 7
In this example, the time of day is set to 12:00 pm without changing the current year, BCD format
requires six contiguous memory locations for the parameter block.
Rung 1 sets up the new time of day in two-digit year BCD format. It writes the value 4608 (equivalent
to 12 00 BCD) to NOON and the value 0 to MIN_SEC.
Rung 2 requests the current date and time using the parameter block located at %P00300.
Rung 3 moves the new time value into the parameter block starting at R00300. It uses AND and ADD
operations to retrieve the current clock value from %P00303 and replace the hours, minutes and
seconds portion of the value with the values in NOON and MIN_SEC.
Rung 4 uses the parameter block beginning at %R00300 to set the new time.

9.9. SVC_REQ 8: Reset Watchdog Timer

Use SVC_REQ 8 to reset the watchdog timer during the scan.
Ordinarily, when the watchdog timer expires, the CPU goes to Stop-Halt mode without warning.
SVC_REQ 8 allows the timer to keep going during a time-consuming task (for example, while waiting
for a response from a communications line).
Warning
Be sure that resetting the watchdog timer does not
adversely affect the controlled process.
SVC_REQ 8 has no associated parameter block; however, you must specify a dummy parameter,
which SVC_REQ 8 will not use.
Example
In the LD example at right, power flow through enabling
output %Q0127 or input %I1476 or internal coil %M00010
causes the watchdog timer to be reset.

9.10. SVC_REQ 9: Read Sweep Time from Beginning of Sweep

Use SVC_REQ 9 to read the time in milliseconds since the start of the sweep. The data format is
unsigned 16-bit integer.
Output
The parameter block is an output parameter block only; it has a length of one word.
Address time since start of scan
Example
The elapsed time from the start of the scan is
read into location %R00200. If it is greater than
100ms, internal coil %M0200 is turned on.
Note: Higher resolution (in nanoseconds) can be obtained by using SVC_REQ 51: Read Sweep Time
from Beginning of Sweep, described on page 417.

9.11. SVC_REQ 10: Read Target Name

Use SVC_REQ 10 to read the name of the currently executing target.
Output
The output parameter block has a length of four words. It returns eight ASCII characters: the target
name (from one to seven characters) followed by null characters (00h). The last character is always a
null character. If the target name has fewer than seven characters, null characters are appended to
the end.
Address Low Byte High Byte
Address character 1 character 2
Address+1 character 3 character 4
Address+3 character 7 00
Example
When enabling input %I0301 goes ON, register
location %R0099 is loaded with the value 10, which is
the function code for the Read Target Name
function. The program block READ_ID is then called
to retrieve the target name. The parameter block is
located at address %R0100.
Program block READ_ID:

9.12. SVC_REQ 11: Read Controller ID

Use SVC_REQ 11 to read the name of the controller executing the program.
Output
The output parameter block has a length of four words. It returns eight ASCII characters: the
Controller ID (from one to seven characters) followed by null characters (00h). The last character is
always a null character
If the Controller ID has fewer than seven characters, null characters are appended to the end.
Address Low Byte High Byte
Address character 1 character 2
Address+3 character 7 00
Example
When enabling input %I0303 is ON, register location
%R0099 is loaded with the value 11, which is the function
code for the Read Controller ID function. The program
block READ_ID is then called to retrieve the ID. The
parameter block is located at address %R0100.
Program Block READ_ID:

9.13. SVC_REQ 12: Read Controller Run State

Use SVC_REQ 12 to read the current RUN state of the CPU.
Output
The output parameter block has a length of one word.
Address 1 = run/disabled
2 = run/enabled
Example
When contact V_I00102 is ON, the CPU run state
is read into location %R4002. If the state is
Run/Disabled, the CALL function calls program
block DISPLAY.

9.14. SVC_REQ 13: Shut Down (Stop) CPU

Use SVC_REQ 13 to stop the CPU after the specified number of scans has been performed. All outputs
go to their designated default states at the start of the next CPU scan. An informational “Shut Down
Controller” fault is placed in the Controller Fault Table. The I/O scan continues as configured.
SVC_REQ 13 has an input parameter block with a length of one word.
Address Number of scans. Valid values:
-1: The CPU uses the Number of Last Scans value configured in the Hardware Configuration
Scan tab to determine when to transition to Stop mode. For details on Hardware
Configuration parameters, refer to Chapter 3.
1 through 5: The CPU finishes executing this scan, then executes this number of scans –1, and
transitions to Stop mode.
Note: For CPUs with firmware version earlier than 2.00, the value must be set to 0; otherwise the
CPU does not stop.
Example
When a “Loss of I/O Module” fault occurs, the #LOS_IOM contact turns ON and SVC_REQ 13 executes.
In this example, if the Shut Down CPU function executes, the JUMPN to the end of the program
prevents the logic that follows the JUMPN from executing in the current sweep.
The block's last instruction is a LABELN:

9.15. SVC_REQ 14: Clear Controller or I/O Fault Table

Use SVC_REQ 14 to clear either the Controller Fault Table or the I/O Fault Table. The SVC_REQ output
is set ON unless some number other than 0 or 1 is entered as the requested operation.
The parameter block has a length of 1 word. It is an input parameter block only. There is no output
parameter block.
Address 0 = clear Controller Fault Table
1 = clear I/O Fault Table
Example
When inputs %I0346 and %I0349 are on, the Controller Fault Table is cleared. When inputs %I0347
and %I0349 are on, the I/O Fault Table is cleared. When input %I0348 is on and input %I0349 is on,
both are cleared. Positive transition coils V_M00001 and V_M00002 are used to trigger these service
requests to prevent the fault tables from being cleared multiple times.
The parameter block for the Controller Fault Table is located at %R0500; for the I/O Fault Table the
parameter block is located at %R0550.
Note: Both parameter blocks are set up elsewhere in the program.

9.16. SVC_REQ 15: Read Last-Logged Fault Table Entry

Use SVC_REQ 15 to read the last entry logged in the Controller Fault Table or the I/O Fault Table. The
SVC_REQ output is set ON unless some invalid number is entered as the requested operation or the
fault table is empty.
The non-extended parameter block has a length of 22 words and the extended parameter block has
a length of 24 words.
Input Parameter Block
Address Format
Address+0 0 = Read Controller Fault Table
1 = Read I/O Fault Table
80h = Read extended Controller Fault Table
81h = Read extended I/O Fault Table
Output Parameter Block

The format of the output parameter block depends on whether SVC_REQ 15 reads the Controller
Fault Table, the extended Controller Fault Table, the I/O Fault Table or the extended I/O Fault Table.
Controller Fault Table Output Format Address I/O Fault Table Output Format
0 Address+0 1
unused long/short (always 01) Address+1 reference address long/short
memory type (always 03)
unused unused Address+2 reference address offset
slot rack Address+3 slot rack
task Address+4 block bus
fault action fault group Address+5 point
error code Address+6 fault action fault category
Address+7 fault type fault category
Address+8 to fault extra data fault description
fault extra data Address+18
minutes seconds Address+19 minutes seconds

day of month hour Address+20 day of month hour
year month Address+21 year month
milliseconds (extended format only) Address+22 milliseconds (extended format only)
not used (extended format only) Address+23 not used (extended format only)

Long/Short Value
The first byte (low byte) of word address +1 contains a number that indicates the length of the fault-
specific data in the fault entry. Possible values are as follows:
Controller extended and non-extended fault tables 00 = 8 bytes (short) 01 = 24 bytes (long)
I/O extended and non-extended fault tables 02 = 5 bytes (short) 03 = 21 bytes (long)
Note: PACSystems CPUs always return the Long values for both extended and non-extended
formats.
SVC_REQ 15 Example 1
When inputs %I0250 and %I0251 are both on, the first
Move function places a zero (read Controller Fault Table)
into the parameter block for SVC_REQ 15. When input
%I0250 is on and input %I0251 is off, the Move
instruction instead places a one (read I/O Fault Table) in
the SVC_REQ parameter block. The parameter block is
located at location %R0600.

The CPU is shut down when any fault occurs on an I/O module
except when the fault occurs on modules in rack 0, slot 9 and in
rack 1, slot 9. If faults occur on these two modules, the system
remains running. The parameter for "table type" is set up on the
first scan. The contact IO_PRES, when set, indicates that the I/O
Fault Table contains an entry. The CPU sets the normally open
contact in the scan after the fault logic places a fault in the table.
If faults are placed in the table in two consecutive scans, the
normally open contact is set for two consecutive scans.
The example uses a parameter block located at %R0600. After
the SVC_REQ function executes, the second, third, and fourth
words of the parameter block identify the I/O module that
faulted:
High Byte Low Byte
%R0600 1
%R0601 reference address memory type long/short
%R0602 reference address offset
%R0603 slot number rack number
%R0604 block (bus address) I/O bus no.
%R0605 point address
%R0606 fault data
In the program, the EQ_INT blocks compare the rack/slot address

in the table to hexadecimal constants. The internal coil %M0007
is turned on when the rack/slot where the fault occurred meets
the criteria specified above. If %M0007 is on, its normally closed
contact is off, preventing the shutdown. Conversely, if %M0007 is
off because the fault occurred on a different module, the
normally closed contact is on and the shutdown occurs.

9.17. SVC_REQ 16: Read Elapsed Time Clock

Use SVC_REQ 16 to read the system's elapsed time clock. The elapsed time clock measures the time
in seconds since the CPU was powered on. The parameter block has a length of three words used for
output only.
Output
Address Seconds from power on (low
order)
Address+1 Seconds from power on (high
order)
Address+2 100 microsecond ticks
The first two words are the elapsed time in seconds. The last word is the number of 100 microsecond
ticks in the current second.
The resolution of the CPU's elapsed time clock is 100 microseconds. The overall accuracy of the
elapsed time clock is ±0.01%. The accuracy of an individual sample of the elapsed time clock is
approximately 105 microseconds.
Warning
The SVC_REQ instruction is not protected against operating
system and user interrupts. The timing and length of these
interrupts are unpredictable. The clock sample returned by
SVC_REQ 16 can sometimes be much more than 105
microseconds old by the time execution is returned to the
LD logic.
Example
The following logic is used in a block that is called infrequently. The screen shot was taken between
calls to the block. The logic displayed calculates the number of seconds that have elapsed since the
last time the block was called. It performs the final operation on rung 4 by subtracting the time
obtained by SVC_REQ 16 the last time the block was called (vetum) from the time currently obtained
by SVC_REQ 16 (novum) and storing the calculated value in the variable named diff.
On rung 2, SVC_REQ 16 returns three WORDs, stored in the 3-WORD array tempus. The first two
WORDs (16-bit values) are moved to a DINT (a 32-bit value). This move amounts to a rough data type
conversion that ignores the fact that the DINT type is actually a signed value. Despite that, the
subsequent calculations are correct until the time since power-on reaches approximately 50 years.
The DINT is converted to REAL to yield the number of whole seconds elapsed since power-on, stored
in variable sec. On rung 3, the third word returned by SVC_REQ 16, tempus[2], is converted to REAL.
This is the number of 100 microsecond ticks. To obtain a fraction of a second, stored in the variable
fractio, the value is divided by 10,000. On rung 4, sec and fractio are added to express the exact
number of seconds elapsed since power-on, and this value is stored in the variable novum. On rung
1, the previous value of novum was saved as vetum, the exact number of seconds elapsed since
power-on the last time the block was called. The last instruction on the fourth rung subtracts vetum
from novum to yield the number of seconds that have elapsed since the last time the block was
called.

Note: Higher resolution (in nanoseconds) can be obtained by using SVC_REQ 50: Read Elapsed Time
Clock, described on page 415.

9.18. SVC_REQ 17: Mask/Unmask I/O Interrupt

Use SVC_REQ 17 to mask or unmask an interrupt from an input/output board. When an interrupt is
masked, the CPU does not execute the corresponding interrupt block when the input transitions and
causes an interrupt.
The parameter block is an input parameter block only; it has a length of three words.
Address 0 = unmask input
1 = mask input
Address+1 memory type
Address+2 reference (offset)
“Memory type” is a decimal number that resides in the low byte of word address + 1. It corresponds
to the memory type of the input:
70 %I memory in bit mode
10 %AI memory
12 %AQ memory
Successful execution occurs unless:
 Some number other than 0 or 1 is entered as the requested operation.
 The memory type of the input/output to be masked or unmasked is not %I, %AI or %AQ memory.
 The I/O board is not a supported input/output module.
 The reference address specified does not correspond to a valid interrupt trigger reference.
 The specified channel does not have its interrupt enabled in the configuration.
9.18.1 Masking/Unmasking Module Interrupts
During module configuration, interrupts from a module can be enabled or disabled. If a module's
interrupt is disabled, it cannot be used to trigger logic execution in the application program and it
cannot be unmasked. However, if an interrupt is enabled in the configuration, it can be dynamically
masked or unmasked by the application program during system operation.
The application program can mask and unmask interrupts that are enabled using Service Request
Function Block #17. To mask or unmask an interrupt from an open VME module, the application logic
should pass VME_INT_ID (17 decimal, 11H) as the memory type and the VME interrupt id as the offset
to SVC_REQ 17.
When the interrupt is not masked, the CPU processes the interrupt and schedules the associated
program logic for execution. When the interrupt is masked, the CPU processes the interrupt but does
not schedule the associated program logic for execution.
When the CPU transitions from Stop to Run, the interrupt is unmasked.
For additional information on configuring and using VME module interrupts in a PACSystems RX7i
control system, refer to PACSystems RX7i User's Guide to Integration of VME Modules, GFK-2235.

In this example, interrupts from input %I00033 are masked. The following values are moved into the
parameter block, which starts at %P00347, on the first scan:
Address %P00347 1 Interrupts
from input
are masked.
Address + 1 %P00348 70 Input type is
%I.
Address + 2 %P00349 33 Offset is 33.
When %T00001 transitions on, alarm
interrupts from input %AI0006 are
masked. The parameter block at
%R00100 is set up on the first scan.

9.19. SVC_REQ 18: Read I/O Forced Status

Use SVC_REQ 18 to read the current status of forced values in the CPU's %I and %Q memory areas.
Note: SVC_REQ 18 does not detect overrides in %G or %M memory types. Use %S0011 (#OVR_PRE)
to detect overrides in %I, %Q, %G, %M, and symbolic memory types.
The parameter block has a length of one word used for output only.
Output
Address 0 = No forced values are set
1 = Forced values are set
Example
SVC_REQ reads the status of I/O forced values into
location %R1003. If the returned value in %R1003 is
1, there is a forced value, and EQ INT turns the
%T0001 coil ON.

9.20. SVC_REQ 19: Set Run Enable/Disable

Use SVC_REQ 19 to permit the LD program to control the RUN mode of the CPU.
The parameter passed indicates which function to perform. The OK output is turned ON if the
function executes successfully. It is set OFF if the requested operation is not SET RUN DISABLE mode
(1) or SET RUN ENABLE mode (2).
The parameter block is an input parameter block only with this format:
Address 1 = SET RUN DISABLE mode
2 = SET RUN ENABLE mode
Example
When input %I00157 transitions to on, the RUN DISABLE mode is set. When the SVC_REQ function
successfully executes, coil %Q00157 is turned on. When %Q00157 is on and register %R00099 is
greater than zero, the mode is changed to RUN ENABLE mode. When the SVC_REQ successfully
executes, coil %Q00157 is turned off.

9.21. SVC_REQ 20: Read Fault Tables

Use SVC_REQ 20 to retrieve the entire Controller or I/O Fault Table and return it to the LD program in
designated registers.
The first input parameter designates which table is to be read. A second input parameter (always
zero for the standard Read Fault Tables) is used by the extended format to read a designated fault
entry or to read a range of fault entries. The fault table data is placed in the parameter block
following the input parameters.
The OK output is turned on if the function executes successfully. It is off if the requested operation is
not Read Controller Fault Table (00h), Read I/O Fault Table (01h), Read Extended Controller Fault Table
(80h), or Read Extended I/O Fault Table (81h), or if there is not enough of the specified memory
reference to hold the fault data. If the specified fault table is empty, the function sets the OK output
on, but returns only the fault table header information.
The parameter block is an input and output parameter block. The parameter block comes in two
formats:
 Non-Extended: Read Controller Fault Table (00h), Read I/O Fault Table (01h)
 Extended: Read Extended Controller Fault Table (80h), Read Extended I/O Fault Table (81h)
9.21.1 Non-Extended Formats
For non-extended formats, SVC_REQ 20 requires 693 registers available.
Input Parameter Block Format
Address + 0 00h = Read Controller fault table
01h = Read I/O Fault Table
Address + 1 Always 0
Non-Extended Output Parameter Block Format

Controller Fault Table Output Format I/O Fault Table Output Format
Address
Unused 0 = Controller Fault Table Address+0 Unused 1 = I/O Fault Table
Unused Always zero (0) Address+1 Unused Always zero (0)
Unused Unused Address+2 Unused Unused
Address+3—
Unused Unused Unused Unused
Address+14
Minutes Seconds Address+15— Minutes Seconds
Address+17
Day Of Month Hour Day of month Hour
(Time Since Last Clear,
Year Month in BCD Format) Year Month
Number of faults since last clear Address+18 Number of faults since last clear
Number of faults in queue Address+19 Number of faults in queue
Number of faults read Address+20 Number of faults read
Start of fault data Address+21 Start of fault data

For the non-extended formats, the returned data for each fault consists of 21 words (42 bytes). This
request returns 16 Controller Fault Table entries or 32 I/O Fault Table entries, or the actual number of
faults if it is fewer. If the fault table read is empty, no data is returned.
The following table shows the return format of a Controller Fault Table entry and an I/O Fault Table
entry.
Format of Returned Data for Fault Table Entries
Address
Unused Long/short Address+21 Memory type Long/Short 20
Unused Unused Address+22 Offset
Slot Rack Address+23 Slot Rack
Task Address+24 Bus address I/O Bus Number (block)
Fault action Fault group Address+25 Point
Error code Address+26 Fault action Fault group
Address+27 Fault type Fault category
Address+28 Fault extra data Fault description
Fault extra data
Address+29—
Fault extra data
Address+38
Minutes Seconds Address+39— Minutes Seconds
Address+41
Day of month Hour Day of month Hour
(Time-stamp, in
Year Month BCD Format) Year Month
Start of next fault output parameter block Address+42 Start of next fault output parameter block
20 The Long/Short indicator in the low byte of Address + 21 specifies the amount of fault data present in the
fault entry:
Fault Table Long/Short Value Fault Data Returned
Controller 00 8 bytes of fault extra data present in the fault entry
01 24 bytes of fault extra data
I/O 02 5 bytes of fault extra data
03 21 bytes of fault extra data

9.21.2 Extended Formats

Each extended format request can read a maximum of 64 faults, or the size of the fault table if it
contains less than 64 faults.
For extended formats (Read Extended Controller Fault Table (80h), or Read Extended I/O Fault Table
(81h)), the controller calculates the number of entries being read. You must ensure that enough
registers are available to receive the amount of fault entries requested. If the amount of data
requested exceeds the registers available, the CPU returns a fault indicating that reference memory
is out of range.
The total size of the fault table for the extended fault format is
Header Size + ((# fault entries) × (size of fault entry))
Input Parameter Block Format
Address+0 80h = Read extended Controller Fault
Table
81h = Read extended I/O Fault Table
Address+1 Starting index of faults to be read
Address+2 Number of faults to be read
Extended Format Output Parameter Block Format

Address
80h = Extended Controller 81h = Extended
Unused Address Unused
Fault Table I/O Fault Table
Starting index of faults to be read Address+1 Starting index of faults to be read
Number of faults to be read Address+2 Number of faults to be read
Unused Unused Address+3—Address+14 Unused Unused
Minutes Seconds Minutes Seconds
Address+15—Address+17
Day of Month Hour (Time Since Last Clear, in Day of month Hour
BCD Format)
Year Month Year Month
Number of faults since last clear Address+18 Number of faults since last clear
Number of faults in queue Address+19 Number of faults in queue
Number of faults read Address+20 Number of faults read
Unused Address+21—Address+36 Unused
Start of fault data Address+37 Start of fault data
For Read Extended Controller Fault Table (80h) and Read Extended I/O Fault Table (81h), the returned
data for each fault entry consists of 23 words (46 bytes).

Format of Returned Data for Fault Table Entries

Address
Reference address Long/Short (See
Unused Long/Short Address+37
memory type page 393.)
Unused Unused Address+38 Reference address offset
Slot Rack Address+39 Slot Rack
I/O bus number
Task Address+40 Bus address
(block)
Fault action Fault group Address+41 point
Error code Address+42 Fault action Fault group
Address+43 Fault type Fault category
Address+44 Fault extra data Fault description
Fault extra data
Address+45—
Fault extra data
Address+54
Minutes Seconds Minutes Seconds
Address+55—
Day of month Hour Address+58 Day of month Hour
Year Month (Time-stamp in BCD Year Month
Format)
Milliseconds Milliseconds
Not used Address+59 Not used
Start of next fault output parameter block Address+60 Start of next fault output parameter block

SVC_REQ 20 Example 1: Non-Extended Format

When Read_PLC transitions on, a value of 0 is moved to the parameter block, which is located at
%R00500, and the Controller Fault Table is read. When Read_IO transitions on, a value of 1 is moved
to the parameter block and the I/O Fault Table is read. When the SVC_REQ function successfully
executes, coil OK is turned on.
SVC_REQ 20 Example 2: Extended Format

When Read_PLC_Xt transitions on, the Extended Controller Fault Table is read. The parameter block
begins at %R00500. %R00500 contains the fault table type (Controller Extended); %R00501 contains
the starting fault to read, and %R00502 contains the number of faults to read starting with the fault
number in %R00501. When the SVC_REQ function successfully executes, coil OK is turned on.

9.22. SVC_REQ 21: User-Defined Fault Logging

Use SVC_REQ 21 to define a fault that can be displayed in the Controller Fault Table. The fault
contains binary information or an ASCII message. The user-defined fault codes start at 0 hex.
The error code information for the fault must be within the range 0 to 2047 for an “Application Msg:”
to be displayed. If the error code is in the range 81 to 112 decimal, the CPU sets a fault bit of the
same number in %SA system memory. This allows up to 32 bits to be individually set.
Error Code Status Bit
Errors 0—80 No bit set
Errors 81—112 Sets %SA
Errors 113—2047 No bit set
Errors 2048—32,767 Reserved
When EN is active, the fault data array referenced by IN is logged as a fault to the Controller Fault
Table. If EN is not enabled, the ok bit is cleared. If the error code is out of range, the ok bit is cleared
and the fault will not be logged as requested.
The parameter block is an input parameter block only with this format:
Error code
Parameter address
MSB LSB
Address+1 Text2 Text1
The input parameter data allows you to select an error code in the range 0 to 2047 and text
information that will be placed in the fault extra data portion of a long controller fault. The controller
fault address, fault group, and fault action are filled in by the function block.

The fault text bytes 1 – 24 can be used to pass binary or ASCII data with the fault. If the first byte of
the fault text data is non-zero, the data will be an ASCII message string. This message will then be
displayed in the fault description area of the fault table. If the message is less than 24 characters, the
ASCII string must be NULL byte-terminated. The programmer will display “Application Msg:” and the
ASCII data will be displayed as a message immediately following “Application Msg:”. If the error code
is between 1 and 2047, the error code number will be displayed immediately after “Msg” in the
“Application Msg:” string. (If the error code is greater than 2047, the function is ignored and its output
is set to OFF.)
If the first byte of text is zero, then only “Application Msg:” will display in the fault description. The next
1-23 bytes will be considered binary data for user data logging. This data is displayed in the
Controller Fault Table.
Note: When a user-defined fault is displayed in the Controller Fault Table, a value of -32768 (8000
hex) is added to the error code. For example, the error code 5 will be displayed as -32763.
Example
The value passed to IN1 is the fault error code. The value passed in,
16x0057, represents an error code of 87 decimal and will appear as
part of the fault message. The values of the next inputs give the ASCII
codes for the text of the error message. For IN2, the input is 2D45. The
low byte, 45, decodes to the letter E and the high byte, 2D, decodes to
-. Continuing in this manner, the string continues with S T O P O and N.
The final character, 00, is the null character that terminates the string.
In summary, the decoding yields the string message E_STOP ON.

9.23. SVC_REQ 22: Mask/Unmask Timed Interrupts

Use SVC_REQ 22 to mask or unmask timed interrupts and to read the current mask. When the
interrupts are masked, the CPU does not execute any timed interrupt block timed program that is
associated with a timed interrupt. Timed interrupts are masked/unmasked as a group. They cannot
be individually masked or unmasked.
Successful execution occurs unless some number other than 0 or 1 is entered as the requested
operation or mask value.
The parameter block is an input and output parameter block.
To determine the current mask, use this format:
Address 0 = Read interrupt mask
The CPU returns this format:
Address 0 = Read interrupt mask
Address+1 0 = Timed interrupts are
unmasked
1 = Timed interrupts are masked
To change the current mask, use this format:
Address 1 = Mask/unmask interrupts
Address+1 0 = Unmask timed interrupts
1 = Mask timed interrupts
Example
When input %I00055 transitions on, timed interrupts are masked.

9.24. SVC_REQ 23: Read Master Checksum

Use SVC_REQ 23 to read master checksums for the set of user program(s) and the configuration, and
to read the checksum for the block from which the service request is made.
There is no input parameter block for this service request. The output parameter block requires 15
words of memory.
Output
When a RUN MODE STORE is active, the program checksums may not be valid until the store is
complete. To determine when checksums are valid, three flags (one each for Program Block
Checksum, Master Program Checksum, and Master Configuration Checksum) are provided at the
beginning of the output parameter block.
Address Description
Address Program Checksum Valid (0 = not valid, 1 = valid)
Address + 1 Master Program Checksum Valid (0 = not valid, 1 = valid)
Address + 2 Master Configuration Checksum Valid (0 = not valid, 1 = valid)
Address + 3 Number of LD/SFC Blocks (including _MAIN)
Address + 4 Size of User Program in Bytes (DWORD data type)
Address + 6 Program Set Additive Checksum
Address + 7 Program CRC Checksum (DWORD data type)
Address + 9 Size of Configuration Data in Kbytes
Address + 10 Configuration Additive Checksum
Address + 11 Configuration CRC Checksum (DWORD data type)
high byte: always zero
Address + 13
low byte: Currently Executing Block’s Additive Checksum
Address + 14 Currently Executing Block’s CRC Checksum
SVC_REQ 23 Example
When the timer using registers %P00013
through %P00015 expires, the checksum
read is performed. The checksum data
returns in registers %P00016 through
%P00030. The master program checksum in
registers %P00022 and %P00023 (the
program checksum is a DWORD data type
and occupies two adjacent registers) is
compared with the last saved master
program checksum. If these are different, coil
%M00055 is latched on. The current master
program checksum is then saved in registers
%P00031 and %P00032.

9.25. SVC_REQ 24: Reset Module

Use SVC_REQ 24 to reset a daughterboard or some modules. Modules that support SVC_REQ 24
include:
RX3i IC693BEM331, IC694BEM331, IC693APU300, IC694APU300, IC695ETM001, IC693ALG2222,
IC694ALG2222, IC695PNC001
RX7i: Embedded Ethernet Interface module, IC697BEM731, IC698BEM731, IC697HSC700,
IC697ALG230, IC698ETM001
The SVC_REQ output is set ON unless one of the following conditions exists:
- An invalid number for rack and/or slot is entered.
- There is no module at the specified location.
- The module at the specified location does not support a runtime reset.
- The CPU was unable to reset the module at the specified location.
For this function, the parameter block has a length of 1 word. It is an input parameter block only.
Address Module slot (low byte)
Module rack (high byte)
Rack 0, Slot 1 indicates that a reset is to be sent to the daughterboard.
Note: It is important to invoke SVC_REQ #24 for a given module for only one sweep at a time. Each
time this function executes, the target module will be reset regardless of whether it has
finished starting up from a previous reset.
After sending a SVC_REQ #24 to a module, you must wait a minimum of 5 seconds before
sending another SVC_REQ #24 to the same module. This ensures that the module has time to
recover and complete its startup.
Example
This example resets the module in
rack0/slot 2.
In rung 1, when contact %I00200 is
closed, the positive transition coil sets
%I00250 to ON for one sweep.
The MOVE_WORD instruction in rung 2
receives power flow and moves the value
2 into %R00500.
The SVC_REQ function in rung 3 then
receives power flow and resets the
module indicated by the rack/slot value in
%R00500.

9.26. SVC_REQ 25: Disable/Enable EXE Block and Standalone C

Program Checksums
Use SVC_REQ 25 to enable or disable the inclusion of EXE in the background checksum calculation.
The default is to include the checksums.
This service request uses only an input parameter block.
Address 0 = Disable C applications inclusion in checksum calculation
1 = Enable C application inclusion in checksum calculation
The parameter block is unchanged after execution of the service request.
Example
When the coil TEST transitions from OFF to ON, SVC_REQ 25 executes to disable the inclusion of EXE
blocks in the background checksum calculation. When coil TEST transitions from ON to OFF, the
SVC_REQ executes to again include EXE blocks in the background checksum calculation.

9.27. SVC_REQ 29: Read Elapsed Power Down Time

Use SVC_REQ 29 to read the amount of time elapsed between the last power-down and the most
recent power-up. If the watchdog timer expired before power-down, the CPU is not able to calculate
the power down elapsed time, so the time is set to 0.
This service request cannot be accessed from a C block.
This function has an output parameter block only. The parameter block has a length of three words.
Address Power-down elapsed seconds (low order)
Address + 1 Power-down elapsed seconds (high order)
Address + 2 100µS ticks
The first two words are the power-down elapsed time in seconds. The last word is the number of 100
microsecond ticks in the current second.
Note: Although this request responds with a resolution of 100µS, the actual accuracy is 1 second.
The battery-backed clock, which is used when the controller is powered down, is accurate to
within 1 second.
SVC_REQ 29 Example
When input %I0251 is ON, the elapsed power-down time is placed into the parameter block that
starts at %R0050. The output coil (%Q0001) is turned on.
%I0251 %Q0001
SVC_
REQ
CONST
00029 FNC
%R0050 PARM

9.28. SVC_REQ 32: Suspend/Resume I/O Interrupt

Use SVC_REQ 32 to suspend a set of I/O interrupts and cause occurrences of these interrupts to be
queued until these interrupts are resumed. The number of I/O interrupts that can be queued depends
on the I/O module’s capabilities. The CPU informs the I/O module that its interrupts are to be
suspended or resumed. The I/O module’s default is resumed. The Suspend applies to all I/O interrupts
associated with the I/O module. Interrupts are suspended and resumed within a single scan.
SVC_REQ 32 uses only an input parameter block. Its length is three words.
Address 0 = resume interrupt
1 = suspend interrupt
Address + 1 memory type
Address + 2 reference (offset)
Successful execution occurs unless:
 Some number other than 0 or 1 is passed in as the first parameter.
 The memory type parameter is not 70 (%I memory).
 The I/O module associated with the specified address is not an appropriate module for this
operation.
 The reference address specified is not the first %I reference for the High Speed Counter.
 Communication between the CPU and this I/O module has failed. (The board is not present, or it
has experienced a fatal fault.)
Note: I/O interrupts, unless suspended or masked, can interrupt the execution of a function block.
The most often used application of this Service Request is to prevent the effects of the
interrupts for diagnostic or other purposes.
SVC_REQ 32 Example
Interrupts from the high speed counter
module whose starting point reference
address is %I00065 will be suspended
while the CPU solves the logic of the
second rung. Without the Suspend, an
interrupt from the HSC could occur
during execution of the third rung and
%T00006 could be set while %R000001
has a value other than 3,400. (%AI00001
is the first non-discrete input reference
for the High Speed Counter.)

9.29. SVC_REQ 45: Skip Next I/O Scan

Use the SVC_REQ function #45 to skip the next output and input scans. Any changes to the output
reference tables during the sweep in which the SVC_REQ #45 was executed will not be reflected on
the physical outputs of the corresponding modules. Any changes to the physical input data on the
modules will not be reflected in the corresponding input references during the sweep after the one in
which the SVC_REQ #45 was executed.
This function has no parameter block.
Note: This service request is provided for conversion of Series 90-30 applications. The Suspend I/O
(SUS_IO) function block, which is supported by all PACSystems firmware versions, should be
used in new applications.
Note: The DOIO Function Block is not affected by the use of SVC_REQ #45. It will still update the I/O
when used in the same logic program as the SVC_REQ #45.
Example
In the following LD example, when the “Idle” contact passes power flow,
the next Output and Input Scan are skipped.

9.30. SVC_REQ 50: Read Elapsed Time Clock

Use SVC_REQ 50 to read the system's elapsed time clock. The elapsed time clock measures the time
in seconds since the CPU was powered on. The parameter block has a length of four words used for
output only.
Output
Address Seconds from power on (low order)
Address+1 Seconds from power on (high order)
Address+2 nanosecond ticks (low order)
Address+3 nanosecond ticks (high order)
The first two words are the elapsed time in seconds. The second two words are the number of
nanoseconds elapsed in the current second.
The resolution of the CPU's elapsed time clock is 100 microseconds. The overall accuracy of the
elapsed time clock is ±0.01%. The accuracy of an individual sample of the elapsed time clock is
approximately 105 microseconds.
Warning
The SVC_REQ instruction is not protected against operating
system and user interrupts. The timing and length of these
interrupts are unpredictable. The clock sample returned by
SVC_REQ 50 can sometimes be much more than 105
microseconds old by the time execution is returned to the
LD logic.

SVC_REQ 50 Example
The following logic is used in a block that is called once in a while. The screen shot was taken
between calls to the block. The second rung of logic calculates the number of seconds that have
elapsed since the last time the block was called. The third rung calculates the number of
nanoseconds to be added to, or subtracted from, the number of seconds. The first rung saves the
previous value of novum[0] and novum[1] into vetum[0] and vetum[1] before the second rung of
logic places the current time values in novum[0] and novum[1].

9.31. SVC_REQ 51: Read Sweep Time from Beginning of Sweep

Use SVC_REQ 51 to read the time in nanoseconds since the start of the sweep. The data is unsigned
32-bit integer.
Output
The parameter block is an output parameter block only; it has a length of two words.
Address time (nanoseconds) since start of scan – low order
Address+1 time (nanoseconds) since start of scan – high order
Example
The elapsed time from the start of the scan is read into locations %R00200 and %R00201 if it is
greater than 10,020ns, internal coil %M0200 is turned on.

9.32. SVC_REQ 56: Logic Driven Read of Nonvolatile Storage

PACSystems controllers support a 64KB nonvolatile flash memory area, which can be accessed by
the logic-driven read/write service requests. Values are stored in the nonvolatile storage area using
SVC_REQ 57: Logic Driven Write to Nonvolatile Storage (see page 422). These values are applied to
the controller user memory on power-up.
If you want only to write to nonvolatile storage and have the values restored on a power cycle, you
may not need to use SVC_REQ 56. However, a logic driven read from nonvolatile storage can be
commanded as needed. For example, you can use #FST_SCN with SVC_REQ 56 calls to force a reload
on each Stop to Run transition.
SVC_REQ 56 specifies a read operation from nonvolatile storage when the PACSystems is running.
You can specify which reference address range to read and optionally a different destination
memory location in CPU memory in which to place the read data. Using different memory locations
enables you to set up a comparison between existing values in CPU memory with values in
nonvolatile storage.
SVC_REQ 56 execution time will vary depending on the number of values stored in nonvolatile
storage, as it will find the most recent value for the requested reference address range.
You can read up to 32 words (64 bytes) inclusively per invocation of SVC_REQ 56.
Discrete Memory
Discrete memory can be read as individual bits or as bytes. For more information, see “Memory Type
Codes” on page 420.
If a discrete memory destination is forced, the forced value remains intact in CPU memory even
though the count in word 10 (address + 10) indicates that all the data was read and transferred.
If a memory location has an associated transition bit and SVC_REQ 56 causes a transition on that
value, the transition bit is set.
Storage Disabled Conditions
By default, the following write operations disable SVC_REQ 56 until logic is written to nonvolatile
storage:
 Run Mode Store (RMS), even if a second RMS reverts everything to the original state.
 Test-Edit session, even when you cancel your edits.
 Word-for-word change.
 Downloading to RAM only of a stopped PACSystems CPU, even if the downloaded contents are
equal to the contents already on the nonvolatile storage. Setting bit 0 of input word 8 (address +
7) to a value of 1 enables SVC_REQ 56 despite the above conditions.
Maximum of One Active Instruction
When SVC_REQ 56 is active, it does not support an interrupt that attempts to activate SVC_REQ 57 or
a second instance of SVC_REQ 56. If an attempt fails, an error indicating that another instance is
active will be returned.
ENO and Power Flow To The Right
If the status is Success or Partial Read (see address+9), on the SVC_REQ instruction, ENO is set to True
in FBD and ST, and power flow passes to the right in LD.

Parameter Block
Address+0 Memory type. See “Memory Type Codes” on page 420.
Address+1 The zero-based offset N to read from nonvolatile storage. Contains the complete offset for any
Address+2 memory area except %W, which also requires the use of address + 2 for offsets greater
than 65,535.
 For %I, %Q, %M, %T, and %G memory in byte mode, N = (Ra - 1) / 8, where Ra = one-based
reference address. For example, to read from the one-based bit reference address %T33,
enter the byte offset 4: (33 - 1) / 8 = 4.
 For %W, %R, %AI, and %AQ memory, and for %I, %Q, %M, %T, and %G memory in bit mode,
N = Ra - 1. For example, to read from the one-based reference address %R200, enter the
zero-based reference offset 199; to read from %I73 in bit mode, enter offset 72. For memory
in bit mode, the offset must be set on a byte boundary, that is, a number exactly divisible
by 8: 0, 8, 16, 24, and so on.
Address+3 Length. The number of items to read from nonvolatile storage beginning at the reference
address calculated from the offset defined at [address + 1 and address + 2]. The length can be
one of the following:
Description Valid range
The number of words (16-bit registers) to read 1 through 32 words
from %W, %R, %AI, or %AQ nonvolatile storage
The number of bytes to read from %I, %Q, %M, 1 through 64 bytes
%T, or %G in byte mode nonvolatile storage
The number of bits to read from %I, %Q, %M, %T, 1 through 512 bits in
or %G in bit mode nonvolatile storage increments of 8 bits
The value must reside in the low byte of address + 3. The high byte must be set to zero.
Address + 4 Destination memory. The CPU memory area to write the read data to. This does not need to be
the same memory area as specified at [address]. Writing to a different memory area enables you
to compare the values that were already in the CPU with the values read from nonvolatile
storage.
Address+5 The zero-based offset N in CPU memory to start writing the read data to. Address + 5, the least
Address+6 significant word, contains the complete offset for any memory area except %W, which also
requires the use of address + 6 for offsets greater than 65,535.
reference address. For example, to write to the one-based bit reference address %T33, enter
the byte offset 4: (33 - 1) / 8 = 4.
N = Ra - 1. For example, to write to the one-based reference address %R200, enter the zero-
based reference offset 199; to write to %I73 in bit mode, enter offset 72.
Address+7  When bit 0 is set to 1, storage disabled conditions are ignored. A read is allowed even if the
logic in RAM has changed since nonvolatile storage was read or written.
 Bits 1 through 15 must be set to zero; otherwise, the read fails.
Address+8 Reserved. Must be set to zero; otherwise, the read fails.
Address+9 Response status. The status read from nonvolatile storage. The low byte contains the major error
code; the high byte contains the minor error code.
For definitions, see “Response Status Codes for SVC_REQ 56” on page 420.
Address+10 Response Count. The number of words, bytes, or bits copied.

Memory Type Codes

Type Decimal Value Type Decimal Value
%R 8 %G (byte mode) 56
%AI 10 %I (bit mode) 70
%AQ 12 %Q (bit mode) 72
%I (byte mode) 16 %T (bit mode) 74
%Q (byte mode) 18 %M (bit mode) 76
%T (byte mode) 20 %G (bit mode) 86
%M (byte mode) 22 %W 196
Response Status Codes for SVC_REQ 56

Minor Major Description
00 01 Success. All values requested were found and copied.
01 01 Partial Read. All values found were copied, but some or all values were not in storage.
01 02 Insufficient Destination Memory. The Destination memory location is not large enough
to store the requested values.
02 02 Invalid Length. The length requested is larger than 64 bytes or less than 1 byte or the
number of bits is not an exact multiple of 8.
03 02 Invalid storage or destination reference address. A specified memory area is not %I,
%Q, %T, %M, %G, %R, %AI, %AQ, or %W, or the offset is out of range, or the offset is not
byte-aligned for discrete memory in bit mode.
04 02 Invalid request. Spare bits or spare words in parameter block are not set to zero.
01 03 Storage Busy. A SVC_REQ 57 or another SVC_REQ 56 instruction is active. For example,
an interrupt block is attempting to execute SVC_REQ 56 when the block it interrupted
was executing SVC_REQ 56.
01 04 Storage Disabled. The logic in RAM differs from the logic in nonvolatile storage. See
Storage disabled conditions.
02 04 Storage Closed. Either the storage has not been created or a previous corruption error
or unexpected read/write failure closed the storage.
01 05 Unexpected Read Failure. A command to the storage hardware failed unexpectedly.
02 05 Corrupted storage. A corrupted checksum or storage header caused a read to fail.

SVC_REQ 56 Example
The following LD logic reads ten continuous bytes written to nonvolatile storage from %G1—%G80
into %G193—%G273. The value applied to IN1, 56, selects byte mode.
The parameter block starts at %R00040. The response words are returned to %R00049 and
%R00050.
Parameter Block for SVC_REQ 56 Example

Address + Offset Address Input Value Definition
Address+0 %R00040 56 Data type = %G (byte mode)
Address+1 %R00041 0 Address written from, low word
Address+2 %R00042 0 Address written from, high word
Address+3 %R00043 10 Length = 10 bytes
Address+4 %R00044 56 Data type to write to = %G (byte mode)
Address+5 %R00045 24 Address to write to, low word
Address+6 %R00046 0 Address to write to, high word
Address+7 %R00047 0 Storage disabled conditions are enforced
Address+8 %R00048 0 Reserved, must be set to 0
Address+9 %R00049 NA Response status.
Address+10 %R00050 NA Response count.

9.33. SVC_REQ 57: Logic Driven Write to Nonvolatile Storage

PACSystems controllers support a 65,500 byte nonvolatile flash memory area that can be accessed
by the logic-driven read/write service requests. Values are stored in the nonvolatile storage area
using SVC_REQ 57. These values are applied to the controller user memory on power up.
SVC_REQ 57 specifies a range of reference addresses to read from a running PACSystems CPU and
write to nonvolatile storage. This feature is intended to retain a limited set of values, such as set
points or tuning parameters that need to change when the PACSystems is running.
This feature uses 65,536 bytes of nonvolatile storage. But not all of this memory is available for the
actual data being written by the service request. Some of the memory is used internally by the
controller to maintain information about the data being stored.
Note: Nonvolatile storage is intended for storing values that do not change frequently. Once the
nonvolatile storage area fills up, a power cycle or stop mode store is required to store more
values. The logic-driven write is not a replacement for battery backed RAM for values that
change frequently or during every sweep. (See “When nonvolatile storage is full” on page
424.)
Length of Data Written
SVC_REQ 57 scans the nonvolatile storage to find the most recent values stored for the specified
range. If it finds no values for the range or the most recent stored values are different, the new values
are written to nonvolatile storage.
SVC_REQ 57 reports the length of data written in word 8 (starting address + 7) of the parameter block.
The number of words written is calculated from the first word that changed to the end of the array.
For example, if you specify 8 words to be written, but only the values of words 3 and 4 are changed,
the SVC_REQ identifies the first mismatch at word 3 and writes the values of words 3 through 8 (a
length of 6 words).
You can write up to 32 words (64 bytes) inclusively per invocation of SVC_REQ 57. Each invocation
requires 4 words of command data (8 bytes). A 1-byte write requires 9 bytes whereas a 64-byte write
requires 72 bytes. You can generally make the most efficient use of nonvolatile storage by
transferring data in 56-byte increments, since this will actually write 64 bytes to the device. Given the
bookkeeping overhead required by the Controller and possible fragmentation, at least 54,912 bytes
and no more than 64,000 bytes will be available for the reference data and the 8 bytes of command
data for each invocation. For additional information on “Fragmentation”, see page 423.
Write Frequency
Multiple calls to SVC_REQ 57 in a single sweep may cause CPU watchdog timeouts. The number of
calls to SVC_REQ 57 that can be made requires consideration of many variables: the software
watchdog timeout value, how much data is being written, how long the sweep is, age of nonvolatile
storage (flash), etc. If the application attempts to write to flash too frequently, the CPU could
experience a watchdog timeout while waiting for a preceding write operation to complete.
The Logic Driven Read/Write to Flash service requests are not intended for high frequency use. We
recommend limiting the number of calls to SVC_REQ 57 to one call per sweep to avoid the potential
of for causing a watchdog timeout and the resulting transition to Stop-Halt mode.

Erase Cycles
The flash component on the PACSystems CPU is rated for 100K erase cycles. Erase cycles occur
under the following conditions:
 Write to flash is commanded from the programmer.
 Clear flash operation.
 Flash compaction after a power cycle when flash memory allotted for SVC_REQ 57 has become
full.
Discrete Memory
Discrete memory can be written to as individual bits or as bytes. For more information, see Address.
Force and transition information is not written to nonvolatile storage.
Retentiveness
Writing values to nonvolatile storage for non-retentive memory such as %T does not make the
memory retentive. For example, all values stored to %T memory are set to zero on power-up or a
stop to run transition. You can, however, read such values from storage after power-up or stop to run
transition by using SVC_REQ 56.
Maximum of One Active Instruction
When SVC_REQ 57 is active, it does not support an interrupt that attempts to activate SVC_REQ 56 or
a second instance of SVC_REQ 57.
Storage Disabled Conditions
By default, the following write operations disable SVC_REQ 57 until logic is written to nonvolatile
storage:
 Run Mode Store (RMS), even if a second RMS reverts everything to the original state
 Test-Edit session, even when you cancel your edits
 Word-for-word change
 Downloading to RAM only of a stopped PACSystems CPU, even if the downloaded contents are
equal to the contents already on the nonvolatile storage
Setting bit 0 of input word 4 (address + 4) to a value of 1 enables SVC_REQ 57 despite the above
conditions.
Error Checking
When writing to nonvolatile storage, error checking is provided to ensure that logic and the
Hardware Configuration (HWC) in nonvolatile memory match the logic and HWC in PACSystems RAM.
Fragmentation
Due to the nature of the media in PACSystems CPUs, writes may produce fragmentation of the
memory. That is, small portions of the memory may become unavailable, depending upon the
sequence of the writes and the size of each one. Data is stored on the device in 128 512-byte
sections. Each section uses 12 bytes of bookkeeping information, leaving a maximum of 64,000 bytes
devoted to the reference data and command data for each invocation. However, the data for a
single invocation cannot be split across sections. So, if there is insufficient space in the currently used
section to contain the new data, the unused portion of that section becomes lost.
Example: Suppose that the current operation is writing 64 bytes of reference data and 8 bytes of
command data (72 bytes total). If there are only 71 bytes remaining in the current section, the new
data will be written to a new section and the unused 71 bytes in the old section become unavailable.

When nonvolatile storage is full

When logic driven user nonvolatile storage is full, a fault is logged. Before you can use SVC_REQ 57 to
write again, use one of the following solutions:
To retain the most up-to-date data and continue writing with SVC_REQ 57 to nonvolatile storage:
1. Stop the PACSystems.
2. Power cycle the PACSystems.
A power cycle when nonvolatile storage is full triggers a compaction of existing data. During
compaction, multiple writes of the same reference memory address are removed, which leaves
only the most recent data, and contiguous reference memory addresses are combined into the
fewest number of records necessary.
If compaction cannot take place, a second fault is logged and you need to use one of the
following two solutions.
To retain specific data from nonvolatile storage, clear nonvolatile storage, and then return the
data to nonvolatile storage:
1. While the controller is still running, use SVC_REQ 56 to read the desired values into PACSystems
memory.
2. Upload the current values from controller memory as initial values to your project.
3. Stop the controller.
4. Do one of the following:
Clear the flash memory, or
Write to flash. The flash is erased prior to writing, which frees up some space.
5. Download the initial values to the controller.
6. Start the controller.
7. Use SVC_REQ 57 to write the desired values from controller memory to nonvolatile storage.
To write to flash to erase everything:
1. Stop the Controller.
2. Write to flash. The flash is erased prior to writing, which frees up some space.
Equality
Because data in nonvolatile storage is not considered part of the project, writing to nonvolatile
storage does not impact equality between the CPU and Logic Developer.
Redundancy
Redundancy systems can benefit from the use of logic driven user nonvolatile storage as long as all
of the references saved to nonvolatile storage are included in the transfer lists. Each redundancy CPU
maintains its own separate logic driven user nonvolatile storage by means of SVC_REQ 57 during its
logic scan. If the values of reference addresses to be stored to user nonvolatile storage are
synchronized, the logic driven user nonvolatile storage data in each CPU is identical. If the values to
be stored are not synchronized, then each CPU’s user nonvolatile storage may be different.
ENO and power flow to the right
If the status is Success or Partial Read, then on the SVC_REQ instruction, ENO is set to True in FBD
and ST, and power flow passes to the right in LD.

9.33.1 Parameter Block for SVC_REQ 57

Address+0 Memory type. See “Memory Type Codes” on page 420
Address+1 The zero-based offset N to write to nonvolatile storage. Contains the complete offset for any
memory area except %W, which also requires the use of address + 2 for offsets greater
Address+2
than 65,535.
reference address. For example, to read from the one-based bit reference address %T33,
enter the byte offset 4: (33 - 1) / 8 = 4.
N = Ra - 1. For example, to read from the one-based reference address %R200, enter the zero-
based reference offset 199; to read from %I73 in bit mode, enter offset 72. For memory-in-bit
mode, the offset must be set on a byte boundary, that is, a number exactly divisible by 8:
0, 8, 16, 24, and so on.
Address+3 Length. The number of items to write to nonvolatile storage beginning at the reference address
calculated from the offset defined at [address + 1 and address + 2]. The length can be one of the
following:
Description Valid range
The number of words (16-bit registers) to read 1 through 32 words
from %W, %R, %AI, or %AQ nonvolatile storage
The number of bytes to read from %I, %Q, %M, 1 through 64 bytes
%T, or %G in byte mode nonvolatile storage
The number of bits to read from %I, %Q, %M, %T, 1 through 512 bits in
or %G in bit mode nonvolatile storage increments of 8 bits
The value must reside in the low byte of address + 3. The high byte must be set to zero.
Address + 4 When bit 0 is set to 1, storage disabled conditions, described on page 423, are ignored. A write is
allowed even if the logic in RAM has changed since nonvolatile storage was read or written.
Bits 1 through 15 must be set to zero; otherwise, the write fails.
Address+5 Reserved. Value must be set to zero.
Address+6 Response status. The low byte contains the major error code; the high byte contains the minor
error code.
Address+7 Count of items written: Words, bytes or bits. Calculated from the first word that changed to the
end of the array.
Address+8
The number of bytes available in nonvolatile storage.
Address+9
Address+10
Reserved.
Address+11

Response Status Codes for SVC_REQ 57

Minor Major Description
00 01 Success. All values requested were written.
01 01 Existing values found. All values requested are in storage, but one or more values were
already stored.
01 02 Insufficient source memory. Counting from the offset, not enough reference addresses
are left in the specified memory area.
02 02 Invalid length. The length requested was larger than 64 bytes or less than 1 byte or the
number of bits is not divisible by 8.
03 02 Invalid source reference address. The memory area specified is not supported, the
starting or ending offset is out of range, or the offset is not byte-aligned for discrete
memory areas.
04 02 Invalid request. Spare bits or spare words in the parameter block are not set to zero.
01 03 Storage busy. A SVC_REQ 56 or another SVC_REQ 57 instruction is active. For example, an
interrupt block is attempting to execute SVC_REQ 57 when the block it interrupted was
executing SVC_REQ 57.
01 04 Storage disabled. The logic in RAM differs from the logic stored in nonvolatile storage. See
“Storage Disabled Conditions” on page 423,
02 04 Storage closed. Either the storage has not been created or a previous corruption error or
unexpected read/write failure closed the storage.
01 05 Unexpected write failure. The command to the storage hardware failed unexpectedly.
02 05 Corrupted storage. The write failed due to a bad checksum or corrupted storage header
information.
01 06 Write failed. Storage is full.

SVC_REQ 57 Example
The following LD logic writes ten continuous bytes to nonvolatile storage, ranging from %G1 through
%G80. The value applied to IN1, 56, determines byte mode.
The parameter block starts at %R00050. The response words are returned to %R00056—%R00059.
Parameter Block for SVC_REQ 57 Example

Address + Offset Address Input Value Definition
Address+0 %R00050 56 Data type = %G (byte mode)
Address+1 %R00051 0 Address written from, low word
Address+2 %R00052 0 Address written from, high word
Address+3 %R00053 10 Length = 10 bytes
Address+4 %R00054 0 Storage disabled conditions are enforced
Address+5 %R00055 0 Reserved, must be set to 0
Address+6 %R00056 NA Response status. The low byte contains the major error code;
the high byte contains the minor error code.
Address+7 %R00057 NA Count of items written: Words, bytes or bits.
Address+8 %R00058 NA
The number of bytes available in nonvolatile storage.
Address+9 %R00059 NA
Address+10 %R00060 NA Reserved
Address+11 %R00061 NA Reserved


Chapter 10 PID Built-In Function Block
This chapter describes the PID (Proportional plus Integral plus Derivative) built-in function block,
which is used for closed-loop process control. The PID function compares feedback from a process
variable (PV) with a desired process set point (SP) and updates a control variable (CV) based on the
error.
The PID function uses PID loop gains and other parameters stored in a 40-word reference array of
16-bit integer words to solve the PID algorithm at the desired time interval.
Figure 27:PID in Ladder Diagram Figure 28: PID in Function Block Diagram
This chapter presents the following topics:

 Operands of the PID Function
 Reference Array for the PID Function
 PID Algorithm Selection and Gain Calculations
 Determining the Process Characteristics
 Setting and Tuning Loop Gains
 Example

Chapter 10. PID Built-In Function Block
10.1. Operands of the PID Function
10.1.1 Operands for LD Version of PID Function Block

Instance Variable name of the PID WORD R, L, P, W No
(????) Parameter Block array, which contains user- and symbolic
configurable and internal parameters,
described on page 432. Uses 40 words that
cannot be shared.
SP The control loop or process set point. Set INT, BOOL All except S, SA, SB, No
using process variable counts, the PID array of length and SC
function adjusts the output control variable 16 or more,
so that the process variable matches the set Constant
point (zero error).
PV Process Variable input from the process INT, BOOL All except S, SA, SB, No
being controlled. Often a %AI input. array of length and SC, and
16 or more constant
MAN While Power Flow is received, the PID Power Flow NA No
function block is held in manual mode. If no
Power Flow is received the PID function
block is in Auto mode.
UP While Power Flow is received, the Manual Power Flow NA No
Command is increased by 1 each user
configured Sample Period.
DN While Power Flow is received, the Manual Power Flow NA No
Command is decreased by 1 each user
configured Sample Period.
CV The control variable output to the process. INT, BOOL All except %S and No
Often a %AQ output. array of length constant
16 or more

10.1.2 Operands for FBD Version of PID Function Block

Control Instance Variable name of the PID WORD R, L, P, W No
Structure Parameter Block array, which contains and symbolic
Variable user-configurable and internal parameters,
described on page 432. Uses 40 words that
cannot be shared.
Function Calculated by the FBD editor. Can be NA NA No
block solve changed by the user.
order – FBD
version
SP The control loop or process set point. Set INT, BOOL array of All except S, SA, SB, No
using process variable counts, the PID length 16 or more, and SC
function adjusts the output control Constant
variable so that the process variable
matches the set point (zero error).
PV Process Variable input from the process INT, BOOL array of All except S, SA, SB, No
being controlled. Often a %AI input. length 16 or more SC and constant
MAN When energized to 1 (through a contact), BOOL, Power Flow All No
the PID function block is in manual mode.
If this input is 0, the PID block is in
automatic mode.
UP If energized along with MAN, increases BOOL, Power Flow All No
the control variable by 1 CV count per
solution of the PID function block.
DN If energized along with MAN, decreases BOOL, Power Flow All No
the control variable by 1 CV count per
solution of the PID function block.
CV The control variable output to the INT, BOOL array of All except %S and No
process. Often a %AQ output. length 16 or more constant

10.2. Reference Array for the PID Function

This parameter block for the PID function occupies 40 words of memory, located at the starting
Instance Variable specified in the PID function block operands. Some of the words are configurable.
Other words are used by the CPU for internal PID storage and are normally not changed.
Every PID function call must use a different 40-word memory area, even if all the configurable
parameters are the same.
The configurable words of the reference array must be specified before executing the PID function.
Zeros can be used for most default values. Once suitable PID values have been chosen, they can be
defined as constants in BLKMOV functions so the program can set and change them as needed.
The LD version of the PID function does not pass power flow if there is an error in the configurable
parameters. The function can be monitored using a temporary coil while modifying data.
10.2.1 Scaling Input and Outputs
All parameters of the PID function are 16 bit integer words for compatibility with 16 bit analog
process variables. Some parameters must be defined in either PV counts or units or in CV counts or
units.
The SP input must be scaled over the same range as the PV, because the PID function calculates
error by subtracting these two inputs.
The process PV and control CV counts do not have to use the same scaling. Either may be -32000 or
0 to 32000 to match analog scaling, or from 0 to 10000 to display variables as 0.00% to 100.00%. If
the process PV and control CV do not use the same scaling, scale factors are included in the PID
gains.
10.2.2 Reference Array Parameters
Note: Machine Edition software allows you to modify the configurable parameters for a PID
instruction in real time in online programmer mode. To customize PID parameters, right click
the PID function and select Tuning.
Low Bit
Words Parameter/Description Range
Units
1 Loop Number Integer 0 to 255 (for
(Address+0) Optional number of the PID block. It provides a common identification user display
in the CPU with the loop number defined by an operator interface only)
device.
2 Algorithm - Set by the
(Address+1) 1 = ISA algorithm CPU
2 = Independent algorithm
3 Sample Period 10ms. 0 (every
(Address+2) The shortest time, in 10ms. increments, between solutions of the PID sweep) to
algorithm. For example, use a 10 for a 100ms. sample period. 65535
Minimum time of 10ms is enforced by the block if the sweep<10ms) (10.9 Min) At
least 10ms.

Low Bit
Units
4,5 Dead Band + PV Dead Band +:
(Address+3, Dead Band – Counts 0 to 32767
Address+4) Integral values defining the upper (+) and lower (-) Dead Band limits. If (never
no Dead Band is required, these values must be 0. If the PID Error (SP - negative)
PV) or (PV - SP) is above the (-) value and below the (+) value, the PID Dead Band -: -
calculations are solved with an Error of 0. If non-zero, the (+) value 32768 to 0
must greater than 0 and the (-) value less than 0 or the PID block will (never
not function. positive)
Leave these at 0 until the PID loop gains are set up or tuned. A Dead
Band might be added to avoid small CV output changes due to
variations in error.
6 PID_IND: Proportional Gain (Kp) 0.01 0 to 327.67%
PID_ISA: Controller gain (Kc = Kp) CV%/PV%
(Address+5)
PID_IND: Change in the control variable in CV Counts for a 100 PV
Count change in the Error term. Entered as an integer representing a %CV/%PV
fixed-point decimal ratio with two decimal places. Displayed as a
ratio of percentages with two decimal places.
For example, a Kp entered as 450 is displayed as 4.50 and results in a
Kp * Error / 100 or 450 * Error / 100 contribution to the PID Output.
PID_ISA: Same as PID_IND.
Kp is generally the first gain set when adjusting a PID loop.
7 PID_IND: Derivative Gain (Kd) 0.01 sec 0 to 327.67
(Address+6) PID_ISA: Derivative Time (Td = Kd) sec
PID_IND: Change in the control variable in CV Counts if the Error or PV
changes 1 PV Count every 10ms. Entered as an integer representing a
fixed-point decimal time in seconds with two decimal places. The
least significant digit represents 0.01 second (10ms.) units. Displayed
as seconds with two decimal places.
For example, Kd entered as 120 is displayed as 1.20 Sec and results in
a Kd * Δ Error / delta time or 120 * 4 / 3 contribution to the PID Output
if Error changes by 4 PV Counts every 30ms. Kd can be used to speed
up a slow loop response, but is very sensitive to PV input noise. This
noise sensitivity can be reduced by using the derivative filter, which is
enabled by setting bit 5 of the Config Word (see page 435.)
PID_ISA: The ISA derivative time in seconds, Td, is entered and
displayed in the same way as Kd. Total derivative contribution to PID
Output is Kc * Td * Δ Error / dt.

Low Bit
Units
8 PID_IND: Integral Rate (Ki) Repeats/ 0 to 32.767
(Address+7) PID_ISA: Integral Rate (1/Ti = Ki) 0.001 repeats/sec
PID_IND: Rate of change in the control variable in CV Counts per Sec
second when the Error is a constant 1 PV Count. Entered as an integer
representing a fixed-point decimal rate with three decimal places. The
least significant digit represents 0.001 counts per second, or 1 count
per 0.001 second. Displayed as Repeats/Sec with three decimal
places.
For example, Ki entered as 1400 is displayed as 1.400 Repeats/Sec
and results in a Ki * Error * dt or 1400 * 20 * 50/1000 = 1,400
contribution to PID Output for an Error of 20 PV Counts and a 50ms.
CPU sweep time (Sample Period of 0).
PID_ISA: The ISA Integral Time in seconds, Ti, must be inverted and
entered, as integral rate, as described for PID_IND. Total integral
contribution to PID Output is Kc * Ki * Error * dt.
Ki is usually the second gain set after Kp.
9 CV Bias/Output Offset CV -32768 to
(Address+8) Number of CV Counts added to the PID Output before the rate and Counts 32767
amplitude clamps. It can be used to set non-zero CV values when only (add to PID
Kp Proportional gains are used, or for feed-forward control of this PID output)
loop output from another control loop.
10, 11 CV Upper Clamp CV -32768 to
(Address+9. CV Lower Clamp Counts 32767
Address+10) Number of CV Counts that define the highest and lowest value that CV (Word 10
is allowed to take. These values are required. The Upper Clamp must must be
have a more positive value than the Lower Clamp, or the PID block will greater than
not work. These are usually used to define limits based on physical word 11.)
limits for a CV output. They are also used to scale the Bar Graph
display for CV. The PID block has anti-reset-windup, controlled by bit 4
of the Config Word, to modify the integral term value when a CV
clamp is reached.
12 Minimum Slew Time Seconds 0 (none) to
(Address+11) Minimum number of seconds for the CV output to move from 0 to full / Full 32000 sec
travel of 100% or 32000 CV Counts. It is an inverse rate limit on how Travel to move full
fast the CV output can change. CV travel
If positive, CV cannot change more than 32000 CV Counts times the
solution time interval (seconds) divided by Minimum Slew Time.
For example, if the Sample Period is 2.5 seconds and the Minimum
Slew Time is 500 seconds, CV cannot change more than
32000 * 2.5 / 500 or 160 CV Counts per PID solution.
The integral term value is adjusted if the CV rate limit is exceeded.
When Minimum Slew Time is 0, there is no CV rate limit. Set Minimum
Slew Time to 0 while tuning or adjusting PID loop gains.

Low Bit
Units
13 Config Word Low 6 Boolean
(Address+12) The low 6 bits of this word are used to modify default PID settings. The bits used
other bits should be set to 0.
Bit 0: Error Term Mode.
When this bit has the default value of 0, the error term is SP - PV.
If the Error=SP-PV is positive, the CV output will decrease.
If the Error=SP-PV is negative, the CV output will increase.
This is type of operation is known as reverse acting. A good example is
your home heating system.
When this bit is 1, the error term is PV - SP.
If the Error=PV-SP is positive, the CV output will increase.
If the Error= PV-SP is negative, the CV output will decrease.
This type of operation is known as direct acting. A good example is
your home cooling system.
Bit 1: Output Polarity.
When this bit is 0, the CV output is the output of the PID calculation.
When it is set to 1, the CV output is the negated output of the PID
calculation. Setting this bit to 1 inverts the Output Polarity so that CV is
the negative of the PID output rather than the normal positive value.
Bit 2: Derivative Action on PV.
When this bit is 0, the derivative action is applied to the error term.
When it is set to 1, the derivative action is applied to PV only.
Bit 3: Deadband action.
When the Deadband action bit is 0, the actual error value is used for
the PID calculation.
When the Deadband action bit is 1, deadband action is chosen. If the
error value is within the deadband limits, the error used for the PID
calculation is forced to be zero. If, however, the error value is outside
the deadband limits, the magnitude of the error used for the PID
calculation is reduced by the deadband limit (|error| = |error –
deadband limit|).
Bit 4: Antireset windup action.
When this bit is 0, the antireset-windup action uses a reset (integral
term) back-calculation. When the output is clamped, the accumulated
integral term is replaced with whatever value is necessary to produce
the clamped output exactly.
When the bit is 1, the accumulated integral term is replaced with the
value of the integral term at the start of the calculation. In this way,
the preclamp integral value is retained as long as the output is
clamped. This option is not recommended for new applications. See
“CV Amplitude and Rate Limits” on page 443.
Bit 5: Enable derivative filtering.
When this bit is set to 0, no filtering is applied to the derivative term.
When set to 1, a first order filter is applied. This will limit the effects of
higher frequency process disturbances, such as measurement noise,
on the derivative term.

Low Bit
Units
14 Manual Command CV Tracks CV in
(Address+13) Set to the current CV output while the PID block is in Automatic mode. Counts Auto or sets
When the block is switched to Manual mode, this value is used to set CV in Manual
the CV output and the internal value of the integral term within the
Upper and Lower Clamp and Slew Time limits.
15 Control Word Maintained Boolean
by the CPU,
(Address+14) If the Override bit (bit 0) is set to 1, the Control Word and the internal unless bit 0
SP, PV and CV parameters must be used for remote operation of the (Override)
PID block (see below). This allows a remote operator interface device, is set to 1.
such as a computer, to take control away from the application
program.
Caution
If you do not want to allow remote
operation of the PID block, make sure
the Control Word is set to 0. If the low
bit is 0, the next 4 bits can be read to
track the status of the PID input
contacts as long as the PID Enable
contact has power.
Control Word is a discrete data structure with the first five bit
positions defined in the following format:
Word Status or
Bit Function
Value External Action if Override bit is set to 1:
If 0, monitor block contacts below. If 1, set
0 1 Override
them externally.
Manual If 1, block is in Manual mode. If other
1 2
/Auto numbers, it is in Automatic mode.
Should normally be 1. Otherwise block is
2 4 Enable
never called.
UP If 1 and Manual (Bit 1) is 1, CV is
3 8
/Raise incremented every solution.
DN If 1 and Manual (Bit 1) is 1, CV is
4 16
/Lower decremented every solution.
16 Internal SP Set and Non-
maintained
(Address+15) Tracks the SP input. If Override = 1, must be set externally to solve the by the CPU,
configurable,
PID algorithm using an alternate SP value. The original SP value is unless bit 0 unless bit 0
maintained until overwritten. (Override) (Override) of
of Control Control Word
Word is set
is set to 1.
to 1.

Low Bit
Units
17 Internal CV Set and Non-
maintained
(Address+16) Tracks CV output. by the CPU.
configurable.
18 Internal PV Set and Non-

maintained
(Address+17) Tracks PV input. Must be set externally if Override bit is set to 1. by the CPU,
configurable,
unless bit 0 unless bit 0
(Override) (Override) of
of Control Control Word
Word is set
is set to 1.
to 1.
19 Output Set and Non-

maintained
(Address+18) A Signed word value representing the output of the function block configurable.
by the CPU.
before the optional inversion. If the output polarity bit in the Config
Word is set to 0, this value equals the CV output. If the output polarity
bit is set to 1, this value equals the negative of the CV output.
20 Derivative Term Storage
(Address+19) Used internally for storage of intermediate values. Do not write to this
location.
21, 22 Integral Term Storage
(Address+20. Used internally for storage of intermediate values. Do not write to
Address+21) these locations.
23 Slew Term Storage
(Address +22) Used internally for storage of intermediate values. Do not write to this
location.
24 – 26 Previous Solution Time Set and Non-
maintained
(Address+23 Internal storage of time of last PID solution. Normally do not write to configurable.
by the CPU.
– these locations. Some special circumstances may justify writing to
Address+25) these locations.
Note: If you call the PID block in Automatic mode after a long delay,
you might want to use SVC_REQ #16 or SVC_REQ #51 to load
the current CPU elapsed time clock into Word 24 to update
the last PID solution time to avoid a step change of the
integral term.
27 Integral Remainder Storage Set and Non-
maintained
(Address+26) Holds remainder from integral term scaling. configurable.
by the CPU.
28, 29 SP, PV Lower Range PV -32768 to

(Address+27, SP, PV Upper Range Counts 32767
Address+28) Optional integer values in PV Counts that define high and low display
values for SP and PV. (Word 29 must be greater than word 28.)
30 Reserved N/A Non-
(Address+29) Word 30 is reserved. Do not use this location. configurable.

Low Bit
Units
31, 32 Previous Derivative Term Storage Set and Non-
maintained
(Address+30, Used in calculations for derivative filter. Do not write to these by the CPU.
configurable.
Address+31) locations.
33 – 40 Reserved N/A Non-
(Address+32 Words 32-39 are reserved. Do not use these references. configurable
–
Address+39)

10.3. Operation of the PID Function

10.3.1 Automatic Operation
When the PID function block is called, it compares the current CPU time with the last PID solution
time stored in the reference array. If the interval between the two times is equal to or greater than
the Sample Period (word 3 of the reference array) and also equal to or greater than 10 milliseconds,
the PID algorithm is solved using this time interval. Both the last solution time and CV output are
updated. In Automatic mode, the output CV is copied to the Manual Command parameter (word 14
of the reference array).
Note: If you call the PID block in Auto mode after a long delay, you may want to use SVC_REQ 16 or
SVC_REQ 51 to load the current CPU time into the stored previous solution time (word 24 of
the reference array, described on page 437). This will update the last PID solution time and
avoid a large step change of the integral term. Another method to prevent the step change
is to copy the PV value to the SP before placing the loop into Auto.
10.3.2 Manual Operation
The PID function block is placed in Manual mode by providing power flow to both the Enable and
Manual input contacts. The output CV is set from the Manual Command parameter. If either the UP or
DN inputs have power flow, the Manual Command word is incremented (UP) or decremented (DN) by
one CV count every PID Sample Period. For faster manual changes of the output CV, it is also possible
to add or subtract any CV count value directly to/from the Manual Command word (word 14 of the
reference array).
The PID function block uses the CV Upper Clamp and CV Lower Clamp parameters to limit the CV
output. If a positive Minimum Slew Time (word 12 of the reference array) is defined, it is used to limit
the rate of change of the CV output. If either CV Clamp or the rate of change limit is exceeded, the
value of the integral (reset) term is adjusted so that CV is at the limit. The anti-reset-windup feature
assures that when the error term tries to drive CV above (or below) the clamps for a long period of
time, the CV output will move off the clamp immediately when the error term changes sufficiently.
This operation, with the Manual Command tracking CV in Automatic mode and setting CV in Manual
mode, provides a bump-less transfer from Automatic to Manual mode. The CV Upper and Lower
Clamps and the Minimum Slew Time always apply to the CV output in Manual mode and the integral
term is always updated. This assures that when a user rapidly changes the Manual Command value
in Manual mode, the CV output cannot change any faster than the slew rate limit set by the Minimum
Slew Time, and the CV cannot go above the CV Upper Clamp limit or below the CV Lower Clamp limit.
In order to assure a bump-less transfer from Manual back to Automatic mode, the user program
should copy the PV to the SP before switching back to Automatic mode. This allows the algorithm to
update the last sample period time and prepare to re-calculate CV based upon the new Auto Mode
SP commanded.

10.3.3 Time Interval for the PID Function

The start time of each CPU sweep is used as the current time when calculating the time interval
between solutions of the PID function. The times and time intervals have a resolution of 100
microseconds. When an application uses multiple PID functions, all of them use the same time value.
The PID algorithm is solved when the current time is equal to or greater than the time of the last PID
solution plus the Sample Period or 10 milliseconds; whichever is larger. If the Sample Period is set for
execution on every sweep (value = 0), the PID function is restricted to a minimum of 10 milliseconds
between solutions. If the sweep time is less than 10 milliseconds, the PID function waits until
enough sweeps have occurred to accumulate an elapsed time of at least 10 milliseconds. For
example, if the sweep time is 9 milliseconds, the PID function executes every other sweep, and the
time interval between solutions is 18 milliseconds. If a specific PID function is executed more than
once per sweep (by referencing the same reference array location in multiple PID function blocks),
the algorithm is solved only on the first call.
The longest possible interval between executions is 65,535 times 10 milliseconds, or 10 minutes,
55.35 seconds.

10.4. PID Algorithm Selection (PIDISA or PIDIND) and Gain

Calculations
The PID function supports both the Independent Term (PID_IND) and ISA standard (PID_ISA) forms of
the PID algorithm. The Independent Term form takes its name from the fact that the coefficients for
the proportional, integral and derivative terms act independently. The ISA algorithm is named for the
Instrument Society of America (now the International Society for Measurement and Control), which
standardized and promoted it.
The two algorithms differ in how words 6 through 8 of the reference array are used and in how the
PID output (CV) is calculated.
The Independent term PID (PID_IND) algorithm calculates the output as:
PID Output = Kp * Error + Ki * Error * dt + Kd * Derivative + CV Bias
where Kp is the proportional gain, Ki is the integral rate, Kd is the derivative time, and dt is the time
interval since the last solution.
The ISA (PID_ISA) algorithm has different coefficients for the terms:
PID Output = Kc * (Error + Error * dt/Ti + Td * Derivative) + CV Bias
where Kc is the controller gain, Ti is the Integral time and Td is the Derivative time. The advantage of
PID_ISA is that adjusting Kc changes the contribution for the integral and derivative terms as well as
the proportional term, which can simplify loop tuning.
If you have the PID_ISA Kc, Ti and Td values, use the following equations to convert them to use as
PID_IND parameters:
Kp = Kc, Ki = Kc/Ti, and Kd = Kc * Td
The following diagram shows how the PID_IND algorithm works:
CV
Proportional Term =
Bias
Error Term Kp * Error
SP Sign
+/-
Integral Term =
Dead Slew Upper / Lower Polarity
Band
Previous Integ. Term + + CV
Limit Clamp
Ki * Error * ΔTime
-/+
PV Deriv Action Derivative Term =
Δ Value
Δ Value
Δ Time Kd *
Δ Time
Figure 29: PID_IND Diagram

The ISA Algorithm (PID_ISA) is similar except that its Kc gain coefficient is applied after the three
terms are summed, so that the integral gain is Kc / Ti and the derivative gain is Kc * Td.
Bits 0, 1 and 2 in the Config Word set the Error sign, Output Polarity and Derivative Action,
respectively.

10.4.1 Derivative Term

The Derivative Term is Kd (word 7 of the reference array) multiplied by the time rate of change of the
Error term in the interval since the last PID solution.
Derivative = Kd * ΔError / dt = Kd * (Error – previous Error) / dt
where
dt = Current controller time – controller time at previous PID solution.
Two bits in the Config Word (word 13 of the reference array) affect the calculation of ΔError: Error
Term Mode and Derivative Action. For additional information about the operation of these bits, see
“Config Word” on page 435.
10.4.2 Error Term Mode
The sign of the Error term is determined by the value of a mode bit in the reference array for the PID
function.
In reverse acting mode, the change in the error term is:
ΔError = (Error – previous Error) = ΔSP – ΔPV
where
ΔPV = (PV – previous PV), and ΔSP = (SP – previous SP).
However, in direct acting mode, the error term is (PV – SP), the sign of the change in the error term is
reversed:
ΔError = (Error – previous Error) = = ΔPV – ΔSP.
10.4.3 Derivative Action on PV Bit
By default, the change in the error term depends on changes in both SP and PV. If SP is constant,
ΔSP = 0, and SP has no effect on the derivative term. When SP changes, however, it can cause large
transient swings in the derivative term and hence the output. Loop stability can be improved by
eliminating the effect of SP changes on the derivative term.
To calculate the Derivative based only on the change in PV, set bit 2 of the Config Word to 1. This
modifies the equations above by assuming SP is constant (ΔSP = 0).
10.4.4 Combined Operation of Error Term and Derivative Action Modes
Bit 0 of Config Word Bit 2 of Config Word
Error Term Value
Value Error Term Mode Value Derivative Action
0 Reverse Acting (default) 0 ΔSP included ΔSP –Δ PV
1 Direct Acting 0 ΔSP included ΔPV –Δ SP
0 Reverse Acting (default) 1 ΔSP ignored –ΔPV
1 Direct Acting 1 ΔSP ignored ΔPV

10.4.5 CV Bias Term

The CV Bias term (word 9 in the reference array) is an additive term separate from the PID inputs. It
may be useful if you are using only Proportional gain (Kp) and you want the CV to be a non-zero value
when the PV equals the SP and the Error is 0. In this case, set the CV Bias to the desired CV when the
PV is at the SP. CV Bias can also be used for feed forward control where another PID loop or control
algorithm is used to adjust the CV output of this PID loop.
If a non-zero Integral rate is used, the CV Bias will normally be 0 as the integral term acts as an
automatic bias or “reset.” Just start up in Manual mode and use the Manual Command word
(word 14 of the reference array) to set the desired CV, and then switch to Automatic mode. This will
immediately calculate the required value for the integral term.
10.4.6 CV Amplitude and Rate Limits
The PID block does not send the calculated Output directly to CV. Both PID algorithms can impose
amplitude and rate of change limits on the output Control Variable. If the Minimum Slew Time (word
12 of the reference array) is non-zero, the rate of change (slew rate) limit is determined by dividing
the maximum CV value (32,000) by the Minimum Slew Time. For example, if the Minimum Slew Time is
100 seconds, the rate limit will be 320 CV counts per second. If the solution interval was 50
milliseconds, the new CV output cannot change more than 320*50/1000 or 16 CV counts from the
previous CV output.
The CV output is then compared to the CV Upper Clamp and CV Lower Clamp values (words 10 and
11 of the reference array). If CV is outside either limit, the CV output is clamped to the appropriate
limit value. When the CV output is modified to impose either slew rate or amplitude limits (or both) the
stored integral term would normally accumulate a large value over time. This phenomenon is known
as “reset windup.” Reset windup introduces errors in CV after the PID output no longer needs to be
limited. For example, windup would prevent the CV output from moving off a clamp value
immediately.
There are two optional methods for preventing reset windup. If the Anti-reset-windup Action bit (bit 4)
of Config Word (word 13 of the reference array) is zero (the default), the integral term is adjusted at
each PID solution to match the error input and limited CV output exactly. When PV changes while CV
is clamped, or when CV is both rate and amplitude limited in a particular PID solution, this option
assures that a smooth transition will always occur after CV is no longer limited.
If the Anti-reset-windup Action bit of Config Word is set, then the integral term stored on the previous
PID solution is simply retained as long as CV is limited. This option was added to assure compatibility
with existing PID applications when the default action described above was introduced. This option is
not recommended for new applications.
Finally, the PID block checks the Output Polarity (bit 2 of the Config Word) and changes the sign of the
output if the bit is 1.
CV = – (Clamped PID Output) if Output Polarity bit set, or
CV= (Clamped PID Output) if Output Polarity bit cleared.
If the block is in Automatic mode, the final CV is placed in the Manual Command (word 14 of the
reference array). If the block is in Manual mode, the PID equation is skipped because CV is set by the
Manual Command, but the slew rate and amplitude limits are still checked. This assures that the
Manual Command cannot change the output above the CV Upper Clamp or below the CV Lower
Clamp, and the output cannot change faster than allowed by the Minimum Slew Time.

10.4.7 Sample Period and PID Function Block Scheduling

The PID function block is a digital implementation of an analog control function, so the dt sample
time in the PID Output equation is not the infinitesimally small sample time available with analog
controls. The majority of processes being controlled can be approximated as a gain with a first or
second order lag and (possibly) a pure time delay. The PID function block sets a CV output to the
process and uses the process feedback PV to determine an Error to adjust the next CV output. A key
process parameter is the total time constant, which is how fast the process can change PV when the
CV is changed. As discussed in “Determining the Process Characteristics” on page 445, the total time
constant, Tp+Tc, for a first order system is the time required for PV to reach 63% of its final value
when CV is stepped. The PID function block will not be able to control a process unless its Sample
Period is well under half the total time constant. Larger Sample Periods will make it unstable.
The Sample Period should be no bigger than the total time constant divided by 10 (or down to 5
worst case). For example, if PV seems to reach about 2/3 of its final value in 2 seconds, the Sample
Period should be less than 0.2 seconds, or 0.4 seconds worst case. On the other hand, the Sample
Period should not be too small, such as less than the total time constant divided by 1000, or the Ki *
Error * dt term for the PID integral term will round down to 0. For example, a very slow process that
takes 10 hours or 36,000 seconds to reach the 63% level should have a Sample Period of 40 seconds
or longer.
Variations of the time interval between PID function solutions can have short-term effects on the CV
output. For example, if a step change to PV caused by measurement noise occurs between
solutions, the value of the derivative term will be inversely proportional to the time interval. The
performance of PID loops that are tuned for quick response may be improved when the solution
interval is held constant by configuring the CPU for constant sweep mode. Depending on the CPU
model and the application, constant sweep times of 10 milliseconds, integer multiples of 10
milliseconds, or exact divisors of 10 milliseconds (1, 2 or 5 milliseconds) will be possible. The Sample
Period can then be set for a suitable multiple of 10 milliseconds.
If many PID loops are used, allowing the application to solve all the loops on the same sweep may
lead to wide variations in CPU sweep time. If the loops have a common Sample Period that is at least
equal to the number of PID loops times the sweep time, a simple solution is to sequence one or more
1’s through an array of zero‘s and use these bits to enable power flow to individual PID function
blocks. The logic should assure that each PID function block is enabled no more often than its Sample
Period.

10.5. Determining the Process Characteristics

The PID loop gains, Kp, Ki and Kd, are determined by the characteristics of the process being
controlled. Two key questions when setting up a PID loop are:
1. How big is the change in PV when CV is changed by a fixed amount, or what is the open loop
gain of the process?
2. How fast does the system respond, or how quickly does PV change after the CV output is
stepped?
Many processes can be approximated by a process gain, first or second order lag and a pure time
delay. In the frequency domain, the transfer function for a first order lag system with a pure time
delay is:
PV (s )
CV (s ) = G (s ) = Ke −T p /(1+Tc s )
Plotting the response to a step input at time t0 in the time domain provides an open-loop unit
reaction curve:
CV Unit Step Output to Process PV Unit Reaction Curve Input from Process
1 K
0.632K
t0 t0
Tp Tc
The following process model parameters can be determined from the PV unit reaction curve:
K Process open loop gain = final change in PV/change in CV at time t0
(Note no subscript on K)
Tp Process or pipeline time delay or dead time after t0 before the process output PV starts moving
Tc First order Process time constant, time required after Tp for PV to reach 63.2% of the final PV
Usually the quickest way to measure these parameters is by putting the PID function block in Manual
mode, making a small step change in the CV output by changing the Manual Command (word 14 of
the reference array), and then plotting the PV response over time. For slow processes this can be
done manually, but for faster processes a chart recorder or computer graphic data-logging package
will help. The CV step size should be large enough to cause an observable change in PV, but not so
large that it disrupts the process being measured. A good step size may be from 2 to 10% of the
difference between the CV Upper and CV Lower Clamp values.

10.6. Setting Tuning Loop Gains

10.6.1 Basic Iterative Tuning Approach
Because PID parameters are dependent on the process being controlled, there are no predetermined
values that will work. However, a simple iterative process can be used to find acceptable values for
Kp, Ki, and Kd gains.
1. Set all the reference array parameters to 0, then set the CV Upper and CV Lower Clamps to the
highest and lowest CV expected. Set the Sample Period to a value within the range Tc/10 to
Tc/100, where Tc is the estimated process time constant defined on page 445.
2. Put the PID function block in Manual mode and set the Manual Command (word 14 in the
reference array) to different values to check if CV can be moved to Upper and Lower Clamp.
Record the PV value at some CV point and load it into SP.
3. Set a small gain, such as 100 * Maximum CV/Maximum PV, into Kp and turn off Manual mode.
Step SP by 2% to 10% of the Maximum PV range and observe PV response. Increase Kp if PV step
response is too slow or reduce Kp if PV overshoots and oscillates without reaching a steady
value.
4. Once a Kp is found, start increasing Ki to get overshooting that dampens out to a steady value in
two to three cycles. This may require reducing Kp. Also try different SP step sizes and CV
operating points.
5. After suitable Kp and Ki gains are found, try adding Kd to get quicker responses to input changes,
providing it doesn't cause oscillations. Kd is often not needed and will not work with noisy PV.
6. Check gains over different SP operating points and add Dead Band and Minimum Slew Time if
needed. Some Reverse Acting processes may need setting of Config Word Error Term or Output
Polarity bits.
10.6.2 Setting Loop Gains Using the Ziegler and Nichols Tuning Approach
This approach provides good response to system disturbances with gains producing an amplitude
ratio of 1/4. The amplitude ratio is the ratio of the second peak over the first peak in the closed loop
response.
1. Determine the three process model parameters, K, Tp and Tc for use in estimating initial PID loop
gains.
2. Calculate the Reaction rate:
R = K/Tc
3. For Proportional control only, calculate Kp as:
Kp = 1/(R * Tp) = Tc/(K * Tp)
For Proportional and Integral control, use:
Kp = 0.9/(R * Tp) = 0.9 * Tc/(K * Tp) Ki = 0.3 * Kp/Tp
For Proportional, Integral and Derivative control, use:
Kp = G/(R * Tp) where G is from 1.2 to 2.0
Ki = 0.5 * Kp/Tp
Kd = 0.5 * Kp * Tp
4. Check that the Sample Period is in the range
(Tp + Tc)/10 to (Tp + Tc)/1000

10.6.3 Ideal Tuning Method

The “Ideal Tuning" procedure provides the best response to SP changes that are delayed only by the
Tp process delay or dead time.
1. Determine the three process model parameters, K, Tp and Tc for use in estimating initial PID loop
gains.
2. Calculate Kp, Ki, and Kd as follows:
Kp = 2 * Tc/(3 * K * Tp)
Ki = Tc
Kd = Ki/4 if Derivative term is used
3. Once initial gains are determined, convert them to integers.
4. Calculate the Process gain, K, as a change in input PV Counts divided by the resulting output step
change in CV Counts. (Not in process PV or CV engineering units.) Specify all times in seconds.
5. Once Kp, Ki and Kd are determined, Kp and Kd are multiplied by 100 while Ki is multiplied by
1000. The resulting values are entered into the corresponding reference array word locations.

10.7. Example
The following PID example has a sample period of 100ms, a Kp gain of 4.00 and a Ki gain of 1.500.
The set point is stored in %R0001, the control variable is output in %AQ0002, and the process
variable is returned in %AI0003. CV Upper and CV Lower Clamps must be set, in this case to 20000
and 4000, and an optional small Dead Band of +5 and -5 is included. The 40-word reference array
starts in %R0100. Normally, user parameters are set in the reference array, but %M0006 can be set
to re-initialize the 14 words starting at %R0102 (word 3) from constants stored in logic (a useful
technique).
The block can be switched to Manual mode with %M1 so that the Manual Command, %R113, can be
adjusted. Bits %M4 or %M5 can be used to increase or decrease %R113 and the PID CV by 1 every
100ms solution. For faster manual operation, bits %M2 and %M3 can be used to add or subtract the
value in %R2 to/from %R113 every CPU sweep. The %T1 output is on when the PID is OK.
Reference Array Initialization using %M00006
For details on the contents of the reference array, refer to page 432.
Word Function Address Value
3 Sample Period %R102 10
4 + Dead Band %R103 5
5 - Dead Band %R104 5
6 Kp %R105 400
7 Kd %R106 0
8 Ki %R107 1500
9 CV Bias %R108 0
10 CV Upper Clamp %R109 2000
11 CV Lower Clamp %R110 400
12 Minimum Slew Time %R111 0
13 Config Word %R112 0
14 Manual Command %R113 0
15 Control Word %R114 0
16 Internal SP %R115 0

Figure 30: PID Example Logic


Chapter 11 Structured Text (ST) Programming
The Structured Text (ST) programming language is an IEC 61131-3 textual programming language.
This chapter describes how structured text is implemented in PACSystems. For information on using
the structured text editor in the programming software, refer to the online help.
The block types Block, Parameterized Block, and Function Block (UDFB) can be programmed in ST.
The _MAIN program block can also be programmed in ST. For details on blocks, refer to Chapter 5,
“Program Organization”.

Chapter 11. Structured Text (ST) Programming
11.1. Language Overview

11.1.1 Statements
A structured text program consists of a series of statements, which are constructed from expressions
and language keywords. A statement directs the PACSystems controller to perform a specified
action. Statements provide variable assignments, conditional evaluations, iteration, and the ability to
call built-in functions. PACSystems supports the statements described in “Statement Types” on page
455.
11.1.2 Expressions
Expressions use operators to calculate values from variables and constants. An example of a simple
expression is (x + 5).
Composite expressions can be created by nesting simpler expressions, for example,
(a + b) * (c + d) – 3.0 ** 4.
11.1.3 Operators
The table below lists the operators that you can use within an expression. They are listed according
to their evaluation precedence, which determines the sequence in which they are executed within
the expression. The operator with the highest precedence is applied first, followed by the operator
with the next highest precedence. Operators of equal precedence are evaluated left to right.
Operators in the same group, for example + and -, have the same precedence.
Any address operators used in LD can be used on ST operands. Address operators have precedence
over the ST language operators. Address operators include indirect addressing (for example, @Var1),
array indexing (for example, Var1[3]), bit within word addressing (for example, Var1.X[3]), and
structure fields (for example, Var1.field1).

Precedence Operator Operand Types Description

Group 1 (Highest) (…) Parenthesized
expression
Group 2 - INT, DINT, REAL, LREAL Negation
NOT BOOL, BYTE, WORD, DWORD Boolean complement
Group 3 **,^ INT, DINT, UINT, REAL, LREAL 21 Exponentiation 22, 23
Group 4 * INT, DINT, UINT, REAL, LREAL Multiplication22
/ INT, DINT, UINT, REAL, LREAL Division22, 24
MOD INT, DINT, UINT Modulus operation24
Group 5 + INT, DINT, UINT, REAL, LREAL Addition22
- INT, UINT, DINT, REAL, LREAL Subtraction22
Group 6 <, >, <=, >= INT, DINT, UINT, REAL, LREAL, BYTE, WORD, DWORD Comparison
Group 7 = ANY 25 Equality
<>, != ANY25 Inequality
Group 8 AND, & BOOL, BYTE, WORD, DWORD Boolean AND
Group 9 XOR BOOL, BYTE, WORD, DWORD Boolean exclusive OR
Group 10 (Lowest) OR BOOL, BYTE, WORD, DWORD Boolean OR
Some comparison and math operators have corresponding built-in functions. For instance the ‘+’
operator is similar to the ADD_INT function. You can use either the language operator or the built-in
function. The built-in function has the advantage of returning an ENO status. For information on
“Built-in Functions Supported for ST Calls”, see page 457.
Operand Types
Type casting is not supported. To convert a type, use one of the built-in conversion functions. Use of
built-in functions is described in “Function Call” on page 456.
For untyped operators (+, *, …), the types of the operands must match.
21 The base must be type REAL or LREAL. If the base is REAL, the power can be type INT, DINT, UINT, or REAL and
the result is type REAL. If the base is type LREAL, the power must be LREAL and the result will be LREAL
22 Use of math operators can cause overflow or underflow. Overflow results are truncated.
23 If either operand is positive or negative infinity, the result is undefined.
24 The CPU flags a “divide-by-0” error as an application fault.
25 Operators that can take operands of type ANY can be used with any of the supported elementary data types.
The supported data types are: BOOL, INT, DINT, UINT, BYTE, WORD, DWORD, LREAL and REAL. STRING and
TIME data types are not supported

11.1.4 Structured Text Syntax

The syntax of the ST implementation for PACSystems follows the IEC 61131-3 standard.
 Structured Text statements must end in a semi-colon (;).
 Structured Text variables must be declared in the variable list for the target.
These symbols have the following functions.
:= assigns an expression to a variable
; required to designate the end of a statement
[ ] used for array indexing where the array index is an integer. For example, this sets the third
element of an array to the value j+10: intarray[3]: = j + 10;
(* *) designates a comment. These comments can span multiple lines. For example, (*This
comment spans
multiple lines.*)
// or ‘ designates a single line comment. For example,
c :=a+b; //This is a single line comment.
c :=a+b; ‘This is a single line comment.

11.2. Statement Types

The Structured Text statements, which specify the actual program execution, consist of the following
types, which are described in more detail on the following pages.
Statement Type Description Example
Assignment Sets an object to a specified value. A := 1; B := A; C := A + B;
CASE Provides for the conditional execution of a set of CASE A OF
statements. 1,2 : C := 3;
3: C := 4;
4..5: C := 5;
ELSE
C := 0;
END_CASE;
COMMENT Places a text explanation in the program. Ignored by (* This is a block comment *)
the ST compiler. ‘ This is a line comment
// This is a line comment //
Function call Calls a function for execution. FbInst(IN1 := 1, OUT1 => A);
RETURN Causes the program to return from a subroutine. The RETURN;
return statement provides an early exit from a block.
EXIT Terminates iterations before the terminal condition EXIT;
becomes TRUE (1).
IF Specifies that one or more statements be executed IF (A < B) THEN
conditionally. C := 4;
ELSIF (A = B) THEN
C:= 5;
ELSE
C := 6
END_IF;
FOR … DO Executes a statement sequence repeatedly based on FOR I := 1 TO 100 BY 2 DO
the value of a control symbol. IF (Var1 – I) = 40 THEN
Key := I;
EXIT;
END_IF;
END_FOR;
WHILE Indicates that a statement sequence be executed WHILE J <= 100 DO
repeatedly until a Boolean expression evaluates to J := J + 2;
FALSE (0). END_WHILE;
REPEAT Indicates that a statement sequence be executed REPEAT
repeatedly until a Boolean expression evaluates to J := J + 2;
TRUE (1). UNTIL J >= 100
END_REPEAT;
ARG_PRESENT Determines whether a parameter value was present ARG_PRES (IN :=In1, Q:>Out1,
when the function block instance of the parameter ENO:>Out2);
was invoked. For example, a parameter can be
optional (pass by value).
Empty Statement ;

11.2.1 Assignment Statement

The assignment statement replaces the value of a variable with the result of evaluating an
expression (of the same data type).
Notes:
 Assignment statements can affect transition bits.
 Assignment statements take override bits into account.
Format
Variable := Expression;
Where:
Variable is a simple variable, array element, etc.
Expression is a single value, expression, or complex expression.
Examples
Boolean assignment statements:
VarBool1 := 1;
VarBool2 := (val <= 75);
Array element assignment:
Array_1[13] := (RealA /RealB)* PI;
11.2.2 Function Call

The structured text function call executes a predefined algorithm that performs a mathematical, bit
string or other operation. The function call consists of the name of the function or block followed by
required input or output parameters.
The structured text logic can call blocks or the PACSystems built-in functions listed in the table below.
The call must be made in a single statement and cannot be part of a nested expression.
Calls to some functions, such as communications request (COMMREQ), require a command block or
parameter block. For these functions, an array is declared, initialized in logic, and then passed as a
parameter to the function.

Built-in Functions Supported for ST Calls

Note: Only the functions listed in the following table are supported in the current PACSystems
version. Other built-in functions are not supported.
Example: cos(IN := inReal, Q => outReal, ENO => outBool);
Category Functions More information
Advanced Math ASIN, ATAN, ACOS, COS, SIN, TAN Chapter 7
LOG, LN, EXP, EXPT,
SQRT_INT, SQRT_DINT, SQRT_REAL
Math ABS_INT, ABS_DINT, ABS_REAL Chapter 7

SCALE_DINT, SCALE_INT, SCALE_UINT
Communication PNIO_DEV_COMM PACSystems RX3i PROFINET
Controller Manual, GFK-2571
Control DO_IO, MASK_IO_INTR, SCAN_SET_IO, SUS_IO, Chapter 7
SUS_IO_INTR, SVC_REQ, SWITCH_POS, F_TRIG,
R_TRIG
Data BCD4_TO_INT, BCD4_TO_UINT, BCD4_TO_REAL Chapter 7
Conversion BCD8_TO_DINT, BCD8_TO_REAL
DINT_TO_BCD8, DINT_TO_DWORD, DINT_TO_INT,
DINT_TO_UINT, DINT_TO_REAL, DINT_TO_LREAL
DWORD_TO_DINT
INT_TO_BCD4, INT_TO_DINT, INT_TO_UINT,
INT_TO_REAL, INT_TO_WORD
UINT_TO_BCD4, UINT_TO_BCD8, UINT_TO_INT,
UINT_TO_DINT, UINT_TO_REAL, UINT_TO_WORD
REAL_TO_INT, REAL_TO_UINT, REAL_TO_DINT,
REAL_TO_LREAL
LREAL_TO_DINT, LREAL_TO_REAL
TRUNC_INT, TRUNC_DINT
DEG_TO_RAD, RAD_TO_DEG
WORD_TO_INT, WORD_TO_UINT
Data Move ARRAY_SIZE, ARRAY_SIZE_DIM1, ARRAY_SIZE_DIM2, Chapter 7
COMMREQ, MOVE_DATA_EX, SIZE_OF
PACMotion The RX3i CPUs support 56 PLCopen compliant motion PACMotion Multi-Axis Motion
functions and function blocks. Controller User’s Manual, GFK-2448

Calls to Standard Function Blocks

Standard function blocks are instructions that have instance data in the form of a structure variable.
(For more information on function blocks and their instance data, refer to “Functions and Function
Blocks” in Chapter 5.) Standard function blocks are called in the same way that a UDFB is called.
PACSystems controllers support three standard function blocks:
Pulse timer (TP) Generates output pulses of a given duration See page 325
On-delay timer Delays setting an output ON for a fixed period after an input is set See page 324
(TON) ON.
Off-delay timer Delays setting an output OFF for a fixed period after an input goes See page 323
(TOF) OFF so that the output is held on for a given period longer than the
input.
Format of Calls to Standard Timer Function Blocks

Notes: TOF, TON and TP have the same input and output parameters, except for the instance
variable, which must be the same type as the instruction.
Writing or forcing values to the instance data elements IN, PT, Q, ET, ENO or TI may cause
erratic operation of the timer function block.
Instance data can be a variable or a parameter of the current UDFB or parameterized block.
Formal Convention
myTOF_Instance_Data(IN := inBool, PT := inDINT, ET => outDINT, Q => outBool, ENO =>
outBoolSuccess);
myTON_Instance_Data(IN := inBool, PT := inDINT, ET => outDINT, Q => outBool, ENO =>
outBoolSuccess);
myTP_Instance_Data(IN := inBool, PT := inDINT, ET => outDINT, Q => outBool, ENO =>
outBoolSuccess);
Note: ENO is an optional BOOL output parameter. If ENO is used in a statement that uses the formal
convention, the state of outBoolSuccess is set to 1 (call was successful) or 0 (call failed).
Informal Convention
myTOF_Instance_Data(inBool, inDINT, outDINT, outBool);
myTON_Instance_Data(inBool, inDINT, outDINT, outBool);
myTP_Instance_Data(inBool, inDINT, outDINT, outBool);
Note: When using the informal convention, the operands must be assigned in the order shown
above (that is, IN, PT, ET, Q and ENO).
Block Types Supported for ST Calls
An ST block can call blocks of type Block, Parameterized Block, or user defined Function Block (UDFB)
or External Block (C block). For more information on block types, refer to Chapter 5.

Formal Calls vs. Informal Calls

PACSystems supports formal and informal calls in ST.
Formal Calls Informal Calls
Input parameter assignments use the ‘:=’ notation Input and output parameters are listed in parentheses.
while output assignments use the ‘=>’ notation.
Optional parameters can be omitted. Parameters cannot be omitted.
Parameters can be in any order. Parameters must be in the correct order as follows:
Inputs
Instance location (if required)
Length parameter (if required)
Outputs, starting with the last output parameter.
The ENO parameter is specified in a formal The ENO parameter is not specified in an informal
function or block call. function or block call.
All built-in functions and user-defined blocks have
an optional ENO output parameter indicating the
success of the function or block. Either ENO or Y0
can be used as this output parameter name.
Format of Formal Function Call

FunctionName(IN1 := inparam1, IN2 := inparam2, OUT1 => outparam1, ENO => enoparam);
Format of Informal Function Call
FunctionName(inparam1, inparam2, outparam1);
Example
This code fragment shows the TAN function call.
TAN( AnyReal, Result );

11.2.3 RETURN Statement

The return statement provides an early exit from a block. For example, in the following lines of code
the third line will never execute. The variable a will have the value 4.
a := 4;
RETURN;
a := 5;

11.2.4 IF Statement
The IF construct offers conditional execution of a statement list. The condition is determined by result
of a Boolean expression. The IF construct includes two optional parts, ELSE and ELSIF, that provide
conditional execution of alternate statement list(s). One ELSE and any number of ELSIF sections are
allowed per IF construct.
Format
IF BooleanExpression1 THEN
StatementList1;
[ELSIF BooleanExpression2 THEN (*Optional*)
StatementList2;]
[ELSE (*Optional*)
StatementList3;]
END_IF;
Where:
BooleanExpression Any expression that resolves to a Boolean value.
StatementList Any set of structured text statements.
Note: Either ELSIF or ELSEIF can be used for the else if clause in an IF statement.
Operation
The following sequence of evaluation occurs if both optional parts are present:
■ If BooleanExpression1 is TRUE (1), StatementList1 is executed. Program execution continues with
the statement following the END_IF keyword.
■ If BooleanExpression1 is FALSE (0) and BooleanExpression2 is TRUE (1), StatmentList2 is executed.
Program execution continues with the statement following the END_IF keyword.
■ If both Boolean expressions are FALSE (0), StatmentList3 is executed. Program execution
continues with the statement following the END_IF keyword.
If an optional part is not present, program execution continues with the statement following the
END_IF keyword.
Example
The following code fragment puts text into the variable Status, depending on the value of I/O point
input value.
IF Input01 < 10.0 THEN
Status := Low_Limit_Warning;
ELSIF Input02 > 90.0 THEN
Status := Upper_Limit_Warning;
ELSE
Status := Limits_OK;
END_IF;

11.2.5 CASE Statement

The CASE …. OF construct offers conditional execution of statement lists. It uses the value of an ST
integer expression to determine whether to execute a statement list. The statement list to be
executed can be selected from multiple statement lists, depending on the value of the associated
integer expression.
Conditions can be expressed as a single value, a list of values, or a range of values. The single-value,
list of values, or range forms can be used by themselves or in combination. The optional ELSE
keyword can be used to execute a statement list when the associated value does not meet any of
the specified conditions.
You can have a maximum of 1024 cases in a single CASE … OF construct. Additional cases can be
handled by adding the ELSE keyword to the construct and specifying a nested CASE … OF construct
or an IF … THEN construct after the ELSE.
The number of nested CASE … OF constructs and the number of levels are limited by the memory in
your computer.
The number of constants and constant ranges in a single conditional statement is limited by the
memory in your computer.
Format
CASE Integer_Expression OF
Int1: (*Single Value*)
StatementList_1;
Int2,Int3,Int4: (*List of Values*)
StatementList_2;
Int5..Int6: (*Range of Values*)
StatementList_3;
[ELSE (*Optional*)
StatementList_Else;]
END_CASE;
Where:
Integer_Expression An ST expression that resolves to an integer (INT, DINT or UINT) value.
Int A constant integer value.
StatementList_1 … Structured Text statements.
StatementList_n
Operation
The Int values are compared to Integer_Expression. The statement list following the first Int value
that matches Integer_Expression is executed. If the optional ELSE keyword is used and no Int value
matches Integer_Expression, the statement list following ELSE is executed. Otherwise, no statement
list is executed.
Requirements for Conditional Statements
 All constants must be of type INT, DINT or UINT.
 In range declarations, the beginning value must be less than the ending value (reading from left
to right). For example, 10..3 and 5..5 are invalid.
 Overlapping values in different case conditions are not allowed. For example, 5..10 and 7 cannot
be specified as conditions in the same CASE … OF construct.

Examples
The following code fragment assigns a value to the variable ColorVariable.
CASE ColorSelection OF
0: ColorVariable:= Red;
1: ColorVariable:= Yellow;
2,3,4: ColorVariable:= Green;
5..9: ColorVariable:= Blue;
ELSE ColorVariable:= Violet;
END_CASE;
The following code fragment uses a nested CASE…OF…END_CASE construct.
0: ColorVariable:= Red;
1: ColorVariable:= Yellow;
2,3,4: ColorVariable:= Green;
5..9: ColorVariable:= Blue;
ELSE
10: ColorVariable:= Violet;
ELSE ColorVariable:= Black;
END_CASE;
ColorError: 1;
END_CASE;

11.2.6 FOR … DO Statements

The FOR loop repeatedly executes a statement list contained within the FOR … DO … END_FOR
construct. It is useful when the number of iterations can be predicted in advance, for example to
initialize an array. The number of iterations is determined by the value of a control variable which is
incremented (or decremented) from an initial value to a final value by the FOR statement.
By default, each iteration of the FOR statement changes the value of the control variable by 1. The
optional BY keyword can be used to specify an increment or decrement of the control variable by
specifying a (non-zero) positive or negative integer or an expression that resolves to an integer.
FOR loops can be nested to a maximum of ten levels.
Format
FOR Control_Variable := Start_Value TO End_Value [BY Step_Value] DO
Statement list;
END_FOR;
Where:
Control_Variable The control variable. Can be an INT, DINT or UINT variable or parameter.
Start_Value The starting value of the control variable. Must be an expression, variable, or
constant of the same data type as Int_Variable.
End_Value The ending value of the control variable. Must be an expression, variable, or
constant of the same data type as Int_Variable.
Step_Value (Optional) The increment or decrement value for each iteration of the loop. Must
be an expression, variable, or constant of the same data type as Int_Variable. If
Step_Value is not specified, the control variable is incremented by 1.
Statement list Any list of Structured Text statements.
Operation
The values of Start_Value, End_Value and Step_Value are calculated at the beginning of the FOR
loop. On the first iteration, Control_Variable is set to Start_Value.
At the beginning of each iteration, the termination condition is tested. If it is satisfied, execution of the
loop is complete and the statements after the loop will proceed. If the termination condition is not
satisfied, the statements within the FOR…END_FOR construct are executed. At the end of each
iteration, the value of Control_Variable is incremented by Step_Value (or 1 if Step_Value is not
specified).
The termination condition of a FOR loop depends on the sign of the step value.
Step Value Termination Condition
>0 Control_Variable > End_Value
<0 Control Variable < End Value
0 None. A termination condition is never reached and the loop will repeat infinitely.
As with the other iterative statements (WHILE and REPEAT), loop execution can be prematurely halted
by an EXIT statement.
To avoid infinitely repeating or unpredictable loops, the following precautions are recommended:
 Do not allow the statement list logic within the FOR loop to modify the control variable.
 Do not use the control variable in logic outside the FOR loop.

Examples
The following code fragment initializes an array of 100 elements starting at %R1000 (given that
R1000 is at %R1000) by assigning a value of 10 to all array elements.
FOR R1000 := 1 TO 100 DO
@R1000 := 10;
END_FOR;
The following code fragment assigns the values of an I/O point to array elements over ten I/O scans.
The last entry is put in the array element with the smallest index.
FOR R1000 := 10 TO 1 BY -1 DO
@R1000 := Input01;
END_FOR;

11.2.7 WHILE Statement

The WHILE loop repeatedly executes (iterates) a statement list contained within the
WHILE…END_WHILE construct as long as a specified condition is TRUE (1). It checks the condition first,
then conditionally executes the statement list. This looping construct is useful when the statement
list does not necessarily need to be executed.
Format
WHILE <BooleanExpression> DO
<StatementList>;
END_WHILE;
Where:
StatementList Any set of Structured Text statements.
Operation
If BooleanExpression is FALSE (0), the loop is immediately exited; otherwise, if the BooleanExpression
is TRUE (1), the StatementList is executed and the loop repeated. The statement list may never
execute, since the Boolean expression is evaluated at the beginning of the loop.
Note: It is possible to create an infinite loop that will cause the watchdog timer to expire. Avoid
infinite loops.
Example
The following code fragment increments J by a value of 2 as long as J is less than or equal to 100.
WHILE J <= 100 DO
J := J + 2;
END_WHILE;

11.2.8 REPEAT Statement

The REPEAT loop repeatedly executes (iterates) a statement list contained within the
REPEAT…END_REPEAT construct until an exit condition is satisfied. It executes the statement list first,
then checks for the exit condition. This looping construct is useful when the statement list needs to
be executed at least once.
Format
REPEAT
StatementList;
UNTIL BooleanExpression END_REPEAT;
Where:
StatementList Any set of Structured Text statements.
Operation
The StatementList is executed. If the BooleanExpression is FALSE (0), then the loop is repeated;
otherwise, if the BooleanExpression is TRUE (1), the loop is exited. The statement list executes at least
once, since the BooleanExpression is evaluated at the end of the loop.
Note: It is possible to create an infinite loop that will cause the watchdog timer to expire. Avoid
infinite loops.
Example
The following code fragment reads values from an array until a value greater than 5 is found (or the
upper bound of the array is reached). Since at least one array value must be read, the REPEAT loop is
used. All variables in this example are of type DINT, UINT, or INT.
Index :=1;
REPEAT
Value:= @Index;
Index:=Index+1;
UNTIL Value > 5 OR Index >= UpperBound END_REPEAT;

11.2.9 ARG_PRES Statement

The ARG_PRES function determines whether an input parameter value was present when the
function block instance of the parameter was invoked. This may be necessary if the parameter is
optional (pass by value).
This function must be called from a function block instance or a parameterized block.
Format
ARG_PRES (IN :=In1, Q:>Out1, ENO:>Out2);
Where:
In1 Must be an input parameter of the function block that contains the ARG_PRES
instruction. Cannot be an array element or structure element. An alias to a parameter
should resolve only to the parameter name.
Can be a BOOL, DINT, DWORD, INT, REAL, UINT, WORD variable, variable array head
name or variable array head name element [000]. Input or output parameter value of
a function block instance or a parameterized block
Out2 A BOOL variable. True if the parameter is present, otherwise false.
Note: ENO is an optional BOOL output parameter. If ENO is used in a statement that uses the formal
convention, the state of Out2 is set to 1 (call was successful) or 0 (call failed).
Example
The parameter TempVal is an input to the function block CheckTemp. In the following code fragment,
ARG_PRES is used to determine whether a value existed for the parameter TempVal when an
instance of CheckTemp was invoked. If TempVal had a value, the BOOL output Temp_Pres is set to 1.
ARG_PRES (TempVal, Temp_Pres);

11.2.10 Exit Statement

The EXIT statement is used to terminate and exit from a loop (FOR, WHILE, REPEAT) before it would
otherwise terminate. Program execution resumes with the statement following the loop terminator
(END_FOR, END_WHILE, END_REPEAT). An EXIT statement is typically used within an IF statement.
Format
EXIT;
Where:
ConditionForExiting An expression that determines whether to terminate early.
Example
The following code fragment shows the operation of the EXIT statement. When the variable number
equals 10, the WHILE loop is exited and execution continues with the statement immediately
following END_WHILE.
while (1) do
a := a + 1;
IF (a = 10) THEN
EXIT;
END_IF;
END_WHILE;


Chapter 12 Communications
This chapter describes the Ethernet and Serial communications features of the PACSystems CPU. The
following information is included:
Ethernet Communications page 472
Ethernet Port Pin Assignments 473
Serial Communications 474
Serial Port Communications Capabilities 474
Serial Port Pin Assignments 475
Serial Port Baud Rates 478
Series 90-70 Communications and Intelligent Option Modules (RX7i only) 480
Communications Coprocessor Module (CMM) 480
Programmable Coprocessor Module (PCM) 481
DLAN/DLAN+ (Drives Local Area Network) Interface 482

Chapter 12. Communications
12.1. Ethernet Communications

For details on Ethernet communications for PACSystems, please refer to the following manuals:
TCP/IP Ethernet Communications for PACSystems User’s Guide, GFK-2224
PACSystems TCP/IP Communications Station Manager Manual, GFK-2225
12.1.1 Embedded Ethernet Interface
RX3i
RX3i CPE305 and CPE310 CPUs have an embedded Ethernet interface that provides TCP/IP
communications with programming software and other control systems. These communications use
the proprietary SRTP protocol and the standard Modbus/TCP protocol. The embedded Ethernet
interface has one RJ-45 Ethernet port that automatically senses the data rate (10Mbps or 100Mbps),
duplex (half duplex or full duplex), and cabling arrangement (straight through or crossover) of the
attached link. On the CPE3xx models, the same shared processor performs Ethernet port processing
and Controller logic processing.
RX7i
RX7i CPUs have an embedded Ethernet interface that provides TCP/IP communications with
programming software and other control systems. These communications use the proprietary SRTP
protocol and the standard Modbus/TCP protocol over a four-layer TCP/IP (Internet) stack. The
Ethernet interface also supports Ethernet Global Data protocol using UDP (user datagram protocol).
The embedded Ethernet interface has two RJ-45 Ethernet ports. Either or both of these ports may be
attached to other Ethernet devices. Each port automatically senses the data rate (10Mbps or
100Mbps), duplex (half duplex or full duplex), and cabling arrangement (straight through or crossover)
of the attached link.
Caution
The two ports on the Ethernet Interface must not be
connected, directly or indirectly to the same device. The hub
or switch connections in an Ethernet network must form a
tree, otherwise duplication of packets may result.

10Base-T/100Base-Tx Port Pin Assignments

Pin assignments are the same for the RX3i and RX7i embedded Ethernet ports.
Pin Number Signal Description
1 TD+ Transmit Data +
2 TD- Transmit Data -
3 RD+ Receive Data +
4 NC No connection
5 NC No connection
6 RD- Receive Data -
7 NC No connection
8 NC No connection
12.1.2 Ethernet Interface Modules

The RX7i and RX3i support rack-based Ethernet Interface modules. (These modules are not
interchangeable.) For details about the capabilities, installation, and operation of these modules,
refer to TCP/IP Ethernet Communications for PACSystems, GFK-2224 and Station Manager for
PACSystems, GFK-2225.
Type Catalog Number Description
RX7i IC698ETM001 Ethernet peripheral VME module
RX3i IC695ETM001 Ethernet peripheral PCI module

12.2. Serial Communications

The independent on-board serial ports of the CPU are accessed via connectors on the front of the
module. Ports 1 and 2 provide serial interfaces to external devices. Port 1 is also used for firmware
upgrades. The RX7i CPUs provide a third serial port that is used as the Ethernet station manager port.
All serial ports are isolated.
12.2.1 Serial Port Communications Capabilities
Ports 1 and 2 can each be configured for one of the following modes. For details on CPU
configuration, refer to Chapter 3.
 RTU Slave – The port can be used for the Modbus RTU slave protocol. This mode also permits
connection to the port by an SNP master, such as the WinLoader utility or the programming
software. For details, refer to Chapter 13, “Serial I/O, SNP & RTU Protocols”.
 Message Mode – The port is available for access by user logic. This enables C language blocks to
perform serial port I/O operations via C Runtime Library functions.
 Available – The port is not to be used by the CPU firmware.
 SNP Slave – The port can only be used for the SNP slave protocol. For details, refer to Chapter 13,
“Serial I/O, SNP & RTU Protocols”.
 Serial I/O – The port can be used for general-purpose serial communication through use of
COMMREQ functions. For details, refer to Chapter 13, “Serial I/O, SNP & RTU Protocols”.
Features Supported
Port 3
Port 1 Port 2
Feature (Station Mgr)
(COM 1) (COM 2)
RX7i only
RTU Slave protocol Yes Yes No
SNP Slave Yes Yes No
Serial I/O – used with COMMREQs Yes Yes No
Firmware Upgrade CPU in
No No
(WinLoader utility) STOP/No IO mode
Message Mode –used only with C blocks
(C Runtime Library Functions: Yes Yes No
serial read, serial write, sscanf, sprintf)
Station Manager (RX7i only) No 26 No26 Yes
RS-232 Yes No Yes
RS-485 No Yes No
26 RX3i CPE-type CPUs, ETM001 & EDS001 support Station Manager using UDP over Ethernet, but not via serial
communications.

12.2.2 Configurable Stop Mode Protocols

You can configure the protocol to be used in Stop mode, based upon the configured Port (Run mode)
protocol. The Run/Stop protocol switching is independently configured for each serial port.
The Run mode protocol setting determines which choices are available for Stop mode. If a Stop mode
protocol is not selected, the default Stop mode protocol is used. For details, refer to “Port 1 and Port 2
Parameters” in Chapter 3.
12.2.3 Serial Port Pin Assignments
Port 1 (RS-232, 9-pin Subminiature D Connector)
This port has a 9-pin, female, D-sub connector with a standard pin out. This is a DCE (data
communications equipment) port that allows a simple straight-through cable to connect with a
standard AT-style RS-232 port.
The CPE310 provides the DCD and RI signals to support point-to-point protocol (PPP).
Port 1 RS-232 Signals
RX3i CPU, RX3i CRU,
RX3i CPE310 Model
and RX7i CPE Models
Non-Isolated
Optocoupler Isolated
Pin No. 27 Signal Name Description Pin No. Signal Name Description
1 NC No Connection 1 DCD Data Carrier Detect
2 TXD Transmit Data 2 TXD Transmit Data
3 RXD Receive Data 3 RXD Receive Data
4 DSR Data Set Ready 4 DSR Data Set Ready
5 0V Signal Ground 5 COM Signal Ground
6 DTR Data Terminal Ready 6 DTR Data Terminal Ready
7 CTS Clear to Send 7 CTS Clear to Send
8 RTS Request to Send 8 RTS Request to Send
9 NC No Connection 9 RI Ring Indicator
Port 1 (RS-232, RJ-25 Connector)

The CPE305 provides RS-232 communications via an RJ-25 connector and requires shielded cable
(IC693CBL316). This port is non-isolated.
CPE305 Port 1 RS-232 Signals
Pin No. Signal Name Description
1 CTS Clear to Send
2 TXD Transmit Data
3 0V Signal Ground
4 0V Signal Ground
5 RXD Received Data
6 RTS Request to Send
27 Pin 1 is at the bottom right of the connector as viewed from the front of the module.

Port 2 (RS-485, 15-pin, Female D-sub Connector) –RX7i CPU/CRU Models

On RX7i CPUs, this port is optocoupler isolated.
This port does not supply +5V volts, therefore RS-485 to RS-232 conversion requires a converter that
is self-powered. It does not support the RS-485 to RS-232 adapter IC690ACC901.
This is a DCE port that allows a simple straight-through cable to connect with a standard AT-style
RS-232 port.
1 Shield Cable Shield
Located at the bottom right of the connector
as viewed from the front of the module.
2 NC No Connection
3 NC No Connection
4 NC No Connection
5 NC No Connection
6 RTS(A) Differential Request to Send A
7 0V Signal Ground
8 CTS(B‘) Differential Clear To Send
9 RT 28 Resistor Termination
10 RD(A‘)28,29 Differential Receive Data A
11 RD(B‘)29 Differential Receive Data B
12 SD(A) Differential Send Data A
13 SD(B) Differential Send Data B
14 RTS(B’) Differential Request To Send B
15 CTS(A’) Differential Clear To Send A
28 To provide termination using the built-in 120Ω resistor, install a jumper between pins 9 and 10.
29 To provide termination using an external resistor, connect a user-supplied resistor across pins 10 and 11.

Port 2 (RS-485, 15-pin, Female D-sub Connector) – All RX3i CPU and CRU Models and RX3i
CPE310
This port is not isolated.
This is a DCE port that allows a simple straight-through cable to connect with a standard AT-style
RS-232 port.
1 Shield Cable Shield
Located at the bottom right of the connector as viewed from the front of the
module.
2 NC No Connection
3 NC No Connection
4 NC No Connection
5 +5VDC Logic Power: Provides isolated +5VDC power (300mA maximum) for
powering external options.
6 RTS(A) Differential Request to Send A
7 0V Signal Ground
8 CTS(B‘) Differential Clear To Send B
9 RT28 Resistor Termination
10 RD(A‘)28, 29 Differential Receive Data A
11 RD(B‘)29 Differential Receive Data B
12 SD(A) Differential Send Data A
13 SD(B) Differential Send Data B
14 RTS(B’) Differential Request To Send B
15 CTS(A’) Differential Clear To Send A

Port 3 (RX7i only)

Port 3, the Station Manager serial port used by the embedded Ethernet Interface, is RS-232
compatible and isolated. Port 3 has a 9-pin, female, D-connector. This is a DCE port that allows a
simple straight-through cable to connect with a standard AT-style RS-232 port. This port contains full
use of the standard RS-232 signals for future use with point-to-point protocol (PPP).
Station Manager RS-232 Signals
Pin No. 27 Signal Name Description
1 DCD Data Carrier Detect
2 TXD Transmit Data
3 RXD Receive Data
4 DSR Data Set Ready
5 0V Signal Ground
6 DTR Data Terminal Ready
7 CTS Clear To Send
8 RTS Request to Send
9 RI Ring Indicator
Serial Cable Lengths and Shielding

The connection from a CPU serial port to the serial port on a computer or other serial device requires
a serial cable. Maximum cable lengths (the total distance from the CPU to the last device attached to
the serial cable) are:
Maximum Cable
Port Cable Type
Length
COM 1/Port 1 (RS-232) 15 meters (50 ft.) Shielded cable required for
RX3i;
Shielded cable optional for RX7i
COM 2/Port 2 (RS-485) 1200 meters (4000 Shielded cable required for all
ft.) models that support this port
STA MGR/Port 3 (RS-232) 15 meters (50 ft.) Shielded cable optional (RX7i
only)
Note: For details on conformance to radiated emissions standards, refer to Appendix A in the
following manuals:
PACSystems RX7i Installation Manual, GFK-2223
PACSystems RX3i System Manual, GFK-2314

12.2.4 Serial Port Baud Rates

Port 1 Port 2 Station Mgr (Port 3)
Protocol
(RS-232) (RS-485) (RS-232)
RTU Slave 1200, 2400, 4800, 1200, 2400, not supported
9600, 19.2K, 38.4K, 4800, 9600,
57.6K, 115.2K 19.2K, 38.4K,
57.6K, 115.2K
Firmware 1200, 2400, 4800, Not supported not supported
Upgrade via 9600, 19.2K, 38.4K,
WinLoader 57.6K, 115.2K
Message Mode 1200, 2400, 4800, 1200, 2400, not supported
9600, 19.2K, 38.4K, 4800, 9600,
57.6K, 115.2K 19.2K, 38.4K,
57.6K, 115.2K
SNP Slave 1200, 2400, 4800, 1200, 2400, not supported
9600, 19.2K, 38.4K, 4800, 9600,
57.6K, 115.2K 19.2K, 38.4K,
57.6K, 115.2K
Serial I/O 1200, 2400, 4800, 1200, 2400, not supported
9600, 19.2K, 38.4K, 4800, 9600,
57.6K, 115.2K 19.2K, 38.4K,
57.6K, 115.2K

12.3. Series 90-70 Communications and Intelligent Option Modules

PACSystems RX7i supports the following Series 90-70 communications and intelligent option
modules:
 Communications Coprocessor Module (CMM), IC697CMM711
 Programmable Coprocessor Module (PCM), IC697PCM711
 DLAN Interface Module, IC697BEM763
12.3.1 Communications Coprocessor Module (CMM)
PACSystems RX7i CPUs with versions 1.50 and higher support IC697CMM711 modules with firmware
versions 4.20 and higher. You must ensure that you are using a valid version of the CMM firmware
because the CPU cannot check the CMM’s firmware version. (The module’s firmware version can be
found on a label attached to the EEPROM.)
PACSystems does not support the following with an IC697CMM711:
 Access to Symbolic variables
 WAIT mode COMMREQs.
 Connecting the programming software to the CPU through the CMM’s serial ports.
 Permanent datagrams.
The following restrictions apply when using the IC697CMM711 with PACSystems:
 Access to %W references is partially supported. Only offsets 0—65535 of %W can be accessed
via the CMM.
 The Program Name is currently always LDPROG1 for PACSystems.
 Reads and writes beyond currently configured reference table limits will report a minor code
error of 90 (REF_OUT_OF_RANGE) instead of F4 (INVALID_PARAMETER) as reported on the Series
90-70.
 In case of ERROR NACK, the Control Program number, privilege level and other piggyback status
data will be set to 0.
 PACSystems CPUs return the major/minor type of the 90-70 CPX935 (major type 12, minor type
35) to the CMM scratch pad memory when communicating with a CMM.
 Control Program Number will be returned as 01 in PACSystems instead of FF as reported on the
Series 90-70.
 If your RX7i application program needs to access the dual port memory of a CMM, use the BUS
READ and WRITE functions. When accessing the CMM, set the Region parameter on the function
block to 1. (For the CMM, region 1 is predefined to be the module's entire dual port memory.)
Note: For details on operation of the IC697CMM711, refer to the Serial Communications User’s
Manual, GFK-0582.

12.3.2 Programmable Coprocessor Module (PCM)

PACSystems RX7i CPUs with versions 1.50 and higher support IC697PCM711modules with firmware
versions 4.05 and higher. You must ensure that you are using a valid version of the PCM firmware
because the CPU cannot check the PCM’s firmware version. (The module’s firmware version can be
PACSystems does not support the following with an IC697PCM711:
 Connecting the programming software to the CPU through the PCM’s serial ports.
 Access to Symbolic variables.
 WAIT mode COMMREQs.
 The following C functions are not supported:
- chk_genius_bus
- chk_genius_device
- get_cpu_type_rev
- get_memtype_sizes
- get_one_rackfault
- get_rack_slot_faults
 The C function write_dev will not write to “read only” references (%S references, transition bits,
and override bits). If this is attempted, the call will fail at run time and return an error code.
 The following restrictions apply when using the IC697PCM711 with PACSystems:
 Access to %W references is partially supported. Only offsets 0—65535 of %W can be accessed
via the PCM.
 The Program Name is currently always LDPROG1 for PACSystems.
 In case of ERROR NACK, the Control Program number, privilege level and other piggyback status
data will be set to 0.
 If an application program running on the PCM accesses the VME bus, the VME addresses being
used by that program must be in agreement with the PACSystems RX7i VME address
assignments. The PACSystems RX7i VME address assignments are described in the PACSystems
RX7i User’s Guide to Integration of VME Modules, GFK-2235.
 PACSystems CPUs return the major/minor type of the Series 90-70 CPX935 (major type 12, minor
type 35) to the PCM scratch pad memory when communicating with a PCM.
 If your RX7i application program needs to access the PCM’s dual port memory, use the BUS READ
and WRITE functions. When accessing the PCM, set the Region parameter on the function block
to 1. (For the PCM, region 1 is predefined to be the module's entire dual port memory.)
Note: For details on operation of the IC697PCM711, refer to Programmable Coprocessor Module and
Support Software, GFK-0255.

12.3.3 DLAN/DLAN+ (Drives Local Area Network) Interface

PACSystems RX7i CPUs with versions 1.50 and higher support IC697BEM763 modules with firmware
versions 3.00 and higher. You must ensure that you are using a valid version of the PCM firmware
because the CPU cannot check the DLAN’s firmware version. (The module’s firmware version can be
If your RX7i application program needs to access the DLAN’s dual port memory, use the BUS READ
and WRITE functions. When accessing a DLAN module, set the Region parameter on the function
block to 1. (For the DLAN module, region 1 is predefined to be the module's entire dual port memory.)
Note: The DLAN Interface module is a specialty module with limited availability. If you have a DLAN
system, refer to the DLAN/DLAN+ Interface Module User’s Manual, GFK-0729 for details.

Chapter 13 Serial I/O, SNP & RTU Protocols
This chapter discusses the following topics related to communications on CPU serial ports 1 and 2:
 Configuring Serial Ports Using COMMREQ Function 65520
 Serial I/O Protocol
 RTU Slave Protocol
 SNP Slave Protocol
Details of the RTU and SNP protocol are described in the Serial Communications User’s Manual
(GFK-0582).

Chapter 13. Serial I/O, SNP & RTU Protocols
13.1. Configuring Serial Ports Using COMMREQ Function 65520

The Serial Port Setup COMMREQ function 65520 (FFF0 hex) may be used to activate a serial
communication protocol for a serial port, overriding the protocol that was specified in the port
settings of the CPU configuration. The COMMREQ installed protocol remains active as long as the
CPU is in run mode. When the CPU is stopped, the COMMREQ installed protocol is removed, and the
protocol settings from the CPU configuration are reactivated.
The COMMREQ requires that all its command data be placed in the correct order (in a command
block) in the CPU memory before it is executed. The COMMREQ should be executed by a contact of a
oneshot coil to prevent sending the data multiple times. For details on the operands and command
block format used by the COMMREQ function, refer to Chapter 7, “Ladder Diagram (LD)
Programming”.
The COMMREQ uses the following TASKs to specify the port for which the operation is intended:
task 19 for port 1
task 20 for port 2
Note: Because address offsets are stored in a 16-bit word field, the full range of %W memory type
cannot be used with COMMREQs.
13.1.1 COMMREQ Function Example
In the example, when %M0021 is ON, a Command Block located starting at %R0032 is sent to port 2
(communications task 20) of the CPU (rack 0, slot 0). If an error occurs processing the COMMREQ,
%Q0110 is set.
13.1.2 Timing
If a port configuration COMMREQ is sent to a serial port that currently has an SNP master (for
example, the programmer) connected to it, the COMMREQ function returns an error code to the
COMMREQ status word.
13.1.3 Sending Another COMMREQ to the Same Port
After sending a COMMREQ to configure a serial port, the application program should monitor the
COMMREQ status word to determine when it can begin sending protocol specific COMMREQs to that
port. It is recommended that the application clear the COMMREQ status word prior to issuing the
configuration change. The status word will be set to a nonzero value when the request has been
processed.

13.1.4 Invalid Port Configuration Combinations

The Machine Edition programming software safeguards against the download of some hardware
configurations that would prevent the programmer from communicating serially with the CPU. In a
system that does not have an embedded Ethernet module, if a rack-based Ethernet is not present, a
serial connection is required for programmer communications.
For CPE305/CPE310 CPUs, which have an embedded Ethernet port that, when configured, is available
for programmer communications, the safeguards on serial port configurations are still enforced.
13.1.5 COMMREQ Command Block Parameter Values
The following table lists common parameter values that are used within the COMMREQ command
blocks for configuring a serial port. All values are in decimal.
Parameter Values
Protocol Selector 1 = SNP
3 = RTU
5 = Serial I/O
7 = Message Mode
Data Rate 0 = 300
1 = 600
2 = 1200
3 = 2400
4 = 4800
5 = 9600
6 = 19200
7 = 38400
8 = 57600
9 = 115200
Parity 0 = None
1 = Odd
2 = Even
Flow Control 0 = Hardware [RTS / CTS]
1 = None
2 = Software [XON / XOFF] (Serial I/O only)
Bits Per Character 0 = 7 bits
1 = 8 bits
Stop Bits 0 = 1 stop bit
1 = 2 stop bits
Duplex Mode 0 = 2-wire
1 = 4-wire
2 = 4-wire transmitter always on
Turnaround Delay (SNP only) 0 = none
1 = 10ms
2 = 100ms
3 = 500ms
Timeout (SNP only) 0 = Long (8 sec)
1 = Medium (2 sec)
2 = Short (500ms)
3 = “None” (200ms)

13.1.6 Sample COMMREQ Command Blocks for Serial Port Setup function
The following COMMREQ command blocks provide examples for configuring the various protocols.
All values are in decimal unless followed by an H indicating hexadecimal.
Note that an example is not provided for Message Mode, but it can be setup with a command block
similar to the one for Serial I/O, with a value of 7 for the protocol selector.
Example COMMREQ Command Block for Configuring SNP Protocol
Values Meaning
Address 16 Data Block Length
Address + 1 0 = No Wait (WAIT mode not supported) WAIT/NOWAIT Flag
Address + 2 0008 = %R, register memory Status Word Pointer Memory
Type
Address + 3 Zero-based number that gives the address of the COMMREQ Status Word Pointer Offset
status word (for example, a value of 99 gives an address of
100 for the status word)
Address + 4 not used Idle Timeout Value
Address + 5 not used Maximum Communication
Time
Address + 6 FFF0H Command Word (serial port
setup)
Address + 7 1 = SNP Protocol
Address + 8 0 = Slave Port Mode
Address + 9 See “COMMREQ Command Block Parameter Values” on page Data Rate
485.
Address + 10 0 = None, 1 = Odd, 2 = Even Parity
Address + 11 not used (SNP always chooses NONE by default) Flow Control
Address + 12 0 = None, 1 = 10ms, 2 = 100ms, 3 = 500ms Turnaround Delay
Address + 13 0 = Long, 1 = Medium, 2 = Short, 3 = None Timeout
Address + 14 not used (SNP always chooses 8 bits by default) Bits Per Character
Address + 15 0 = 1 Stop Bit, 1 = 2 Stop bits Stop Bits
Address + 16 not used Interface
Address + 17 not used (SNP always chooses 4-wire mode by default) Duplex Mode
Address + 18 user-provided 30 Device identifier bytes 1 and 2
30 The device identifier for SNP Slave ports is packed into words with the least significant character in the least significant
byte of the word. For example, if the first two characters are “A” and “B,” the Address + 18 will contain the hex
value 4241.

Example COMMREQ Data Block for Configuring RTU Protocol

Values Meaning
Address 13, or 17 Data Block Length
Address + 2 0008 = %R, register memory Status Word Pointer Memory Type
Address + 5 not used Maximum Communication Time
Address + 6 FFF0H Command Word (serial port setup)
Address + 7 3 = RTU Protocol
Address + 8 0 = Slave Port Mode
Address + 9 See “COMMREQ Command Block Parameter Values” on Data Rate
page 485.
Address + 11 0 = Hardware, 1 = None Flow Control
Address + 12 not used Turnaround delay
Address + 13 not used Timeout
Address + 14 not used (RTU always chooses 8 bits by default) Bits per Character
Address + 15 not used (RTU always chooses 1 stop bit by default) Stop Bits
Address + 17 0 = 2-wire, 1 = 4-wire, 2 = 4-wire transmitter always on Duplex Mode
Address + 18 Station Address (1-247) Device Identifier
Address + 19 Count of 100 microseconds units (0 = 3.5 character times) End-of-frame timeout 31
Address + 20 not used
Address + 21 not used
Address + 22 Count of 10 millisecond units (range 0-255) Receive-to-transmit delay 31
31 The End-of-frame timeout and Receive-to-transmit delay values were added in Release 6.70 for the RX3i.
They are discussed in the RTU Slave Protocol section.

Example COMMREQ Data Block for Configuring Serial I/O Protocol

Values Meaning
Address 12 Data Block Length
Address + 2 0008 = %R, register memory Status Word Pointer Memory
Type
Address + 5 not used Maximum Communication Time
Address + 6 FFF0H Command Word (serial port
setup)
Address + 7 5 = Serial I/O Protocol
Address + 8 not used Port Mode
Address + 9 See “COMMREQ Command Block Parameter Values” on page Data Rate
485.
Address + 11 0 = Hardware, 1 = None, 2 = Software Flow Control
Address + 12 not used Turnaround Delay
Address + 13 not used Timeout
Address + 14 0=7 bits, 1=8 bits Bits per Character
Address + 15 0 = 1 stop bit, 1 = 2 stop bits Stop Bits
Address + 17 0 = 2-wire, 1 = 4-wire, 2 = 4-wire transmitter always on Duplex Mode

13.2. Serial I/O Protocol

Serial I/O protocol is a communication protocol that is driven entirely by the application program.
Serial I/O protocol is active only when the CPU is in run mode, since it is driven completely by
COMMREQ functions in the application program. Those COMMREQ functions are described in detail
within this section.
When the CPU is stopped, a port configured for Serial I/O protocol will revert to a stop mode protocol
as specified in the port settings of the CPU configuration. If a stop mode protocol was not specified,
RTU slave protocol is used by default.
13.2.1 Calling Serial I/O COMMREQs from the CPU Sweep
Implementing a serial protocol using Serial I/O COMMREQs may be restricted by the sweep time. For
example, if the protocol requires that a reply to a certain message from the remote device be
initiated within 5ms of receiving the message, this method may not be successful if the sweep time is
5ms or longer, since timely response is not guaranteed.
13.2.2 Compatibility
The COMMREQ function blocks supported by Serial I/O are not supported by other currently existing
protocols (such as SNP slave and RTU slave). Errors are returned if they are attempted for a port
configured for one of those protocols.
13.2.3 Status Word for Serial I/O COMMREQs
A value of 1 is returned in the COMMREQ status word upon successful completion of the COMMREQ.
Any other value returned is an error code where the low byte is a major error code and the high byte
is a minor error code.
Major Error Code Description
1 (01h) Successful Completion (this is the expected completion value in the COMMREQ status
word).
12 (0Ch) Local error —Error processing a local command. The minor error code identifies the
specific error.
2 (02h) COMMREQ command is not supported.
6 (06h) Invalid CPU memory type specified.
7 (07h) Invalid CPU memory offset specified.
8 (08h) Unable to access CPU memory.
12 (0Ch) COMMREQ data block length too small.
14 (0Eh) COMMREQ data is invalid.
15 (0Fh) Could not allocate system resources to complete COMMREQ.
13 (0Dh) Remote error — Error processing a remote command. The minor error code identifies the
error.
2 (02h) Number of bytes requested to read is greater than input buffer size OR
number bytes requested to write is zero or greater than 250 bytes.
3 (03h) COMMREQ data block length is too small. String data is missing or
incomplete.

Major Error Code Description

4 (04h) Receive timeout awaiting serial reception of data
6 (06h) Invalid CPUmemory type specified.
7 (07h) Invalid CPUmemory offset specified.
8 (08h) Unable to access CPU memory.
12 (0Ch) COMMREQ data block length too small.
16 (10h) Operating system service error. The operating system service used to
perform the request has returned an error.
17 (11h) Port device error. The port device used to perform the service has detected
an error. Either a break was received or a UART Error (parity, framing,
overrun) occurred.
18 (12h) Request cancelled. The request was terminated before it could complete.
48 (30h) Serial output timeout. The serial port was unable to transmit the string. (Could
be due to missing CTS signal when the serial port is configured to use
hardware flow control.)
14 (0Eh) Autodial Error — An error occurred while attempting to send a command string to an
attached external modem. The minor error code identifies the specific error.
2 (02h) The modem command string length exceeds end of reference memory type.
3 (03h) COMMREQ Data Block Length too small. Output command string data
missing or incomplete.
4 (04h) Serial output timeout. The serial port was unable to transmit the modem
autodial output.
5 (05h) Response was not received from modem. Check modem and cable.
6 (06h) Modem responded with BUSY. Modem is unable to complete the requested
connection. The remote modem is already in use; retry the connection
request later.
7 (07h) Modem responded with NO CARRIER. Modem is unable to complete the
requested connection. Check the local and remote modems and the
telephone line.
8 (08h) Modem responded with NO DIALTONE. Modem is unable to complete the
requested connection. Check the modem connections and the telephone line.
9 (09h) Modem responded with ERROR. Modem is unable to complete the requested
command. Check the modem command string and modem.
10 (0Ah) Modem responded with RING, indicating that the modem is being called by
another modem. Modem is unable to complete the requested command.
Retry the modem command later.
11 (0Bh) Unknown response received from the modem. Modem unable to complete
the request. Check the modem command string and modem. Response
should be CONNECT or OK.

13.2.4 Serial I/O COMMREQ Commands

The following COMMREQs are used to implement Serial I/O:
■ Local COMMREQs - do not receive or transmit data through the serial port.
 Initialize Port (4300)
 Set Up Input Buffer (4301)
 Flush Input buffer (4302)
 Read port status (4303)
 Write port control (4304)
 Cancel Operation (4399)
■ Remote COMMREQs - receive and/or transmit data through the serial port.
 Autodial (4400)
 Write bytes (4401)
 Read bytes (4402)
 Read String (4403)
13.2.5 Overlapping COMMREQs

Some Serial I/O COMMREQs must complete execution before another COMMREQ can be processed.
Others can be left pending while others are executed.
COMMREQS that Must Complete Execution
■ Autodial (4400)
■ Initialize Port (4300)
■ Set Up Input Buffer (4301)
■ Flush Input buffer (4302)
■ Read port status (4303)
■ Write port control (4304)
■ Cancel Operation (4399)
■ Serial Port Setup (FFF0)
COMMREQs that can be Pending While Others Execute
The table below shows whether Write Bytes, Read Bytes and Read String COMMREQs can be pending
when other COMMREQs are executed.
NEW COMMREQ
Currently-Pending Autodial Write Initialize Set Up Flush Read Write Read Read Cancel Serial
COMMREQs (4400) Bytes Port Input Input Port Port Bytes String Operation Port
(4401) (4300) Buffer Buffer Status Control (4402) (4403) (4399) Setup
(4301) (4302) (4303) (4304 (FFF0)
Write Bytes (4401) No No Yes Yes Yes Yes Yes Yes Yes Yes No
Read Bytes (4402) No Yes Yes No No Yes Yes No No Yes No
Read String (4403) No Yes Yes No No Yes Yes No No Yes No

13.2.6 Initialize Port Function (4300)

This function causes a reset command to be sent to the specified port. It also cancels any COMMREQ
currently in progress and flushes the internal input buffer. RTS and DTR are set to inactive.
Example Command Block for the Initialize Port Function
Value Value Meaning
(decimal) (hexadecimal)
Address 0001 0001 Data block length
Address +1 0000 0000 NOWAIT mode
Address +2 0008 0008 Status word memory type (%R)
Address +3 0000 0000 Status word address minus 1 (%R0001)
Address +4 0000 0000 Not used
Address +6 4300 10CC Initialize port command
Operating Notes
Remote COMMREQs that are cancelled due to this command executing will return a COMMREQ
status word indicating request cancellation (minor code 12H).
Caution
If this COMMREQ is sent when a Write Bytes (4401)
COMMREQ is transmitting a string from a serial port,
transmission is halted. The position within the string where
the transmission is halted is indeterminate. In addition, the
final character received by the device to which the CPU is
sending is also indeterminate.

13.2.7 Set Up Input Buffer Function (4301)

This function is provided for compatibility with legacy Serial I/O applications. In PACSystems releases
5.70 and later, the internal input buffer is always set to 2097 bytes. In earlier PACSystems
implementations, the internal input buffer is set to 2K bytes.
The Set Up Input Buffer function returns a success status to the COMMREQ status word, regardless of
the buffer length specified in the command block.
As data is received from the serial port it is placed in the input buffer. If the buffer becomes full, any
additional data received from the serial port is discarded and the Overflow Error bit in the Port Status
word (See Read Port Status Function) is set.
Retrieving Data from the Buffer
Data can be retrieved from the buffer using the Read String or Read Bytes function. It is not directly
accessible from the application program.
If data is not retrieved from the buffer in a timely fashion, some characters may be lost.
Example Command Block for the Set Up Input Buffer Function
VALUE VALUE
(decimal) (hexadecimal) MEANING
Address +6 4301 10CD Setup input buffer command
Address +7 0064 0040 Buffer length (in words)

13.2.8 Flush Input buffer Function (4302)

This operation empties the input buffer of any characters received through the serial port but not yet
retrieved using a read command. All such characters are lost.
Example Command Block for the Flush Input Buffer Function
VALUE VALUE MEANING
Address +6 4302 10CE Flush input buffer command

13.2.9 Read port status Function (4303)

This function returns the current status of the port. The following events can be detected:
1. A read request was initiated previously and the required number of characters has now been
received or the specified time-out has elapsed.
2. A write request was initiated previously and transmission of the specified number of characters is
complete or a time-out has elapsed.
The status returned by the function indicates the event or events that have completed. More than
one condition can occur simultaneously, if both a read and a write were initiated previously.
Example Command Block for the Read Port Status Function
VALUE VALUE MEANING
Address +6 4303 10CF Read port status command
Address +7 0076 004C Port status memory type (%M)
Address +8 0101 0065 Port status memory offset (%M101)

Port Status
The port status consists of a status word and the number of characters in the input buffer that have
not been retrieved by the application (characters which have been received and are available).
word 1 Port status word (see below)
word 2 Characters available in the input buffer
Port Status Word Meanings
Bit Name Definition Status Meaning
Read In Set Read Bytes or Read String invoked
15 RP
progress Cleared Previous Read bytes or String has timed out, been canceled, or finished
Read Set Read Bytes or Read String has successfully completed
14 RS
Success Cleared New Read Bytes or Read String invoked
Read Set Receive timeout occurred during Read Bytes or Read String
13 RT
Time-out Cleared New Read Bytes or Read String invoked
Set New Write Bytes invoked
Write In
12 WP Previously-invoked Write Bytes has timed out, been canceled, or
progress Cleared
finished
Write Set Previously-invoked Write Bytes has successfully completed
11 WS
Success Cleared New Write Bytes invoked
Write Set Transmit timeout occurred during Write Bytes
10 WT
Time-out Cleared New Write Bytes invoked
Character Set Unread characters are in the buffer
9 CA
Available Cleared No unread characters in the buffer
Overflow Set Overflow error occurred on the serial port or internal buffer
8 OF
error Cleared Read Port Status invoked
Framing Set Framing error occurred on the serial port
7 FE
Error Cleared Read Port Status invoked
Set Parity error occurred on the serial port
6 PE Parity Error
Cleared Read Port Status invoked
Clear to Set Clear to Send signal is active
5 CTS
Send Cleared Clear to Send signal is not active
Data Set Set Data Set Ready signal is active
4 DSR
Ready Cleared Data Set Ready signal is not active
Ring Set Ring Indicator signal is active
3 RI
Indicator Cleared Ring Indicator signal is not active
Data Set Data Carrier Detect signal is active
2 DCD Carrier Data Carrier Detect signal is not active
Detect Cleared
1-0 n/a Not used These bits are always set to 0
Operating Notes
For reference, see the tables under “Serial Port Pin Assignments” in Chapter 12.
Support for the DSR status bit is provided for Port 1 only, on all RX7i and RX3i models (except CPE305),
in Rel. 7.16 and later releases.
Support for the RP and DCD status bits is provided only for Port 1 on the CPE310, in Rel. 7.16 and later
releases.

Write Port Control Function (4304)

This function controls output signals on the specified port:
Example Command Block for the Write Port Control Function
VALUE VALUE MEANING
Address +6 4304 10D0 Write port control command
Address +7 xxxx xxxx Port control word
Port Control Word

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
RTS DTR -- -- -- -- -- -- -- -- -- -- -- -- -- --
Port Control Word Meanings:

Commanded state of Request to Send signal
15 RTS 1 = Activates RTS
0 = Deactivates RTS
Commanded state of Data Terminal Ready signal
14 DTR 1 = Activates DTR
0 = Deactivates DTR
13-0 n/a Unused (should be zero)
Operating Notes
For reference, see the tables under “Serial Port Pin Assignments” in Chapter 12.
Support for the DTR output signal is provided for Port 1 only, on all RX7i and RX3i models (except
CPE305), in Rel 7.16 and later releases.
For CPU port 2 (RS-485), the RTS signal is also controlled by the transmit driver. Therefore, control of
RTS is dependent on the current state of the transmit driver. If the transmit driver is not enabled,
asserting RTS with the Write Port Control COMMREQ will not cause RTS to be asserted on the serial
line. The state of the transmit driver is controlled by the protocol and is dependent on the current
Duplex Mode of the port. For 2-wire and 4-wire Duplex Mode, the transmit driver is only enabled
during transmitting. Therefore, RTS on the serial line will only be seen active on port 2 (configured for
2-wire or 4-wire Duplex Mode) when data is being transmitted. For point-to-point Duplex Mode, the
transmit driver is always enabled. Therefore, in point-to-point Duplex Mode, RTS on the serial line will
always reflect what is chosen with the Write Port Control COMMREQ.

13.2.10 Cancel COMMREQ Function (4399)

This function cancels the current operations in progress. It can be used to cancel both read
operations and write operations.
If a read operation is in progress and there are unprocessed characters in the input buffer, those
characters are left in the input buffer and available for future reads. The serial port is not reset.
Example Command Block for the Cancel Operation Function
Value Value Meaning
Address 0002 0002 Data block length (2)
Address +6 4399 112F Cancel operation command
Address +7 0001 0001 Transaction type to cancel
1 All operations
2 Read operations
3 Write operations
Operating Notes
Remote COMMREQs that are cancelled due to this command executing will return a COMMREQ
status word indicating request cancellation (minor code 12H).
Caution
If this COMMREQ is sent in either Cancel All or Cancel Write
mode when a Write Bytes (4401) COMMREQ is transmitting a
string from a serial port, transmission is halted. The position
within the string where the transmission is halted is
indeterminate. In addition, the final character received by
the device to which the CPU is sending is also indeterminate.

13.2.11 Autodial Function (4400)

This feature allows the CPU to automatically dial a modem and send a specified byte string.
To implement this feature, the port must be configured for Serial I/O. After the autodial function is
executed and the modem has established a connection, other serial I/O functions (Write bytes, Set
Up Input Buffer, Flush Input buffer, Read port status, Write port control, Read bytes, Read String, and
Cancel Operation) can be used.
Example
Pager enunciation can be implemented by three commands, requiring three COMMREQ command
blocks:
Autodial: Dials the modem.
04400 (1130h)
Write Bytes: Specifies an ASCII string, from 1 to 250 bytes in length, to send from the serial port.
04401 (1131h)
Autodial: It is the responsibility of the application program to hang up the phone connection.
04400 (1130h) This is accomplished by reissuing the autodial command and sending the hang up
command string.
Autodial Command Block

The Autodial command automatically transmits an Escape sequence that follows the Hayes
convention. If you are using a modem that does not support the Hayes convention, you may be able
to use the Write Bytes command to dial the modem.
Examples of commonly used command strings for Hayes-compatible modems are listed below:
Command String Length Function
ATDP15035559999<CR> 16 (10h) Pulse dial the number 1-503-555-9999
ATDT15035559999<CR> 16 (10h) Tone dial the number 1-503-555-9999
ATDT9,15035559999<CR> 18 (12h) Tone dial using outside line with pause
ATH0<CR> 5 (05h) Hang up the phone
ATZ <CR> 4 (04h) Restore modem configuration to internally saved values

Sample Autodial Command Block

This COMMREQ command block dials the number 234-5678 using a Hayes-compatible modem.
Word Definition Values
1 0009h CUSTOM data block length (includes command string)
2 0000h NOWAIT mode
3 0008h Status word memory type (%R)
4 0000h Status word address minus 1 (Register 1)
5 0000h not used
6 0000h not used
7 04400 (1130h) Autodial command number
8 00030 (001Eh) Modem response timeout (30 seconds)
9 0012 (000Ch) Number of bytes in command string
10 5441h A (41h), T (54h)
11 5444h D (44h), T (54h)
12 3332h Phone number: 2 (32h), 3 (33h)
13 3534h 4 (34h), 5 (35h)
14 3736h 6 (36h), 7 (37h)
15 0D38h 8 (38h) <CR> (0Dh)

13.2.12 Write bytes Function (4401)

This operation can be used to transmit one or more characters to the remote device through the
specified serial port. The character(s) to be transmitted must be in a word reference memory . They
should not be changed until the operation is complete.
Up to 250 characters can be transmitted with a single invocation of this operation. The status of the
operation is not complete until all of the characters have been transmitted or until a timeout occurs
(for example, if hardware flow control is being used and the remote device never enables the
transmission).
Example Command Block for the Write Bytes Function
Value Value Meaning
Address 0006 0006 Data block length (includes characters to send)
Address +6 4401 1131 Write bytes command
Address +7 0030 001E Transmit time-out (30 seconds). See note below.
Address +8 0005 0005 Number of bytes to write
Address +9 25960 6568 ‘h’ (68h), ‘e’ (65h)
Address +10 27756 6C6C ‘l’ (6Ch), ‘l’ (6Ch)
Address +11 0111 006F ‘o’ (6Fh)
Although printable ASCII characters are used in this example, there is no restriction on the values of
the characters that can be transmitted.
Operating Notes
Specifying zero as the Transmit time-out sets the time-out value to the amount of time actually
needed to transmit the data, plus 4 seconds.
Caution
If an Initialize Port (4300) COMMEQ is sent or a Cancel
Operation (4399) COMMREQ is sent in either Cancel All or
Cancel Write mode while this COMMREQ is transmitting a
string from a serial port, transmission is halted. The position
within the string where the transmission is halted is
indeterminate. In addition, the final character received by
the device the CPU is sending to is also indeterminate.

13.2.13 Read bytes Function (4402)

This function causes one or more characters to be read from the specified port. The characters are
read from the internal input buffer and placed in the specified input data area. The function returns
both the number of characters retrieved and the number of unprocessed characters still in the input
buffer. If zero characters of input are requested, only the number of unprocessed characters in the
input buffer is returned.
If insufficient characters are available to satisfy the request and a non-zero value is specified for the
number of characters to read, the status of the operation is not complete until either sufficient
characters have been received or the time-out interval expires. In either of those conditions, the port
status indicates the reason for completion of the read operation. The status word is not updated until
the read operation is complete (either due to timeout or when all the data has been received).
If the time-out interval is set to zero, the COMMREQ remains pending until it has received the
requested amount of data, or until it is cancelled.
If this COMMREQ fails for any reason, no data is returned to the input data area. Any data that has
not been read from the internal input buffer remains and it can be retrieved with a subsequent read
request.
Example Command Block for the Read Bytes Function
Value Value Meaning
Address +6 4402 1132 Read bytes command
Address +7 0030 001E Read time-out (30 seconds)
Address +8 0005 0005 Number of bytes to read
Address +9 0008 0008 Input data memory type (%R).
Address +10 0100 0064 Input data memory address (%R0100)

Return Data Format for the Read Bytes Function

The return data consists of the number of characters actually read, the number of characters still
available in the input buffer after the read is complete (if any), and the actual input characters.
Address Number of characters actually read
Address + 1 Number of characters still available in the input buffer, if any
Address + 2 first two characters (first character is in the low byte)
Address + 3 third and fourth characters (third character is in the low byte)
Address + n subsequent characters
Operating Notes for Read Bytes

If the input data memory type parameter is specified to be a word memory type, and if an odd
number of bytes is actually received, then the high byte of the last word to be written with the
received data is left unchanged.
As data is received from the serial port it is placed in the internal input buffer. If the buffer becomes
full, then any additional data received from the serial port is discarded and the Overflow Error bit in
the Port Status word (See Read Port Status Function) is set.

13.2.14 Read String Function (4403)

This function causes characters to be read from the specified port until a specified terminating
character is received. The characters are read from the internal input buffer and placed in the
specified input data area.
The function returns both the number of characters retrieved and the number of unprocessed
characters still in the input buffer. If zero characters of input are requested, only the number of
unprocessed characters in the input buffer is returned.
If the terminating character is not in the input buffer, the status of the operation is not complete until
either the terminating character has been received or the time-out interval expires. In either of those
conditions, the port status indicates the reason for completion of the read operation.
If the time-out interval is set to zero, the COMMREQ remains pending until it has received the
requested string, terminated by the specified end character.
If this COMMREQ fails for any reason, no data is returned to the input data area. Any data that has
not been read from the internal input buffer remains, and it can be retrieved with a subsequent read
request.
Example Command Block for the Read String Function
Value Value
Meaning
Address +6 4403 1133 Read string command
Address +7 0030 001E Read time-out (30 seconds)
Terminating character (carriage return): must be
Address +8 0013 000D
between 0 and 255 (0xFF), inclusive
Address +9 0008 0008 Input data memory type (%R)
Address +10 0100 0064 Input data memory address (%R0100)

Return Data Format for the Read String Function

The return data consists of the number of characters actually read, the number of characters still
available in the input buffer after the read is complete (if any), and the actual input characters:
Address Number of characters actually read
Address + 1 Number of characters still available in the input buffer, if any
Address + 2 first two characters (first character is in the low byte)
Address + 3 third and fourth characters (third character is in the low byte)
Address + n subsequent characters
Operating Notes for Read String

If the input data memory type parameter is specified to be a word memory type, and if an odd
number of bytes is actually received, then the high byte of the last word to be written with the
received data is left unchanged.
As data is received from the serial port it is placed in the internal input buffer. If the buffer becomes
full, then any additional data received from the serial port is discarded and the Overflow Error bit in
the Port Status word (See Read Port Status Function) is set.

13.3. RTU Slave Protocol

RTU protocol is a query-response protocol used for communication between the RTU device and a
host computer, which is capable of communicating using RTU protocol. The host computer is the
master device and it transmits a query to a RTU slave, which responds to the master. The RTU slave
device cannot query; it can only respond to the master. A PACSystems CPU can only function as an
RTU slave.
The RTU data transferred consists of 8-bit binary characters with an optional parity bit. No control
characters are added to the data block; however, an error check (Cyclic Redundancy Check) is
included as the final field of each query and response to ensure accurate transmission of data.
Note: You should avoid using station address 1 for any other Modbus slave in a PACSystems control
system because the default station address for the PACSystems CPU is 1. The CPU uses the
default address in two situations:
1. If you power up without a configuration, the default station address of 1 is used.
2. When the Port Mode parameter is set to Message Mode, and Modbus becomes the
protocol in stop mode, the station address defaults to 1, unless you specify a stop mode
for the port in the CPU configuration, and then change the station address to be used for
stop mode.
In either of these situations, if you have a slave configured with a station address of 1,
confusion may result when the PACSystems CPU responds to requests intended for that
slave.
13.3.1 Message Format
The general formats for RTU message transfers are shown below:
RTU Message Transfers
Slave Turn-around Time
Master Query Message
Slave Response
Query Transaction
Master Broadcast Message
Slave (No Response)
Broadcast Transaction
Figure 31: RTU Message Transactions
The master device begins a data transfer by sending a query or broadcast request message. A slave
completes that data transfer by sending a response message if the master sent a query message
addressed to it. No response message is sent when the master sends a broadcast request.

RTU Slave Turnaround Time

The time between the end of a query and the beginning of the response to that query is called the
slave turnaround time. The turnaround time of a PACSystems slave depends on the Controller
Communications Window time and the sweep time of the PACSystems. RTU requests are processed
only in the Controller Communications Window. In Normal sweep mode, the Controller
Communications Window occurs once per sweep. Because the sweep time on PACSystems can be
up to 2.5 seconds, the time to process an RTU request could be up to 2.5 seconds. Another factor is
the Controller Communications Window time allowed in Hardware Configuration. If you configure a
very small Controller Communications Window, the RTU request may not be completed in one sweep,
causing RTU processing to require multiple sweeps. For details on CPU window modes, refer to
“Window Modes” in Chapter 4.
Receive-to-Transmit Delay
Part of the RTU Slave Turnaround time is the receive-to-transmit delay. The RTU driver inserts this
delay after a request from the master has been received, and before the response to the master is
sent. Starting with Release 6.70 for the RX3i, the receive-to-transmit delay can be configured with
the Serial Port Setup COMMREQ function 65520. The timeout is specified in units of 10 milliseconds,
with a range of
0–255 units (maximum delay is 2.55 seconds). If the specified time is less than 3.5 character times,
then the delay is set to 3.5 character times.
Message Types
The RTU protocol has four message types: query, normal response, error response, and broadcast.
Query
The master sends a message addressed to a single slave.
Normal Response
After the slave performs the function requested by the query, it sends back a normal response for
that function. This indicates that the request was successful.
Error Response
The slave receives the query, but cannot perform the requested function. The slave sends back an
error response that indicates the reason the request could not be processed. (No error message will
be sent for certain types of errors. For more information see “Communication Errors.”)
Broadcast
The master sends a message addressed to all of the slaves by using address 0. All slaves that receive
the broadcast message perform the requested function. This transaction is ended by a time-out
within the master.

Message Fields
The message fields for a typical message are shown in the figure below, and are explained in the
following sections.
FRAME
Station Address Function Code Information Error Check
Station Address
The Station Address is the address of the slave station selected for this data transfer. It is one byte in
length and has a value from 0 to 247 inclusive. An address of 0 selects all slave stations, and
indicates that this is a broadcast message. An address from 1 to 247 selects a slave station with that
station address.
Function Code
The Function Code identifies the command being issued to the station. It is one byte in length and is
defined for the values 0 to 255 as follows:
Function Code Description
0 Illegal Function
1 Read Output Table
2 Read Input Table
3 Read Registers
4 Read Analog Input
5 Force Single Output
6 Preset Single Register
7 Read Exception Status
8 Loopback Maintenance
9-14 Unsupported Function
15 Force Multiple Outputs
16 Preset Multiple Registers
17 Report Device Type
18–21 Unsupported Function
22 Mask Write 4x Register
23 Read/Write 4x Registers
24–66 Unsupported Function
67 Read Scratch Pad Memory
68-127 Unsupported Function
128-255 Reserved for Exception Responses

Information Fields
All message fields, other than the Station Address field, Function Code field, and Error Check field are
called, generically, “information” fields. Information fields contain additional information required to
specify or respond to a requested function. Different types of messages have different types or
numbers of information fields. (Details on information fields for each message type and function code
are found in “Message Descriptions,” page 515) Some messages (Message 07 Query and Message 17
Query) do not have information fields.
Examples
As shown in the following figure, the information fields for message READ OUTPUT TABLE (01) Query
consist of the Starting Point No. field and Number of Points field. The information fields for message
READ OUTPUT TABLE (01) Response consist of the Byte Count field and Data field.
Message (01)
Read Output Table
Information Fields
Address Func Starting Number of Error

01 Point No. Points Check
Hi Lo Hi Lo
Query
Information Fields
Address Func Byte Data Error

01 Count Check
Normal Response
Figure 32: RTU Read Output Table Example
Some information fields include entries for the range of data to be accessed in the RTU slave.
Note: Data addresses are 0-based. This means you will need to subtract 1 from the actual address
when specifying it in the RTU message. For message (01) READ OUTPUT TABLE Query, used in
the example above, you would specify a starting data address in the Starting Point No. field.
To specify %Q0001 as the starting address, you would place the address %Q0000 in this field.
Also, the value placed in the Number of Points field determines how many %Q bits are read,
starting with address %Q0001. For example:
 Starting Point No. field = %Q0007, so the starting address is %Q0008.
 Number of Points field = 16 (0010h), so addresses %Q0008 through %Q0023 will be read.
Error Check Field
The Error Check field is two bytes in length and contains a cyclic redundancy check (CRC-16) code. Its
value is a function of the contents of the station Address, Function code, and Information field. The
details of generating the CRC-16 code are described in “Cyclic Redundancy Check (CRC)” on page
511. Note that the Information field is variable in length. To properly generate the CRC-16 code, the
length of frame must be determined. To calculate the length of a frame for each of the defined
function codes, see “Calculating the Length of Frame” on page 514.

Message Length
Message length varies with the type of message and amount of data to be sent. Information for
determining message length for individual messages is found in “Message Descriptions.”
Character Format
A message is sent as a series of characters. Each byte in a message is transmitted as a character.
The illustration below shows the character format. A character consists of a start bit (0), eight data
bits, an optional parity bit, and one stop bit (1). Between characters the line is held in the 1 state.
MSB Data Bits LSB
10 9 8 7 6 5 4 3 2 1 0
Parity
Stop Start
(optional)
Message Termination
Each station monitors the time between characters. When a period of three character times elapses
without the reception of a character, the end of a message is assumed. The reception of the next
character is assumed to be the beginning of a new message. The end of a frame occurs when the
first of the following two events occurs:
 The number of characters received for the frame is equal to the calculated length of the frame.
 A length of 4 character times elapses without the reception of a character.
Timeout Usage
Timeouts are used on the serial link for error detection, error recovery, and to prevent the missing of
the end of messages and message sequences. Note that although the module allows up to three
character transmission times between each character in a message that it receives, there is no more
than half a character time between each character in a message that the module transmits. After
sending a query message, the master should wait an appropriate amount of time for slave
turnaround before assuming that the slave did not respond to the request. Slave turnaround time is
affected by the Controller Communications Window time and the CPU sweep time, as described in
“RTU Slave Turnaround Time” on page 507.
End-of-frame Timeout
The End-of-frame timeout is a feature that compensates for message gaps that can occur due to the
use of radio modems. The timeout is added to the amount of time allowed for receiving a message
from the master. The timeout should be sized according to the maximum gap time that could be
introduced by the master’s transmitting equipment. Starting with Release 6.70 for the RX3i, the end-
of-frame timeout can be configured with the Serial Port Setup COMMREQ function 65520. The
timeout is specified in units of 100 microseconds. If the specified time is less than 3.5 character
times, then the RTU driver sets the timeout to 3.5 character times.

13.3.2 Cyclic Redundancy Check (CRC)

The CRC is one of the most effective systems for checking errors. The CRC consists of two check
characters generated at the transmitter and added at the end of the transmitted data characters.
Using the same method, the receiver generates its own CRC for the incoming data and compares it
to the CRC sent by the transmitter to ensure proper transmission. A complete mathematic derivation
for the CRC is not given in this section. This information can be found in a number of texts on data
communications. The essential steps that should be understood in calculating the CRC are as follows:
■ The number of bits in the CRC multiplies the data bits that make up the message.
■ The resulting product is then divided by the generating polynomial (using modulo 2 with no
carries). The CRC is the remainder of this division.
■ Disregard the quotient and add the remainder (CRC) to the data bits and transmit the message
with CRC.
■ The receiver then divides the message plus CRC by the generating polynomial and if the
remainder is 0, the transmission was transmitted without error.
A generating polynomial is expressed algebraically as a string of terms in powers of X such as X 3 + X
2 + X 0 (or 1) which can in turn be expressed as the binary number 1101. A generating polynomial
could be any length and contain any pattern of 1s and 0s as long as both the transmitter and
receiver use the same value. For optimum error detection, however, certain standard generating
polynomials have been developed. RTU protocol uses the polynomial X 16 + X 15 + X 2 + 1 which in
binary is 1 1000 0000 0000 0101. The CRC this polynomial generates is known as CRC-16.
The discussion above can be implemented in hardware or software. One hardware implementation
involves constructing a multi-section shift register based on the generating polynomial.
13.3.3 Cyclic Redundancy Check Register
2 15 16
X X X
CRC Register
15 14 + 13 12 11 10 9 8 7 6 5 4 3 2 1 + 0 +
Data
+ = Exclusive Or
Input
Figure 33: CRC Register Operation

To generate the CRC, the message data bits are fed to the shift register one at a time. The CRC
register contains a preset value. As each data bit is presented to the shift register, the bits are shifted
to the right. The LSB is XORed with the data bit and the result is: XORed with the old contents of bit 1
(the result placed in bit 0), XORed with the old contents of bit 14 (and the result placed in bit 13), and
finally, it is shifted into bit 15. This process is repeated until all data bits in a message have been
processed. Software implementation of the CRC-16 is explained in the next section.

13.3.4 Calculating the CRC-16

The pseudo code for calculation of the CRC-16 is given below.
Preset byte count for data to be sent.
Initialize the 16-bit remainder (CRC) register to all ones.
XOR the first 8-bit data byte with the high order byte of the 16-bit CRC register. The
result is the current CRC.
INIT SHIFT: Initialize the shift counter to 0.
SHIFT: Shift the current CRC register 1 bit to the right.
Increment shift count.
Is the bit shifted out to the right (flag) a 1 or a 0?
If it is a 1, XOR the generating polynomial with the current CRC.
If it is a 0, continue.
Is shift counter equal to 8?
If NO, return to SHIFT.
If YES, increment byte count.
Is byte count greater than the data length?
If NO, XOR the next 8-bit data byte with the current CRC and go to INIT SHIFT.
If YES, add current CRC to end of data message for transmission and exit.
When the message is transmitted, the receiver performs the same CRC operation on all the data bits
and the transmitted CRC. If the information is received correctly the resulting remainder (receiver
CRC) is 0.
Sample CRC-16 Calculation
The RTU device transmits the rightmost byte (of registers or discrete data) first. The first bit of the
CRC-16 transmitted is the MSB. Therefore, in the example the MSB of the CRC polynomial is to the
extreme right. The X16 term is dropped because it affects only the quotient (which is discarded) and
not the remainder (the CRC characters). The generating polynomial is therefore 1010 0000 0000
0001. The remainder is initialized to all 1s.
In this example, the CRC-16 is calculated for RTU message, Read Exception Status 07. The message
format is as follows:
Address Function CRC-16
01 07
In this example, device number 1 (address 01) is queried. You need to know the amount of data to be
transmitted and this information can be found for every message type in “Calculating the Length of
Frame.” For this message the data length is 2 bytes.

Transmitter CRC-16 Algorithm Receiver1 CRC-16 Algorithm

MSB2 LSB2 Flag MSB2 LSB2 Flag
Initial Remainder 1111 1111 1111 1111 Rcvr CRC after data 1110 0010 0100 0001
XOR 1st data byte 0000 0000 0000 0001 XOR 1st byte Trns CRC 0000 0000 0100 0001
Current CRC 1111 1111 1111 1111 Current CRC 1110 0010 0000 0000
Shift 1 0111 1111 1111 1111 0 Shift 1 0111 0001 0000 0000 0
Shift 2 0011 1111 1111 1111 1 Shift 2 0011 1000 1000 0000 0
XOR Gen. Polynomial 1010 0000 0000 0001 Shift 3 0001 1100 0100 0000 0
Current CRC 1001 1111 1111 1110 Shift 4 0000 1110 0010 0000 0
Shift 3 0100 1111 1111 1111 0 Shift 5 0000 0111 0001 0000 0
Shift 4 0010 0111 1111 1111 1 Shift 6 0000 0011 1000 1000 0
XOR Gen. Polynomial 1010 0000 0000 0001 Shift 7 0000 0001 1100 0100 0
Current CRC 1000 0111 1111 1110 Shift 8 0000 0000 1110 0010 0
Shift 5 0100 0011 1111 1111 0 XOR 2nd byte trns CRC 0000 0000 1110 0010
Shift 6 0010 0001 1111 1111 1 Current CRC 0000 0000 0000 0000
XOR Gen. Polynomial 1010 0000 0000 0001 Shift 1-8 yields 0000 0000 0000 0000
Current CRC 1000 0001 1111 1110 All errors for receiver final CRC-16 indicates transmission correct.
Shift 7 0100 0000 1111 1111 0
Shift 8 0010 0000 0111 1111 1
XOR Gen. Polynomial 1010 0000 0000 0001
Current CRC 1000 0000 0111 1110
XOR 2nd data byte 0000 0000 0000 0111
Current CRC 1000 0000 0111 1001
Shift 1 0100 0000 0011 1100 1
Current CRC 1110 0000 0011 1101
Shift 2 0111 0000 0001 1110 1
Current CRC 1101 0000 0001 1111
Shift 3 0110 1000 0000 1111 1
Current CRC 1100 1000 0000 1110
Shift 4 0110 0100 0000 0111 0
Shift 5 0011 0010 0000 0011 1
Current CRC 1001 0010 0000 0010
Shift 6 0100 1001 0000 0001 0
Shift 7 0010 0100 1000 0000 1
Current CRC 1000 0100 1000 0001
Shift 8 0100 0010 0100 0000 1
Transmitted CRC 1110 0010 0100 0001
E 2 4 1
1. The receiver processes incoming data through the same CRC algorithm as the transmitter. The example for the receiver
starts at the point after all the data bits but not the transmitted CRC have been received correctly. Therefore, the
receiver CRC should be equal to the transmitted CRC at this point. When this occurs, the output of the CRC algorithm will
be zero indicating that the transmission is correct.
The transmitted message with CRC would then be:
Address Function CRC–16
01 07 41 E2
2. The MSB and LSB references are to the data bytes only, not the CRC bytes. The CRC MSB and LSB order are the reverse
of the data byte order.

13.3.5 Calculating the Length of Frame

To generate the CRC-16 for any message, the message length must be known. The length for all
types of messages can be determined from the table below.
RTU Message Length
Function Name Query or Broadcast Message Length Response Message Length
Code Less CRC Code Less CRC Code
0 Not Defined Not Defined
1 Read Output Table 6 3 + 3rd byte 32
2 Read Input Table 6 3 + 3rd byte32
3 Read Registers 6 3 + 3rd byte32
4 Read Analog Input 6 3 + 3rd byte32
5 Force Single Output 6 6
6 Preset Single Register 6 6
7 Read Exception Status 2 3
8 Loopback/Maintenance 6 6
9-14 Not Defined Not Defined
15 Force Multiple Outputs 7 + 7th byte32 6
16 Preset Multiple Registers 7 + 7th byte32 6
17 Report Device Type 2 8
22 Mask Write 4x Registers 8 8
23 Read/Write 4x Registers 13+byte 1132 5+byte 332
24–66 Not Defined Not Defined
67 Read Scratch Pad 6 3 + 3rd byte32
128-255 Not Defined 3
32 The value of this byte is the number of bytes contained in the data being transmitted.

13.3.6 RTU Message Descriptions

This section presents the format and fields for each RTU message.
Message (01): Read Output Table
Format:

Hi Lo Hi Lo
Query

01 Count Check
Normal Response
Figure 34: RTU Read Output Table Message Format
Query:
 An address of 0 is not allowed because this cannot be a broadcast request.
 The function code is 01.
 The starting point number is two bytes in length and may be any value less than the highest
output point number available in the attached CPU. The starting point number is equal to one
less than the number of the first output point returned in the normal response to this request.
 The number of points value is two bytes in length. It specifies the number of output points
returned in the normal response. The sum of the starting point value and the number of points
value must be less than or equal to the highest output point number available in the attached
CPU. The high order byte of the Starting Point Number and Number of Points fields is sent as the
first byte. The low order byte is the second byte in each of these fields.
Response:
 The byte count is a binary number from 1 to 256 (0 = 256). It is the number of bytes in the normal
response following the byte count and preceding the error check.
 The Data field of the normal response is packed output status data. Each byte contains eight
output point values. The least significant bit (LSB) of the first byte contains the value of the output
point whose number is equal to the starting point number plus one. The values of the output
points are ordered by number starting with the LSB of the first byte of the Data field and ending
with the most significant bit (MSB) of the last byte of the Data field. If the number of points is not a
multiple of 8, the last data byte contains zeroes in one to seven of its highest order bits.

Message (02): Read Input Table

Format:

Hi Lo Hi Lo
Query

02 Count Check
Normal Response
Figure 35: RTU Read Input Table Message Format
Query:
 An address of 0 is not allowed as this cannot be a broadcast request.
 The function code is 02.
 The starting point number is two bytes in length and may be any value less than the highest
input point number available in the attached CPU. The starting point number is equal to one less
than the number of the first input point returned in the normal response to this request.
 The number of points value is two bytes in length. It specifies the number of input points returned
in the normal response. The sum of the starting point value and the number of points value must
be less than or equal to the highest input point number available in the attached CPU. The high
order byte of the Starting Point Number and Number Of Bytes fields is sent as the first byte. The
low order byte is the second byte in each of these fields.
Response:
 The byte count is a binary number from 1 to 256 (0 = 256). It is the number of bytes in the normal
response following the byte count and preceding the error check.
 The Data field of the normal response is packed input status data. Each byte contains eight input
point values. The least significant bit (LSB) of the first byte contains the value of the input point
whose number is equal to the starting point number plus one. The values of the input points are
ordered by number starting with the LSB of the first byte of the Data field and ending with the
most significant bit (MSB) of the last byte of the Data field. If the number of points is not a multiple
of 8, then the last data byte contains zeroes in one to seven of its highest order bits.

Message (03): Read Registers

Format:
03 Register No. Registers Check
Hi Lo Hi Lo
Query

03 Count Check
First Register
Hi Lo Hi Lo
Normal Response
Figure 36: RTU Read Registers Message Format
Query:
 An address of 0 is not allowed as this request cannot be a broadcast request.
 The function code is equal to 3.
 The starting register number is two bytes in length. The starting register number may be any
value less than the highest register number available in the attached CPU. It is equal to one less
than the number of the first register returned in the normal response to this request.
 The number of registers value is two bytes in length. It must contain a value from 1 to 125
inclusive. The sum of the starting register value and the number of registers value must be less
than or equal to the highest register number available in the attached CPU. The high order byte
of the Starting Register Number and Number of Registers fields is sent as the first byte in each of
these fields. The low order byte is the second byte in each of these fields.
Response:
 The byte count is a binary number from 2 to 250 inclusive. It is the number of bytes in the normal
response following the byte count and preceding the error check. Note that the byte count is
equal to two times the number of registers returned in the response. A maximum of 250 bytes
(125) registers is set so that the entire response can fit into one 256 byte data block.
 The registers are returned in the Data field in order of number with the lowest number register in
the first two bytes and the highest number register in the last two bytes of the Data field. The
number of the first register in the Data field is equal to the Starting Register Number plus one.
The high order byte is sent before the low order byte of each register.

Message (04): Read Analog Inputs

Format:
04 Analog Input Analog Check
No. Inputs
Hi Lo Hi Lo
Query
Address Func Byte First Data Error

04 Count Analog Check
Input
Hi Lo Hi Lo
Normal Response
Figure 37: RTU Read Analog Inputs Message Format
Query:
 An Address of 0 is not allowed as this request cannot be a broadcast request.
 The Starting Analog Input Number is two bytes in length. The Starting Analog Input Number may
be any value less than the highest analog input number available in the attached CPU. It is equal
to one less than the number of the first analog input returned in the normal response to this
request.
 The Number Of Analog Inputs value is two bytes in length. It must contain a value from 1 to 125
inclusive. The sum of the Starting Analog Input value and the Number Of Analog Inputs value
must be less than or equal to the highest analog input number available in the at-attached CPU.
The high order byte of the Starting Analog Input Number and Number of Analog Inputs fields is
sent as the first byte in each of these fields. The low order byte is the second byte in each of these
fields.
Response:
 The Byte Count is a binary number from 2 to 250 inclusive. It is the number of bytes in the normal
response following the byte count and preceding the error check. Note that the Byte Count is
equal to two times the number of analog inputs returned in the response. A maximum of 250
bytes (125) analog inputs is set so that the entire response can fit into one 256 byte data block.
 The analog inputs are returned in the Data field in order of number with the lowest number
analog input in the first two bytes and the highest number analog input in the last two bytes of
the Data field. The number of the First Analog Input in the Data field is equal to the Starting
analog input number plus one. The high order byte is sent before the low order byte of each
analog input.

Message (05): Force Single Output

Format:
Address Func Point Data Error Check
05 Number
00H
Hi Lo Hi Lo
Query
Address Func Point Data Error Check

05 Number
00H
Hi Lo Hi Lo
Normal Response
Figure 38: RTU Force Single Output Message Format
Query:
 An Address of 0 indicates a broadcast request. All slave stations process a broadcast re-quest
and no response is sent.
 The Point Number field is two bytes in length. It may be any value less than the highest output
point number available in the attached CPU. It is equal to one less than the number of the output
point to be forced on or off.
 The first byte of the Data field is equal to either 0 or 255 (FFH). The output point specified in the
Point Number field is to be forced off if the first Data field byte is equal to 0. It is to be forced on if
the first Data field byte is equal to 255 (FFH). The second byte of the Data field is always equal to
zero.
Response:
 The normal response to a force single output query is identical to the query.
Note: The force single output request is not an output override command. The output specified in
this request is ensured to be forced to the value specified only at the beginning of one sweep
of the user logic.

Message (06): Preset Single Register

Format:
Address Func Register Data Error Check
06 Number
Hi Lo Hi Lo
Query
Address Func Register Data Error Check

06 Number
Hi Lo Hi Lo
Normal Response
Figure 39: RTU Preset Single Register Message Format
Query:
 An Address 0 indicates a broadcast request. All slave stations process a broadcast request and
no response is sent.
 The Register Number field is two bytes in length. It may be any value less than the highest
register available in the attached CPU. It is equal to one less than the number of the register to be
preset.
 The Data field is two bytes in length and contains the value that the register specified by the
Register Number Field is to be preset to. The first byte in the Data field contains the high order
byte of the preset value. The second byte in the Data field contains the low order byte.
Response:
 The normal response to a preset single register query is identical to the query.

Message (07): Read Exception Status

Format:
Address Func Error Check
07
Query
Address Func Data Error Check

07
Normal Response
Figure 40: RTU Read Exception Status Message Format

Query:
This query is a short form of request for the purpose of reading the first eight output points.
 An Address of zero is not allowed as this cannot be a broadcast request.
Response:
 The Data field of the normal response is one byte in length and contains the states of output
points one through eight. The output states are packed in order of number with output point
one’s state in the least significant bit and output point eight’s state in the most significant bit.

Message (08): Loopback/Maintenance (General)

Format:
Address Func Diagnostic Data Error Check
08 Code
0, 1, or 4
DATA 1 DATA 1
Query
Address Func Diagnostic Data Error Check

08 Code
0, 1, or 4
DATA 1 DATA 1
Normal Response
Figure 41: RTU Loopback/Maintenance Message Format
Query:
 The Function code is equal to 8.
 The Diagnostic Code is two bytes in length. The high order byte of the Diagnostic Code is the first
byte sent in the Diagnostic Code field. The low order byte is the second byte sent. The
loopback/maintenance command is defined only for Diagnostic Codes equal to 0, 1, or 4. All
other Diagnostic Codes are reserved.
 The Data field is two bytes in length. The contents of the two Data bytes are defined by the value
of the Diagnostic Code.

Response:
 See descriptions for individual Diagnostic Codes.
Diagnostic Return Query Data Request (Loopback/Maintenance Code 00):
 An address of 0 is not allowed for the return query data request.
 The values of the two Data field bytes in the query are arbitrary.
 The normal response is identical to the query.
 The values of the Data bytes in the response are equal to the values sent in the query.
Diagnostic Initiate Communication Restart Request (Loopback/Maintenance Code 01):
 An Address of 0 indicates a broadcast request. All slave stations process a broadcast request and
 This request disables the listen-only mode (enables responses to be sent when queries are
received so that communications can be restarted).
 The value of the first byte of the Data field (DATA1) must be 0 or FF. Any other value will cause an
error response to be sent. The value of the second byte of the Data field (DATA2) is always equal
to 0.
 The normal response to an Initiate Communication Restart query is identical to the query.
Diagnostic Force Listen-Only Mode Request (Loopback/Maintenance code 04):
 An Address of 0 indicates a broadcast request. All slave stations process a broadcast request.
 After receiving a Force Listen-Only mode request, the RTU device will go into the listen-only
mode, will not perform a requested function, and will not send either normal or error responses
to any queries. The listen-only mode is disabled when the RTU device receives an Initiate
Communication Restart request or when the RTU device is powered up.
 Both bytes in the Data field of a Force Listen-Only Mode request are equal to 0. The RTU device
never sends a response to a Force Listen-Only Mode request.
Note: Upon power up, the RTU device disables the listen-only mode and is enabled to continue
sending responses to queries.

Message (15): Force Multiple Outputs

Format:
Address Func Starting Number Byte Data Error Check
15 Point No. of Points Count
Query
Address Func Starting Number Error Check

15 Point No. of Points
Normal Response
Figure 42: RTU Force Multiple Outputs Message Format
Query:
 An Address of 0 indicates a broadcast request. All slave stations process a broadcast request and
 The value of the Function code is 15.
 The Starting Point Number is two bytes in length and may be any value less than the highest
output point number available in the attached CPU. The Starting Point Number is equal to one
less than the number of the first output point forced by this request.
 The Number of Points value is two bytes in length. The sum of the Starting Point Number and the
Number of Points value must be less than or equal to the highest output point number available
in the attached CPU. The high order byte of the Starting Point Number and Number of Bytes fields
is sent as the first byte in each of these fields. The low order byte is the second byte in each of
these fields.
 The Byte Count is a binary number from 1 to 256 (0 = 256). It is the number of bytes in the Data
field of the force multiple outputs request.
 The Data field is packed data containing the values that the outputs specified by the Starting
Point Number and the Number of Points fields are to be forced to. Each byte in the Data field
contains the values that eight output points are to be forced to. The least significant bit (LSB) of
the first byte contains the value that the output point whose number is equal to the starting point
number plus one is to be forced to. The values for the output points are ordered by number
starting with the LSB of the first byte of the Data field and ending with the most significant bit
(MSB) of the last byte of the Data field. If the number of points is not a multiple of 8, then the last
data byte contains zeroes in one to seven of its highest order bits.
Response:
 The descriptions of the fields in the response are covered in the query description.
Note: The force multiple outputs request is not an output override command. The outputs specified
in this request are ensured to be forced to the values specified only at the beginning of one
sweep of the user logic.

Message (16): Preset Multiple Registers

Format:
Address Func Starting Number of Byte Data Error Check
16 Point Registers Count
Query
Address Func Starting Number of Error Check

16 Register No. Registers
Normal Response
Figure 43: RTU Preset Multiple Registers Message Format

Query:
 An Address of 0 indicates a broadcast request. All slave stations process a broadcast re-quest
and no response is sent.
 The value of the Function code is 16.
 The Starting Register Number is two bytes in length. The Starting Register Number may be any
value less than the highest register number available in the attached CPU. It is equal to one less
than the number of the first register preset by this request.
 The Number of Registers value is two bytes in length. It must contain a value from 1 to 125
inclusive. The sum of the Starting Register Number and the Number of Registers value must be
less than or equal to the highest register number available in the attached CPU. The high order
byte of the Starting Register Number and Number of Registers fields is sent as the first byte in
each of these fields. The low order byte is the second byte in each of these fields.
 The Byte Count field is one byte in length. It is a binary number from 2 to 250 inclusive. It is equal
to the number of bytes in the data field of the preset multiple registers request. Note that the
Byte Count is equal to twice the value of the Number of Registers.
 The registers are returned in the Data field in order of number with the lowest number register in
the first two bytes and the highest number register in the last two bytes of the Data field. The
number of the first register in the Data field is equal to the starting register number plus one. The
high order byte is sent before the low order byte of each register.
Response:
 The descriptions of the fields in the response are covered in the query description.

Message (17): Report Device Type

Format:
Address Func 17 Error Check
Query
Address Func 17 Byte Device Slave Run Data Error Check

Count Type 43 Light
Normal Response
Figure 44: RTU Report Device Type Message Format

Query:
The Report Device Type query is sent by the master to a slave in order to learn what type of
programmable control or other computer it is.
 An Address of zero is not allowed as this cannot be a broadcast request.
 The Function code is 17.
Response:
 The Byte Count field is one byte in length and is equal to 5.
 The Device Type field is one byte in length and is equal to 43 (hexadecimal) for PACSystems
 The Slave Run Light field is one byte in length. The Slave Run Light byte is equal to OFFH if the
CPU is in RUN mode. It is equal to 0 if the CPU is not in RUN mode.
 The Data field contains three bytes. For PACSystems CPUs, the first byte is the Minor Type, and
the remaining bytes are zeroes. The following table lists minor types.
Response Data
CPU Model
(Minor Type)
02 hex IC698CPE010
04 hex IC698CPE020
05 hex IC698CRE020
06 hex IC698CPE030
08 hex IC698CPE040
IC695CPE305
0A hex
IC695CPU310
0C hex IC695NIU001
10 hex IC695CPU320
11 hex IC695CRU320
12 hex IC695CPE305
18 hex IC695CPU315

Message (22): Mask Write 4x Memory

Modifies the contents of a specified 4x register using a combination of an AND mask, an OR mask,
and the register's current contents. The function can be used to set or clear individual bits in the
register. Broadcast is not supported.
Query
The query specifies the 4x reference to be written, the data to be used as the AND mask, and the
data to be used as the OR mask.
The function's algorithm is:
Result = (Current Contents AND And_Mask) OR (Or_Mask AND And_Mask )
For example:
Hex Binary
Current Contents 12 0001 0010
And_Mask F2 1111 0010
Or_Mask 25 0010 0101
And_Mask 0D 0000 1101
Result 17 0001 0111
Note: If the Or_Mask value is zero, the result is simply the logical ANDing of the current contents
and And_Mask. If the And_Mask value is zero, the result is equal to the Or_Mask value.
Note: The contents of the register can be read with the Read Holding Registers function (function
code 03). They could, however, be changed subsequently as the controller scans its user logic
program.
Example of a Mask Write to register 5 in slave device 17, using the above mask values:
Field Name Example (Hex)
Slave Address 11
Function 16
Reference Address Hi 00
Reference Address Lo 04
And_Mask Hi 00
And_Mask Lo F2
Or_Mask Hi 00
Or_Mask Lo 25
Error Check (LRC or CRC) --
Response
The normal response is an echo of the query. The response is returned after the register has been
written.

Message (23): Read Write 4x Memory

Performs a combination of one read and one write operation in a single Modbus transaction. The
function can write new contents to a group of 4x registers, and then return the contents of another
group of 4x registers. Broadcast is not supported.
Query
The query specifies the starting address and quantity of registers of the group to be read. It also
specifies the starting address, quantity of registers, and data for the group to be written. The Byte
Count field specifies the quantity of bytes to follow in the Write Data field.
Here is an example of a query to read six registers starting at register 5, and to write three registers
starting at register 16, in slave device 17:
Slave address 11
Function 17
Read Reference Address Hi 00
Read Reference Address Lo 04
Quantity to Read Hi 00
Quantity to Read Lo 06
Write Reference Address Hi 00
Write Reference Address Lo 0F
Quantity to Write Hi 00
Quantity to Write Lo 03
Byte Count 06
Write Data 1 Hi 00
Write Data 1 Lo FF
Write Data 2 Hi 00
Write Data 2 Lo FF
Write Data 3 Hi 00
Write Data 3 Lo FF

Response
The normal response contains the data from the group of registers that were read. The Byte Count
field specifies the quantity of bytes to follow in the Read Data field.
Here is an example of a response to the query:
Slave Address 11
Function 17
Byte Count 0C
Read Data 1 Hi 00
Read Data 1 Lo FE
Read Data 2 Hi 0A
Read Data 2 Lo CD
Read Data 3 Hi 00
Read Data 3 Lo 01
Read Data 4 Hi 00
Read Data 4 Lo 03
Read Data 5 Hi 00
Read Data 5 Lo 0D
Read Data 6 Hi 00
Read Data 6 Lo FF

Message (67): Read Scratch Pad Memory

Format:
67 Byte No. Bytes Check
Query

67 Count Check
Normal Response
Figure 45: RTU Read Scratch Pad Memory Message Format
Query:
 An Address of 0 is not allowed as this cannot be a broadcast request.
 The Function Code is equal to 67.
 The Starting Byte Number is two bytes in length and may be any value less than or equal to the
highest scratch pad memory address available in the attached CPU as indicated in the table
below. The Starting Byte Number is equal to the address of the first scratch pad memory byte
returned in the normal response to this request.
 The Number of Bytes value is two bytes in length. It specifies the number of scratch pad memory
locations (bytes) returned in the normal response. The sum of the Starting Byte Number and the
Number of Bytes values must be less than two plus the highest scratch pad memory address
available in the attached CPU. The high order byte of the Starting Byte Number and Number of
Bytes fields is sent as the first byte in each of these fields. The low order byte is the second byte in
each of the fields.
Response:
 The Byte Count is a binary number from 1 to 256 (0 = 256). It is the number of bytes in the Data
field of the normal response.
 The Data field contains the contents of the scratch pad memory requested by the query. The
scratch pad memory bytes are sent in order of address. The contents of the scratch pad memory
byte whose address is equal to the Starting Byte Number is sent in the first byte of the Data field.
The contents of the scratch pad memory byte whose address is equal to one less than the sum of
the starting byte number and number of bytes values is sent in the last byte of the Data field.

13.3.7 RTU Scratch Pad

The entire scratch pad is updated every time an external READ request is received by the
PACSystems RTU slave. All scratch pad locations are read only. The scratch pad is a byte-oriented
memory type.
RTU Scratch Pad Memory Allocation
Bits
SP Address Field Identifier
7 6 5 4 3 2 1 0
00 CPU Run Status 0 0 0 0 See note. 33
01 CPU Command Status Bit pattern same as SP(00)

02 Major 34 (in hexadecimal)
CPU Type
03 Minor 35 (in hexadecimal)
04 – 0B CPU SNP ID 7 ASCII characters + termination character (00h)
0C Major (in BCD)
CPU Firmware Revision No.
0D Minor (in BCD)
0E Communications Management Module (CMM) Major
0F Firmware Revision No. Minor
10—11 Reserved 00h
12 Node Type Identifier PACSystems 43 (hexadecimal)
13—15 Reserved 00h
16 RTU Station Address 1—247 (decimal)
17 Reserved 00h
18—33 36 Sizes of Memory Types
18—1B Register Memory %R size (words)
1C—1F Analog Input Table %AI size (words)
20—23 Analog Output Table %AO size (words)
24—27 Input Table %I size (bits)
28—2B Output Table %O size (bits)
2C—2F Internal Discrete Memory %M size (bits)
The amount of program memory occupied by the
30—33 User Program Code
logic program.
34—FF Reserved 00h
33 0000 = Run_Enabled 0100 = Halted 0001 = Run_Disabled

0101 = Suspended 0010 = Stopped 0110 = Stopped_IO_Enabled
34 CPU Major Type Codes: PACSystems 0x43
35 PACSystems Minor Types for CPU: see Message (17) Report Device Type
36 Four bytes hold the hexadecimal length of each memory type with the most significant word reserved for
future expansion. For example, the default register memory size of 1024 words (0400h) would be returned in
the following format:
Word Least Significant Most Significant
SP Byte 18 19 1A 1B
Contains 00 04 00 00

13.3.8 Communication Errors

Serial link communication errors are divided into three groups:
 Invalid Query Message
 Serial Link Time Outs
 Invalid Transaction
Invalid Query Message
When the communications module receives a query addressed to itself, but cannot process the
query, it sends one of the following error responses:
Subcode
Invalid Function Code 1
Invalid Address Field 2
Invalid Data Field 3
Query Processing Failure 4
The format for an error response to a query is as follows:
Address Exception Error Error
Func Subcode Check
Figure 46: RTU Error Response Format

The address reflects the address provided on the original request. The exception function code is
equal to the sum of the function code of the query plus 128. The error subcode is equal to 1, 2, 3, or 4.
The value of the subcode indicates the reason the query could not be processed.
Invalid Function Code Error Response (1)

An error response with a subcode of 1 is called an invalid function code error response. This response
is sent by a slave if it receives a query whose function code is not equal to 1- 8, 15, 16, 17, or 67.
Note: Starting with Release 6.70 for the RX3i, the invalid function code error response is not used.
Instead, undefined and unsupported function codes are ignored, and no response is
generated.

Invalid Address Error Response (2)

An error response with a subcode of 2 is called an invalid address error response. This error response
is sent in the following cases:
1. The Starting Point Number and Number of Points fields specify output points or input points that
are not available in the attached CPU (returned for function codes 1, 2, 15).
2. The Starting Register Number and Number of Registers fields specify registers that are not
available in the attached CPU (returned for function codes 4, 16).
3. The Starting Analog Input Number and Analog Input Number fields specify analog inputs that are
not available in the attached CPU (returned for function code 3).
4. The Point Number field specifies an output point not available in the attached CPU (returned for
function code 5).
5. The Register Number field specifies a register not available in the attached CPU (returned for
function code 6).
6. The Analog Input Number field specifies an analog input number not available in the at-attached
CPU (returned for function code 3).
7. The Diagnostic Code is not equal to 0, 1, or 4 (returned for function code 8).
8. The starting Byte Number and Number of Bytes fields specify a scratch pad memory address that
is not available in the attached CPU (returned for function code 67).
Invalid Data Value Error Response (3)
An error response with a subcode of 3 is called an invalid data value error response. This response is
sent in the following cases:
The first byte of the Data field is not equal to 0 or 255 (FFh) or the second byte of the Data field is not
equal to 0 for the Force Single Output Request (Function Code 5) or the initiate communication
restart request (function code 8, diagnostic code 1). The two bytes of the Data field are not both
equal to 0 for the Force Listen-Only request (Function Code 8, Diagnostic Code 4). This response is
also sent when the data length specified by the Memory Address field is longer than the data
received.
Query Processing Failure Error Response (4)
An error response with a subcode of 4 is called a query processing failure response. This error
response is sent by a RTU device if it properly receives a query but communication between the
associated CPU and the CMM fails.

Serial Link Timeout

The only cause for a RTU device to timeout is if an interruption to a data stream of 4 character times
occurs while a message is being received. If this occurs the message is considered to have
terminated and no response will be sent to the master. There are certain timing considerations due
to the characteristics of the slave that should be taken into account by the master. After sending a
query message, the master should wait an appropriate amount of time for slave turnaround before
assuming that the slave did not respond to the request. Slave turnaround time is affected by the
Controller Communications Window time and the CPU sweep time, as described in “RTU Slave
Turnaround Time” on page 507.
Invalid Transactions
If an error occurs during transmission that does not fall into the category of an invalid query
message or a serial link time-out, it is known as an invalid transaction. Types of errors causing an
invalid transaction include:
 Bad CRC.
 The data length specified by the Memory Address field is longer than the data received.
 Framing or overrun errors.
 Parity errors.
If an error in this category occurs when a message is received by the slave serial port, the slave does
not return an error message; rather the slave ignores the incoming message, treating the message
as though it was not intended for it.

13.3.9 RTU Slave/SNP Slave Operation with Programmer Attached

A port that has been configured for RTU Slave protocol can switch to SNP protocol if an SNP master
such as a programmer begins communicating to the port. The programmer must use the same serial
communications parameters (baud rate, parity, stop bits, etc.) as the currently active RTU Slave
protocol for it to be recognized. When the CPU recognizes the SNP master, the CPU removes the RTU
Slave protocol from the port and installs SNP Slave as the active protocol.
The SNP protocol that is installed in this case has the following fixed characteristics:
■ The SNP ID is set to blank. Therefore the SNP master must use a blank ID in the SNP attach
message. This also means that this capability is only useful for point-to-point connections.
■ The turnaround time is set to 0ms.
■ The idle timeout is set to 10 seconds.
After the programmer is removed, there is a slight delay (equal to the idle timeout) before the CPU
recognizes its absence. During this time, no messages are processed on the port. The CPU detects
removal of the programmer as an SNP Slave protocol timeout. Therefore, it is important to be careful
when disabling timeouts used by the SNP Slave protocol.
When the CPU recognizes the programmer disconnect, it reinstalls RTU Slave protocol unless a new
protocol has been configured in the meantime. In that case, the CPU installs the new protocol
instead.
Example
1. Port 1 is running RTU Slave protocol at 9600 baud.
2. A programmer is attached to port 1. The programmer is using 9600 baud.
3. The CPU installs SNP Slave on port 1 and the programmer communicates normally.
4. The programmer stores a new configuration to port 1. The new configuration sets the port for
SNP Slave at 4800 baud (it will not take effect until the port loses communications with the
programmer).
5. When the CPU loses communications with the programmer, the new configuration takes effect.

13.4. SNP Slave Protocol

PACSystems CPUs can communicate with Machine Edition software through either Port 1 or Port 2
using SNP slave protocol.
CPU port 1 is wired as an RS-232 Data Communications Equipment (DCE) port, and can be connected
directly using straight-through cable to one of the serial ports of a PC running Machine Edition or
other SNP master software.
CPU port 2 is wired for RS-485. If the SNP master does not have an RS-485 port, an RS-485/RS-232
converter is required. The RX3i can use converter IC690ACC901, which uses +5VDC from the serial
port. The RX7i CPU port 2 does not support IC690ACC901 and requires an externally powered
converter.
PACSystems provides the break free version of SNP, so that the SNP master does not need to issue a
break signal as part of the SNP attach sequence. However, the CPU responds appropriately if a break
signal is detected, by resetting the protocol to wait for another attach sequence from the master.
PACSystems supports both point-to-point connections (single master/single slave) and multi-drop
connections (single master/multiple slaves).
For details on SNP protocol, refer to the Serial Communications User’s Manual, GFK-0582.
13.4.1 Permanent Datagrams
Permanent datagrams survive after the SNP session that created them has been terminated. This
allows an SNP master device to periodically retrieve datagram data from a number of different
controllers on a multi-drop link, without the master having to establish and write the datagram each
time it reconnects to the controller.
The maximum number of permanent datagrams that can be established is 32. When this limit is
reached, additional requests to establish datagrams are denied. One or more of the permanent
datagrams will need to be cancelled before others can be established. Since the permanent
datagrams are not automatically deleted when the SNP session is terminated, this limit prevents an
inordinate amount of these datagrams from being established.
Permanent datagrams do not survive a power-cycle.
13.4.2 Communication Requests (COMMREQs) for SNP
The PACSystems serial ports 1 and 2 currently do not provide SNP Master service, nor do they
support COMMREQ functions for SNP commands. However, those COMMREQ functions can be used
with PCM/CMM modules that are configured to provide SNP service. For more information, refer to
the Serial Communications User’s Manual, GFK-0582.

Chapter 14 Diagnostics
This chapter explains the PACSystems fault handling system, provides definitions of fault extra data,
and suggests corrective actions for faults.
Faults occur in the control system when certain failures or conditions happen that affect the
operation and performance of the system. Some conditions, such as the loss of an I/O module or
rack, may impair the ability of the PACSystems controller to control a machine or process. Other
conditions, such as when a new module comes online and becomes available for use, may be
displayed to inform or alert the user.
Any detected fault is recorded in the Controller Fault Table or the I/O Fault Table, as applicable.
Information in this chapter is organized as follows:
 Fault Handling Overview page 538
 Using the Fault Tables 540
 System Handling of Faults 544
 Controller Fault Descriptions and Corrective Actions 551
 I/O Fault Descriptions and Corrective Actions 585
 Diagnostic Logic Blocks 611

Chapter 14. Diagnostics
14.1. Fault Handling Overview

The PACSystems CPU detects three classes of faults:
Fault Class Examples
Internal Failures (Hardware) Non-responding modules
Failed battery
Failed Energy Pack (CPE305/CPE310 models)
Memory checksum errors
External I/O Failures (Hardware) Loss of rack or module
Addition of rack or module
Loss of Genius I/O block
Operational Failures Communication failures
Configuration failures
Password access failures
14.1.1 System Response to Faults

Hardware failures require that either the system be shut down or the failure be tolerated. I/O failures
may be tolerated by the control system, but they may be intolerable by the application or the process
being controlled. Operational failures are normally tolerated.
Faults have three attributes:
Fault Table Affected I/O Fault Table
Controller Fault Table
Fault Action Fatal
Diagnostic
Informational
Configurability Configurable
Non-configurable
14.1.2 Fault Tables

The PACSystems CPU maintains two fault tables, the Controller Fault Table for internal CPU faults and
the I/O Fault Table for faults generated by I/O devices (including I/O controllers). For more
information, see “Using the Fault Tables” on page 540.

14.1.3 Fault Actions and Fault Action Configuration

Fatal faults cause the fault to be recorded in the appropriate table, diagnostic variables to be set, and
the system to be stopped. Only fatal faults cause the system to stop.
Diagnostic faults are recorded in the appropriate table, and any diagnostic variables are set.
Informational faults are only recorded in the appropriate table.
Fault Action Response by CPU
Fatal Log fault in fault table.
Set fault references.
Go to Stop/Fault mode.
Diagnostic Log fault in fault table.
Set fault references.
Informational Log fault in fault table.
The hardware configuration can be used to specify the fault action of some fault groups. For these
groups, the fault action can be configured as either fatal or diagnostic. When a fatal or diagnostic
fault within a configurable group occurs, the CPU executes the configured fault action instead of the
action specified within the fault.
Note: The fault action displayed in the expanded fault details indicates the fault action specified by
the fault that was logged, but not necessarily the executed fault action. To determine what
action was executed for a particular fault in a configurable fault group, you must refer to the
hardware configuration settings.
Faults that are part of configurable fault groups:

Fault Action Displayed in
Informational Diagnostic Fatal
Fault Table
Diagnostic or Fatal.
Diagnostic or Fatal.
Fault Action Executed Informational Determined by action
Determined by action selected
selected in Hardware
in Hardware Configuration.
Configuration.
Faults that are part of non-configurable fault groups:

Fault Action Displayed in
Informational Diagnostic Fatal
Fault Table
Fault Action Executed Informational Diagnostic Fatal

14.2. Using the Fault Tables

To display the fault tables in Logic Developer software,
1. Go online with the PACSystems.
2. Select the Project tab in the Navigator, right click the Target node and choose Diagnostics. The
Fault Table Viewer appears.
The Controller Fault Table and the I/O Fault Table display the following information:
Controller Time/Date The current date and time of the CPU.
Last Cleared The date and time faults were last cleared from the fault table. This
information is maintained by the PACSystems controller.
Status Displays “Updating” while the programmer is reading the fault table. Status is
“Online” when update is complete.
Total Faults The total number of faults since the table was last cleared.
Entries Overflowed The number of entries lost because the fault table has overflowed since it
was cleared. Each fault table can contain up to 64 faults.
14.2.1 Controller Fault Table

The Controller Fault Table displays CPU faults such as password violations, configuration
mismatches, parity errors, and communications errors.
Figure 47: Controller Fault Table Display

The Controller Fault Table provides the following information for each fault:
Location Identifies the location of the fault by rack.slot.
Description Corresponds to a fault group, which is identified in the fault Details.
Date/Time The date and time the fault occurred based on the CPU clock.
Details To view detailed information, click the fault entry. See “Viewing Controller Fault
Details” for more information.

Viewing Controller Fault Details

Note: The fault action displayed in the expanded fault details indicates the fault action specified by
the fault that was logged, but not necessarily the executed fault action. To determine what
action was executed for a particular fault in a configurable fault group, you must refer to the
hardware configuration settings.
To see controller fault details, click the fault entry. The detailed information box for the fault appears.
(To close this box, click the fault.)
Figure 48: Detail Information for Controller Fault Entry

The detailed information for controller faults includes the following:
Error Code Further identifies the fault. Each fault group has its own set of error codes.
Group Group is the highest classification of a fault and identifies the general category
of the fault. The fault description text displayed by your programming software
is based on the fault group and the error codes.
Action Fatal, Diagnostic, or Informational. For definitions of these actions, see p.539.
Task Number Not used for most faults. When used, provides additional information for
Technical Support representatives.
Fault Extra Data Provides additional information for diagnostics by Technical Support engineers.
Explanations of this information are provided as appropriate for specific faults
in “Controller Fault Descriptions and Corrective Actions” on page 551.
User-Defined Faults
User-defined faults can be logged in the Controller Fault Table. When a user-defined fault occurs, it is
displayed in the appropriate fault table as “Application Msg (error_code):” and may be followed by a
descriptive message up to 24 characters. The user can define all characters in the descriptive
message. Although the message must end with the null character, e.g., zero (0), the null character
does not count as one of the 24 characters. If the message contains more than 24 characters, only
the first 24 characters are displayed.
Certain user-defined faults can be used to set a system status reference (%SA0081–%SA0112).
User-defined faults are created using SVC_REQ 21: User-Defined Fault Logging, which is described in
Chapter 9.
Note: When a user-defined fault is displayed in the Controller Fault table, a value of -32768 (8000
hex) is added to the error code. For example, the error code 5 will be displayed as -32763.

14.2.2 I/O Fault Table

The I/O Fault Table displays I/O faults such as circuit faults, address conflicts, forced circuits, I/O
module addition/loss faults and I/O bus faults.
The fault table displays a maximum of 64 faults. When the fault table is full, it displays the earliest 32
faults (33—64) and the last 32 faults (1—32). When another fault is received, fault 32 is shoved out of
the table. In this way, the first 32 faults are preserved for the user to view.
Figure 49: I/O Fault Table Display

The I/O Fault Table provides the following information for each fault:
Location Identifies the location of the fault by rack.slot location, and sometimes bus and
buss address.
CIRC No. When applicable, identifies the specific I/O point on the module.
Variable Name If the fault is on a point that is mapped to an I/O variable, and the variable is set to
publish (either internal or external), the I/O Fault Table displays the variable name.
Unpublished I/O variables will not be displayed in this field.
Ref. Address If the fault is on a point that is mapped to a reference address, this field identifies
the I/O memory type and location (offset) that corresponds to the point
experiencing the fault. When a Genius device fault or local analog module fault
occurs, the reference address refers to the first point on the block where the fault
occurred.
Note: The Reference Address field displays 16-bits and %W memory has a 32-bit
range. Addresses in %W are displayed correctly for offsets in the 16-bit
range (≤65,535). For %W offsets greater than 16-bits, the I/O Fault Table
displays a blank reference address.
Fault Category Specifies a general classification of the fault.
Fault Type Consists of subcategories under certain fault categories. Set to zero when not
applicable to the category.
Date/Time The date and time the fault occurred based on the CPU clock.
Details To view detailed information, click the fault entry. See “Viewing I/O Fault Details” for
more information.

Viewing I/O Fault Details

To see I/O fault details, click the fault entry. The detailed information box for the fault appears. (To
close this box, click the fault.)
Figure 50: I/O Fault Table Fault Entry Detail Display
The detailed information for I/O faults includes:

I/O Bus When the module in the slot is a Genius Bus Controller (GBC), this number is
always one.
Bus Address The serial bus address of the Genius device that reported or has the fault.
Point Address Identifies the point on the I/O device that has the fault when the fault is a
point-type fault.
Group Fault group is the highest classification of a fault. It identifies the general
category of the fault.
Action Fatal, Diagnostic, or Informational. For definitions of these actions, refer to
page 539.
Category Identifies the category of the fault.
Fault Type Identifies the fault type by number. Set to zero when not applicable to the
category.
Fault Extra Data Provides additional information for diagnostics by Technical Support
engineers. Explanations of this information are provided as appropriate for
specific faults in “I/O Fault Descriptions and Corrective Actions” on page 582.
Fault Description Provides a specific fault code when the I/O fault category is a circuit fault
(discrete circuit fault, analog circuit fault, low-level analog fault) or module
fault. It is set to zero for other fault categories.

14.3. System Handling of Faults

The system fault references listed below can be used to identify the specific type of fault that has
occurred. (A complete list of “System Status References” is provided in Chapter 6.)
System Fault Address Description
Reference
#ANY_FLT %SC0009 Any new fault in either table since the last power-up or clearing
of the fault tables
#SY_FLT %SC0010 Any new system fault in the Controller Fault Table since the last
power-up or clearing of the fault tables
#IO_FLT %SC0011 Any new fault in the I/O Fault Table since the last power-up or
clearing of the fault tables
#SY_PRES %SC0012 Indicates that there is at least one entry in the Controller Fault
Table
#IO_PRES %SC0013 Indicates that there is at least one entry in the I/O Fault Table
#HRD_FLT %SC0014 Any hardware fault
#SFT_FLT %SC0015 Any software fault
On power-up, the system fault references are cleared. If a fault occurs, the positive contact transition
of any affected reference is turned on the sweep after the fault occurs. The system fault references
remain on until both fault tables are cleared or All Memory in the CPU is cleared.
14.3.1 System Fault References
When a system fault reference is set, additional fault references are also set. These other types of
faults are listed in “Fault References for Configurable Faults” below and “Fault References for Non-
Configurable Faults” on page 546.

Fault References for Configurable Faults

Fault
Address Description May Also Be Set
(Default Action)
#SBUS_ER %SA0032 System bus error. All system bus error faults are #HRD_FLT, #SY_PRES,
(diagnostic) logged as informational. #SY_FLT
#SFT_IOC 37 %SA0029 Non-recoverable software error in an I/O #IO_FLT, #IO_PRES,
(diagnostic) Controller (IOC). #SFT_FLT
#LOS_RCK 38 %SA0012 Loss of rack (BRM failure, loss of power) or #SY_FLT, #SY_PRES,
(diagnostic) missing a configured rack. #IO_FLT, #IO_PRES
#LOS_IOC 39 %SA0013 Loss of I/O Controller or missing a configured #IO_FLT, #IO_PRES
(diagnostic) Bus Controller.
#LOS_IOM %SA0014 Loss of I/O module (does not respond), or #IO_FLT, #IO_PRES
(diagnostic) missing a configured I/O module.
#LOS_SIO %SA0015 Loss of intelligent module (does not respond), or #SY_FLT, #SY_PRES
(diagnostic) missing a configured module.
#IOC_FLT %SA0022 Non-fatal bus or I/O Controller error, more than #IO_FLT, #IO_PRES
(diagnostic) 10 bus errors in 10 seconds. (Error rate is
configurable.)
#CFG_MM %SA0009 Configuration mismatch. Wrong module type #SY_FLT, #SY_PRES
(fatal) detected. The CPU does not check the
configuration parameter settings for individual
modules such as Genius I/O blocks.
#OVR_TMP %SA0008 CPU temperature has exceeded its normal #SY_FLT, #SY_PRES
(diagnostic) operating temperature.
Note: If the fault action for a fault logged to the fault table is informational, the configured action is
not used. For example, if the logged fault action for an SBUS_ERR is informational, but you
configure it as fatal, the action is still informational.
37 The #SFT_IOC software fault will have the same action as what you set for #LOS_IOC.
38 When a Loss of Rack or Addition of Rack fault is logged, individual loss or add faults for each module in that
rack are usually not generated.
39 Even if the #LOS_IOC fault is configured as Fatal, the CPU will not go to STOP/FAULT unless both GBCs of an
internal redundant pair fail.

Fault References for Non-Configurable Faults

Fault Address Description Result
#PS_FLT %SA0005 Power supply fault Sets #SY_FLT, #SY_PRES
#HRD_CPU %SA0010 CPU hardware fault (such as failed memory Sets #SY_FLT, #SY_PRES, #HRD_FLT
(fatal) device or failed serial port).
#HRD_SIO %SA0027 Non-fatal hardware fault on any module in Sets #SY_FLT, #SY_PRES, #HRD_FLT
(diagnostic) the system, such as failure of a serial port
on a LAN interface module.
#PNIO_ %SA0030 A diagnostic PROFINET alarm has been Sets #ANY_FLT, #IO_FLT, #IO_PRES
ALARM received and an I/O fault has been logged
in group 28.
#SFT_SIO %SA0031 Non-recoverable software error in a LAN Sets #SY_FLT, #SY_PRES, #SFT_FLT
(diagnostic) interface module.
#PB_SUM %SA0001 Program or block checksum failure during Sets #SY_FLT, #SY_PRES
(fatal) power-up or in Run mode.
#LOW_BAT %SA0011 The low battery indication is not supported Sets #SY_FLT, #SY_PRES
(diagnostic) for all CPU versions. For details, see
“Battery Status (Group 18)” on page 567.
#OV_SWP %SA0002 Constant sweep time exceeded. Sets #SY_FLT, #SY_PRES
(diagnostic)
#SY_FULL %SA0022 Controller fault table full (64 entries). Sets #SY_FLT, #SY_PRES, #IO_FLT,
#IO_FULL I/O Fault Table full (64 entries). #IO_PRES
(diagnostic)
#APL_FLT %SA0003 Application fault. Sets #SY_FLT, #SY_PRES
(diagnostic)
#ADD_RCK38 %SA0017 New rack added, extra rack, or previously Sets #SY_FLT, #SY_PRES
(diagnostic) faulted rack has returned.
#ADD_IOC %SA0018 Extra IOC, previously faulted I/O Controller Sets #IO_FLT, #IO_PRES
(diagnostic) is no longer faulted.
#ADD_IOM %SA0019 Extra IO module, or previously faulted I/O Sets #IO_FLT, #IO_PRES
(diagnostic) module is no longer faulted.
#ADD_SIO %SA0020 New intelligent module is added, or Sets #SY_FLT, #SY_PRES
(diagnostic) previously faulted module no longer
faulted.
#IOM_FLT %SA0023 Point or channel on an I/O module; a partial Sets #IO_FLT, I#O_PRES
(diagnostic) failure of the module.
#NO_PROG %SB0009 No application program is present at CPU will not go to Run mode; it
(information) power-up. Should only occur the first time continues executing Stop mode
the PACSystems controller is powered up or sweep until a valid program is loaded.
if the user memory containing the program This can be a “null” program that does
fails. nothing. Sets #SY_FLT and #SY_PRES.

Fault Address Description Result

#BAD_RAM %SB0010 Corrupted program memory at power-up. Sets #SY_FLT and #SY_PRES.
(fatal) Program could not be read and/or did not
pass checksum tests.
#WIND_ER %SB0001 Window completion error. Servicing of Sets #SY_FLT and #SY_PRES.
(information) Controller Communications or Logic
Window was skipped. Occurs in Constant
Sweep mode.
#BAD_PWD %SB0011 Change of privilege level request to a Sets #SY_FLT and #SY_PRES.
(information) protection level was denied; bad password.
#NUL_CFG %SB0012 No configuration present upon transition to Sets #SY_FLT and #SY_PRES.
(fatal) Run mode. Running without a configuration
is equivalent to suspending the I/O scans.
#SFT_CPU %SB0013 CPU software fault. A non-recoverable CPU immediately transitions to
(fatal) error has been detected in the CPU. May be Stop/Halt mode. The only activity
caused by Watchdog Timer expiring. permitted is communication with the
programmer. To be cleared, controller
power must be cycled. Sets SY_FLT,
SY_PRES, and SFT_FLT.
#STOR_ER %SB0014 Download of data to CPU from the CPU will not transition to Run mode.
(fatal) programmer failed; some data in CPU may This fault is not cleared at power-up,
be corrupted. intervention is required to correct it.
Sets SY_FLT and SY_PRES.

14.3.2 Using Fault Contacts

Fault (-[F]-) and no-fault (-[NF]-) contacts can be used to detect the presence of I/O faults in the
system. These contacts cannot be overridden. The following table shows the state of fault and no-
fault contacts.
Condition [F] [NF]
Fault Present ON OFF
Fault Absent OFF ON
An NF contact will be ON (F contact will be OFF) when the referenced I/O point is not faulted, or the
referenced I/O point does not exist in the hardware configuration.
Fault Locating References (Rack, Slot, Bus, Module)
The PACSystems CPU supports reserved fault names for each rack, slot, bus, and module. By
programming these names on the FAULT and NOFLT contact instructions, logic can be executed in
response to faults associated with configured racks and modules.
Fault Locating Reference Name Format
These fault names can only be programmed on the FAULT and NOFLT contacts. The reserved fault
names are always available. It is not necessary to enable a special option, such as point faults.
Fault Reference Reserved Comment
Type Name
Rack #RACK_000r Where r is rack number 0 to 7.
Slot #SLOT_0rss Where r is rack number 0 to 7 and ss is slot number 0 to 31.
Bus #BUS_0rssb Where r is rack number 0 to 7, ss is slot number 0 to 31, and b is
(Genius only) the bus number (0 or 1).
Module #M_rssbmmm Where r is rack number 0 to 7, ss is slot number 0 to 31, b is the
(Genius only) bus number, and mmm is the Bus Address number 000 to 255.
These fault names do not correspond to %SA, %SB, %SC, or to any other reference type. They are
mapped to a memory area that is not user-accessible. Only the name is displayed.
Fault Reference Name Examples:
#RACK_0001 represents rack 1.

#SLOT_0105 represents rack 1, slot 5.
#BUS_02041 represents rack 2, slot 4, bus 1.
#M_2061028 represents rack 2, slot 6, bus 1, Genius module 28.
Note: When a slot level failure fault is reported to the fault tables, all bus and module fault locating
references associated with that slot are set (the FAULT contact passes power flow, and the
NOFLT contact does not pass power flow), regardless of what type of module it is. Conversely,
when a slot level reset fault is reported to the fault tables, all bus and module fault locating
references are cleared (the FAULT contact does not pass power flow, and the NOFLT contact
passes power flow).

Behavior of Fault Locating References

At power-up, all fault locating references are cleared in the CPU. When a fault is logged, the CPU
transitions the state of the affected reference(s). The state of the fault reference remains in the fault
state until one of the following actions occurs:
 Both the Controller and the I/O Fault Tables are cleared through your programming software
either by clearing each table individually or clearing the entire CPU memory.
 The associated device (rack, I/O module, or Genius device) is added back into the system.
Whenever an “Addition of. . . ” fault is logged, the CPU initializes all fault references associated
with the device to the NoFlt state. These references remain in the NoFlt state until another fault
associated with the device is reported. (This could take several seconds for distributed I/O faults,
especially if the bus controller has been reset.)
Note: These fault references are set for informational purposes only. They should not be used to
qualify I/O data. The Alarm Contacts (described on page 549) may be used to qualify I/O data.
The CPU does not halt execution as a result of setting a fault locating reference to the Fault
state.
The fault references have a cascading effect. If there is a problem in the module located at rack 5,
slot 6, bus 1, module 29, the following fault references are set: RACK_05, SLOT_0506, BUS_05061, and
M_5061029. There will only be one entry in the fault table to describe the problem with the module.
The fault table does not show separate entries pertaining to the rack, slot, and bus in this case.
If an analog base module (IC697ALG230) is lost, the fault locating reference for that module is set.
The fault locating references for its expander modules (IC697ALG440 and ALG441) are not set as a
result of the loss. Therefore, any fault locating references to an expander module should also
reference the base module to verify that the module or its base have not been lost.
14.3.3 Using Point Faults
Point faults pertain to external I/O faults, although they are also set due to the failure of associated
higher-level internal hardware (for example, IOC failure or loss of a rack). To use point faults, they
must be enabled in Hardware Configuration on the Memory parameters tab of the CPU.
When enabled, a bit for each discrete I/O point and a byte for each analog I/O channel are allocated
in CPU memory. The CPU memory used for point faults is included in the total reference table
memory size. The FAULT and NOFLT contacts described in “Using Fault Contacts” on page 548
provide access to the point faults.
The full support of point fault contacts depends on the capability of the I/O module. Some Series 90-
30 modules do not support point fault contacts. The point fault contacts for these modules remain all
off, unless a Loss of I/O Module occurs, in which case the RX3i CPU turns on all point fault contacts
associated with the lost module.

14.3.4 Using Alarm Contacts

High (-[HA]-) and low (-[LA]-) alarm contacts are used to represent the state of the analog input
module comparator function. To use alarm contacts, point faults must first be enabled in Hardware
Configuration on the Memory parameters tab of the CPU.
The following example logic uses both high and low alarm contacts.
Note: HA and LA contacts do not create an entry in a fault table.

14.4. Controller Fault Descriptions and Corrective Actions

Each fault explanation contains a fault description and instructions to correct the fault. Many fault
descriptions have multiple causes. In these cases, the error code and additional fault information are
used to distinguish among fault conditions sharing the same fault description.
14.4.1 Controller Fault Groups
Group Name Default Fault Action 40 Configurable
1 Loss of or Missing Rack Diagnostic Yes
4 Loss of or Missing Option Module Diagnostic Yes
5 Addition of, or Extra Rack N/A No
8 Reset of, Addition of, or Extra Option Module N/A No
11 System Configuration Mismatch Fatal 41 Yes
12 System Bus Error Fatal Yes
13 CPU Hardware Failure N/A No
14 Module Hardware Failure N/A No
16 Option Module Software Failure N/A No
17 Program or Block Checksum Failure Group N/A No
18 Battery Status Group N/A No
19 Constant Sweep Time Exceeded N/A No
20 System Fault Table Full N/A No
21 I/O Fault Table Full N/A No
22 User Application Fault N/A No
24 CPU Over Temperature Diagnostic Yes
128 System Bus Failure N/A No
129 No User Program on Power-up N/A No
130 Corrupted User Program on Power-up N/A No
131 Window Completion Failure N/A No
132 Password Access Failure N/A No
134 Null System Configuration for Run Mode N/A No
135 CPU System Software Failure N/A No
137 Communications Failure During Store N/A No
140 Non-critical CPU Software Event N/A No
40 The fault action indicated is not applicable if the fault is displayed as informational. Faults displayed as
informational, always behave as informational.
41 If a system configuration mismatch occurs when the CPU is in Run mode, the fault action will be Diagnostic
regardless of the fault configuration. For additional information, see “Fault Parameters” in Chapter 3.

14.4.2 Loss of or Missing Rack (Group 1)

The fault group Loss of or Missing Rack occurs when the system cannot communicate with an
expansion rack because the BTM (Bus Transmitter Module) in the main rack failed, the BRM (Bus
Receiver Module) in the expansion rack failed, power failed in the expansion rack, or the expansion
rack was configured in the configuration file but did not respond during power-up.
Default action: Diagnostic. Configurable.
1, Rack Lost
The CPU generates this error when the main rack can no longer communicate with an expansion
rack. The error is generated for each expansion rack that exists in the system.
Correction
1) Power off the system. Verify that both the BTM and the BRM are seated properly in their
respective racks and that all cables are properly connected and seated.
2) Replace the cables.
3) Replace the BRM.
4) Replace the BTM.
2, Rack Not Responding
The CPU generates this error when the configuration file stored from the programmer indicates that
a particular expansion rack should be in the system but none responds for that rack number.
Correction
1) Check rack number jumper behind power supply—first on missing rack and then on all other
racks—for duplicated rack numbers.
2) Update the configuration file if a rack should not be present.
3) Add the rack to the hardware configuration if a rack should be present and one is not.
4) Power off the system. Verify that both the BTM and the BRM are seated properly in their
respective racks and that all cables are properly connected and seated.
5) Replace the cables.
6) Replace the BRM.
7) Replace the BTM.
8) Check for Termination Plug on last BRM.

14.4.3 Loss of or Missing Option Module (Group 4)

The fault group Loss of or Missing Option Module occurs when a LAN interface module, BTM, or BRM
fails to respond. The failure may occur at power-up or store of configuration if the module is missing
or during operation if the module fails to respond. This may also occur due to hot removal of an
option module.
Default action: Diagnostic. Configurable
3C hex/60 decimal, Module in Firmware Update Mode
The CPU generates this error when it finds a module in Firmware Update mode. Modules in this mode
will not communicate with the CPU.
Correction
1) Run the firmware update utility for the module.
2) Reset the module with the push-button.
3) Power-cycle the entire system.
4) Power-cycle the rack containing the module.
63 hex/99 decimal, Module Hot Removed
The CPU logs this fault when it detects hot removal of an option module such as the LAN interface
module. No correction necessary
All Others, Module Failure During Configuration
The CPU generates this error when a module fails during power-up or configuration store.
Correction
1) Power off the system. Replace the module located in that rack and slot.
2) If the board is located in an expansion rack, verify BTM/BRM cable connections are tight and the
modules are seated properly; verify the addressing of the expansion rack.
3) Replace the BTM.
4) Replace the BRM.
5) Replace the rack.

14.4.4 Addition of, or Extra Rack (Group 5)

This fault group occurs when a configured expansion rack with which the CPU could not
communicate comes online or is powered on, or an unconfigured rack is found.
Action: Non-configurable.
1, Extra Rack
Correction
1) Check rack jumper behind power supply for correct setting.
2) Update the configuration file to include the expansion rack.
Note: No correction necessary if rack was just powered on.

14.4.5 Reset of, Addition of, or Extra Option Module (Group 8)

The fault group Reset of, Addition of, or Extra Option Module occurs when an option module (LAN
interface module, BTM, etc.) comes online, is reset, is hot inserted or a module is found in the rack but
is not configured.
3, LAN Interface Restart Complete, Running Utility
The LAN Interface module has restarted and is running a utility program.
Correction
Refer to the LAN Interface manual, GFK-0868 or GFK-0869 (previously GFK-0533).
7, Extra Option Module
Note: This fault is logged for an RX3i CPE310 that is configured as a CPU310 because the RX3i
system detects the embedded Ethernet module as an unconfigured module.
Correction
1) Update the configuration file to include the module.
2) Remove the module from the system.
E Hex/14 Decimal, Option Module Hot inserted
The CPU logs this fault when it detects hot insertion of an option module such as the LAN interface
module. No correction necessary
Note: When configuration is cleared or stored, a reset fault is generated for every intelligent option
module physically present in the system.

14.4.6 System Configuration Mismatch (Group 11)

The fault group Configuration Mismatch occurs when the module occupying a slot is different from
that specified in the configuration file. When the GBC generates the mismatch because of a Genius
block, the second byte in the Fault Extra Data field contains the bus address of the mismatched
block.
Default action: Fatal. Configurable.
Note: If a system configuration mismatch occurs when the CPU is in Run mode, the fault action will
be Diagnostic regardless of the fault configuration. For additional information, see “Fault
Parameters” in Chapter 3.
2, Genius I/O Block Model Number Mismatch
The CPU generates this fault when the configured and physical Genius I/O blocks have different
model numbers.
Correction
1) Replace the Genius I/O block with one corresponding to the configured module.
2) Update the configuration file.
Fault Extra Data for Genius I/O Block Model Number Mismatch
Byte Value
[0] FF (flag byte)
[1] Serial Bus address
[2] Installed module type (See “Installed/Configured Module Types” on page 556.)
[3] Configured module type (See “Installed/Configured Module Types” on page 556.)
Installed/Configured Module Types (Bytes 2 and 3 of Fault Extra Data)
Number
Description
Decimal Hexadecimal
4 4 Genius Network Interface (GENI)
5 5 Phase B Hand Held Monitor
6 6 Phase B Series Six GBC with Diagnostics
7 7 Phase B Series Six GBC without Diagnostics
8 8 PLCM/Series Six
9 9 PLCM/Series 90-70
10 A Series 90-70 Single Channel Bus Controller
11 B Series 90-70 Dual Channel Bus Controller
12 C Series 90-10 Genius Communications Module
13 D Series 90-30 Genius Communications Module
32 20 High Speed Counter
69 45 Phase B 115Vac 8-point (2 amp) Grouped Block
70 46 Phase B 115Vac/125Vdc 8-point Isolated Block
70 46 Phase B 115Vac/125Vdc 8-point Isolated Block without Failed Switch
71 47 Phase B 220Vac 8-point Grouped Block
72 48 Phase B 24-48Vdc 16-point Proximity Sink Block

Number
Description
Decimal Hexadecimal
72 48 Phase B 24Vdc 16-point Proximity Sink Block
73 49 Phase B 24-48Vdc 16-point Source Block
73 49 Phase B 24Vdc 16-point Proximity Source Block
74 4A Phase B 12-24Vdc 32-point Sink Block
75 4B Phase B 12-24Vdc 32-point Source Block
76 4C Phase B 12-24Vdc 32-point 5V Logic Block
77 4D Phase B 115Vac 16-point Quad State Input Block
78 4E Phase B 12-24Vdc 16-point Quad State Input Block
79 4F Phase B 115/230Vac 16-point Normally Open Relay Block
80 50 Phase B 115/230Vac 16-point Normally Closed Relay Block
81 51 Phase B 115Vac 16-point AC Input Block
82 52 Phase B 115Vac 8-point Low-Leakage Grouped Block
Genius Network Adapter (GENA). See “GENA Application ID Numbers”
127 7F
below.
131 83 Phase B 115Vac 4-input, 2-output Analog Block
132 84 Phase B 24Vdc 4-input, 2-output Analog Block
133 85 Phase B 220Vac 4-input, 2-output Analog Block
134 86 Phase B 115Vac Thermocouple Input Block
135 87 Phase B 24Vdc Thermocouple Input Block
136 88 Phase B 115Vac RTD Input Block
137 89 Phase B 24/48Vdc RTD Input Block
138 8A Phase B 115Vac Strain Gauge/mV Analog Input Block
139 8B Phase B 24Vdc Strain Gauge/mV Analog Input Block
140 8C Phase B 115Vac 4-input, 2-output Current Source Analog Block
141 8D Phase B 24Vdc 4-input, 2-output Current Source Analog Block
GENA Application ID Numbers

If the model number is 7F hex (Genius Network Adapter), the block may be one of the following. (The
GENA Application ID is shown for reference.)
Number
Decimal Hexadecimal Description
131 83 115Vac/230Vac/125Vdc Power Monitor Module
132 84 24/48Vdc Power Monitor Module
160 A0 Genius Remote 90-70 Rack Controller

4, I/O Type Mismatch

The CPU generates this fault when the physical and configured I/O types of Genius grouped blocks
are different.
Correction
1) Remove the indicated Genius module and install the module indicated in the configuration file.
2) Update the Genius module descriptions in the configuration file to agree with what is physically
installed.
Fault Extra Data for I/O Type Mismatch
Byte Value
[0] FF
[1] Bus address
[2] Installed module’s I/O type
[3] Configured module’s I/O type
Genius Installed Module I/O Types (Byte 2 of Fault Extra Data)

Value Description
01 Input only
02 Output only
03 Combination
Genius Configured Module I/O Types (Byte 3 of Fault Extra Data)

Value
Decimal Hexadecimal Description
0 0 Discrete input
1 1 Discrete output
2 2 Analog input
3 3 Analog output
4 4 Discrete grouped
5 5 Analog grouped
20 14 Analog in, discrete in
21 15 Analog in, discrete out
24 18 Analog in, discrete grouped
30 1E Analog out, discrete in
31 1F Analog out, discrete out
34 22 Analog out, discrete grouped
50 32 Analog grouped, discrete in
51 33 Analog grouped, discrete out
54 36 Analog grouped, discrete grouped

8, Analog Expander Mismatch

The CPU generates this error when the configured and physical Analog Expander modules have
different model numbers.
Correction
1) Replace the Analog Expander module with one corresponding to configured module.
9, Genius I/O Block Size Mismatch
The CPU generates this error when block configuration size does not match the configured size.
Correction
Reconfigure the block.
Fault Extra Data for Genius I/O Block Size Mismatch
Byte Value
[0] FF
[1] Bus address
[2] Module’s broadcast data length
[3] Configured module’s broadcast data
length
A hex/10 decimal, Unsupported Feature

Configured feature not supported by this revision of the module.
Correction
1) Update the module to a revision that supports the feature.
2) Change the module configuration.
Fault Extra Data for Unsupported Feature
Byte Value
[8] Contains a reason code indicating what feature is not supported.
0x5 – GBC revision too old
0x6 – Only supported in main rack
E hex/14 decimal, LAN Duplicate MAC Address

This LAN Interface module has the same MAC address as another device on the LAN. The module is
off the network.
Correction
1) Change the module’s MAC address.
2) Change the other device’s MAC address.
F hex/15 decimal, LAN Duplicate MAC Address Resolved
Previous duplicate MAC address has been resolved. The module is back on the network. This is an
informational message. No correction required.

10 hex/16 decimal, LAN MAC Address Mismatch

MAC address programmed by softswitch utility does not match configuration stored from software.
Correction
Change MAC address on softswitch utility or in software.
11 hex/17 decimal, LAN Softswitch/Modem mismatch
Configuration of LAN module does not match modem type or configuration programmed by
softswitch utility.
Correction
1) Correct configuration of modem type.
2) Consult LAN Interface manual for configuration setup.
13 hex/19 decimal, DCD Length Mismatch
Directed control data lengths do not match.
Correction
See Fault Extra Data.
Fault Extra Data for DCD Length Mismatch
Byte Value
[0] FF
[1] Bus address
[2] Module’s directed data length
[3] Configured module’s directed data length
25 hex/37 decimal, Controller Reference Out-of-Range

A reference on either the trigger, disable, or I/O specification is out of the configured limits.
Correction
Modify the incorrect reference to be within range, or increase the configured size of the reference
data.
26 hex/38 decimal, Bad Program Specification
The I/O specification of a program is corrupted.
Correction
Contact Technical Support.
27 hex/39 decimal, Unresolved or Disabled Interrupt Reference
The CPU generates this error when an interrupt trigger reference is either out of range or disabled in
the I/O module’s configuration.
Correction
1) Remove or correct the interrupt trigger reference.
2) Update the configuration file to enable this particular interrupt.

43 hex/67 decimal, Module Configuration Failure

Module configuration was not successfully accepted by the module.
Correction
Check fault table for other module-specific faults for possible reasons why the module did not accept
the configuration. Check that the configuration for the module is correct and valid.
4B hex/75 decimal, ECC jumper is disabled, but should be enabled
If the CPU redundancy feature is supported and required, the ECC jumper must be in the enabled
position.
Correction
Set the ECC jumper to the enabled position. (See the instructions provided with the Redundancy CPU
firmware upgrade kit).
4C hex/76 decimal, ECC jumper is enabled, but should be disabled
If the CPU firmware does not support redundancy, the ECC jumper must be in the disabled position.
Correction
Set the ECC jumper to the disabled position (jumper on one pin or removed entirely).
All Others, Module and Configuration do not Match
The CPU generates this fault when the module occupying a slot is not of the same type that the
configuration file indicates.
Correction
1) Replace the module in the slot with the type indicated in the configuration file.

14.4.7 System Bus Error (Group 12)

The fault group System Bus Error occurs when the CPU encounters a bus error.
4, Unrecognized VME Interrupt Source
The CPU generates this error when a module generates an interrupt not expected by the CPU
(unconfigured or unrecognized).
Correction
Ensure that all modules configured for interrupts have corresponding interrupt declarations in the
program logic.

14.4.8 CPU Hardware Failure (Group 13)

The fault group CPU Hardware occurs when the CPU detects a hardware failure, such as a RAM
failure or a communications port failure.
When a CPU Hardware failure occurs, the OK LED will flash on and off to indicate that the failure was
not serious enough to prevent Controller Communications to retrieve the fault information.
6E hex/110 decimal, Time-of-Day Clock not Battery-Backed
The battery-backed value of the time-of-day clock has been lost.
Correction
1) Replace the battery. Do not remove power from the main rack until replacement is complete.
Reset the time-of-day clock using your programming software.
2) Replace the module.
0A8 hex/168 decimal, Critical Over-Temperature Failure
CPU’s critical operating temperature exceeded.
All Others
Correction
Replace the module.
Fault Extra Data for CPU Hardware Failure
For a RAM failure in the CPU (one of the faults reported as a CPU hardware failure), the address of the
failure is stored in the first four bytes of the field.

14.4.9 Module Hardware Failure (Group 14)

The fault group Module Hardware Failure occurs when the CPU detects a non-fatal hardware failure
on any module in the system, for example, a serial port failure on a LAN interface module. The fault
action for this group is Diagnostic.
1A0 hex/416 decimal, Missing 12 Volt Power Supply
A power supply that supplies 12 volts is required to operate the LAN Interface module.
Correction
1) Install/replace a 100 watt power supply.
2) Connect an external VME power supply that supplies 12 volts.
1C2 - 1C6 hex (450 – 454 decimal), LAN Interface Hardware Failure
Refer to the LAN Interface manual, GFK-0868 or GFK-0869 (previously GFK-0533), for a description of
these errors.
All Others, Module Hardware Failure
A module hardware failure has been detected.
Correction
Replace the affected module.

14.4.10 Option Module Software Failure (Group 16)

The fault group Option Module Software Failure occurs when:
 A non-recoverable software failure occurs on an intelligent option module.
 The module type is not a supported type.
 The Ethernet Interface logs an event in its Ethernet exception log.
1, Unsupported Board Type
The board is not one of the supported types.
Correction
1) Upload the configuration file and verify that the software recognizes the board type in the file. If
there is an error, correct it, download the corrected configuration file, and retry.
2) Display the Controller Fault Table on the programmer. Contact Technical Support, giving them all
the information contained in the fault entry.
2, 3, COMMREQ Frequency Too High
COMMREQs are being sent to a module faster than it can process them.
Correction
Change the application program to send COMMREQs to the module at a slower rate or check the
completion status of each COMMREQ before sending the next.
4, More Than One BTM in a Rack
There is more than one BTM present in the rack.
Correction
Remove one of the BTMs from the rack; there can only be one in a CPU rack.
>4, Option Module Software Failure
Software failure detected on an option module.
Correction
1) Reload software into the indicated module.
>400, LAN System Software Fault
The Ethernet interface software has detected an unusual condition and recorded an event in its
exception log. The Fault Extra Data contains the corresponding event in the Ethernet exception log,
which can be viewed by the Ethernet Interface’s Station Manager function. The first two digits of
Fault Extra Data contain the Event type; the remaining data correspond to the four-digit values for
Entry 2 through Entry 6. Some exceptions may also contain optional multi-byte SCode and other
data.
Correction
For information on interpreting the fault extra data, refer to the PACSystems TCP/IP Communications
Station Manager Manual, GFK-2225, Appendix B.

14.4.11 Program or Block Checksum Failure (Group 17)

The fault group Program or Block Checksum Failure occurs when the CPU detects error conditions in
program or blocks. It also occurs during Run mode background checking. In all cases, the Fault Extra
Data field of the Controller Fault Table record contains the name of the program or block in which the
error occurred.
All Error Codes, Program or Block Checksum Failure
The CPU generates this error when a program or block is corrupted.
Correction
1) Clear CPU memory and retry the store.
2) Examine C application for errors.
3) Display the Controller Fault Table on the programmer. Contact Technical Support, giving them all
Fault Extra Data for Program or Block Checksum Failure
The name of the offending program block is contained in the first eight bytes of the Fault Extra Data
field.

14.4.12 Battery Status (Group 18)

Faults in this group occur when the CPU detects a failed battery (or Energy Pack).
0, Failed Battery
CPUs with battery-backed RAM, including RX7i CPUs, and RX3i CPU310, CPU315, CPU/CRU320 and
NIU001
The battery in the CPU module has failed or is disconnected.
If the battery is disconnected, this fault is logged for all CPU types and all supported battery types.
Should a Smart Battery fail during operation, this fault is logged for all CPU types. When used with a
legacy (non-smart) battery, this indication is not reliable.
CPE305 and CPE310
The Energy Pack has failed or is disconnected.
Correction
Replace the battery or Energy Pack. For instructions on replacing the battery, refer to the PACSystems
Battery and Energy Pack Manual, GFK-2741.
1, Low Battery – CPUs with Battery-Backed RAM
This fault is supported only by the CPU versions listed in the PACSystems Battery and Energy Pack
Manual, GFK-2741.
The CPU detects the low battery condition only while the CPU is powered up.
If a low battery condition occurs while the CPU is powered down, the CPU logs a Low Battery fault
upon power-up as soon as it detects the signal from the smart battery.
While the CPU is powered up, it is unlikely that a Low Battery fault will be detected because the
current drain on the battery is negligible. The exception is when a good battery is replaced with a low
battery while the CPU has power. In this case, a Low Battery fault would indicate that a good battery
has been accidentally replaced with a depleted battery.
The Controller fault table indicates the battery status. For details of LED operation of specific CPUs,
refer to Chapter 2.
When a Failed Battery fault is logged, this fault is also logged.
Correction
Replace the battery. For instructions on replacing the battery, refer to the PACSystems Battery and
Energy Pack Manual, GFK-2741.
1, Low Battery – CPE3xx CPUs with Energy Pack
The Status LED and the Controller fault table indicate the Energy Pack status.
PLC_BAT LOW_BAT Energy Pack Status
(%S0014) (%SA0011)
0 0 Energy Pack connected and operational (may be charging)
1 1 Energy Pack not connected or has failed
0 1 Energy Pack is nearing its end-of-life and should be replaced.

14.4.13 Constant Sweep Time Exceeded (Group 19)

The fault group Constant Sweep Exceeded occurs when the CPU operates in Constant Sweep mode
and detects that the sweep has exceeded the constant sweep timer. In the fault extra data, the
DWORD at byte offset 8 contains the amount of time that the sweep went beyond the constant
sweep time (in microsecond units). Stored in Big Endian format.
0, Constant Sweep
Correction
If Constant Sweep (0):
1) Increase constant sweep time.
2) Remove logic from application program.
Note: Error code 1 is not used.

14.4.14 System Fault Table Full (Group 20)

The fault group System Fault Table Full occurs when the Controller Fault Table reaches its limit (see
page 540).
0, System Fault Table Full
Correction
Clear the Controller Fault Table.

14.4.15 I/O Fault Table Full (Group 21)

The fault group I/O Fault Table Full occurs when the I/O Fault Table reaches its maximum configured
limit (see page 542). To avoid loss of additional faults, clear the earliest entry from the table.
0, I/O Fault Table Full
Correction
Clear the I/O Fault Table.

14.4.16 User Application Fault 42 (Group 22)

The fault group Application Fault occurs when the CPU detects a fault in the user program.
2, Software Watchdog Timer Expired
The CPU generates this error when the watchdog timer expires. The CPU stops executing the user
program and enters Stop/Halt mode. To recover, cycle power to the CPU with battery disconnected.
Causes of timer expiration include: Looping, via jump, very long program, etc.
Correction
1) Determine what caused the expiration (logic execution, external event, etc.) and correct.
2) Use the system service function block to restart the watchdog timer.
7, Application Stack Overflow
Block call depth has exceeded the CPU capability.
Correction
Increase the program’s stack size or adjust application program to reduce nesting.
11 hex/17 decimal, Program Run Time Error
A run-time error occurred during execution of a program.
Correction
Correct the specific problem in the application.
22 hex/34 decimal, Unsupported Protocol
Hardware does not support configured protocol.
33 hex/51 decimal, Flash Read Failed
Possible causes:
1) Files not in flash. (May be caused by power cycle during flash write.)
2) Could not read from flash because OEM protection is enabled.
34 hex/52 decimal, Memory Reference Out of Range
A user logic memory reference, computed during logic execution, is out of range. Includes indirect
references, array element references, and potentially other types of references.
Correction
Correct logic or adjust memory size in hardware configuration.
35 hex/53 decimal, Divide by zero attempted in user logic.
User logic contained a divide by zero operation. (Applies to ST and FBD logic.)
Correction
Correct logic.
42 Error Codes 1, 4, 5, 6, 8-15, 28, 29 and 49 are not used by PACs.

36 hex/54 decimal, Operand is not byte aligned.

A variable in user logic is not properly byte-aligned for the requested operation.
Correction
Correct logic or adjust memory size in hardware configuration.
39 hex/57 decimal, DLB heartbeat not received, All DLBs stopped and deleted
The controller has not received a heartbeat signal from the programmer within the time specified by
the DLB Heartbeat setting in the Target properties.
Correction
Increase the DLB Heartbeat setting. For additional information, see “Executing DLBs” on page 614.
3B hex /59 decimal, PSB called by a block whose %L or %P memory is not large enough
to accommodate this reference.
Parameterized blocks do not have their own %L data, but instead inherit the %L data of their calling
blocks. If %L references are used within a parameterized block and the block is called by _MAIN, %L
references are inherited from the %P references wherever encountered in the parameterized block
(for example, %L0005 = %P0005). For a discussion of the use of local data with parameterized blocks,
refer to “Parameterized Blocks and Local Data” in Chapter 5.
Correction
Determine which block called the parameterized subroutine block and increase the size of %L or %P
memory allocated to the calling block. (To do this, change the Extra Local Words setting in the block’s
Properties.)
The maximum size of %L or %P is 8192 words per block. If your application needs more space,
consider changing some %P or %L references to %R, %W, %AI, or %AQ. These changes require a
recompilation of the program block and a Stop Mode store to the CPU.
It is possible, by using Online Editing in the programming software to cause a parameterized block to
use %L higher than allowed because of the way it inherits data. To correct this condition, delete the
%L variables from the logic and then remove the unused variables from the variable list. These
changes require a recompilation of the program block and a Stop Mode store to the CPU.

14.4.17 CPU Over-Temperature (Group 24)

1, Over-Temperature failure.
CPU’s normal operating temperature exceeded.
Correction
Turn off CPU to allow heat to disperse and install a fan kit to regulate temperature.

14.4.18 Power Supply Fault (Group 25)

1, Power supply failure.
Unknown power supply failure.
Correction
Replace power supply module.
2, Power supply overloaded
The load on the power supply has reached its rated maximum
Correction
Replace power supply with a higher capacity model or reconfigure system to reduce load on power
supply.
3, Power supply switched off
The switch on the power supply was moved to the OFF position.
4, Power-supply has exceeded normal operating temperature
The temperature of the power supply is a just a few degrees from causing it to turn off.
Correction
Turn off system to allow heat to disperse. Install a fan kit to regulate temperature.

14.4.19 No User Program on Power-Up (Group 129)

The fault group No User Program on Power-Up occurs when the CPU powers up with its memory
preserved but no user program exists in the CPU. The CPU detects the absence of a user program on
power-up; the controller stays in Stop mode.
Correction
Download an application program before attempting to go to Run mode.

14.4.20 Corrupted User Program on Power-Up (Group 130)

The fault group Corrupted User Program on Power-Up occurs when the CPU detects corrupted user
RAM. The CPU will remain in Stop mode.
1, Corrupted user RAM on power-up
The CPU generates this error when it detects corrupted user RAM on power-up.
Recommended Corrections, Listed in Order
1) Cycle power without battery or Energy Pack.
2) Examine any C applications for errors.
3) Replace the volatile memory backup battery on the CPU.
4) Replace the CPU.
7, User memory not preserved over power cycle
The CPU generates this error when it detects a battery failure that occurred while the controller was
powered down.
If this fault occurs on a power cycle when the battery was not detached or replaced, the battery has
failed and should be replaced.
Correction
Replace the battery on the CPU. For instructions on replacing the battery, refer to the PACSystems
Battery and Energy Pack Manual, GFK-2741.

14.4.21 Window Completion Failure (Group 131)

The fault group Window Completion Failure is generated by the pre-logic and end-of-sweep
processing software in the CPU. The fault extra data contains the name of the task that was
executing when the error occurred.
0, Window Completion Failure
The CPU generates this error when it is operating in Constant Sweep mode and the constant sweep
time was exceeded before the programmer window had a chance to begin executing.
Correction
Increase the constant sweep timer value.
1, Logic Window Skipped
The logic window was skipped due to lack of time to execute.
Correction
1) Increase base cycle time.
2) Reduce Communications Window time.

14.4.22 Password Access Failure (Group 132)

The fault group Password Access Failure occurs when the CPU receives a request to change to a new
privilege level and the password included with the request is not valid for that level.
0, Password Access Failure
Correction
Retry the request with the correct password.

14.4.23 Null System Configuration for Run Mode (Group 134)

The fault group Null System Configuration for Run Mode occurs when the CPU transitions from Stop
to one of the Run modes and a configuration file is not present. The transition to Run is permitted, but
no I/O scans occur.
Action: Informational. Non-configurable.
0, Null System Configuration for Run Mode
Correction
Download a configuration file.

14.4.24 CPU System Software Failure (Group 135)

Faults in this group are generated by the operating software of the CPU. They occur at many
different points of system operation. When a fatal fault occurs, the CPU immediately transitions to
Stop/Halt. The only activity permitted when the CPU is in this mode is communications with the
programmer. The only method of clearing this condition is to cycle power on the controller with the
battery disconnected.
5A hex/90 decimal, User Shut Down Requested
The CPU generates this informational alarm when SVC_REQ #13 (User Shut Down) executes in the
Correction
None required. Information-only alarm.
94 hex/148 decimal, Units Contain Mismatched Firmware, Update Recommended
This fault is logged each time the redundancy state changes and the redundant CPUs contain
incompatible firmware.
Correction
Ensure that redundant CPUs have compatible firmware.
D8 hex/216 decimal, Processor Exception Trap
The processor has detected an error condition while executing an instruction. The CPU was placed
into Stop/Halt mode.
Correction
Disconnect the battery from the CPU and cycle power to clear the Stop/Halt condition.
DA hex/218 decimal, Critical Over-Temperature Failure
CPU’s critical operating temperature exceeded.
Correction
Turn off CPU to allow heat to disperse and install a fan kit to regulate temperature.
All Others, CPU Internal System Error
An internal system error has occurred that should not occur in a production system.

Correction
Display the Controller Fault Table on the programmer. Contact Technical Support and give them all
Error Fault Extra Data Description
Value (First Byte)
DEVICE_NOT_AVAILABLE CF Specific device is not available in the system.
BAD_DEVICE_DATA CC Data stored on device has been corrupted and is no
longer reliable. Or, Flash Memory has not been
initialized.
DEVICE_RW_ERROR CB Error occurred during a read/write of the Flash
Memory device.
FLASH_INCOMPAT_ERROR 8E Data in Flash Memory is incompatible with the CPU
firmware release due to the CPU firmware revision
numbers, the instruction groups supported, or the
CPU model number.
ITEM_NOT_FOUND_ERROR 8D One or more specified items were not found in Flash
Memory.

14.4.25 Communications Failure During Store (Group 137)

This fault group occurs during the store of programs or blocks and other data to the CPU. The stream
of commands and data for storing programs or blocks and data starts with a special start-of-
sequence command and terminates with an end-of-sequence command. This fault is logged if
communications with the programming device performing the store is interrupted or any other
failure that terminates the store occurs. As long as this fault is present in the system, the controller
will not transition to Run mode. This fault is not automatically cleared on power-up; you must
specifically clear the condition.
0, Communications Failure During Store
Correction
Clear the fault and retry the download of the program or configuration file.
1, Communications Lost During Run Mode Store
Communications or power was lost during a Run Mode Store. The new program or block was not
activated and was deleted.
Correction
Perform the Run Mode Store again. This fault is diagnostic.
2, Communications Lost During Cleanup for Run Mode Store
Communications was lost, or power was lost during the cleanup of old programs or blocks during a
Run Mode Store. The new program or block is installed, and the remaining programs and blocks were
cleaned up.
Correction
None required. This fault is informational.
3, Power Lost During a Run Mode Store
Power was lost in the middle of a Run Mode Store.
Correction
Delete and restore the program. This error is fatal.

14.4.26 Non-Critical CPU Software Event (Group 140)

This group is used for recording conditions in the system that may provide valuable information to
Technical Support.
Default action: Non-configurable.
Error Code Description Correction
1-30 Events during power-up No corrective action is required unless this
fault occurs with other specific faults. The
31-50 Events on the serial port or in a serial
fault may contain useful information for
protocol
Technical Support if other problems are
51, 52 Miscellaneous internal system events encountered.
53 Access control fault See details below.
54 and greater Miscellaneous internal system events No corrective action is required unless this
fault occurs with other specific faults. The
fault may contain useful information for
Technical Support if other problems are
encountered.
Error code 53, Access Control Fault

If data access is prevented because of the Enhanced Security settings, the Controller logs a fault into
the fault table. This fault can be used to help diagnose access problems. To prevent overflowing the
fault table, only one fault is logged until the fault table is cleared.
Fault example
Location: 0.8 Date/Time: 07-07-2013 17:06:55.087
Group: 140 INFO_CPU_SOFTWR - CPU software event
Error Code: 53 Action:1 Task Num:3
Extra Data: 00 fa 02 a5 00 00 00 00 01 1e 06 00 00 00 00 00 00 00 01 00 00 00 00 00
Meaning of this example fault
A 1-bit READ request beginning at %S7 was rejected due to an access violation.

Interpreting the Fault Extra Data

Bytes 1 - 8: Ignored when decoding a security-related fault.
Byte 9: The operation during which the fault occurred.
 01 (as in the example): Read
 02: Write
Byte 10: The hexadecimal value (HV) that specifies a CPU memory area.
Hexadecimal
Memory area
Value (HV)
08 %R (Register memory)
0A %AI (Analog input memory)
0C %AQ (Analog output memory)
10 %I (Discrete input memory)
12 %Q (Discrete output memory)
14 %T (Discrete temporary status memory)
16 %M (Discrete momentary internal memory)
18 %SA (Discrete system memory A)
1A %SB (Discrete system memory B)
1C %SC (Discrete system memory C)
1E %S (Discrete system memory)
38 %G (Genius global memory)
C4 %W (Bulk Memory)
Bytes 11–18: 0-based bit offset of the memory area being accessed. The 8-byte value is encoded in
little endian format, meaning that the byte values are reversed. In the example, the
value is 0x0000000000000006, which is equal to 1-based bit offset 7.
Bytes 19–22: The length in bits of data requested. In the example, 1 bit was requested.
Bytes 23–24: Ignored when decoding a security-related fault.

14.5. I/O Fault Descriptions and Corrective Actions

The I/O fault table reports the following data about faults:
 Fault Group
 Fault Action
 Fault category
 Fault type
 Fault description
All faults have a fault category, but a fault type and fault group may not be listed for every fault. To
view the detailed information pertaining to a fault, click the fault entry in the I/O Fault Table.
Note: The model number mismatch and I/O type mismatch faults are reported in the controller
fault table under the System Configuration Mismatch group. They are not reported in the I/O
fault table.
14.5.1 Fault Extra Data
An I/O fault table entry contains up to 21 bytes of I/O fault extra data that contains additional
information related to the fault. Not all entries contain I/O fault extra data.
14.5.2 I/O Fault Groups
Group Number Group Name Default Fault Action40 Configurable
2 Loss of or Missing IOC Diagnostic Yes
Loss of or Missing I/O module or network
3 Diagnostic Yes
Device
6 Addition or Reset of, or Extra IOC N/A No
Addition of or Extra I/O module or
7 N/A No
network Device
9 IOC or I/O Bus Fault Diagnostic Yes
10 I/O Module Fault N/A No
15 IOC Software Failure Same As Group 2 43 Yes
16 Module Software Failure N/A No
28 PROFINET Alarms Diagnostic No
133 Genius Block Address Mismatch N/A No
43 The fault action for the IOC Software Failure group 15 always matches the action used by the Loss of or
Missing IOC group 2. If the Loss of or Missing IOC group is configured, the IOC Software Failure group is also
configured to take the same fault action.

14.5.3 I/O Fault Categories

Category Fault Type Fault Description Fault Extra Data
Circuit Fault (1) Discrete Fault (1) Loss of User Side Power (01 hex) Circuit Configuration
Short Circuit in User Wiring (02 hex) Circuit Configuration
Sustained Overcurrent (04 hex) Circuit Configuration
Low or No Current Flow (08 hex) Circuit Configuration
Switch Temperature Too High (10 hex) Circuit Configuration
Switch Failure (20 hex) Circuit Configuration
Point Fault (83 hex) Circuit Configuration
Output Fuse Blown (84 hex) Circuit Configuration
Analog Fault (2) Input Channel Low Alarm (01 hex) Circuit Configuration
Input Channel High Alarm (02 hex) Circuit Configuration
Input Channel Under Range (04 hex) Circuit Configuration
Input Channel Over Range (08 hex) Circuit Configuration
Input Channel Open Wire (10 hex) Circuit Configuration
Over Range or Open Wire (18 hex) Circuit Configuration
Output Channel Under Range (20 hex) Circuit Configuration
Output Channel Over Range (40 hex) Circuit Configuration
Expansion Channel Not Responding Circuit Configuration
(80 hex)
Invalid Data (81 hex) Circuit Configuration
Low-Level Input Channel Low Alarm (01 hex) Circuit Configuration
Analog Fault (4) Input Channel High Alarm (02 hex) Circuit Configuration
Input Channel Under Range (04 hex) Circuit Configuration
Input Channel Over Range (08 hex) Circuit Configuration
Input Channel Open Wire (10 hex) Circuit Configuration
Wiring Error (20 hex) Circuit Configuration
Internal Fault (40 hex) Circuit Configuration
Input Channel Shorted (80 hex) Circuit Configuration
Invalid Data (81 hex) Circuit Configuration
GENA (Genius Network GENA Circuit Fault (80 hex) Byte 2:GENA Fault
Adapter) Fault (3)


Loss of Block (2) Not Specified (0) NA Block Configuration
A/D Communications Number of Input
Lost (1) Circuits
Number of Output
Circuits
Addition of Block (3) NA NA Block Configuration
Number of Input
Circuits
Number of Output
Circuits
I/O Bus Fault (6) Bus Fault (1) NA NA
Bus Outputs Disabled (2)
SBA Conflict (3)
Genius Module Headend Fault (0) Configuration Memory Failure (08 hex) NA
Fault (8) A to D Comm. Fault (1) Calibration Memory Failure (20 hex)
User Scaling Error (5) Shared RAM Failure (40 hex)
Store Fail (6) Internal Circuit Fault (80 hex)
Watchdog Timeout (81 hex)
Output Fuse Blown (84 hex)
Addition of IOC (9) NA Extra Module (01 hex) NA
Reset Request (02 hex)
Loss of IOC (10) NA NA Timeout
Unexpected State
Unexpected Mail
Status VME Bus
Error
IOC Software Fault NA NA NA
(11)
Forced Circuit (12) NA NA Block Configuration
Discrete/Analog
Indication*
Unforced Circuit NA NA Block Configuration
(13) Discrete/Analog
Indication*
Loss of I/O Module NA NA NA
(14)
Addition of I/O NA VME Module Reset Requested (30 hex) NA
Module (15)
Extra I/O Module NA NA NA
(16)
Extra Block (17) NA NA NA
IOC Hardware NA NA NA
Failure (18)


GBC stopped GBC detected high error NA NA
reporting faults count on Genius Bus and
because too many dropped off the bus for at
faults have least 1.5 seconds. (1)
occurred (19)
GBC Software Datagram queue full (1) NA
Exception (21) R/W request queue full (2)
Low priority mail rejected (3)
Background message
received before CPU
completed initialization (4)
Genius software version too
old (5)
Excessive use of internal
GBC memory (6)
Block Switch (22) – NA NA Block Configuration
redundant Genius Number of Input
block switched bus Circuits
Number of Output
Circuits
Rack/Slot address of
GBC from which
block was removed.
Block not active on NA NA NA
redundant bus (23)
Reset of IOC (27) NA NA NA
PROFINET network NA Refer to PROFINET controller NA
faults (33 and documentation.
higher)

14.5.4 Circuit Faults (Category 1)

Circuit faults apply to Genius I/O modules and the IC697VRD008 RTD/Strain Bridge modules. Fault
extra data is available for all faults in this category. More than one condition may be present in a
particular reporting of the fault.
Action: Diagnostic.
Fault Extra Data for Circuit Faults
Genius Bus Controller
Circuit fault entries use one or two bytes of the fault extra data area. If the GBC reports the fault, the
first byte is generated by the GBC and the second byte contains the circuit configuration and is
encoded as shown in the following table.
Value Description
(Byte 2)
1 Circuit is an input.
3 Circuit is an output.
If the fault type is a GENA fault, the second byte contains the data that was reported from the GENA
module in fault byte 2 of its “Report Fault” message.
VRD001 RTD/Strain Bridge
Circuit fault entries 13 bytes of the fault extra data area. The fault extra data is encoded as shown in
the following table.
Bytes Description
1-10 Used by technical support.
11 Line number
12 Module number
13 Used by technical support.

Fault Descriptions for Discrete Faults

1, Loss of User Side Power
The GBC generates this error when there is a power loss on the field wiring side of a Genius I/O block.
Correction
1) (Only valid for Isolated I/O blocks.) Initiate “Pulse Test” COMREQ #1. Pulse test may be enabled or
disabled at I/O block.
2) Correct the power failure.
2, Short Circuit in User Wiring
The GBC generates this error when it detects a short circuit in the user wiring of a Genius block. A
short circuit is defined as a current level greater than 20 amps.
Correction
Fix the cause of the short circuit.
4, Sustained Overcurrent
The GBC generates this error when it detects a sustained current level greater than 2 amps in the
user wiring.
Correction
Fix the cause of the over current.
8, Low or No Current Flow
The GBC generates this error when there is very low or no current flow in the user circuit.
Correction
Fix the cause of the condition.
10 hex, Switch Temperature Too High
The GBC generates this error when the Genius block reports a high temperature in the Genius Smart
Switch.
Correction
1) Ensure that the block is installed to provide adequate circulation.
2) Decrease the ambient temperature surrounding the block.
3) Install RC Snubbers on inductive loads.
20 hex, Switch Failure
The GBC generates this error when the Genius block reports a failure in the Genius Smart Switch.
Correction
1) Check for shunts across Genius output (pushbuttons).
2) Replace the Genius I/O block.
83 hex, Point Fault
The CPU generates this error when it detects a failure of a single I/O point on a Genius I/O module.
Correction
Replace the Genius I/O block.

84 hex, Output Fuse Blown

The CPU generates this error when it detects a blown fuse on a Genius I/O output block.
Correction
1) Determine and repair the cause of the fuse blowing; replace the fuse.
2) Replace the block.
Fault Descriptions for Analog Faults

1, Input Channel Low Alarm
The GBC generates this error when the Genius Analog module reports a low alarm on an input
channel.
Correction
Correct the condition causing the low alarm.
2, Input Channel High Alarm
The GBC generates this error when the Genius Analog module reports a high alarm on an input
channel.
Correction
Correct the condition causing the high alarm.
4, Input Channel Under Range
The GBC generates this error when the Genius Analog module reports an under-range condition on
an input channel.
Correction
Correct the problem causing the condition.
8, Input Channel Over Range
The GBC generates this error when the Genius Analog module reports an over-range condition on an
input channel.
Correction
10 hex/16 decimal, Input Channel Open Wire
The GBC generates this error when a Genius Analog module detects an open wire condition on an
input channel.
Correction
18 hex/24 decimal, Over Range or Open Wire
Inputs open or inputs off-scale.
Correction

20 hex/32 decimal, Output Channel Under Range

an output channel.
Correction
40 hex/64 decimal, Output Channel Over Range
output channel.
Correction
80 hex/128 decimal, Expansion Channel Not Responding
The CPU generates this error when data from an expansion channel on a multiplexed analog input
board is not responding.
Correction
1) Check wiring to the module.
81 hex/129 decimal, Invalid Data
The GBC generates this error when it detects invalid data from a Genius Analog input block.
Correction
Low-Level Analog Faults
1, Input Channel Low Alarm
The GBC generates this error when the Genius Analog module reports a low alarm on an input
channel.
Correction
Correct the condition causing the low alarm.
2, Input Channel High Alarm
The GBC generates this error when the Genius Analog module reports a high alarm on an input
channel.
Correction
Correct the condition causing the high alarm.
4, Input Channel Under Range
an input channel.
Correction

8, Input Channel Over Range

input channel.
Correction
10 hex, Input Channel Open Wire
The GBC generates this error when the Genius Analog module detects an open wire condition on an
input channel.
Correction
20 hex/32 decimal, Wiring Error
The GBC generates this error when the Genius Analog module detects an improper RTD connection
or thermocouple reverse junction fault.
Correction
40 hex/64 decimal, Internal Fault
The GBC generates this error when the Genius Analog module reports a cold junction sensor fault on
a thermocouple block or an internal error in an RTD block.
Correction
80 hex/128 decimal, Input Channel Shorted
The GBC generates this error when it detects an input channel shorted on a Genius RTD or Strain
Gauge Block.
Correction
81 hex/129 decimal, Invalid Data
The GBC generates this error when it detects invalid data from a Genius Analog input block.
Correction
GENA Fault
The GENA Fault has no fault descriptions associated with it. GENA Fault Byte 2 is the first byte of the
fault extra data.
80 hex/128 decimal
The Genius I/O operating software generates this error when it detects a failure in a GENA block
attached to the Genius I/O bus.
Correction
Replace the GENA block.

14.5.5 Loss of Block (Category 2)

The fault category Loss of Block applies to Genius devices.
Action: Diagnostic.
Loss of Block
The GBC generates this error when it is unable to communicate to the Genius device.
Correction
1) Verify power and wiring to the block.
Loss of Block - A/D Communications Fault
The GBC generates this error when it detects a failure of A/D communications on a Genius device.
Correction
1) Verify power and serial bus wiring to the block.
Fault Extra Data for Loss of Block
The Loss of Block fault provides four bytes of fault extra data. The second byte contains the block
configuration and is encoded as shown in the following table. The third byte specifies the number of
input circuits possibly used, and the fourth byte specifies the number of output circuits possibly used.
Block Configuration (Byte 2)
Value Description
1 Block is configured for inputs only.
2 Block is configured for outputs only.
3 Block is configured for inputs and outputs (grouped block).

14.5.6 Addition of Block (Category 3)

The fault category Addition of Block applies only to Genius devices. There are no fault types or fault
descriptions associated with this category.
The Genius operating software generates this error when it detects that a Genius block that stopped
communicating with the controller starts communicating again.
Action: Diagnostic.
Correction
Informational only. None required.
Fault Extra Data for Addition of Block
The Addition of Block fault provides four bytes of fault extra data. The second byte contains the block
configuration and is encoded as shown in the following table. The third byte specifies the number of
input circuits possibly used, and the fourth byte specifies the number of output circuits possibly used.
Block Configuration (Byte 2)
Value Description
1 Block is configured for inputs only.
3 Block is configured for inputs and outputs (grouped block).

14.5.7 I/O Bus Fault (Category 6)

The fault category I/O Bus Faults has three fault types associated with it.
Bus Fault
The GBC operating software generates this error when it detects a failure with a Genius I/O bus.
(Generated when Error Rate in the GBC configuration is exceeded—the default Error Rate is 10 errors
in a 10 second period).
Correction
1) Determine the reason for the bus failure and correct it.
2) Replace the GBC.
The Error Rate can be set higher than the default value if needed, but the bus should be examined
electrically—use an oscilloscope for waveform check.
Bus Outputs Disabled
The GBC operating software generates this error when it times out waiting for the CPU to perform an
output scan.
Correction
1) Reduce time between GBC output scans by assigning them to scan set 1.
2) Increase CPU software watchdog timer setting
3) Replace the CPU.
4) Display the controller fault table on the programmer. Contact Technical Support, giving them all
SBA Conflict
The GBC detected a conflict between its serial bus address and that of another device on the bus.
Correction
Adjust one of the conflicting serial bus addresses.

14.5.8 Module Fault (Category 8)

The fault category Module Fault has one fault type, headend fault, and eight fault descriptions. This
fault category does not provide fault extra data. The default fault action for this category is
Diagnostic.
08 hex, Configuration Memory Failure
The GBC generates this error when it detects a failure in a Genius block’s EEPROM or NVRAM.
Correction
Replace the Genius block’s electronics module.
20 hex/32 decimal, Calibration Memory Failure
The GBC generates this error when it detects a failure in a Genius block’s calibration memory.
Correction
40 hex/64 decimal, Shared RAM Fault
The GBC generates this error when it detects an error in a Genius block’s shared RAM.
Correction
80 hex/128 decimal, Module Fault
An internal failure has been detected in a module.
Correction
Replace the affected module.
81 hex/129 decimal, Watchdog Timeout
The CPU generates this error when it detects that an input module watchdog timer has expired.
Correction
Replace the input module.
84 hex/132 decimal, Output Fuse Blown
The CPU generates this error when it detects a blown fuse on an output module.
Correction
1) Determine and repair the cause of the fuse blowing, and replace the fuse.

14.5.9 Addition of IOC (Category 9)

The fault category Addition of I/O Controller has no fault types or fault descriptions associated with it.
The default fault action for this category is Diagnostic.
Addition of IOC
The CPU generates this error when an IOC that has been faulted returns to operation or when an IOC
is found in the system and the configuration file indicates that no IOC is to be in that slot or when an
IOC is hot inserted.
Correction
1) No action is necessary if the faulted module is in a remote rack and is returning due to a remote
rack power cycle.
2) Update the configuration file or remove the module.
01 hex, Extra Module
Module present, but not configured.
Correction
Update the configuration file or remove the module.
02 hex, Reset Request
Module added back after reset request. No corrective action is necessary.

14.5.10 Loss of or Missing IO Controller (Category 10)

The fault category Loss of IOC has no fault types or fault descriptions associated with it.
Note: This fault is always displayed as Fatal in the I/O Fault Table, regardless of its configured
action.
The CPU generates this error when it cannot communicate with an I/O Controller and an entry for the
IOC exists in the configuration file.
This fault is also logged when an IOC is hot removed (No corrective action necessary in this case).
Correction
1) Verify that the module in the slot/bus address is the correct module.
2) Review the configuration file and verify that it is correct.
4) If fault is not resolved, display the controller fault table on the programmer. Contact Technical
Support, giving them all the information contained in the fault entry.
Fault Extra Data for Loss of or Missing IOC
Fault extra data for Loss of or Missing IOC provides additional information for diagnostics by
Technical Support.

14.5.11 IOC (I/O Controller) Software Fault (Category 11)

The fault category IOC Software Fault applies to any type of I/O Controller.
Action: Fatal.
Datagram Queue Full, Read/Write Queue Full
Too many datagrams or read/write requests have been sent to the GBC.
Correction
Adjust the system to reduce the request rate to the GBC.
Response Lost
The GBC is unable to respond to a received datagram or read/write request.
Correction

14.5.12 Forced and Unforced Circuit (Categories 12 and 13)

The fault categories Forced Circuit and Unforced Circuit report point conditions and therefore are not
technically faults. They have no fault types or fault descriptions. These reports occur when a Genius
I/O point was forced or unforced with the Hand-Held Monitor.
Action: Informational.
Fault Extra Data for Forced/Unforced Circuit
Three bytes of fault extra data are present when a circuit force is added or removed
Byte Number Description Value Description
1 Circuit Configuration 1 Circuit is an input.
2 Analog/Discrete Information 1 Block is a discrete block.
2 Block is an analog block.
3 Block has both discrete and analog.

14.5.13 Loss of or Missing I/O Module (Category 14)

The fault category Loss of I/O Module applies to discrete and analog I/O modules. There are no fault
types or fault descriptions associated with this category.
The CPU generates this error when it detects that an I/O module is no longer responding to
commands from the CPU, or when the configuration file indicates an I/O module is to occupy a slot
and no module exists in the slot. This fault is also logged when an I/O module is hot removed (No
corrective action necessary in this case).
Correction
2) Correct the configuration file.
3) Display the I/O fault table on the programmer. Contact Technical Support, giving them all the
information contained in the fault entry.

14.5.14 Addition of I/O Module (Category 15)

The fault category Addition of I/O Module applies to discrete and analog I/O modules. There are no
fault types or fault descriptions associated with this category.
Action: Diagnostic.
Addition of I/O Module
The CPU generates this error when an I/O module that had been faulted returns to operation or is hot
inserted.
Correction
1) No action necessary if module was removed or replaced or if the remote rack was power cycled.
2) Update the configuration file or remove the module.
30 hex/48 decimal, VME Reset on Request
Reset of VME module was requested. No corrective action necessary.

14.5.15 Extra I/O Module (Category 16)

The fault category Extra I/O Module applies to discrete and analog I/O modules. There are no fault
types or fault descriptions associated with this category.
Action: Diagnostic.
The CPU generates this error when it detects an I/O module in a slot that the configuration file
indicates should be empty.
Correction
1) Remove the module. (It may be in the wrong slot.)
2) Update and restore the configuration file to include the extra module.

14.5.16 Extra Block (Category 17)

The fault category Extra Block applies only to Genius I/O devices. There are no fault types or fault
descriptions associated with this category.
Action: Diagnostic.
The GBC generates this error when it detects a Genius device on the bus at a serial bus address
where the configuration file does not have a block.
Correction
1) Remove or reconfigure the block. (It may be at the wrong serial bus address.)
2) Update and restore the configuration file to include the extra block.

14.5.17 IOC Hardware Failure (Category 18)

The fault category IOC Hardware Failure has no fault types or fault descriptions.
Action: Diagnostic.
The Genius operating software generates this error when it detects a hardware failure in the bus
communication hardware or a baud rate mismatch.
Correction
1) Verify that the baud rate set in the configuration file for the GBC agrees with the baud rate
programmed in every block on the bus.
2) Change the configuration file and restore it, if necessary.
3) Replace the GBC.
4) Selectively remove each block from the bus until the offending block is isolated then replace it.

14.5.18 GBC Stopped Reporting Faults (Category 19)

GBC detected a high error count on the Genius I/O bus and dropped off the bus for at least 1.5
seconds.
Correction
Check for incorrect wiring, interference from other equipment, a loose connection, or a failed device
on the Genius bus.

14.5.19 GBC Software Exception (Category 21)

1, Incoming datagram queue full
Too many datagrams or read/write requests have been sent to the GBC.
Correction
2, Read/write request queue full
The queue for Read/Write requests in the GBC is full. The requests may be from the Genius Bus or
from COMMREQs.
Correction
3, Low priority mail queue from GBC to CPU full
The response to the CPU was lost.
4, Genius background message requiring CPU action received before CPU completed
initialization
Message was ignored.
5, GBC software version too old
Correction
Update GBC firmware.
6, Excessive use of internal GBC memory
Correction
Verify COMMREQ usage.

14.5.20 Block Switch (Category 22)

The Block Switch fault category has no fault types or fault descriptions.
Action: Diagnostic.
The GBC generates this error when a Genius block on redundant Genius buses switches from one bus
to another.
Correction
1) No action is required to keep the block operating.
2) The bus that the block switched from may need to be repaired.
a) Verify the bus wiring.
b) Replace the I/O controller.
c) Replace the Bus Switching Module (BSM).
Fault Extra Data for Block Switch
Byte Number Description Value Description
1 Circuit configuration 1 Circuit is an input.
2 Block configuration 1 Block is configured for inputs only.
3 Block is configured for inputs and outputs
(grouped block).
3 Number of input circuits used
4 Number of output circuits used

14.5.21 Reset of IOC (Category 27)

The fault category Reset of I/O Controller has no fault types or fault descriptions associated with it.
The default fault action for this category is Diagnostic.
The CPU generates this message when an I/O Controller is reset. No corrective action necessary.

14.6. Diagnostic Logic Blocks (DLBs)

A Diagnostic Logic Block (DLB) is a block of Ladder Diagram logic that can be downloaded to the
controller for independent execution. These blocks are useful tools for interacting with an application
that is running in the PACSystems controller. DLBs may be used to:
 Collect information from a running application to analyze and diagnose problems
 Test modifications and corrections to a running application before actually incorporating them
into the application.
 Test the devices that will be controlled by the application.
DLBs are intended to accomplish a specific task that is temporary in nature, such as diagnosing the
source of a problem or testing tuning parameters. When you have finished using a DLB, it should be
removed from the host controller. At this point the application logic and its variable allocation return
to what it was before the DLB was downloaded.
You can also remove the DLBs from the Logic Developer target, at which point the target’s logic and
variable allocation will be identical to what they were before the DLBs were introduced.
Note that, although the DLB is removed from the controller, any changes the DLB made to the
system are not removed. For example, if the DLB logic changes a hardware parameter, the
parameter does not return to its previous value when the DLB is removed.
DLB logic can be executed with the controller in Stop IO Enabled mode, which allows debugging the
application without the main application program running.
Caution
Do not use a DLB as a permanent part of a production
application, because a DLB is stopped and deleted from
memory when Logic Developer loses its Programmer-mode
connection with the host controller. This could happen if the
programmer’s communications cable is disconnected or if a
second programmer connects serially to the same RX3i and
establishes a Programmer-mode session.
Note: Redundancy CPUs do not support DLBs.

14.6.1 DLB Operation

DLBs are created as components of a specific Target and are
separate from the application logic block components
associated with a target.
They are written in LD programming language and support
many of the same features, such as View Lock, Edit Lock, etc. as
other block types.
A target can have a maximum of 128 DLBs in a given PME
target. Each DLB can have associated published variable table
(PVT) and cam profile (used with Motion applications) files. Each
DLB can use up to 128K bytes of memory.
A DLB can be copied and pasted like other blocks. Regardless of
where a DLB is pasted, normal conflict handling is applied. Figure 51: Diagnostic Logic Blocks
(DLBs) assigned to Target in MPE
An active DLB can be dragged to the Toolchest, to folders under the Active Blocks node, or to folders
under the Program Blocks node. Note that only active blocks can be dragged. Downloading,
executing, or modifying a DLB does not affect the equality of the main logic program.
Suspend I/O Function and DLBs
The Suspend I/O (SUS_IO) function operates the same in a DLB as it does in application logic. Both
application logic and DLB logic execute in the CPU Sweep Logic window. Therefore, when a
SUSPEND_IO is executed by either the application or the DLB, outputs are held current during the
output scan that occurs immediately after the Logic window finishes its execution, and input
references will not be updated from inputs during the input scan that occurs immediately before the
Logic window is executed in the next CPU sweep.
Note that a SUSPEND_IO only affects normal I/O scans. It does not affect I/O scanning that is done as
the result of DO_IO or SCAN_SET_IO functions that execute in application or DLB logic. SUS_IO has
the same effect whether it is executed once in a sweep or multiple times in a sweep.
Restrictions on DLB Operation
Because DLBs are intended only for temporary use, there are more restrictions on their operation
compared to application logic blocks. All built-in functions and function blocks other than those listed
below can be used in DLB logic.
 DLB logic may not call any logic block or be called by any logic block.
 You cannot define parameters or scheduling for a DLB.
 A DLB has no parameters other than the standard ENO output parameter. Since DLBs cannot be
called from other blocks, you can access its ENO parameter only by reading or writing it in the
DLB’s logic.
 You cannot use variables that have %L or %P addresses. As a consequence, the following
features that require %L or %P memory cannot be used in a DLB:
a. #FST_EXE system variable
b. The built-in timer function blocks, ONDTR, OFDT, and TMR
c. %L or %P variables.
 Locally scoped variables must be symbolic. For additional information, see “DLB Variables.”
 DLBs or their associated files cannot be loaded from the RX3i.
 DLBs and their associated files cannot be downloaded to flash memory.

 You cannot give an LD DLB the name _MAIN.

 You cannot modify an active LD DLB while it is executing on the Controller.
 You cannot perform a Test Edit (Online Edit Mode and Online Test Mode).
 You cannot perform word-for-word changes on an active DLB.
DLB Variables
A DLB can have its own variables, which are local to the DLB and not accessible by any other block.
All DLB local variables are symbolic, retentive, and published.
Local variables should be used within DLBs whenever possible. If the system is already running and
you create new global variables in the DLB, the programming software will not download the DLB
because the programmer’s memory map will no longer match the RX3i controller’s memory map.
DLB logic can read and write the global variables of the application that resides in the same target as
it does. These variables may be mapped or symbolic.
To use functions that require the use of located variables, a DLB must use the global located
variables of the application that resides in the same target as the DLB. These functions include:
a. COMMREQ (location of the Status variable)
b. DO_IO
c. Some SVC_REQ functions
A DLB can create aliases to global located application variables or arrays of variables that were
specifically created and documented to serve as “scratchpad” memory for DLBs that need to use
located variables.

14.6.2 Executing DLBs

DLB Properties
The properties for an active DLB include Execution Mode, which has the following possible values:
 Sweep (Default) - The DLB executes at a fixed point in the normal Controller sweep, until explicitly
stopped.
 Update Rate – Uses the Update Rate defined for the Target. The actual rate varies from a
minimum value equal to the Update Rate to a maximum value of Update Rate + 1 sweep. If the
sweep takes more time than the update rate, the DLB is executed as soon as the user logic
program execution completes in the current sweep.
 Scan Once - The DLB executes exactly one time when the user requests for DLB execution to
start. It then stops executing until it is manually instructed to run again.
Figure 52: Properties of Diagnostic Logic Block (DLB)

Target Properties
The Target properties include DLB Heartbeat, which specifies, in milliseconds, the maximum time the
controller waits for a heartbeat signal from the programmer. If a heartbeat timeout occurs, the DLB
will be stopped and removed from the controller. This insures that DLB execution is stopped in the
event of a communications failure between the programmer and the controller.
With larger applications or a slower PC, some operations such as opening the Controller File Explorer
may cause the DLB Heartbeat to time out. If this happens, you may need to increase the DLB
Heartbeat interval.
The DLB Heartbeat must always be greater than the Update Rate setting for the Target.
Figure 53: DLB Heartbeat Setting

Right-click Online Operations for an Active DLB

Menu Enable Rules Description
Download Disabled if block is already running on Downloads block to controller,
controller, target not in programmer mode, removing any other DLB that was
Config+Logic is not equal, or Access Level already there.
prevents write.
Start Disabled if block is already running, target not Downloads block to controller,
in programmer mode, another block is removing any other DLB that was
executing on controller, HWC+Logic is not already there, and then starts
equal, or Access Level prevents write executing block.
Stop Disabled if block is not executing Stops execution of block.
Remove Disabled if block is not on controller, block is Stops block, then removes it from
executing, or not in programmer mode controller.
DLB Online Operations

Only a single DLB can be downloaded and executed on the controller at a time. To download an
Active DLB to the controller, you must have:
 Program logic and HWC equal to the controller (Logic EQ)
 Target in programmer mode
 Sufficient privilege to write to the controller
Operation Minimum PACSystems RX3i Privilege Level Required
Storing DLBs in Stop mode 3
Storing DLBs in Run mode 4
When a DLB is downloaded, you are given the option of storing initial values or clearing memory for
local variables. If another DLB is already downloaded on the controller it will be removed before the
selected DLB is downloaded.
When a DLB is downloaded to the controller, all variables locally scoped to the DLB are published
from the controller so that HMIs or other devices can view the data.
While a DLB is running, the active target is read-only; no changes are allowed to DLB or the
application logic. If the DLB has been downloaded to the controller but is not executing, changes are
allowed but the first change will remove the DLB from the controller. You will be prompted to confirm
the change before the DLB is removed. Uploading of the DLB is not supported.
Once a DLB is downloaded to the controller, it can be started if the main program is running on the
controller in Stop with I/O Enabled or Run with I/O Enabled mode.

Removing a DLB from the Controller

The following actions will cause the DLB to be removed from the controller. If the DLB is executing, it
will be stopped before being removed.
 Removing the DLB from the controller through the Online Operations menu.
 Programmer connection to controller is lost by going offline or a communication failure that
causes a DLB Heartbeat timeout
 Switching from programmer mode to monitor mode
 Downloading to controller (Config, Logic, Stored Values, etc.)
 Clearing the controller, other than fault tables and controller supplemental files
 Performing any Flash operation, other than Verify
 Uploading from controller (Config, Logic, Stored Values, etc.)
 Changing the DLB that is on the controller
If there is an executing DLB, and you transition from run mode to stop mode, the executing DLB will
be stopped as well. The DLB will not be removed from the controller in this case.
If you initiate an upload, and there is a DLB on the controller, you will be prompted for confirmation
and notified that the DLB will be removed and that all active DLBs will be made inactive. If there are
no DLBs on the controller but there is at least one active DLB, you will be prompted for confirmation
and notified that all active DLBs will be made inactive. If you choose to abort the upload, no changes
are made. If you proceed, all DLBs are deactivated. If DLBs are de-activated, you will have to
reactivate them manually.
When a DLB is removed from the controller, any PMM data logger (DLOG) and event queue (ELOG)
files that were created by the DLB are also removed.
Basic Steps for Using a DLB in the Controller
1) Create an LD Block under the Active Blocks DLB Node in the Navigator.
You can accomplish this in several ways, such as by creating a new block under the Active Blocks
node, dragging a block from the Toolchest, or copying and pasting a block from another project.
2) Select DLB block properties, for example, Execution Mode, as desired.
3) If necessary, change the Target property, DLB Heartbeat. For larger projects, you may need to
increase DLB Heartbeat from its default value of 1000ms to avoid timing out while performing
some operations, such as opening the Controller File Explorer.
4) Go online to the Controller and go into Programmer Mode, Logic Equal.
5) Right click the DLB and select the Online Operations menu to download the DLB to the controller
and start its execution. (To download and start the DLB in one operation, select Online Operations
> Start.)
6) Monitor DLB execution.

Monitoring DLB Execution

There are several tools to monitor the execution of the DLB in the controller:
 DLB Local Symbolic variables monitored in Data Watch, LD Editor, or Data Monitor.
 DLB Icon shows the DLB state in the Navigator: Downloaded to controller or Executing .
 A Proficy View application can monitor the execution of the DLB by using its Local Symbolic
Variables in Panels and Scripts.
The DLB block icon in the Navigator indicates its current state, as shown below:
Inactive DLB - (block displayed in gray)
Active DLB Downloaded to Controller - (block displayed in blue)
Executing DLB - (block displayed in green)

14.6.3 Diagnostic Logic Block (DLB) Example

In this example, a block of LD logic is downloaded to the controller and executed.
The basic steps for using a sample DLB in the controller are as follows:
1) Create an LD block named MonitorScan and place it in the Toolchest. For information on working
with the Toolchest, refer to the online help.
The logic in the DLB block measures Controller scan time. It calculates the Minimum (minTime),
Maximum (maxTime), and Average (avgTime) time between DLB block executions. When the DLB
is set to Sweep Mode, these values should be close to the Controller Sweep time.
Logic for the MonitorScan Block


2) Drag and drop the DLB Block from the Toolchest to the Active Blocks node in the Navigator.
Figure 54: Drag DLB from Toolchest and Drop in Active Blocks Node
3) In the DLB block properties, set the Execution Mode to Sweep.
Figure 55: Set DLB Execution Mode to Sweep (Properties Tab)

4) Go online to the Controller, and select Programmer Mode. Put the Controller in Run mode or Stop
Enabled mode.
5) Select the DLB Online Operations > Start menu to download the DLB to the controller and start its
execution.
Figure 56: Start DLB Execution

6) In the Initialize Symbolic Variables dialog box, select how new local symbolic variables will be
initialized and click OK.
Figure 57: Initialize Local Symbolic Variables

7) Notice the change in the DLB Icon and the DLB status in the Status bar.
DLB Block Icon/Status Bar Once Started.
DLB Running
Figure 58: DLB Icon and Status Bar after Execution has Commenced
8) Open the DLB block and place the DLB variables in the Data Watch window to observe their
operation.
Figure 59: Data Watch for DLB Variables


Appendix A Performance Data
This appendix contains instruction and overhead timing collected for each PACSystems CPU module.
This timing information can be used to predict CPU sweep times. The information in this appendix is
organized as follows:
Boolean Execution Times page 623
Instruction Timing 625
Overview 625
CPU Version Information 626
RX3i 627
RX7i 640
Overhead Sweep Impact Times 650
A-1 Boolean Execution Times

Boolean execution times for contacts and coils depend on several factors, including the CPU model,
the type of reference address associated with the contact/coil, and whether the address is used
directly or passed as a parameter. To help compare Boolean performance across PACSystems CPUs,
average time measurements are presented below for each CPU model.
The measurements are for these three categories:
• Simple address: Boolean with a simple reference address that is known at compile/validation
time. For example, a symbolic variable, or a mapped variable, such as %I00001, or a Boolean
from an array that is indexed by a constant, such as BoolArray[3].
• Complex address: Boolean with a complex address that requires run-time computation to
resolve. For example, a Boolean from an array that is indexed by a variable, such
asBoolArray[j].
• Passed as parameter: Boolean within a parameterized block or UDFB, where the reference
address of the Boolean is passed as a parameter to the block. The measurement covers the
Boolean execution time within the block, but does not include the time to compute the
reference address before passing it to the block.

Appendix A. Performance Data
A-1.1 Boolean Execution Measurements (milliseconds per 1000 Boolean

executions) 44
Boolean Category
CPU Model
Simple Address Complex Address Passed as Parameter
CPU310 0.253 1.371 0.467
CPE310 0.103 0.512 0.203
CPE305 0.102 0.513 0.203
CPU320 / CPU315 0.053 0.272 0.113
CRU320 0.055 0.272 0.111
CPE010 0.244 1.329 0.469
CPE020 0.095 0.543 0.198
CRE020 0.096 0.556 0.194
CPE030 0.087 0.450 0.183
CRE030 0.090 0.451 0.184
CPE040 0.029 0.150 0.061
CRE040 0.029 0.149 0.061
44 Measured with CPU firmware version 7.18.

A-2 Instruction Timing

A-2.1 Overview
The tables in this section list the execution and incremental times in microseconds for each function
supported by the PACSystems CPUs. Two execution times are shown for each instruction.
Execution Time Description
Enabled Time in microseconds required to execute the function or function block when
power flows into the function with valid inputs.
Disabled Time in microseconds required to execute the function when it is not enabled.
Notes:
 All times represent typical execution time. Times may vary with input and error conditions.
 Enabled time is for single length units of word-oriented memory.
 COMMREQ time was measured between CPU and Ethernet module with NOWAIT option.
 DOIO time was measured using a discrete output module.
 Timers are updated each time they are encountered in the logic by the amount of time
consumed by the last sweep.
 Performance times for the BUS_ functions were measured on the RX7i using a Series 90-70
Genius Bus Controller, and on the RX3i using an RMX128 Redundancy Memory Xchange Module.
 Performance times for all redundancy (CRE and CRU) CPUs were measured with ECC enabled.
 Due to a change in caching, measured times for some instructions changed for release 6.0 as
compared to releases 5.0/5.1. It was found that increases in some instructions were offset by
decreases in other instructions, so that no effective net change was observed.

A-2.2 CPU Version Information

The instruction execution and incremental times were obtained by testing the following CPU versions:
Model Firmware Version
All instructions IC695CPE305/CPE310 7.10
except as listed below
IC695CPU310/CPU315 6.0
IC695CPU320/IC695CRU320 45 7.18
IC698CPE010/CPE020 6.0
IC698CRE020 6.0 (with ECC enabled)
IC698CPE030/CPE040 6.0
IC698CRE030/CRE040 6.0 (with ECC enabled)
MOVE_UINT CPE010/020 3.5

CRE02045 2.04 (with ECC enabled)
SVC_REQs for Redundancy IC695CRU32045 6.0 (with ECC enabled)
TON, TOF, TP Instructions CPU310/CPU315//320,

5.7
CRU320
CPE010/030/040 3.6
CRE030/04045 3.6 (with ECC enabled)
Instructions for PACMotion CPU315/CPU320 5.6

CPU310 6.0
45 Due to Error Checking and Correction (ECC), Redundant CPU times are approximately 5% slower, on average,
than the equivalent Non-Redundant CPU.

A-2.3 RX3i Instruction Times

CPE305 /CPE310 CPU310 CPU315/ CPU320/ CRU32045
Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
Bit Operation
AND_WORD 1.47 0.51 3.40 1.45 0.84 0.46 0.911 0.382
AND_DWORD 1.433 0.44 3.50 1.46 0.84 0.46 0.968 0.378
OR_WORD 1.332 0.44 3.40 1.50 0.84 0.47 0.891 0.437
OR_DWORD 1.387 0.45 3.63 1.51 0.89 0.47 0.919 0.375
XOR_WORD 1.347 0.46 3.37 1.44 0.86 0.46 0.908 0.375
XOR_DWORD 1.391 0.47 3.46 1.45 0.83 0.46 0.866 0.388
NOT_WORD 1.089 0.40 2.97 1.29 0.64 0.42 0.659 0.274
NOT_DWORD 1.03 0.37 2.93 1.32 0.67 0.40 0.662 0.282
MCMP_WORD 2.477 0.80 5.58 2.29 1.51 0.61 1.668 0.605
MCMP_DWORD 2.385 0.74 5.61 2.20 1.50 0.63 1.682 0.636
SHL_WORD 1.921 0.84 4.52 2.39 1.15 0.56 1.275 0.633
SHL_DWORD 1.903 0.77 4.54 2.44 1.12 0.56 1.321 0.665
SHR_WORD 1.875 0.76 5.15 2.43 1.18 0.57 1.26 0.614
SHR_DWORD 1.864 0.78 4.69 2.45 1.14 0.57 1.24 0.616
ROL_WORD 1.176 0.48 2.99 1.50 0.68 0.46 0.735 0.431
ROL_DWORD 1.125 0.42 3.22 1.53 0.64 0.46 0.773 0.402
ROR_WORD 1.105 0.41 2.91 1.43 0.66 0.46 0.704 0.431
ROR_DWORD 1.116 0.43 2.87 1.44 0.71 0.46 0.711 0.384
BTST_WORD 1.333 0.45 3.22 1.27 0.71 0.35 0.693 0.314
BTST_DWORD 1.265 0.39 3.09 1.26 0.71 0.34 0.73 0.321
BSET_WORD 0.897 0.35 2.38 1.17 0.59 0.30 0.635 0.293
BSET_DWORD 0.88 0.37 2.36 1.14 0.58 0.30 0.635 0.293
BCLR_WORD 0.849 0.35 2.39 1.14 0.59 0.30 0.659 0.316
BCLR_DWORD 0.86 0.33 2.45 1.19 0.59 0.30 0.623 0.291
BPOS_WORD 1.719 0.47 4.03 1.33 0.80 0.23 1.024 0.309
BPOS_DWORD 1.941 0.40 4.83 1.31 0.96 0.22 1.302 0.324
Relational
CMP_INT 1.623 0.41 3.52 1.16 0.89 0.33 1.11 0.363
CMP_DINT 1.552 0.38 3.54 1.19 0.91 0.34 1.143 0.393
CMP_REAL 1.619 0.39 3.63 1.20 0.94 0.35 1.146 0.362
CMP_LREAL 1.835 0.44 3.92 1.13 1.08 0.34 1.227 0.361
CMP_UINT 1.485 0.39 3.50 1.17 0.93 0.33 1.097 0.361
EQ_DATA - - 10.63 7.98 2.37 1.29
EQ_DATA_INPUTREF 2.247 0.12 -- -- -- -- 1.55 0.448
EQ_DATA_AXISREF 2.377 0.32 -- -- -- -- 1.616 0.491
EQ_DINT 1.074 0.29 2.32 0.96 0.65 0.24 0.737 0.277
EQ_INT 1.123 0.36 2.45 0.96 0.66 0.24 0.69 0.276
EQ_LREAL 1.174 0.37 2.88 1.07 0.78 0.26 0.832 0.282
EQ_REAL 1.05 0.30 2.38 0.96 0.66 0.26 0.677 0.328

Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
EQ_UINT 1.01 0.31 2.37 0.96 0.65 0.25 0.659 0.269
NE_INT 1.03 0.32 2.29 0.98 0.64 0.24 0.715 0.292
NE_DINT 1.074 0.33 2.37 1.00 0.66 0.24 0.718 0.269
NE_UINT 1.14 0.34 2.39 0.96 0.66 0.24 1.029 0.583
NE_REAL 1.076 0.32 2.35 0.95 0.67 0.25 0.863 0.408
NE_LREAL 1.142 0.35 2.87 1.04 0.79 0.26 0.926 0.279
GT_INT 1.035 0.31 2.49 0.98 0.66 0.25 0.703 0.269
GT_DINT 1.018 0.31 2.34 1.01 0.65 0.24 0.714 0.268
GT_REAL 1.057 0.31 2.36 0.94 0.65 0.24 0.714 0.269
GT_LREAL 1.146 0.36 2.82 1.02 0.77 0.27 0.893 0.324
GT_UINT 1.048 0.31 2.37 0.95 0.66 0.24 0.714 0.27
GE_INT 1.017 0.31 2.44 0.93 0.68 0.24 0.682 0.269
GE_DINT 1.082 0.32 2.43 1.01 0.66 0.24 0.675 0.284
GE_REAL 1.075 0.32 2.35 0.94 0.66 0.26 0.678 0.266
GE_LREAL 1.154 0.34 2.85 1.04 0.77 0.26 0.817 0.282
GE_UINT 1.03 0.32 2.44 1.03 0.67 0.24. 0.677 0.272
LT_INT 1.049 0.32 2.53 1.02 0.64 0.24 0.712 0.281
LT_DINT 1.08 0.33 2.37 1.05 0.65 0.25 0.72 0.269
LT_REAL 1.044 0.32 2.37 0.97 0.64 0.25 0.873 0.409
LT_LREAL 1.139 0.35 2.81 1.01 0.77 0.26 0.882 0.299
LT_UINT 1.087 0.31 2.41 0.95 0.65 0.24 0.71 0.271
LE_INT 1.123 0.32 2.46 0.99 0.69 0.25 0.678 0.269
LE_DINT 1.014 0.31 2.33 1.03 0.65 0.25 0.665 0.27
LE_UINT 1.045 0.32 2.44 1.02 0.64 0.24 0.683 0.283
LE_REAL 1.03 0.31 2.34 1.00 0.65 0.25 0.676 0.27
LE_LREAL 1.136 0.35 2.78 0.98 0.77 0.26 0.818 0.291
Conversion
BCD-4 to INT 0.933 0.30 2.17 1.00 0.55 0.23 0.544 0.25
DINT to INT 0.694 0.30 1.90 0.98 0.55 0.21 0.507 0.247
UINT to INT 0.736 0.30 2.04 0.94 0.49 0.20 0.583 0.234
BCD-8 to DINT 0.889 0.28 2.58 0.97 0.62 0.21 0.612 0.235
INT to DINT 0.672 0.29 1.88 0.2 0.51 0.21 0.567 0.232
UINT to DINT 0.771 0.32 1.90 0.96 0.63 0.21 0.591 0.227
INT to UINT 0.724 0.30 1.93 0.93 0.62 0.21 0.551 0.251
DINT to UINT 0.674 0.30 1.92 1.06 0.50 0.21 0.517 0.248
BCD-4 to UINT 0.792 0.35 2.18 1.04 0.55 0.22 0.603 0.247
INT to BCD-4 0.922 0.30 2.19 0.93 0.61 0.22 0.596 0.239
UINT to BCD-4 0.853 0.30 2.17 0.94 0.67 0.22 0.644 0.229
DINT to BCD-8 0.849 0.30 2.35 1.03 0.62 0.21 0.63 0.235
REAL_TO_INT 0.922 0.31 2.43 1.00 0.66 0.21 0.665 0.23
REAL_TO_UINT 0.882 0.30 2.37 0.99 0.63 0.21 0.637 0.239
REAL_TO_LREAL 0.697 0.31 2.10 0.95 0.52 0.21 0.555 0.224

Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
REAL_TO_DINT 0.877 0.30 2.42 0.99 0.64 0.21 0.638 0.24
INT_TO_REAL 0.707 0.31 2.00 0.98 0.49 0.22 0.521 0.255
UINT_TO_REAL 0.724 0.31 1.87 0.95 0.55 0.23 0.595 0.239
DINT_TO_REAL 0.773 0.30 1.95 1.02 0.56 0.21 0.516 0.231
DINT_TO_LREAL 0.741 0.36 2.06 1.02 0.50 0.20 0.584 0.248
REAL_TRUN_INT 0.757 0.34 1.77 0.73 0.45 0.19 0.515 0.16
REAL_TRUN_DINT 0.776 0.35 1.84 0.83 0.52 0.19 0.516 0.167
DEG_TO_RAD_REAL 0.749 0.28 1.90 1.01 0.55 0.21 0.515 0.24
DEG_TO_RAD_LREAL 0.901 0.34 2.33 0.94 0.64 0.23 0.63 0.249
RAD_TO_DEG_REAL 0.703 0.28 1.91 0.97 0.59 0.21 0.515 0.25
RAD_TO_DEG_LREAL 0.789 0.32 2.33 0.94 0.64 0.23 0.636 0.256
BCD-4 to REAL 0.852 0.30 2.30 1.03 0.56 0.20 0.692 0.301
BCD-8 to REAL 0.996 0.30 2.62 0.94 0.66 0.20 0.661 0.25
LREAL_TO_DINT 0.869 0.33 2.67 1.03 0.63 0.20 0.673 0.23
LREAL_TO_REAL 0.666 0.30 2.25 1.01 0.54 0.21 0.549 0.224
Data Move
BLKCLR 0.796 0.29 1.96 0.96 0.45 0.19 0.528 0.223
BITSEQ 0.175 0.15 1.14 4.14 0.90 0.89
MOVE_BIT 1.162 0.41 3.00 1.37 0.67 0.25 0.861 0.245
MOVE_DINT 0.864 0.37 2.21 1.32 0.47 0.43 0.533 0.292
MOVE_INT 0.857 0.38 2.21 1.33 0.48 0.44
MOVE_UINT - - - - - - 0.523 0.305
MOVE_WORD 0.919 0.44 2.15 1.25 0.48 0.41 0.551 0.298
MOVE_DWORD 0.884 0.36 2.15 1.24 0.48 0.42 0.548 0.293
MOVE_REAL 0.844 0.35 2.15 1.24 0.47 0.41 0.594 0.354
MOVE_LREAL 1.136 0.41 2.63 1.27 0.57 0.41 0.604 0.297
MOVE_DATA - - 8.36 2.36 2.16 1.20 - -
MOVE_DATA_INPUTREF 2.094 0.34 10.63 2.60 - - 2.077 0.384
MOVE_DATA_AXISREF 2.437 0.39 10.63 2.60 - - 2.172 0.376
MOVE_DATA_EX 2.094 0.34 9.28 1.98 2.60 1.66 2.23 0.544
MOVE_DATA_EX_INPUTREF 2.437 0.39 9.28 1.98 - - 2.509 0.587
MOVE_TO_FLAT 2.094 0.34 9.28 1.98 2.60 1.66 2.23 0.544
MOVE_FROM_FLAT 2.094 0.34 9.28 1.98 2.60 1.66 2.23 0.544
BLKMOV_WORD 1.009 0.72 2.89 2.17 0.68 0.60 0.788 0.511
BLKMOV_DWORD 1.019 0.65 3.03 2.17 0.71 0.54 0.862 0.517
BLKMOV_DINT 1.133 0.68 3.04 2.22 0.71 0.55 0.842 0.541
BLKMOV_INT 0.938 0.69 2.78 2.13 0.69 0.60 0.8 0.511
BLKMOV_REAL 1.004 0.66 2.98 2.14 0.70 0.53 0.853 0.528
BLKMOV_UINT 0.91 0.65 2.79 2.09 0.67 0.60 0.785 0.531
DATA_INIT_ASCII 0.432 0.45 0.89 1.25 0.20 0.35 0.176 0.236
DATA_INIT_COMM 0.37 0.36 1.03 1.20 0.22 0.34 0.196 0.221
DATA_INIT_DLAN 0.433 0.39 1.33 1.32 0.33 0.35 0.254 0.238

Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
DATA_INIT_DINT 0.313 0.37 0.89 1.21 0.21 0.33 0.169 0.24
DATA_INIT_DWORD 0.313 0.36 0.97 1.26 0.21 0.34 0.172 0.221
DATA_INIT_INT 0.343 0.38 0.94 1.27 0.20 0.33 0.178 0.231
DATA_INIT_REAL 0.344 0.38 0.91 1.22 0.21 0.35 0.172 0.248
DATA_INIT_LREAL 0.468 0.41 0.96 1.18 0.18 0.34 0.183 0.248
DATA_INIT_WORD 0.342 0.36 0.97 1.27 0.20 0.34 0.179 0.219
DATA_INIT_UINT 0.419 0.37 0.93 0.9 0.21 0.35 0.16 0.254
SWAP_WORD 0.976 0.36 2.67 1.24 0.58 0.41 0.616 0.291
SWAP_DWORD 1.008 0.38 2.75 1.29 0.59 0.41 0.62 0.308
SHFR_BIT 2.461 1.11 6.52 2.88 1.45 0.64 1.621 0.705
SHFR_WORD 2.441 1.49 7.13 4.94 1.94 1.40 2.072 1.51
SHFR_DWORD 2.403 1.48 7.16 4.91 2.00 1.42 2.127 1.493
Data Table
SORT_INT 15.58 0.40 36.56 1.25 9.89 0.42 9.743 0.295
SORT_UINT 15.436 0.35 36.49 1.24 9.86 0.42 9.628 0.296
SORT_WORD 15.516 0.36 36.46 1.26 9.87 0.42 9.613 0.332
TBLRD_INT 1.299 0.47 3.49 1.23 0.88 0.33 0.968 0.402
TBLRD_DINT 1.21 0.44 3.58 1.27 0.90 0.33 0.887 0.345
TBLWRT_INT 1.71 0.53 4.02 1.53 1.03 0.41 1.06 0.388
TBLWRT_DINT 1.599 0.48 3.94 1.52 1.03 0.42 1.113 0.391
FIFORD_INT 1.67 0.54 4.04 1.68 0.92 0.41 0.931 0.405
FIFORD_DINT 1.627 0.55 4.00 1.69 0.92 0.41 0.927 0.408
FIFOWRT_INT 1.189 0.32 3.06 1.21 0.83 0.30 0.838 0.358
FIFOWRT_DINT 1.197 0.31 3.05 1.19 0.84 0.30 0.836 0.278
LIFORD_INT 1.563 0.54 3.83 1.69 0.87 0.41 0.887 0.403
LIFORD_DINT 1.508 0.54 3.81 1.64 0.87 0.41 0.886 0.403
LIFOWRT_INT 1.211 0.33 3.06 1.18 0.83 0.30 0.836 0.278
LIFOWRT_DINT 1.194 0.35 3.05 1.19 0.83 0.32 0.837 0.284
LIFOWRT_DWORD 1.2 0.34 3.06 1.18 0.83 0.30 0.838 0.293
Array
ARRAY_MOVE_BIT 1.787 0.69 4.62 2.03 0.91 0.51 0.984 0.504
ARRAY_MOVE_BYTE 1.385 0.57 3.62 1.84 0.78 0.57 0.927 0.49
ARRAY_MOVE_WORD 1.335 0.59 3.67 1.92 0.80 0.57 0.858 0.556
ARRAY_MOVE_DWORD 1.346 0.59 3.61 1.85 0.80 0.58 0.86 0.49
ARRAY_MOVE_DINT 1.368 0.59 3.62 1.94 0.80 0.57 0.856 0.491
ARRAY_MOVE_INT 1.357 0.61 3.72 1.99 0.80 0.57 0.868 0.496
ARRAY_MOVE_UINT 1.408 0.61 3.61 1.87 0.79 0.58 0.88 0.491
SRCH_BYTE 1.8 0.63 4.35 1.86 1.04 0.46 1.254 0.487
SRCH_WORD 1.666 0.57 4.05 1.81 1.02 0.46 1.306 0.508
SRCH_DWORD 1.721 0.57 4.17 1.82 1.12 0.46 1.245 0.531
ARRAY_RANGE_WORD 1.715 0.59 4.16 1.77 1.00 0.42 1.159 0.419
ARRAY_RANGE_DWORD 1.714 0.53 4.43 1.78 1.21 0.42 1.209 0.417

Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
ARRAY_RANGE_DINT 1.724 0.54 4.47 1.83 1.16 0.43 1.171 0.419
ARRAY_RANGE_INT 1.647 0.53 4.69 1.85 1.16 0.41 1.185 0.404
ARRAY_RANGE_UINT 1.706 0.55 4.17 1.84 1.11 0.41 1.162 0.406
Math
ADD_INT 0.932 0.41 2.08 1.19 0.70 0.30 0.796 0.28
ADD_DINT 0.841 0.35 2.22 1.17 0.63 0.31 0.825 0.272
ADD_REAL 0.819 0.34 2.12 1.13 0.61 0.32 0.751 0.327
ADD_LREAL 0.962 0.38 3.09 1.20 0.75 0.31 0.94 0.299
ADD_UINT 0.801 0.34 2.08 1.14 0.64 0.30 0.717 0.259
SUB_INT 0.805 0.34 2.08 1.15 0.66 0.30 0.729 0.258
SUB_DINT 0.846 0.33 2.17 1.13 0.64 0.30 0.75 0.258
SUB_REAL 0.826 0.34 2.17 1.18 0.62 0.31 0.743 0.26
SUB_LREAL 0.998 0.40 2.81 1.27 0.81 0.31 0.958 0.3
MUL_INT 0.822 0.34 2.21 1.13 0.64 0.30 0.727 0.258
MUL_DINT 0.883 0.35 2.20 1.20 0.63 0.31 0.765 0.255
MUL_REAL 0.86 0.35 2.13 1.14 0.57 0.31 0.752 0.265
MUL_LREAL 0.97 0.39 3.03 1.44 0.75 0.33 0.94 0.29
MUL_MIXED 0.913 0.37 2.06 1.19 0.64 0.31 0.823 0.275
MUL_UINT 0.8 0.34 2.42 1.18 0.65 0.30 0.728 0.259
DIV_INT 0.913 0.35 2.35 1.19 0.64 0.30 0.74 0.268
DIV_DINT 0.904 0.36 2.45 1.21 0.64 0.31 0.77 0.281
DIV_REAL 0.894 0.34 2.39 1.13 0.69 0.30 0.761 0.258
DIV_LREAL 1.012 0.39 2.93 1.20 0.79 0.31 0.962 0.279
DIV_MIXED 1.00 0.34 2.45 1.15 0.67 0.30 0.788 0.259
MOD_INT 0.903 0.35 2.36 1.23 0.69 0.31 0.762 0.278
MOD_DINT 0.904 0.35 2.30 1.18 0.64 0.31 0.742 0.277
MOD_UINT 0.82 0.35 2.23 1.19 0.71 0.31 0.83 0.261
ABS_INT 0.728 0.29 1.96 0.91 0.51 0.23 0.555 0.241
ABS_DINT 0.717 0.29 1.99 0.91 0.56 0.23 0.528 0.241
ABS_REAL 0.751 0.28 2.12 0.96 0.56 0.21 0.521 0.239
ABS_LREAL 0.875 0.38 2.54 1.01 0.62 0.22 0.678 0.24
SCALE_INT 1.12 0.58 3.07 1.54 0.85 0.44 0.931 0.437
SCALE_DINT 1.263 0.56 2.65 1.51 0.71 0.51 0.991 0.429
SCALE_UINT 1.067 0.55 2.70 1.50 0.71 0.49 0.9 0.404
SQRT_INT 0.905 0.26 2.36 0.93 0.63 0.21 0.618 0.24
SQRT_DINT 0.906 0.33 2.86 0.93 0.69 0.21 0.742 0.24
SQRT_REAL 0.812 0.28 2.15 0.92 0.55 0.23 0.592 0.293
SQRT_LREAL 0.897 0.30 2.60 1.02 0.65 0.22 0.644 0.244
Trigonometric
SIN_REAL 1.031 0.28 2.48 0.92 0.61 0.22 0.628 0.239
SIN_LREAL 1.063 0.35 2.97 1.02 0.74 0.22 0.74 0.294
COS_REAL 0.988 0.28 2.41 0.93 0.67 0.21 0.616 0.239

Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
COS_LREAL 1.04 0.28 2.93 1.02 0.75 0.21 0.736 0.235
TAN_REAL 1.156 0.28 2.53 0.92 0.63 0.21 0.635 0.24
TAN_LREAL 1.086 0.32 3.03 1.02 0.83 0.22 0.776 0.236
ASIN_REAL 1.096 0.28 2.80 0.98 0.73 0.21 0.743 0.24
ASIN_LREAL 1.127 0.49 3.23 1.00 0.88 0.21 0.835 0.223
ACOS_REAL 1.096 0.28 2.80 0.98 0.73 0.21 0.743 0.24
ACOS_LREAL 1.221 0.33 3.27 0.99 0.88 0.21 0.845 0.239
ATAN_REAL 1.013 0.29 2.56 1.03 0.67 0.23 0.63 0.256
ATAN_LREAL 0.992 0.31 2.88 1.00 0.76 0.21 0.719 0.24
Logarithmic
LOG_REAL 0.977 0.29 2.46 0.99 0.65 0.21 0.641 0.241
LOG_LREAL 1.052 0.30 3.25 0.95 0.73 0.21 0.733 0.223
LN_REAL 1 0.30 2.46 0.97 0.65 0.22 0.66 0.287
LN_LREAL 1.05 0.33 3.14 1.01 0.75 0.22 0.744 0.239
EXPT_REAL 1.568 0.36 3.75 1.29 0.88 0.31 0.988 0.246
EXPT_LREAL 1.114 0.39 3.35 1.31 0.72 0.30 0.727 0.277
EXP_REAL 0.91 0.29 2.26 0.97 0.61 0.23 0.612 0.254
EXP_LREAL 0.966 0.34 2.85 1.1 0.76 0.23 0.698 0.232
PID
PIDISA 2.862 2.54 6.80 6.14 1.52 1.43 1.74 1.468
PIDIND 2.701 2.46 6.83 6.16 1.51 1.39 1.784 1.495
Range
RANGE_INT 1.424 0.62 3.57 2.09 0.85 0.47 1.055 0.615
RANGE_DINT 1.341 0.57 3.28 1.85 0.85 0.47 0.952 0.463
RANGE_DWORD 1.363 0.59 3.39 1.84 0.85 0.47 0.911 0.482
Timers
ONDTR 1.918 1.52 4.91 3.81 1.11 0.83 1.104 0.807
OFDT 1.756 1.56 4.70 4.22 1.03 0.87 1.027 0.838
TMR 1.797 1.58 4.69 4.21 1.04 0.88 1.031 0.838
TOF 2.986 1.951 7.8 4.7 1.8 1.2 1.803 1.107
TON 2.262 1.912 7.4 4.5 1.8 1.1 1.357 1.108
TP 2.312 1.909 7.5 4.5 1.8 1.2 1.422 1.11
Counters
UPCTR 1.851 1.69 4.24 4.28 0.96 0.92 0.899 0.907
DNCTR 1.668 1.68 4.20 4.23 0.94 0.93 0.903 0.896
Control
JUMPN 0.021 0.06 0.29 0.13 0.02 0.01 0.134 0.01
FOR/NEXT 0.482 0.22 1.40 0.70 0.23 0.18 0.256 0.167
MCRN/ENDMCRN
0.212 0.21 0.64 0.65 0.06 007 0.1 0.146
Combined
SWITCH_POS 0.787 0.28 1.96 0.91 0.57 0.21 0.549 0.185
DOIO 78.972 0.41 58.32 1.32 38.72 0.30 16.97 0.29

Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
DOIO with ALT 79.187 0.41 58.17 1.28 38.67 0.33 16.947 0.305
DRUM_SEQ 2.68 2.20 6.74 5.42 1.63 1.30 1.71 1.266
SCAN_SET_IO 138.471 0.797 155.02 1.87 111.81 0.50 39.488 0.394
SUSIO 0.797 0.14 1.93 0.38 0.49 0.11 0.514 0.094
COMM_REQ 221.447 0.39 219.48 1.51 133.87 0.36 136.466 0.362
CALL/RETURN
2.907 0.17 7.23 0.44 1.83 0.09 1.853 0.088
(C Block)
CALL/RETURN (LD) 2.859 0.13 7.50 0.42 1.73 0.10 1.853 0.106
CALL/RETURN
1.85 0.12 4.92 0.41 1.22 0.11 1.288 0.087
(Parameterized Block)
Bus 46
BUS_RD_BYTE 16.228 0.75 20.16 2.35 7.41 0.68 1.02 0.589
BUS_RD_WORD 16.189 0.73 20.67 2.46 7.48 0.71 1.07 0.64
BUS_RD_DWORD 16.383 0.72 20.80 2.43 7.55 0.70 1.032 0.613
BUS_WRT_BYTE 12.34 0.70 20.94 2.59 6.19 0.70 1.944 0.589
BUS_WRT_WORD 12.478 0.71 20.76 2.49 6.17 0.69 1.956 0.593
BUS_WRT_DWORD 12.489 0.73 21.09 2.49 6.24 0.69 1.957 0.601
BUS_RMW_BYTE 17.5 0.83 21.72 2.67 7.96 0.78 1.385 0.682
BUS_RMW_WORD 17.647 0.83 21.01 2.69 7.95 0.79 1.358 0.659
BUS_RMW_DWORD 17.484 0.79 21.20 2.71 7.96 0.78 1.429 0.665
BUS_TS_BYTE 17.284 0.61 19.07 2.05 7.80 0.50 1.309 0.511
BUS_TS_WORD 17.378 0.59 20.16 2.09 7.66 0.51 1.254 0.512
46 Results will vary with how quickly the module responds to bus cycles. Because of this, incremental times do
not appear in the “Incremental Times” tables.

Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
SVC_REQ
#1 2.179 0.26 6.57 1.02 1.34 0.18 1.54 0.217
#2 2.523 0.27 6.35 1.01 1.57 0.21 1.809 0.176
#3 1.746 0.25 4.80 0.92 0.98 0.18 1.15 0.142
#4 1.735 0.24 4.83 0.98 0.99 0.19 1.14 0.158
#5 1.697 0.24 4.90 0.92 0.97 0.17 1.158 0.153
#6 1.688 0.25 4.58 0.97 0.99 0.19 1.099 0.18
#7 3.661 0.32 8.64 1.12 1.95 0.20 2.022 0.182
#8 10.343 0.28 6.82 1.01 3.14 0.20 3.306 0.192
#9 1.76 0.28 4.53 1.03 1.06 0.20 1.192 0.195
#10 2.487 0.28 7.09 1.04 1.72 0.20 1.586 0.205
#11 1.751 0.28 4.25 1.03 1.07 0.20 1.166 0.195
#12 0.931 0.28 2.37 1.03 0.60 0.20 0.708 0.187
#13 1.438 0.25 4.56 1.09 0.89 0.18 0.903 0.177
#14 178.204 0.23 436.25 1.11 124.34 0.19 117.072 0.161
#15 1.13 0.36 2.72 1.10 0.60 0.34 0.712 0.308
#16 1.739 0.33 4.39 1.01 1.04 0.21 1.058 0.202
#17 1.235 0.32 2.95 0.90 0.85 0.19 0.732 0.196
#18 31.168 0.33 112.51 1.05 41.61 0.21 25.369 0.181
#19 1.618 0.32 4.30 1.05 0.88 0.20 0.929 0.173
#20 4.997 0.33 17.78 1.05 4.59 0.21 4.614 0.173
#21 16.058 0.34 35.02 1.00 9.48 0.21 9.344 0.173
#22 1.07 0.29 2.82 1.00 0.65 0.20 0.735 0.175
#23 36.224 0.29 118.94 1.03 32.49 0.21 24.019 0.188
#24 2.003 0.30 4.66 0.98 1.05 0.20 0.665 0.173
#25 1.181 0.29 3.00 0.98 0.74 0.20 0.746 0.167
NA NA
#26 NA NA NA NA NA NA
1.73 1.28
NA NA
1.75 1.29
NA NA
1.96 1.30
#32 9.788 0.30 12.88 1.31 5.03 0.20 4.824 0.178
NA NA
1.77 1.27
#50 1.655 0.29 4.48 1.05 1.00 0.21 1.116 0.157
#51 1.67 0.29 4.54 0.99 1.05 0.20 1.154 0.157
563.143 47 84.1647
#56 0.39 0.97 22.73 0.21 1396.47 0.159
17.413 48 84.1648
9167.40347 17558.3347
#57 0.39 0.97 13970.00 0.21 6131.71 0.159
8.7948 17558.3348
47 Initial execution.
48 Subsequent executions.

Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
PACMotion
MC_AbortTrigger 167.406 5.322 150.954 12.762 50.35 3.01 50.35 3.01
MC_CamFileRead 22.997 14.603 63.861 44.001 13.84 7.05 13.84 7.05
MC_CamFileWrite 25.499 15.152 52.938 27.52 12.02 4.7 12.02 4.7
MC_CamIn 185.117 10.867 169.563 30.988 102.8 4.86 102.8 4.86
MC_CamOut 134.517 4.580 99.325 10.812 47.49 2.8 47.49 2.8
MC_CamTableDeselect 104.051 8.023 116.468 18.343 60.09 3.56 60.09 3.56
MC_CamTableSelect 126.359 7.399 138.508 21.01 75.97 3.77 75.97 3.77
MC_DelayedStart 122.332 7.167 141.552 20.164 76.77 3.22 76.77 3.22
MC_DigitalCamSwitch 229.067 39.904 227.174 70.804 152.59 4.32 152.59 4.32
MC_DL_Activate 102.622 19.693 101.982 26.656 50.63 3.39 50.63 3.39
MC_DL_Configure 182.666 8.776 200.857 23.556 130 3.72 130 3.72
MC_DL_Delete 92.780 10.230 116.745 21.212 49.57 3.14 49.57 3.14
MC_DL_Get 102.580 9.065 109.414 35.919 61.29 3.16 61.29 3.16
MC_GearIn 170.551 7.611 165.344 23.176 91.03 4.34 91.03 4.34
MC_GearInPos 115.852 7.790 134.393 21.776 70.31 4.43 70.31 4.43
MC_GearOut 89.184 4.646 100.441 10.64 46.91 3.2 46.91 3.2
MC_Halt 152.450 7.622 155.891 19.243 82.5 4.11 82.5 4.11
MC_Home 117.432 7.715 134.787 19.626 71.45 3.77 71.45 3.77
MC_JogAxis 114.385 11.529 128.661 32.746 65.18 3.38 65.18 3.38
MC_LibraryStatus 91.545 8.275 105.757 16.573 48.78 3.33 48.78 3.33
MC_ModuleReset 95.198 6.322 103.803 17.462 83.73 3.15 83.73 3.15
MC_MoveAbsolute 175.661 7.095 174.49 18.321 99.53 3.95 99.53 3.95
MC_MoveAdditive 159.697 7.495 168.611 19.947 89.47 4.14 89.47 4.14
MC_MoveRelative 159.920 7.440 158.805 19.89 90.54 3.83 90.54 3.83
MC_MoveVelocity 162.556 7.650 159.625 22.839 65.66 3.98 65.66 3.98
MC_Phasing 170.154 7.646 167.904 21.544 95.11 4.6 95.11 4.6
MC_Power 37.423 37.284 130.954 130.871 24.49 20.06 24.49 20.06
MC_ReadActualPosition 39.528 1.656 36.643 4.216 18.61 0.73 18.61 0.73
MC_ReadActualVelocity 39.183 1.644 36.072 4.262 18.36 0.74 18.36 0.74
MC_ReadAnalogInput 45.623 1.988 51.211 4.74 22.38 1.17 22.38 1.17
MC_ReadAnalogOutput 59.744 3.318 47.314 7.89 22.16 1.67 22.16 1.67
MC_ReadAxisError 36.524 2.813 38.94 6.712 17.17 1.32 17.17 1.32
MC_ReadBoolParameter 32.953 2.761 37.485 6.408 14.85 1.57 14.85 1.57
MC_ReadBoolParameters 31.974 3.435 37.936 7.479 15 1.64 15 1.64
MC_ReadDigitalInput 38.895 3.226 36.186 7.043 14.63 1.67 14.63 1.67
MC_ReadDigitalOutput 44.757 2.485 47.597 6.216 17.07 1.58 17.07 1.58
MC_ReadDwordParameters 31.176 3.467 36.61 7.079 14.54 1.58 14.54 1.58
MC_ReadEventQueue 108.594 9.296 123.594 22.352 60.86 4.33 60.86 4.33
MC_ReadParameter 45.460 3.075 58.045 9.839 22.87 1.58 22.87 1.58
MC_ReadParameters 43.504 4.021 47.405 8.012 20.72 1.61 20.72 1.61
MC_ReadStatus 32.917 3.436 41.05 7.167 16.01 4.12 16.01 4.12

Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
MC_ReadTorqueCommand 39.639 1.720 36.657 4.36 18.51 0.73 18.51 0.73
MC_Reset 93.936 5.851 103.623 16.885 48.37 2.99 48.37 2.99
MC_SetOverride 107.928 11.412 116.23 36.465 62.21 3.81 62.21 3.81
MC_SetPosition 98.519 7.638 116.732 23.002 54 3.97 54 3.97
MC_Stop 99.332 6.130 112.185 16.24 56.38 3.6 56.38 3.6
MC_Superimposed 105.975 5.892 122.646 16.499 63.24 3.75 63.24 3.75
MC_SyncStart 103.035 6.320 122.121 17.198 60.23 3.1 60.23 3.1
MC_TouchProbe 173.373 7.268 160.243 18.934 56.11 3.32 56.11 3.32
MC_WriteAnalogOutput 134.439 8.041 112.994 21.111 53.53 3.36 53.53 3.36
MC_WriteBoolParameter 104.890 7.287 95.696 20.303 48.29 3.21 48.29 3.21
MC_WriteBoolParameters 131.228 8.106 106.974 22.215 57.41 3.23 57.41 3.23
MC_WriteDigitalOutput 96.338 8.259 116.644 23.822 52.99 4.27 52.99 4.27
MC_WriteDwordParameters 160.433 7.661 125.168 19.661 73.23 3.25 73.23 3.25
MC_WriteParameter 98.558 8.231 122.482 27.394 55.3 4.03 55.3 4.03
MC_WriteParameters 192.054 6.859 161.002 18.911 94.77 4.84 94.77 4.84

RX3i Incremental Times

An Increment time is shown for functions that can have variable length inputs.
Incremental time is added to the base function time for each addition to the length of an input
parameter. This time applies only to functions that can have varying input lengths (Search, Array
Moves, etc.)
Units:
 For table functions, increment is in units of length specified.
 For bit operation functions, increment is microseconds per bit.
 For data move functions, increment is in microseconds per unit.
CPE305 CPU320/
Instruction CPU310 CPU315
CPE310 CRU32045
Bit Operation
AND_WORD 0.04 0.12 0.02826 0.02463
AND_DWORD 0.06 0.16 0.3088 0.03789
OR_WORD 0.04 0.12 0.03 0.02472
OR_DWORD 0.06 0.16 0.03444 0.03798
XOR_WORD 0.04 0.12 0.02818 0.02478
XOR_DWORD 0.06 0.16 0.03424 0.03762
NOT_WORD 0.02 0.08 0.02011 0.01888
NOT_DWORD 0.04 0.12 0.02839 0.02799
MCMP_WORD 0.08 0.26 0.05934 0.055
MCMP_DWORD 0.09 0.29 0.06407 0.05919
SHL_WORD 0.07 0.17 0.0468 0.05032
SHL_DWORD 0.07 0.18 0.04381 0.04681
SHR_WORD 0.07 0.18 0.04883 0.03557
SHR_DWORD 0.09 0.19 0.0455 0.04718
BTST_WORD 0.00 0 0.00011 0.04332
BTST_DWORD 0.00 0 0.00046 0.03983
ROL_WORD 0.06 0.19 0.05071 0.03634
ROL_DWORD 0.07 0.17 0.03929 0.04152
ROR_WORD 0.06 0.16 0.0428 0.00012
ROR_DWORD 0.07 0.17 0.03992 0.00033
BPOS_WORD 0.32 0.76 0.17369 0.19574
BPOS_DWORD 0.72 1.69 0.38279 0.43922
Relational
EQ_DATA 0.0001 0.00019 0
Conversion
REAL_TO_UINT 0 0.00421 0
REAL_TO_DINT 0 0.00936 0
LReal_To_Real - - - 0

CPE305 CPU320/
CPE310 CRU32045
Data Move
MOVE_BIT 0.01 0.02 0.00412 0.00488
MOVE_DINT 0.02 0.04 0 0.0089
MOVE_INT 0.01 0.02 0 0
MOVE_UINT - - - 0.00439
MOVE_WORD 0.01 0.02 0.00968 0.0041
MOVE_DWORD 0.02 0.04 0.04613 0.00913
MOVE_REAL 0.02 0.04 0.0372 0.00951
MOVE_LREAL 0.03 0.09 0.01952 0.01928
MOVE_DATA 0.0002 0.00022 0
MOVE_DATA_EX 0.0002 0.00028 0
DATA_INIT_ASCII 0.00 0.01 0.00217 0.00304
DATA_INIT_COMM 0.01 0.02 0.00408 0.00398
DATA_INIT_DLAN - 0 0 0
DATA_INIT_DINT 0.01 0.04 0.00811 0.00812
DATA_INIT_DWORD 0.01 0.04 0.00817 0.00807
DATA_INIT_INT 0.01 0.02 0.00447 0.00432
DATA_INIT_REAL 0.01 0.04 0.00796 0.00822
DATA_INIT_LREAL 0.03 0.08 0.01584 0.01639
DATA_INIT_WORD 0.01 0.02 0.00439 0.00469
DATA_INIT_UINT 0.01 0.02 0.00391 0.00422
SWAP_WORD 0.04 0.19 0.00498 0.02921
SWAP_DWORD 0.06 0.16 0.00942 0.03614
BLKCLR_WORD 0.01 0.02 0.00568 0.00627
SHFR_BIT 0.02 0.04 0.01174 0.01241
SHFR_WORD 0.06 0.18 0.04529 0.03804
SHFR_DWORD 0.07 0.20 0.04751 0.04277
Data Table
SORT_INT 0.33 0.74 0.22253 0.2179
SORT_UINT 0.33 0.74 0.22237 0.21686
SORT_WORD 0.32 0.74 0.22243 0.21704
TBLRD_INT 0.00 0 -1E-05 0.00016
TBLRD_DINT 0.00 0 0.00012 0.00014
TBLWRT_INT 0.00 0 -0.0002 0.00003
TBLWRT_DINT 0.00 0 -0.0002 0.0002
FIFORD_INT 0.01 0.02 0.00432 0.00417
FIFORD_DINT 0.02 0.04 0.00927 0.0093
FIFOWRT_INT 0.00 -0.1333333 0.00011 0.00009
FIFOWRT_DINT 0.00 -1.1777778 -0.001 0.00001
LIFORD_INT 0.00 0.01111111 0.00021 0.00001
LIFORD_DINT 0.00 0.64444444 0.00021 0.00011
LIFOWRT_INT 0.00 -0.8666667 0.0001 0.00004
LIFOWRT_DINT 0.00 -0.8777778 4.4E-05 0.00001
LIFOWRT_DWORD 0.00 0.11111111 -0.0002 0.00001

CPE305 CPU320/
CPE310 CRU32045
Array
ARRAY_MOVE_BIT 0.01 0.02 0.00558 0.00538
ARRAY_MOVE_BYTE 0.00 0.01 0.0024 0.00207
ARRAY_MOVE_INT 0.01 0.02 0.00424 0.00407
ARRAY_MOVE_DINT 0.02 0.05 0.00961 0.00986
ARRAY_MOVE_WORD 0.01 0.02 0.0041 0.00442
ARRAY_MOVE_DWORD 0.02 0.04 0.00974 0.009
ARRAY_MOVE_UINT 0.01 0.02 0.00413 0.0038
SRCH_BYTE 0.02 0.07 0.01796 0.0173
SRCH_WORD 0.03 0.07 0.01828 0.01946
SRCH_DWORD 0.02 0.07 0.01507 0.01407
ARRAY_RANGE_DINT 0.19 0.54 0.13903 0.13582
ARRAY_RANGE_INT 0.18 0.52 0.13471 0.13199
ARRAY_RANGE_UINT 0.18 0.52 0.13647 0.13241
ARRAY_RANGE_WORD 0.18 0.52 0.13578 0.13282
ARRAY_RANGE_DWORD 0.19 0.56 0.14221 0.13928
PACMotion
MC_ReadBoolParameters 16.000 14.000 7.62 –
MC_ReadDwordParameters 30.000 28.000 12.34 –
MC_ReadParameters 40.000 38.000 19.42 –
MC_WriteBoolParameters 22.000 10.000 0.48 –
MC_WriteDwordParameters 40.000 34.000 1.4 –
MC_WriteParameters 45.000 42.000 1.34 –

A-2.4 RX7i Instruction Times

CPE030 CPE040
CPE010 CPE020 CRE02045
CRE03045 CRE04045
Disabled
Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
Bit Operation
AND_WORD 3.42 1.58 1.49 0.69 1.71 0.81 1.29 0.58 0.43 0.20
AND_DWORD 3.64 1.58 1.58 0.70 1.67 0.81 1.31 0.58 0.44 0.20
OR_WORD 3.58 1.71 1.56 0.76 1.72 0.90 1.28 0.59 0.43 0.20
OR_DWORD 3.55 1.66 1.54 0.73 1.71 0.83 1.44 0.60 0.48 0.20
XOR_WORD 3.42 1.57 1.48 0.69 1.73 0.80 1.29 0.61 0.48 0.25
XOR_DWORD 3.55 1.58 1.54 0.70 1.66 0.81 1.32 0.58 0.44 0.25
NOT_WORD 2.73 1.38 1.17 0.59 1.39 0.72 1.02 0.40 0.34 0.13
NOT_DWORD 2.81 1.44 1.21 0.62 1.44 0.75 1.07 0.41 0.35 0.14
MCMP_WORD 5.69 2.43 2.44 1.04 2.64 1.14 2.51 1.08 0.85 0.36
MCMP_DWORD 5.69 2.32 2.50 1.00 2.63 1.11 2.48 1.03 0.82 0.34
SHL_WORD 4.46 2.62 1.89 1.11 2.31 1.25 1.92 1.00 0.64 0.34
SHL_DWORD 4.53 2.73 1.92 1.56 2.31 1.28 1.90 0.98 0.63 0.32
SHR_WORD 4.64 2.59 1.96 1.09 2.45 1.24 1.98 0.98 0.66 0.32
SHR_DWORD 4.51 2.65 1.91 1.12 2.11 1.29 1.90 1.01 0.63 0.34
ROL_WORD 2.95 1.61 1.27 0.69 1.43 0.82 1.17 0.61 0.39 0.20
ROL_DWORD 3.27 1.61 1.39 0.70 1.46 0.84 1.07 0.59 0.36 0.20
ROR_WORD 2.93 1.52 1.25 0.66 1.45 0.82 1.11 0.57 0.39 0.19
ROR_DWORD 2.92 1.58 0.68 0.68 1.41 0.81 1.20 0.57 0.40 0.19
BTST_WORD 3.23 1.45 0.58 0.5 1.49 0.75 1.16 0.63 0.39 0.21
BTST_DWORD 3.29 1.37 1.41 0.5 1.48 0.72 1.19 0.63 0.40 0.19
BSET_WORD 2.62 1.43 1.12 0.61 1.17 0.72 0.97 0.48 0.31 0.16
BSET_DWORD 2.59 1.40 1.13 0.60 1.16 0.71 0.97 0.48 0.32 0.16
BCLR_WORD 2.51 1.36 1.08 0.59 1.20 0.72 0.97 0.48 0.31 0.16
BCLR_DWORD 2.49 1.33 1.07 0.57 1.16 0.70 0.97 0.47 0.32 0.16
BPOS_WORD 3.63 1.24 1.66 0.64 1.84 0.76 1.51 0.56 0.50 0.19
BPOS_DWORD 3.29 1.18 1.97 0.62 2.18 0.75 1.78 0.48 0.59 0.18
Relational
CMP_INT 3.51 1.25 1.50 0.54 1.45 0.60 1.58 0.52 0.53 0.17
CMP_DINT 3.86 1.32 1.66 0.57 1.51 0.66 1.61 0.52 0.53 0.17
CMP_REAL 3.65 1.30 1.57 0.56 1.52 0.62 0.53 0.53 0.54 0.1
CMP_LREAL 4.08 1.25 1.75 0.53 1.64 0.59 1.84 0.52 0.61 0.18
CMP_UINT 4.15 1.35 1.78 0.58 1.48 0.63 1.62 0.53 0.54 0.17
EQ_DATA 10.13 2.02 2.91 1.05 2.81 0.94 2.82 1.08 1.27 0.66
EQ_DINT 2.45 1.15 1.06 0.50 1.08 0.60 1.05 0.41 0.35 0.13
EQ_INT 2.49 1.14 1.07 0.50 1.04 0.58 1.04 0.47 0.35 0.16
EQ_LREAL 3.00 1.27 1.28 0.54 1.25 0.64 1.27 0.47 0.43 0.17
EQ_REAL 2.61 1.12 1.12 0.49 1.03 0.60 1.15 0.43 0.37 0.14
EQ_UINT 2.33 1.11 1.00 0.48 1.01 0.59 1.04 0.40 0.35 0.13

CPE030 CPE040
CRE03045 CRE04045
Disabled
Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
NE_INT 2.34 1.13 1.01 0.49 0.97 0.60 1.03 0.42 0.34 0.14
NE_DINT 2.56 1.34 1.10 0.55 1.10 0.66 1.08 0.43 0.36 0.14
NE_UINT 2.43 1.18 1.04 0.51 1.00 0.62 1.08 043 0.36 0.14
NE_REAL 2.65 1.18 1.14 0.51 1.05 0.61 1.13 0.40 0.38 0.13
NE_LREAL 2.93 1.17 1.26 0.51 1.24 0.60 1.29 0.42 0.44 0.15
GT_INT 2.50 1.14 1.08 0.49 1.05 0.60 1.05 0.40 0.35 0.13
GT_DINT 2.42 1.15 1.04 0.50 1.04 0.59 1.05 0.40 0.35 0.13
GT_REAL 2.60 1.11 1.11 0.48 1.02 0.58 1.13 0.40 0.38 0.13
GT_LREAL 2.90 1.15 1.27 0.50 1.21 0.60 1.28 0.43 0.43 0.15
GT_UINT 2.39 1.10 1.02 0.48 0.99 0.59 1.06 0.40 0.35 0.13
GE_INT 2.48 1.13 1.07 0.50 1.04 0.59 1.08 0.40 0.36 0.13
GE_DINT 2.57 1.19 1.08 0.51 1.08 0.62 1.07 0.41 0.36 0.14
GE_REAL 2.59 1.10 1.11 0.48 1.02 0.58 1.13 0.43 0.38 0.14
GE_LREAL 2.92 1.17 0.51 0.6 1.25 0.62 1.24 0.41 0.43 0.14
GE_UINT 2.42 1.19 1.04 0.51 1.01 0.63 1.06 0.41 0.35 0.13
LT_INT 2.54 1.22 1.09 0.50 1.06 0.61 1.05 0.42 0.35 0.14
LT_DINT 2.58 1.27 1.11 0.54 1.09 0.66 1.08 0.43 0.36 0.14
LT_REAL 2.66 1.18 1.14 0.51 1.04 0.72 1.13 0.39 0.38 0.13
LT_LREAL 2.90 1.15 1.24 0.50 1.22 0.59 1.29 0.43 0.43 0.14
LT_UINT 2.48 1.15 1.03 0.49 1.02 0.60 1.04 0.0 0.35 0.13
LE_INT 2.48 1.14 1.07 0.49 1.03 0.60 1.08 0.40 0.36 0.13
LE_DINT 2.46 1.15 1.05 0.50 1.04 0.59 1.05 0.40 0.35 0.13
LE_UINT 2.41 1.17 1.03 0.50 1.04 0.61 1.02 0.41 0.34 0.13
LE_REAL 2.68 1.14 1.16 0.49 1.02 0.60 1.10 0.40 0.37 0.13
LE_LREAL 2.89 1.15 1.24 0.49 12.1 0.58 1.26 0.39 0.43 0.14
Conversion
BCD-4 to INT 2.11 1.11 0.90 0.48 0.95 0.62 0.83 0.34 0.27 0.14
DINT to INT 2.18 1.15 0.94 0.48 0.81 0.56 0.85 0.33 0.28 0.14
UINT to INT 1.95 1.14 0.84 0.49 0.81 0.55 0.77 0.31 0.25 0.14
BCD-8 to DINT 3.00 1.10 1.29 0.47 1.02 0.58 0.94 0.32 0.30 0.14
INT to DINT 2.19 1.13 0.94 0.49 0.78 0.55 0.75 0.33 0.23 0.15
UINT to DINT 2.17 1.18 0.94 0.51 0.92 0.57 0.79 0.32 0.27 0.13
INT to UINT 1.88 1.12 0.81 0.48 0.76 0.56 0.80 0.35 0.27 0.14
DINT to UINT 2.15 1.11 0.93 0.48 0.83 0.58 0.72 0.33 0.24 0.14
BCD-4 to UINT 2.13 1.08 0.93 0.48 0.94 0.65 0.81 0.35 0.27 0.14
INT to BCD-4 2.24 1.12 0.94 0.48 0.92 0.56 0.95 0.35 0.27 0.15
UINT to BCD-4 2.26 1.17 0.97 0.50 0.93 0.56 1.07 0.36 0.33 0.15
DINT to BCD-8 3.15 1.08 1.35 0.47 1.00 0.60 0.91 0.34 0.31 0.14
REAL_TO_INT 2.75 1.20 1.18 0.52 1.02 0.58 0.99 0.34 0.33 0.14
REAL_TO_UINT 2.67 1.18 1.15 0.51 1.01 0.57 0.95 0.34 0.31 0.14
REAL_TO_LREAL 2.26 1.01 0.97 0.43 0.88 0.55 0.88 0.37 0.29 0.12

CPE030 CPE040
CRE03045 CRE04045
Disabled
Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
REAL_TO_DINT 3.06 1.14 1.32 0.49 1.05 0.57 0.98 0.34 0.31 0.14
INT_TO_REAL 2.17 1.12 0.93 0.48 0.77 0.56 0.73 0.36 0.24 0.15
UINT_TO_REAL 2.19 1.17 0.94 0.50 0.77 0.57 0.83 0.37 0.28 0.15
DINT_TO_REAL 2.43 1.14 1.04 0.49 0.84 0.60 0.75 0.34 0.27 0.14
DINT_TO_LREAL 2.24 1.01 0.96 0.44 0.85 0.73 0.85 0.42 0.28 0.13
REAL_TRUN_INT 2.22 1.37 0.87 0.49 0.83 0.59 0.56 0.13 0.26 0.11
REAL_TRUN_DINT 2.42 1.13 1.09 0.55 0.89 0.64 0.70 0.13 0.30 0.11
DEG_TO_RAD_REAL 2.39 1.11 1.03 0.48 0.83 0.57 0.87 0.35 0.29 0.12
DEG_TO_RAD_LREAL 2.34 1.05 1.01 0.44 0.92 0.52 0.98 0.34 033 0.11
RAD_TO_DEG_REAL 2.34 1.16 1.03 0.48 0.94 0.57 0.86 0.35 0.29 0.12
RAD_TO_DEG_LREAL 2.33 1.06 1.00 0.44 0.93 0.52 0.98 0.34 0.33 0.11
BCD-4 to REAL 2.42 1.09 1.04 0.48 0.99 0.64 0.89 0.34 0.28 0.14
BCD-8 to REAL 3.07 1.14 1.32 0.49 1.11 0.55 0.98 0.31 0.31 0.14
LREAL_TO_DINT 2.85 1.00 1.21 0.43 1.07 0.73 1.10 0.42 0.36 0.13
LREAL_TO_REAL 2.35 1.09 1.01 0.47 0.87 0.58 0.83 0.35 0.2 0.12
Data Move
BLKCLR 2.13 1.16 0.91 0.50 1.09 0.62 0.73 0.34 0.24 0.11
BITSEQ 3.90 3.93 1.63 1.64 1.76 1.74 1.50 1.59 0.50 0.53
MOVE_BIT 2.93 1.53 1.22 0.63 1.47 0.81 1.06 0.41 0.35 0.14
MOVE_DINT 2.23 1.44 0.92 0.58 1.07 0.75 0.78 0.26 0.3 0.13
MOVE_INT 2.27 1.47 0.94 0.60 1.06 0.75 0.79 0.42 0.26 0.14
MOVE_DWORD 2.31 1.51 0.96 0.62 1.10 0.77 0.81 0.41 0.26 0.14
MOVE_LREAL 2.74 1.43 1.15 0.61 1.56 0.77 0.95 0.42 0.31 0.14
MOVE_REAL 2.18 1.39 0.91 0.57 1.07 0.74 0.78 0.40 0.26 0.14
MOVE_UINT 2.3 1.2 1.0 0.5 - - - - - -
MOVE_WORD 2.25 1.45 0.93 0.59 1.04 0.76 0.80 0.43 0.27 0.14
MOVE_DATA 9.81 3.22 2.72 1.02 2.73 0.95 2.54 1.12 1.11 0.69
MOVE_DATA_EX 12.25 4.22 3.53 1.15 3.35 1.27 2.85 1.44 1.27 0.80
MOVE_TO_FLAT 12.25 4.22 3.53 1.15 3.35 1.27 2.85 1.44 1.27 0.80
MOVE_FROM_FLAT 12.25 4.22 3.53 1.15 3.35 1.27 2.85 1.44 1.27 0.80
BLKMOV_WORD 2.73 2.26 1.17 0.97 1.23 1.14 1.13 0.91 0.38 0.30
BLKMOV_DINT 3.02 2.36 1.30 1.01 1.35 1.10 1.19 0.90 0.40 0.30
BLKMOV_INT 2.71 2.26 1.16 0.97 1.21 1.13 1.11 0.88 0.37 0.30
BLKMOV_DWORD 2.97 2.31 1.28 0.99 1.33 1.08 1.19 0.87 0.40 0.29
BLKMOV_REAL 3.01 2.34 1.29 1.00 1.35 1.10 1.18 0.89 0.39 0.29
BLKMOV_UINT 2.71 2.21 1.17 0.96 1.23 1.15 1.12 0.87 0.37 0.29
DATA_INIT_ASCII 0.91 1.39 0.40 0.60 0.76 0.77 0.30 0.44 0.10 0.15
DATA_INIT_COMM 1.05 1.36 0.46 0.60 0.84 0.78 0.37 0.43 0.11 0.15
DATA_INIT_DLAN 1.33 1.49 0.58 0.64 0.94 0.83 0.39 0.45 0.14 0.15
DATA_INIT_DINT 0.92 1.37 0.40 0.59 0.78 0.79 0.30 0.45 0.10 0.15
DATA_INIT_DWORD 0.98 1.39 0.41 0.60 0.79 0.81 0.32 0.45 0.11 0.15

CPE030 CPE040
CRE03045 CRE04045
Disabled
Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
DATA_INIT_INT 0.95 1.41 0.42 0.61 0.81 0.81 0.31 0.46 0.10 0.15
DATA_INIT_REAL 0.90 1.36 0.40 0.59 0.77 0.78 0.30 0.44 0.18 0.22
DATA_INIT_LREAL 0.98 1.33 0.42 0.57 0.79 0.78 0.36 0.48 0.11 0.16
DATA_INIT_WORD 0.90 1.41 0.40 0.61 0.78 0.79 0.30 0.44 0.10 0.15
DATA_INIT_UINT 0.90 1.37 0.39 0.59 0.78 0.79 0.31 0.46 0.10 0.15
SWAP_WORD 2.83 1.41 1.18 0.57 1.34 0.74 0.96 0.42 0.32 0.13
SWAP_DWORD 2.59 1.43 1.08 0.58 1.29 0.73 0.93 0.42 0.31 0.14
SHFR_BIT 6.35 2.94 2.74 1.27 2.92 1.22 2.37 1.08 0.79 0.36
SHFR_WORD 7.08 4.90 3.04 2.11 3.25 2.16 3.27 2.46 1.09 0.82
SHFR_DWORD 7.62 5.03 3.27 2.1 3.39 2.24 3.29 2.43 1.10 0.81
Data Table
SORT_INT 36.57 1.40 15.66 0.60 15.94 0.75 16.50 0.44 5.50 0.15
SORT_UINT 36.48 1.40 15.66 0.60 15.90 0.75 16.50 0.44 5.49 0.15
SORT_WORD 36.51 1.39 15.61 0.60 15.90 0.76 16.46 0.44 5.49 0.15
TBLRD_INT 4.14 1.75 1.79 0.77 2.03 0.97 1.52 0.73 0.49 0.25
TBLRD_DINT 4.19 1.77 1.79 0.76 2.02 0.97 1.47 0.69 0.48 0.22
TBLWRT_INT 4.06 1.74 1.73 0.74 1.72 0.84 1.59 0.74 0.53 0.25
TBLWRT_DINT 4.00 1.70 1.72 0.72 1.70 0.84 1.60 0.72 0.53 0.23
FIFORD_INT 3.92 1.69 1.68 0.71 1.67 0.72 1.58 0.66 0.53 0.22
FIFORD_DINT 3.89 1.71 1.65 0.73 1.65 0.68 1.56 0.66 0.52 0.22
FIFOWRT_INT 3.17 1.46 1.35 0.64 1.41 0.75 1.23 0.49 0.42 0.18
FIFOWRT_DINT 3.10 1.43 1.33 0.62 1.39 0.72 1.25 0.51 0.42 0.17
LIFORD_INT 3.77 1.73 1.60 0.72 1.62 0.72 1.49 0.66 0.50 0.22
LIFORD_DINT 3.77 1.74 1.60 0.72 1.63 0.72 1.48 0.66 0.49 0.22
LIFOWRT_INT 3.18 1.49 1.35 0.63 1.43 0.72 1.25 0.51 0.42 0.17
LIFOWRT_DINT 3.08 1.42 1.33 0.61 1.41 0.72 1.33 0.68 0.42 0.18
LIFOWRT_DWORD 3.15 1.47 1.35 0.63 1.43 0.72 1.25 0.53 0.41 0.18
Array
ARRAY_MOVE_BIT 4.10 2.16 1.76 0.92 1.94 1.06 1.57 0.75 0.52 0.25
ARRAY_MOVE_BYTE 3.12 1.97 1.34 0.84 1.45 0.95 1.25 0.82 0.42 0.27
ARRAY_MOVE_WORD 3.19 2.10 1.37 0.91 1.45 1.05 1.26 0.81 0.42 0.27
ARRAY_MOVE_DINT 3.10 2.04 1.33 0.85 1.41 0.97 1.24 0.81 0.41 0.2
ARRAY_MOVE_DWORD 3.07 1.97 1.32 0.84 1.42 0.95 1.24 0.81 0.42 0.27
ARRAY_MOVE_INT 3.23 2.12 1.39 0.92 1.47 1.03 1.26 0.79 0.42 0.26
ARRAY_MOVE_UINT 3.10 1.96 1.33 0.84 1.53 1.07 1.37 1.14 0.42 0.28
SRCH_BYTE 4.07 1.86 1.74 0.79 2.11 0.91 1.74 0.87 0.58 0.29
SRCH_WORD 3.90 1.86 1.70 0.82 1.83 0.91 1.90 0.83 0.63 0.27
SRCH_DWORD 4.57 1.91 1.96 0.82 1.92 0.96 1.78 0.78 0.59 0.25
ARRAY_RANGE_WORD 4.14 1.89 1.80 0.81 1.90 0.96 1.70 0.69 0.57 0.23
ARRAY_RANGE_DWORD 4.61 1.88 1.99 0.80 2.06 0.97 1.70 0.65 0.57 0.22
ARRAY_RANGE_DINT 4.39 1.89 1.88 0.81 1.97 0.99 1.81 0.69 0.61 0.23

CPE030 CPE040
CRE03045 CRE04045
Disabled
Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
ARRAY_RANGE_INT 4.22 1.84 1.81 0.79 1.92 0.96 1.84 0.68 0.61 0.23
ARRAY_RANGE_UINT 4.44 1.82 1.76 0.78 1.91 0.96 1.68 0.66 0.56 0.22
Math
ADD_INT 2.11 1.31 0.91 0.58 0.87 0.66 1.00 0.49 0.33 0.16
ADD_DINT 2.56 1.34 1.12 0.58 0.97 0.67 0.90 0.46 0.30 0.15
ADD_REAL 2.75 1.32 1.19 0.56 0.96 0.66 0.92 0.50 0.30 0.17
ADD_LREAL 2.82 1.30 1.21 0.54 1.09 0.62 1.28 0.53 0.43 0.18
ADD_UINT 2.23 1.42 0.93 0.57 0.96 0.68 0.90 0.51 0.29 0.16
SUB_INT 2.13 1.35 0.91 0.55 0.87 0.65 0.87 0.49 0.29 0.16
SUB_DINT 2.50 1.35 1.09 0.56 0.94 0.65 0.90 0.49 0.30 0.16
SUB_REAL 2.46 1.29 1.13 0.63 1.08 0.85 1.08 0.69 0.30 0.17
SUB_LREAL 1.26 1.26 1.26 0.54 1.10 0.63 1.37 0.53 0.47 0.17
MUL_INT 2.25 1.42 0.93 0.57 0.90 0.65 0.89 0.49 0.30 0.16
MUL_DINT 2.53 1.34 1.10 0.59 0.95 0.69 1.05 0.49 0.35 0.17
MUL_MIXED 2.36 1.31 1.00 0.58 0.89 0.66 0.90 0.51 0.30 0.16
MUL_REAL 2.57 1.39 1.08 0.56 0.93 0.65 0.88 0.48 0.29 0.17
MUL_LREAL 2.87 1.21 1.24 0.52 1.19 0.61 1.28 0.54 044 0.18
MUL_UINT 2.14 1.35 0.92 0.55 0.90 0.65 0.87 0.49 0.29 0.16
DIV_INT 2.25 1.29 0.99 0.58 0.98 0.68 0.90 0.48 0.30 0.16
DIV_DINT 2.71 1.35 1.16 0.60 0.99 0.73 0.93 0.48 0.30 0.16
DIV_REAL 2.70 1.43 1.11 0.56 0.96 0.68 1.07 0.49 0.36 0.16
DIV_LREAL 2.86 1.20 1.23 0.52 1.14 0.61 1.33 0.53 0.45 0.18
DIV_MIXED 2.70 1.35 1.15 0.56 1.11 0.65 0.97 0.49 0.33 0.16
MOD_INT 2.23 1.38 0.95 0.57 0.93 0.66 0.91 0.48 0.30 0.16
MOD_DINT 2.65 1.35 1.12 0.56 1.09 0.79 1.09 0.69 0.30 0.17
MOD_UINT 2.19 1.29 1.01 0.63 0.99 0.74 0.99 0.50 0.33 0.17
ABS_INT 2.01 1.21 0.99 0.63 0.93 0.60 0.84 0.38 0.29 0.13
ABS_DINT 2.44 1.17 1.05 0.50 0.96 0.60 0.84 0.37 0.28 0.12
ABS_REAL 2.45 1.14 1.05 0.49 0.87 0.59 0.90 0.35 0.30 0.12
ABS_LREAL 2.58 1.07 1.11 0.46 0.97 0.53 0.98 0.35 0.33 0.11
SCALE_INT 3.54 1.84 1.57 0.83 1.82 0.91 1.23 0.54 0.48 0.24
SCALE_DINT 2.98 1.79 1.37 0.89 1.61 1.03 1.00 0.51 0.41 0.24
SCALE_UINT 2.89 1.78 1.27 0.81 1.39 0.98 0.98 0.5 0.40 0.25
SQRT_INT 2.39 1.13 1.05 0.50 1.08 0.57 0.99 0.35 0.32 0.12
SQRT_DINT 3.37 1.18 1.44 0.51 1.28 0.58 1.08 0.35 0.36 0.12
SQRT_REAL 2.54 1.23 1.09 0.54 0.91 0.61 0.85 0.37 0.29 0.13
SQRT_LREAL 2.36 1.09 1.00 0.46 0.92 0.53 0.99 0.32 0.34 0.12

CPE030 CPE040
CRE03045 CRE04045
Disabled
Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
Trigonometric
SIN_REAL 3.02 1.11 1.26 0.48 0.97 0.57 0.95 0.35 0.32 0.12
SIN_LREAL 3.05 1.10 1.31 0.48 1.13 0.55 1.16 0.35 0.39 0.11
COS_REAL 2.96 1.11 1.22 0.48 0.97 0.57 1.06 0.35 0.36 0.12
COS_LREAL 2.88 1.09 1.18 0.47 1.10 0.56 1.17 0.35 0.39 0.11
TAN_REAL 3.02 1.11 1.26 0.48 1.02 0.57 0.96 0.35 0.32 0.12
TAN_LREAL 2.89 1.09 1.23 0.476 1.14 0.56 1.32 0.36 0.44 0.11
ASIN_REAL 3.29 1.20 1.41 0.52 1.26 0.63 1.13 0.35 0.38 0.12
ASIN_LREAL 3.14 10.5 1.32 0.45 1.33 0.54 1.37 0.35 0.46 0.12
ACOS_REAL 3.29 1.20 1.41 0.52 1.26 0.63 1.13 0.35 0.38 0.12
ACOS_LREAL 3.10 1.04 1.32 0.45 1.28 0.53 1.36 0.54 0.47 0.12
ATAN_REAL 3.26 1.25 1.37 0.54 1.02 0.65 1.05 0.37 0.35 0.12
ATAN_LREAL 2.87 1.04 1.20 0.46 1.08 0.53 1.18 0.35 0.40 0.12
Logarithmic
LOG_REAL 2.90 1.16 1.25 0.50 1.03 0.59 1.04 0.35 0.35 0.12
LOG_LREAL 2.88 1.03 1.21 0.43 1.11 0.52 1.19 0.38 0.39 0.12
LN_REAL 2.84 1.13 1.22 0.50 1.01 0.58 1.06 0.37 0.35 0.12
LN_LREAL 2.83 1.07 1.22 0.46 1.16 0.53 1.19 0.34 0.40 0.11
EXPT_REAL 4.13 1.41 1.77 0.63 1.52 0.72 1.39 0.40 0.46 0.13
EXPT_LREAL 3.03 1.33 1.30 0.57 1.35 0.71 1.24 0.42 0.42 0.14
EXP_REAL 2.70 1.16 1.16 0.50 0.97 0.59 1.00 0.37 0.33 0.12
EXP_LREAL 2.71 1.04 1.16 0.45 1.08 0.54 1.25 0.34 0.42 0.12
PID
PIDISA 6.92 6.18 2.98 2.66 3.17 2.79 2.66 2.44 0.89 0.81
PIDIND 6.86 6.13 2.97 2.66 3.17 2.79 2.65 2.43 0.88 0.81
Range
RANGE_INT 3.27 1.89 1.40 0.81 1.35 0.91 1.40 0.87 0.53 0.35
RANGE_DINT 3.26 1.94 1.40 0.83 1.36 0.92 1.41 0.81 0.47 0.27
RANGE_DWORD 3.40 2.02 0.87 0.87 1.46 1.01 1.42 0.82 0.47 0.27
Timers
ONDTR 4.79 3.70 2.01 1.54 2.11 1.57 1.82 1.38 0.61 0.46
OFDT 4.57 4.08 1.92 1.71 1.97 1.76 1.71 1.45 0.57 0.49
TMR 4.52 4.04 1.92 1.71 2.05 1.79 1.71 1.45 0.58 0.49
TOF 9.6 4.9 4.1 2.1 NA NA 3.9 2.0 1.3 0.6
TON 9.5 4.8 4.0 2.0 NA NA 3.9 2.0 1.3 0.6
TP 9.8 4.8 4.2 2.1 NA NA 3.9 2.0 1.3 0.6
Counters
UPCTR 4.13 4.17 1.74 1.76 1.85 1.86 1.59 1.53 0.53 0.51
DNCTR 4.16 4.18 1.73 1.75 1.84 1.86 1.54 1.53 0.52 0.51

CPE030 CPE040
CRE03045 CRE04045
Disabled
Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
Control
JUMPN 0.21 0.26 0.06 0.06 0.12 0.09 0.12 0.08 0.04 0.03
FOR/NEXT 1.51 0.72 0.64 0.31 0.90 0.47 0.56 0.26 0.19 0.09
MCRN/ENDMCRN Combined 0.68 0.68 0.28 0.29 0.28 0.28 0.10 0.10 0.03 0.03
SWITCH_POS 1.91 1.02 0.82 0.44 0.87 0.59 0.60 0.13 0.26 0.12
DOIO 32.78 1.45 17.60 0.63 6.50 0.76 14.94 0.23 9.374 0.15
DOIO with ALT 32.56 1.48 17.47 0.63 6.47 0.75 14.91 0.32 9.36 0.18
DRUM_SEQ 6.98 5.70 2.99 2.45 3.21 2.67 2.63 2.21 0.88 0.74
SCAN_SET_IO 55.21 1.92 32.65 0.83 33.69 0.86 30.40 0.76 22.84 0.25
SUSIO 2.14 0.45 0.92 0.20 1.12 0.35 0.68 0.06 0.30 0.05
COMMREQ 117.27 1.60 73.25 0.73 73.30 0.90 73.42 0.59 65.23 0.22
CALL/RETURN (LD) 7.27 0.51 3.11 0.23 3.58 0.42 2.79 0.06 0.99 0.05
CALL/RETURN 7.84 0.56 2.07 0.23 2.33 0.42 1.94 0.05 0.72 0.06
(Parameterized Block)
CALL/RETURN (C Block) 7.24 0.55 3.05 0.25 3.29 0.45 2.91 0.06 1.04 0.04
Bus46
BUS_RD_BYTE 21.30 2.42 10.87 1.04 1.94 1.18 8.56 1.00 5.24 0.33
BUS_RD_DWORD 21.96 2.51 11.16 1.09 2.13 1.25 8.14 1.00 5.17 0.33
BUS_RD_WORD 21.44 2.54 10.98 1.10 2.11 1.29 8.14 1.01 5.17 0.33
BUS_WRT_BYTE 23.76 2.72 11.62 1.17 3.10 1.26 9.46 0.96 5.76 0.32
BUS_WRT_DWORD 23.52 2.56 11.53 1.10 3.11 1.30 9.48 0.95 5.77 0.32
BUS_WRT_WORD 23.51 2.55 11.54 1.10 3.09 1.28 9.46 0.95 5.76 0.32
BUS_RMW_BYTE 24.44 2.78 12.97 1.19 2.41 1.37 10.28 1.12 6.58 0.37
BUS_RMW_DWORD 24.73 2.82 12.80 1.21 2.23 1.35 10.06 1.13 6.48 0.38
BUS_RMW_WORD 24.00 2.77 12.54 1.19 2.41 1.38 10.25 1.12 6.54 0.38
BUS_TS_BYTE 23.23 2.36 12.23 1.01 2.19 1.28 9.93 0.87 6.45 0.29
BUS_TS_WORD 22.98 2.31 12.14 0.99 2.06 1.15 9.96 0.91 6.5 0.28

CPE030 CPE040
CRE03045 CRE04045
Disabled
Disabled
Disabled
Disabled
Disabled
Enabled
Enabled
Enabled
Enabled
Enabled
Instruction
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
(μs)
SVC_REQ
#1 6.40 1.20 2.75 0.52 2.78 0.79 2.10 0.1 0.77 0.10
#2 6.45 1.04 2.76 0.45 2.74 0.67 2.67 0.35 0.89 0.12
#3 4.94 1.15 2.10 0.49 2.45 0.74 1.39 0.09 0.53 0.10
#4 4.93 1.12 2.09 0.47 2.49 0.74 1.42 0.08 0.54 0.10
#5 4.99 1.19 2.12 0.50 2.49 0.77 1.44 0.10 0.55 0.10
#6 4.62 1.12 1.96 0.47 1.97 0.74 1.46 0.13 0.55 0.11
#7 8.81 1.17 3.67 0.51 3.72 0.78 3.30 0.34 1.05 0.10
#8 7.08 1.07 3.82 0.46 4.00 0.66 3.92 0.34 2.53 0.12
#9 4.12 1.06 1.76 0.46 1.95 0.66 1.83 0.32 0.60 0.11
#10 6.81 1.10 3.02 0.45 3.04 0.67 2.71 0.35 0.91 0.12
#11 4.26 1.12 1.84 0.48 1.90 0.68 1.82 0.34 0.61 0.11
#12 2.25 1.01 0.97 0.44 1.12 0.66 1.02 0.33 0.34 0.11
#13 4.55 1.24 1.96 0.51 2.78 0.75 1.32 0.08 0.51 0.09
#14 424.95 1.16 188.07 0.48 203.10 0.76 197.46 0.09 71.70 0.10
#15 3.18 1.14 1.38 0.49 1.25 0.51 0.94 0.49 0.31 0.16
#16 4.57 1.20 1.94 0.52 2.06 0.70 1.71 0.35 0.57 0.12
#17 2.94 1.13 1.24 0.49 NA NA 1.27 0.32 035 0.04
#18 112.36 1.18 48.09 0.51 48.20 0.69 69.36 0.33 23.12 0.11
#19 4.61 1.19 1.97 0.51 2.71 0.66 1.51 0.33 0.50 0.11
#20 18.92 1.19 8.09 0.51 7.58 0.65 7.69 0.33 2.56 0.11
#21 36.19 1.23 18.15 0.52 17.77 0.66 13.29 0.32 7.15 0.18
#22 2.86 1.23 1.23 0.53 1.28 0.63 1.19 0.36 0.39 0.12
#23 119.63 1.19 51.22 0.52 54.68 0.65 54.33 0.33 18.01 0.11
#24 150.79 1.17 77.38 0.51 1.26 0.65 58.55 0.32 34.67 0.11
#25 3.03 1.21 1.30 0.52 1.25 0.66 1.30 0.35 0.43 0.121
#26 NA NA NA NA 3.20 2.85 NA NA NA NA
2.65 2.13 0.88 0.71
2.90 2.16 0.97 0.72
3.30 2.17 1.18 0.73
#32 54.47 1.21 48.97 0.50 NA NA 47.36 0.30 45.12 0.12
NA NA NA NA
2.93 2.11 0.98 0.70
#50 4.48 1.18 1.90 0.51 1.92 0.63 1.76 0.33 0.59 0.11
#51 4.60 1.13 1.98 0.49 1.9 0.64 2.27 0.80 0.59 0.10
#56 82.65 1.23 42.66 0.52 44.03 0.78 29.75 0.32 10.26 0.11
#57 19331.60 1.21 19017.30 0.52 18848.20 0.78 13585 0.32 13540 0.11

RX7i Incremental Times

An Increment time is shown for functions that can have variable length inputs.
Incremental time is added to the base function time for each addition to the length of an input
parameter. This time applies only to functions that can have varying input lengths (Search, Array
Moves, etc.)
Units:
 For table functions, increment is in units of length specified.
 For bit operation functions, increment is microseconds per bit.
 For data move functions, microseconds per unit.
CPE030/ CPE040/
Instruction CPE010 CPE020 CRE020
CRE030 CRE040
Bit Operation
AND_WORD 0.11572 0.04957 0.05006 0.04553 0.01517
AND_DWORD 0.15567 0.5996 0.6002 0.5095 0.1766
OR_WORD 0.11857 0.05078 0.05039 0.04842 0.01543
OR_DWORD 0.15729 0.06743 0.067 0.05626 0.01859
XOR_WORD 0.1156 0.04983 0.05022 0.04613 0.01532
XOR_DWORD 0.15568 0.06691 0.06669 0.05623 0.0187
NOT_WORD 0.07498 0.03249 0.03248 0.03343 0.01117
NOT_DWORD 0.11946 0.0513 0.05011 0.04666 0.01556
MCMP_WORD 0.26347 0.11279 0.11288 0.0969 0.03228
MCMP_DWORD 0.28671 0.12257 0.1226 0.10587 0.03523
SHL_WORD 0.17382 0.07444 0.0745 0.07786 0.02594
SHL_DWORD 0.18306 0.07839 0.07842 0.07287 0.02428
SHR_WORD 0.18397 0.07872 0.0785 0.08088 0.02686
SHR_DWORD 0.18868 0.08229 0.08062 0.07612 0.02537
BTST_WORD 0.00014 -6E-05 -3E-05 0.00026 0.0001
BTST_DWORD 0.00098 3.3E-05 0.00042 0.00071 0.00024
ROL_WORD 0.1944 0.08303 0.08316 0.08447 0.02821
ROL_DWORD 0.16617 0.07114 0.0714 0.06493 0.02161
ROR_WORD 0.15893 0.06819 0.06809 0.0715 0.02382
ROR_DWORD 0.16617 0.0737 0.07399 0.06634 0.0221
BPOS_WORD 0.76048 0.32549 0.32584 0.28894 0.09634
BPOS_DWORD 1.68499 0.72159 0.7231 0.6378 0.21258
Relational
EQ_DATA 0.00029 0.00004 0.00021 0.00051 2.6E-05
Conversion
REAL_TO_UINT 0 0 0 0 0
REAL_TO_DINT 0 0 0 0 0

CPE030/ CPE040/
CRE030 CRE040
Data Move
MOVE_BIT 0.01958 0.00821 0.00813 0.00919 0.00307
MOVE_DINT 0.04398 0.01884 0.01943 0.0157 0.00533
MOVE_INT 0.02002 0.00833 0.00863 0.00694 0.00231
MOVE_DWORD 0.04447 0.01904 0.0193 0.01584 0.00528
MOVE_LREAL 0.08989 0.03854 0.03878 0.03242 0.01083
MOVE_UINT 0.02 0.01 0.02 0.03 0.01
MOVE_WORD 0.02046 0.00876 0.00839 0.00704 0.00234
MOVE_REAL 0.04464 0.01914 0.01946 0.01572 0.00523
MOVE_DATA 0.00021 0.00015 0.00015 -0.0002 7.2E-05
MOVE_DATA_EX 0.0011 6.9E-05 6.9E-05 3.2E-05 2.1E-05
DATA_INIT_ASCII 0.01057 0.00459 0.00844 0.00686 0.00101
DATA_INIT_COMM 0.01982 0.00851 0.01724 0.01381 0.00229
DATA_INIT_DLAN 0 0 0 0 0
DATA_INIT_DINT 0.04034 0.01713 0.00878 0.00754 0.00464
DATA_INIT_DWORD 0.04032 0.01728 0.0084 0.00649 0.00461
DATA_INIT_INT 0.01952 0.00837 0.01714 0.01392 0.00253
DATA_INIT_REAL 0.03997 0.01711 0 0 0.00453
DATA_INIT_LREAL 0.08051 0.03457 0.03434 0.02621 0.00902
DATA_INIT_WORD 0.02071 0.00888 0.01718 0.01343 0.0025
DATA_INIT_UINT 0.01971 0.00844 0.00849 0.00732 0.00226
SWAP_WORD 0.18858 0.08076 0.08082 0.07672 0.02551
SWAP_DWORD 0.15904 0.06834 0.06833 0.0613 0.0204
BLKCLR 0.02528 0.01094 0.01097 0.0101 0.00334
SHFR_BIT 0.04324 0.01827 0.01867 0.02013 0.00666
SHFR_WORD 0.16054 0.06598 0.06848 0.07023 0.0251
SHFR_DWORD 0.19577 0.08384 0.08263 0.08009 0.02663
Data Table
SORT_INT 0.74431 0.31843 0.31607 0.37118 0.12369
SORT_UINT 0.74589 0.31942 0.317 0.3717 0.12383
SORT_WORD 0.74476 0.31838 0.31632 0.37082 0.12369
TBLRD_INT 0.00096 -0.0001 -9E-05 -0.0005 -0.0002
TBLRD_DINT -0.0002 -0.0001 0.00016 -0.0001 -9E-05
TBLWRT_INT 0.00048 0.00018 0.00023 1.1E-05 -4E-05
TBLWRT_DINT -0.0009 -0.0004 -0.0003 -0.0002 -6E-05
FIFORD_INT 0.1939 0.00816 0.00866 0.00698 0.00234
FIFORD_DINT 0.04449 0.01866 0.0188 0.01529 0.00511
FIFOWRT_INT 0.00058 0.00047 0.00046 -3E-05 -1E-05
FIFOWRT_DINT -0.0007 -0.0003 -0.0004 0 -1E-05
LIFORD_INT 0.00022 0.00031 0.00042 -7E-05 1.1E-05
LIFORD_DINT 0.00087 0.00037 0.00044 0.00027 8.9E-05
LIFOWRT_INT 0.00037 0.00041 0.00042 0.00011 6.7E-05
LIFOWRT_DINT -0.0006 -0.0003 -0.0003 0.00019 0
LIFOWRT_DWORD 0.00101 0.00029 0.00028 -0.0002 -7E-05

CPE030/ CPE040/
CRE030 CRE040
Array
ARRAY_MOVE_BIT 0.01967 0.00841 0.00863 0.00914 0.00304
ARRAY_MOVE_BYTE 0.00957 0.00387 0.00379 0.00358 0.00119
ARRAY_MOVE_INT 0.02002 0.00857 0.00857 0.0067 0.00223
ARRAY_MOVE_DINT 0.04762 0.02019 0.02021 0.0164 0.00547
ARRAY_MOVE_WORD 0.02063 0.00883 0.00878 0.00643 0.00211
ARRAY_MOVE_DWORD 0.04489 0.01922 0.01913 0.01529 0.00511
ARRAY_MOVE_UINT 0.02014 0.00863 0.00922 0.00687 0.00231
SRCH_BYTE 0.07277 0.03143 0.03112 0.03001 0.0101
SRCH_WORD 0.07492 0.03186 0.03177 0.02826 0.0094
SRCH_DWORD 0.06664 0.02854 0.02841 0.02641 0.00882
ARRAY_RANGE_DINT 0.5422 0.232 0.23221 0.23434 0.07808
ARRAY_RANGE_INT 0.51968 0.22242 0.22204 0.22419 0.07467
ARRAY_RANGE_UINT 0.51902 0.22204 0.22200 0.22429 0.07492
ARRAY_RANGE_WORD 0.52001 0.22294 0.22249 0.2255 0.07511
ARRAY_RANGE_DWORD 0.55802 0.23898 0.23903 0.23764 0.07917
A-3 Overhead Sweep Impact Times

This section contains overhead timing information for the PACSystems CPUs. This information can be
used in conjunction with the estimated logic execution time to predict sweep times for the CPUs. The
information in this section is made up of a base sweep time plus sweep impact times for each of the
CPU models. The predicted sweep time is computed by adding the sweep impact time(s), the base
sweep, and the estimated logic execution time.
A sample calculation for estimating sweep times is provided on page 674.
The following components make up the total sweep time:
 Programmer communications sweep impact
 I/O Scan and fault sweep impact
 Ethernet Global Data sweep impact
 Intelligent Option Module (LAN modules) sweep impact
 I/O interrupt performance and sweep impact
 Timed interrupt performance and sweep impact

A-3.1 Base Sweep Times

Base sweep time is the time for an empty _MAIN program block to execute, with no configuration
stored and none of the windows active. The following table gives the base sweep times in
microseconds for each CPU model.
Family Model Run I/O enabled (µs) Run outputs disabled (µs)
CPU310 49 1086 1076
CPU315
180 176
CPU32049
RX3i
CRU32049 198 194
CPE305
426 424
CPE310
CPE010 457 449
CPE020
182 180
CRE020
RX7i 50
CPE030
169 165
CRE030
CPE040
77.4 74.8
CRE040
49 Base sweep time calculated with RUN/STOP switch, single ETM.

50 Base sweep time with I/O enabled includes time to scan the status bits for the Ethernet daughterboard.

The following diagram shows the differences between the full sweep phases and the base sweep
phases.
Base Sweep vs. Full Sweep Phases
Base Sweep Full Sweep
<START OF SWEEP> <START OF SWEEP>
Sweep Housekeeping Sweep Housekeeping
 
NULL Input Scan 51 Input Scan 51
 
Program Logic Execution EGD Consumption Scan 52
 
NULL Output Scan 51 Program Logic Execution
 
 Output Scan 51
 
 EGD Production Scans 52
 
 Poll for Missing I/O Modules 53
 
 Controller Communications Window
 
 Backplane Communications Window
<END OF SWEEP> <END OF SWEEP>
For the base sweep, if there is no configuration, the input and output scan phases of the sweep are
NULL (i.e., check for configuration and then end). The presence of a configuration with no I/O modules
or intelligent I/O modules (GBC) has the same effect. The logic execution time is not zero in the base
sweep. The time to execute the empty _MAIN program is included so that you only need to add the
estimated execution times of the functions actually programmed. The base sweep also assumes no
missing I/O modules. The lack of programmer attachment means that the Controller
Communications Window is never opened. The lack of intelligent option modules means that the
Backplane Communications Window is never opened.
51 If I/O is suspended, the input and output scans are skipped.

52 If no Ethernet Global Data (EGD) exchanges are configured, the consumption and production scans are
skipped.
53 Polling for missing I/O modules only occurs if a “Loss of ...” fault has been logged for an I/O module.

A-3.2 What the Sweep Impact Tables Contain

In some tables, functions are shown as asynchronously impacting the sweep. This means that there
is not a set phase of the sweep in which the function takes place. For instance, the scanning of all I/O
modules takes place during either the input or output scan phase of the CPU’s sweep. However, I/O
interrupts are totally asynchronous to the sweep and will interrupt any function currently in progress.
The communication functions (with the exception of the high priority programmer requests) are all
processed within one of the two windows in the sweep (the Controller Communications Window and
the Backplane Communications Window). Sweep impact times for the various service requests are all
minimum sweep impact times for the defined functions, where the window times have been adjusted
so that no time slicing (limiting) of the window occurs in a given sweep. This means that, as much as
possible, each function is completed in one occurrence of the window (between consecutive logic
scans). The sweep impact of these functions can be spread out over multiple sweeps (limited) by
adjusting the window times to a value lower than the documented sweep impact time. For the
programmer, the default time is 10 milliseconds; therefore, some of the functions listed in that
section will naturally time slice over successive sweeps.

A-3.3 Programmer Sweep Impact Times

The following table shows nominal programmer sweep impact times in microseconds.
RX3i RX7i
Sweep CPU315
Description CPE020 CPE030 CPE040
Impact Item CPU310 CPU320 CPE010
CRE020 CRE030 CRE0400
(µs) CRU320 (µs)
(µs) (µs) (µs)
(µs)
The time required to open the
Programmer Window but not process
Programmer any requests. The programmer is
2.9 0.2 1.95 0.21 0.2 0.2
window attached through an Ethernet
connection; no reference values are
being monitored.
The sweep impact to refresh the
reference table screen. (The %R table
was used as the example.) Mixed table
Reference display impacts are slightly larger. The
4.9 0.29 1.2 0.33 0.26 0.29
table monitor sweep impact may not be continuous,
depending on the sweep time of the
CPU and the speed of the host of the
The sweep impact to refresh the editor
screen when monitoring ladder logic.
The times given in the table are for a
Editor
logic screen containing one contact, 4.1 0.31 1.41 0.35 0.31 0.31
monitor
two coils, and eleven registers. As with
the reference table sweep impact, the
impact may not be continuous.

A-3.4 I/O Scan and I/O Fault Sweep Impact

The I/O scan sweep impact has two parts, Local I/O and Genius I/O. The equation for computing I/O
scan sweep impact is:
I/O Scan Sweep Impact = Local Scan Impact + Genius I/O Scan
Sweep Impact of Local I/O Modules

The I/O scan of I/O modules is impacted as much by location and reference address of a module as it
is by the number of modules. The I/O scan has several basic parts.
I/O Scan Description
Rack Setup Time Each expansion rack is selected separately because of the addressing of
expansion racks on the VME bus. This results in a fixed overhead per
expansion rack, regardless of the number of modules in that rack.
Per Module Setup Time Each Local I/O module has a fixed setup scan time.
Byte Transfer Time The actual transfer of bytes is much faster for modules located in the main
rack than for those in expansion racks. The byte transfer time differences
will be accounted for by using different times for I/O modules in the main
rack versus expansion racks.
In addition, analog input expander modules (the same as Genius blocks) have the ability to be
grouped into a single transfer as long as consecutive reference addresses are used for modules that
have consecutive slot addresses. Each sequence of consecutively addressed modules is called a
scan segment. There is a time penalty for each additional scan segment.
RX7i I/O Module Types
Type Part Numbers
Discrete Input Type I IC697MDL240, IC697MDL241, IC697MDL251, IC697MDL640,
(16 point, 14 point) IC697MDL671
Discrete Input Type II IC697MDL250, IC697MDL252, IC697MDL253, IC697MDL254,
(32 point) IC697MDL651, IC697MDL652, IC697MDL653, IC697MDL650,
IC697MDL654
Discrete Output Type I IC697MDL340, IC697MDL341, IC697MDL740, IC697MDL940
(16 point, 12 point)
Discrete Output Type II IC697MDL350, IC697MDL750, IC697MDL752, IC697MDL753
(32 point)
Analog Input Type I IC697ALG230
(8 Channel)
Analog Input Type II IC697ALG440, IC697ALG441
(16 Channel with 8 channel AI
module)
Analog Output IC697ALG320
(4 channel)

RX7i Module Sweep Impact Times (microseconds)

The following table provides sweep impact times for modules in the Main rack and in an expansion
(Exp) rack. The base case provides the overhead a single module in the rack. The increment (Inc)
refers to the overhead for each similar module that is added to the same rack.
Model CPE010 CPE020/CRE020 CPE030/CRE030 CPE040/CRE040
Rack Main Exp Main Exp Main Exp Main Exp
Impact Base Inc Base Inc Base Inc Base Inc Base Inc Base Inc Base Inc Base Inc
Discrete In.
35.8 9.3 29.6 30.2 9.5 6.3 10.2 13.8 10.2 10.6 14.4 16.5 5.1 4.1 6.0 9.8
Type - I
Discrete In.
35.1 13.4 34.3 31.9 12.1 6.6 14.5 10.9 10.5 6.4 14.4 16.5 5.7 4.6 9.9 13.7
Type - II
Discrete Out.
38.9 14.8 33.1 33.0 12.9 6.2 11.7 14.4 11.5 6.4 10.8 12.9 6.0 4.5 6.3 10.0
Type - I
Discrete Out.
40.2 15.8 36.9 37.2 13.6 7.3 16.2 18.1 11.7 6.9 14.5 17.2 7.0 5.7 10.4 13.9
Type - II
Per fault
106.254 — 111.01 — 44.608 — 45.716 — — — — — — — — —
message
Analog In.
49.5 26.3 71.6 54.7 19.2 11.7 40.3 35.3 16.3 11.9 38 34 9.9 8.7 31.3 30.6
Type 1
Analog Exp –
80.1 15.2 133.9 58.6 33.5 12.6 96.8 56.4 30.1 13.7 94.9 57 22.4 12.6 87.0 55.4
Type 2
Analog Out. 49.9 25.1 63.2 39.6 16.6 11.2 29.3 24.7 15.2 10.2 27 22.3 8.4 7.1 20.1 19.2
Per fault
86.207 — 86.7 — 40.135 60.762 — — — — — — — — —
message
Analog In.
74.0 54.3 N/A N/A 44.9 38.2 N/A N/A 42.8 38.1 N/A N/A 35.8 32.2 N/A N/A
VAL132
Analog In.
VME-3125A
Analog In.
VAL264
Analog In.
VME-3122A
Analog In.
VRD008
Analog Out.
VAL301
Discrete In.
VDD100
Discrete In.
50.5 29.2 NA NA 24.5 18.1 N/A N/A 22.5 18.7 N/A N/A 14.7 14.7 N/A N/A
VME-1182A
Discrete Out.
VDQ120
Discrete Out.
VDR151

RX3i I/O Module Types

Type Part Numbers
Discrete Input, 16 point IC694MDL240, IC694MDL241, IC694MDL645, IC694MDL646
Discrete Input - Smart Digital Input,
IC695MDL664
16 point
Discrete Input, 32 point IC694MDL654, IC694MDL655, IC694MDL654
Discrete Output, 8 point IC694MDL330, IC694MDL732, IC694MDL930, IC694MDL940
Discrete Output, 16 point and 12 point IC694MDL340, IC694MDL341, IC694MDL740, IC694MDL741
Discrete Output – Smart Digital
IC695MDL765
Output. 16 point
IC694MDL350, IC694MDL340, IC694MDL742, IC694MDL752,
Discrete Output, 32 point
IC694MDL753, IC694MDL940
Discrete Output, 32 point IC694MDL758
Discrete In/Out, 8 point IC693MDR390, IC693MAR590
Analog Input, 4 Channel IC695ALG220, IC694ALG221
Analog Input, 6 Channel IC695ALG106
Analog Input, 12 channel IC695ALG112
Analog Input, 16 Channel IC694ALG222, IC694ALG223
Analog Output, 2 channel IC694ALG390, IC694ALG391
Analog Mixed Input/Output IC694LG442
Analog Input with Diagnostics IC694ALG232, IC694ALG233
Analog Mixed Input/Output with
IC694ALG542
Diagnostics

RX3i I/O Module Sweep Impact Times (microseconds)

The following table provides sweep impact times for modules in the Main rack and in an expansion
(Exp) rack. The base case provides the overhead for a single module in the rack. The increment (Inc)
refers to the overhead for each similar module that is added to the same rack. To estimate sweep
impact for modules in a remote rack, multiply the time in the main rack by 6:
main rack base time × 6 = approximate sweep impact in remote rack
CPU310 CPU315/CPU320 CPE305/CPE310

Main Rack Exp Main Rack Exp Main Rack Exp
Base Inc Base Inc Base Inc Base Inc Base Inc Base Inc
Discrete Input 16 point 57.1 41.4 87.6 74.4 37.4 34.6 68.2 66.3 – – – –
Discrete Input 16 point
(Smart Digital Input – 24.6 21.6 NA NA – – NA NA – – – –
IC695MDL664)
Discrete Input 32 point 78.4 59.7 105.9 96.1 56.2 55.3 86.1 85.7 – – – –
Discrete Output 8 point 61.0 40.3 84.3 74.9 35.6 34.7 64.5 65.5 – – – –
Discrete Output 16 point 61.5 38.9 87 74.4 35.4 34.5 65.2 64.9 – – – –
Discrete Output 16 point
(Smart Digital Output – 24.8 21.4 NA NA – – NA NA – – – –
IC695MDL765)
Discrete Output 32 point 79.7 57 101.8 90.6 54.4 50.1 81.8 81.9 – – – –
Discrete Output 32 point
– – – – 128.57 123.69 220.88 216.02 193.06 – 288.53 –
(IC694MDL758)
Discrete Mixed
104.5 85.7 167 151.7 72.2 68.9 132.3 131.2 – – – –
8 point in/ 8 point out
Analog In/Out 4 channel 114.9 99 142.7 132 93.7 92.5 124.8 123.3 – – – –
Analog Input 16 channel 427.7 407.1 538.8 538 385.3 378.8 499.9 499.3 – – – –
Analog Output 2 channel 98.3 80.8 154.4 143.4 69.7 66.8 129.1 128.3 – – – –
Analog Input 6 channel,
92.9 73.4 N/A N/A 51.6 51.0 N/A N/A – – – –
IC695ALG106
Analog Input 12 channel,
111.7 94.8 N/A N/A 66.8 58.7 N/A N/A – – – –
IC695ALG112
Universal Analog
90.3 77.2 N/A N/A 50.9 45.7 N/A N/A – – – –
IC695ALG600
Analog Input 8 channel
84.4 68.3 N/A N/A 43.3 39.8 N/A N/A – – – –
IC695ALG608
Analog Input 16 channel
99.5 82.6 N/A N/A 56.3 55.6 N/A N/A – – – –
IC695ALG616
Analog Output 4 channel
122 101.8 N/A N/A 54.6 48.3 N/A N/A – – – –
IC695ALG704
Analog Output 8 channel
121.6 103.3 N/A N/A 54.7 49.6 N/A N/A – – – –
IC695ALG708

Worksheet A: I/O Module Sweep Time

The following form can be used for computing I/O module sweep impact. The calculation contains
times for analog input expanders that are either grouped into the same scan segment as the
preceding module or are grouped in a separate new scan segment. The sweep impact times of I/O
Modules can be found on pages 656 and 658.
Number of expansion racks ______
Sweep impact per expansion rack x ______ = ______
Number of discrete I/O modules—main rack ______
Sweep impact per discrete I/O module—main rack x ______ = ______
Number of discrete I/O modules—expansion rack ______
Sweep impact per discrete I/O module—expansion rack x ______ = ______
Number of analog input base and output modules—main rack ______
Sweep impact per analog input base and output module—main rack x ______ = ______
Number of analog input expander modules (same segment)—main rack ______
Sweep impact per analog input expander module (same segment)—main rack x ______ = ______
Number of analog input expander modules (new segment)—main rack ______
Sweep impact per analog input expander module (new segment)—main rack x ______ = ______
Number of analog input base and output modules—expansion rack ______
Sweep impact per analog input base and output module—expansion rack x ______ = ______
Number of analog input base and output modules (same segment)—exp. rack ______
Sweep impact per analog input base and output module (same seg.)—exp. rack x ______ = ______
Number of analog input base and output modules (new segment)—exp. rack ______
Sweep impact per analog input base and output module (new seg.)—exp. rack x ______ = ______
Predicted I/O Module Sweep Impact ______

Note: If point faults are enabled, substitute the corresponding times for point faults enabled, as
shown in the following table.

Sweep Impact of Genius I/O and GBCs

For the sweep impact of Genius I/O and Genius Bus Controllers (GBC), there is a sweep impact for
each GBC, a sweep impact for each scan segment, and a transfer time (per word) sweep impact for
all I/O data.
The GBC sweep impact has three parts:
1. Sweep impact to open the System Communications Window. This is added only once when
the first intelligent option module (of which the GBC is one) is placed in the system.
2. Sweep impact to poll each GBC for background messages (datagrams). This part is an impact
for every GBC in the system.
Note: Both the first and second parts of the GBC’s sweep impact may be eliminated by closing the
Backplane Communications Window (setting its time to 0). This should only be done to reduce
scan time during critical phases of a process to ensure minimal scan time. Incoming
messages will timeout and COMM_REQs will stop working while the window is closed.
3. Sweep impact to scan the GBC. This results from the CPU notifying the GBC that its new
output data has been transferred, commanding the GBC to ready its input data, and
informing the GBC that the CPU has finished another sweep and is still in RUN mode.
A scan segment for a Genius I/O block consists of consecutive memory locations starting from a
particular reference address. A new scan segment is created for each starting input or output
reference address. The time to process a single scan segment is higher for an input scan segment
than it is for an output scan segment. The scan segment processing is the same for analog, discrete,
and global data scan segments. Discrete data is transferred a byte at a time and takes longer to
complete the transfer than analog data, which is transferred a word at a time. Global data should be
counted as either discrete or analog, based on the memory references used in the source or
destination.
Sweep Impact Time of Genius I/O and GBCs
Note: Functions in bold type impact the sweep continuously. All other functions impact the sweep
only when invoked. Not all the timing information listed in the following table was available at
print time for this manual (the blank spaces).
CPU310 CPE010 CPE020 CPE030 CPE040
(µs) (µs) (µs) (µs) (µs)
Genius Bus Controller
open backplane communications window 30 24 4 4 1
per Genius Bus Controller polling for background messages 403 19 11 9 6
per Genius Bus Controller I/O Scan
Genius Bus Controller in the main rack 469 1 1 1 1
Genius Bus Controller in the expansion rack 683 11 7 6.9 1
Genius I/O Blocks
per I/O block scan segment 3 217 217 193.7 208
per I/O block scan segment w/point faults enabled 3 217 217 194.8 213
per byte discrete I/O data in the main rack 13 3 3 2.1 3
per byte discrete I/O data in expansion racks 16 8 5 4.2 4
per word analog I/O data in the main rack 24 5 4 4 5
per word analog I/O data in expansion racks 34 11 8 8 11

Worksheet B: Genius I/O Sweep Time

Use the following worksheet for predicting the sweep impact due to Genius I/O. The sweep impact
times can be found in “Sweep Impact Time of Genius I/O and GBCs” above (page 660).
Open backplane communications window ______ = ______
______
GBC poll for background messages x ______ = ______
Number of GBCs
GBC I/O scan for the main rack ______
Number of GBCs in the main rack X ______ = ________
GBC I/O scan for the expansion rack ______
Number of GBCs in the expansion rack X ______ = ________
Input block scan segments—number of ______
I/O block scan segments—sweep impact x ______ = ______
Output block scan segments—number of ______
I/O block scan segments—sweep impact x ______ = ______
Bytes of discrete I/O data on GBCs—main rack ______
Sweep impact/bytes of discrete I/O data—main rack x ______ = ______
Bytes of discrete I/O data on GBCs—expansion racks ______
Sweep impact/bytes of discrete I/O data—expansion racks x ______ = ______
Words of analog I/O data on GBCs—main rack ______
Sweep impact/word analog I/O data—main rack x ______ = ______
Words of analog I/O data on GBCs—expansion racks ______
Sweep impact/word analog I/O data—expansion racks x ______ = ______
Predicted Genius I/O Scan Impact ______

A-3.5 Ethernet Global Data Sweep Impact

Note: Refer to the section A-3.6 for Embedded Ethernet interface on RX3i CPE305/310 specific information.
Depending on the relationship between the CPU sweep time and an Ethernet Global Data (EGD)
exchange’s period, the exchange’s data may be transferred every sweep or periodically after some
number of sweeps. Therefore, the sweep impact varies based on the number of exchanges that are
scheduled to be transferred during the sweep. All of the exchanges must be taken into account when
computing the worst-case sweep impact.
The Ethernet Global Data (EGD) sweep impact has two parts, Consumption Scan and Production
Scan:
EGD Sweep Impact = Consumption + Production
Scan Scan
This sweep impact should be taken into account when configuring the CPU constant sweep mode
and setting the CPU watchdog timeout.
Where the Consumption and Production Scans consist of two parts, exchange overhead and byte
transfer time:
Scan Time = Exchange Overhead + Byte Transfer Time
Exchange Overhead
Exchange overhead includes the setup time for each exchange that will be transferred during the
sweep. When computing the sweep impact, include overhead time for each exchange.
Note: The exchange overhead times in the table below were measured for a test-case scenario of
1400 bytes over 100 variables.
EGD Exchange Overhead Time
Embedded Rack-based
Ethernet Interface Ethernet Module
(µs) (µs)
Consume / READ — 54 —58
CPE305/CPE310
Produce / WRITE —54 —
Consume / READ NA 233.6
CPU310/NIU001
Produce / WRITE NA 480.6
Consume / READ NA 100.0
CPU315/CPU320
Produce / WRITE NA 195.1
Consume / READ 184.3 238.2
CPE010
Produce / WRITE 342.0 452.0
CPE020
CPE030
CPE040
54 EGD Class 1 for this CPU type requires RX3i CPE310/CPE305 Firmware Release 8.30 or later. Prior to that, EGD
was only possible in RX3i via the ETM001 Module. Refer to the section A-3.6.

Data Transfer Time

Note: This is the time required to transfer the data between the CPU module and the rack-based
Ethernet module. EGD data transfer times do not increase linearly in relation to data size.
Please use the data values in the table below to estimate data transfer times.
Note: CPE modules do not need to use this table with respect their embedded Ethernet port, as
there is no transfer of data across the backplane corresponding to EGD traffic.
Embedded Rack-based
CPU Data Size (Bytes) Direction Ethernet Ethernet Module
Interface (µS) (µS)
CPU310 1 Consume / READ NA 9.3
NIU001 55 100 Consume / READ NA 51.8
200 Consume / READ NA 97.9
1 Produce / WRITE NA 6.5
CPU315, 1 Consume / READ NA 6.2
CPU320 100 Consume / READ NA 49.5
CPE010 1 Consume / READ 4.1 8.8
100 Consume / READ 25.7 23.5
200 Consume / READ 49.0 38.6
256 Consume / READ 61.4 46.8
1 Produce / WRITE 1.9 8.8
100 Consume / READ 23.6 19.5
200 Consume / READ 46.3 34.9
256 Consume / READ 58.9 42.7
55 EGD performance is different on the IC695NIU001+ (versions-AAAA and later) compared to the IC695NIU001.
In general consumed data exchanges with a size greater than 31 bytes will result in contributing less of a
sweep time impact and data exchanges with a size less than that will contribute slightly greater sweep
impact. All produced exchanges on the IC695NIU001+ will appear to have a slightly greater sweep impact
when compared to the IC695NIU001.

Embedded Rack-based
CPU Data Size (Bytes) Direction Ethernet Ethernet Module
Interface (µS) (µS)
100 Consume / READ 25.8 18.7
200 Consume / READ 50.7 33.4
256 Consume / READ 60.1 40.4
100 Consume / READ 21.1 10.1
200 Consume / READ 43.5 31.4
256 Consume / READ 56.5 39.2
Worksheet C: Ethernet Global Data Sweep Time

Number of consumed exchanges __________________
Sweep impact per exchange x __________________ = __________________
Number of data bytes in all of the

__________________
consumed exchanges
Sweep impact per consumed data byte x __________________ = __________________
Number of produced exchanges __________________

Sweep impact per exchange x __________________ = __________________
Number of data bytes in all of the produced

__________________
exchanges
Sweep impact per produced data byte x __________________ = __________________
__________________
Predicted EGD Sweep Impact

A-3.6 EGD Sweep Impact for Embedded Ethernet Interface on RX3i CPE305
and 310
Each EGD production or consumption will take about 200 microseconds regardless of size of
exchange. For Produced Exchanges on the embedded port you can think of it as a timed interrupt
block that takes 200us duration to execute each time it is triggered. For Consumed Exchanges on the
embedded port you can think of it as an I/O interrupt block that takes 200us duration to execute
each time the remote unit sends an exchange and it is received on the embedded port.
It is important to note that this 200us per exchange is not a simple ‘sweep impact’ time, rather per
execution of that exchange time, and depending on sweep time length and production period it may
occur more than one time per sweep.
Users configuring systems with EGD on an embedded Ethernet port should take care to make sure
that production and consumption time on the embedded Ethernet port is accounted for.
EGD Sweep impact for RX3i CPE305/310 Embedded Ethernet Interface:
The impact of EGD Exchanges configured on Embedded Ethernet Interface of RX3i CPE305/310 on
the Controller sweep can be reflected in two parameters :
1. 𝑻𝑻𝑻𝑻𝑻𝑻𝑻𝑻𝑻𝑻_𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬_𝒎𝒎𝒎𝒎 : This is the total EGD impact per Watchdog Time period
configured in milliseconds.
2. 𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝒏𝒏 % : This is the percentage EGD processor utilization.
The formula for calculating these two parameters are shown below:
255
𝑊𝑊𝑊𝑊𝑊𝑊_𝑚𝑚𝑚𝑚
𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇_𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸_𝑚𝑚𝑚𝑚 = � � × 𝐸𝐸𝑥𝑥𝑥𝑥ℎ𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑛𝑛 × 0.2 00�
𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃_𝑚𝑚𝑚𝑚𝑛𝑛
𝑛𝑛=1
𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇𝑇_𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸_𝑚𝑚𝑚𝑚
𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸𝐸_% = � � × 100
𝑊𝑊𝑊𝑊𝑊𝑊_𝑚𝑚𝑚𝑚
𝑊𝑊𝑊𝑊𝑊𝑊_𝑚𝑚𝑚𝑚 – Watchdog time configured in milliseconds
𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃_𝑚𝑚𝑚𝑚𝑛𝑛 – Exchange Period nth Exchange, as configured in milliseconds (Production Period for
production exchanges and Consumption timeout for consumption exchanges
𝐸𝐸𝐸𝐸𝐸𝐸ℎ𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑛𝑛 – nth Exchange configured (value=1) or not configured (value=0)
It is recommended that the calculated 𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬_% for a given EGD exchange

configuration and Watchdog period should be less than 50-55% for stable operation within
watchdog period without WDT elapse.
Note: The higher percentage of this parameter indicates that the EGD on Embedded Ethernet
interface could have a greater impact on CPU applications.

Example Calculation for EGD Utilization on CPE305/310:-

The watchdog time configured is 200ms for below table calculations:
SN EGD Exchange Type of Exchange Period Total_EgdImpactPerWDT_ms[n]
1 EGD Exchange#1 Producer 25 1.600
5 EGD Exchange#5 Consumer 30 1.333
Total_EgdImpactPerWDT_ms 9.600
EgdProcessorUtilization_% 4.800
Normal Sweep – EGD on RX3i CPE305/310 Embedded Ethernet Interface:

The following table shows the chart for setting up EGD exchanges on Embedded Ethernet for RX3i
CPE305/310 with a no sweep load and no network traffic. The table is a compilation of results based
on testing with two RX3i CPE310 Systems in which one is acting as the EGD Producer and the other is
acting as the EGD Consumer.
Production Period
Data size per Exchange Maximum Number of EGD
SN [Consumption Timeout*]
(Bytes) Exchanges ( Recommended)
(ms)
A 500 1400 254
B 500 200 255
C 500 10 255
D 300 1400 166
E 300 200 255
F 300 10 255
G 200 1400 109
H 200 200 255
I 200 10 255
J 100 1400 54
K 100 200 255
L 100 10 255
M 50 1400 27
N 50 200 127
O 50 10 230
P 30 1400 16
Q 30 200 75
R 30 10 136
S 20 1400 11
T 20 200 50
U 20 10 91

* Note: The previous table shows the value of Production Period (ms). Note that the Consumption
Timeout is set as twice the Production Period on the other consuming CPE310 node. For example, for
A, the Production Period for all the Producer exchanges is set to 500ms. This indicates that the
Consumption Timeout for all of the consumer exchanges on the consuming node is set to 1000ms
(twice the production period).
The following are important points to be considered when configuring EGD exchanges on Embedded
Ethernet Interface.
1. The recommended values in the given table should be used in conjunction with the
recommended limit value for 𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬𝑬_% as per the watchdog time and
sweep load of the application.
2. EGD Consumption and Production below 20ms are not recommended for Embedded
Ethernet Interface on with CPE305/310.
3. It is advisable to limit the number of EGD exchanges or EGD load on Embedded Ethernet
Interface of the CPE305/310, and use higher periods while defining the system and
configuration, and take into account the sweep load for minimizing EGD sweep impact.
Constant Sweep - EGD on RX3i CPE305/310 Embedded Ethernet Interface:

The EGD on Embedded Ethernet Interface can be treated as interrupt blocks. Therefore, EGD
exchanges with Constant sweep may cause sweep overruns and should be avoided. It is also
recommended that the Production period for Producer exchanges be set to multiples (3 and above)
of the Constant sweep time set to avoid stale data being produced by the CPE305/310 system on
Embedded Ethernet Interface. Some of the factors affecting the Constant sweep overruns with EGD
on Embedded Ethernet Interface are Constant sweep time, No of Exchanges, Production period, and
Exchange data size.
The Constant sweep with EGD exchanges configured on Embedded Ethernet Interface and timed or
I/O interrupts will also cause constant sweep overruns and are not recommended.

A-3.7 Sweep Impact of Intelligent Option Modules

The tables in this section list the sweep impact times in microseconds for intelligent option modules.
The fixed sweep impact is the sum of the polling sweep impact and the I/O scan impact. The opening
of the Backplane Communications Window and the polling of each module have relatively small
impacts compared to the sweep impact of CPU memory read or write requests.
Intelligent option modules include GBCs being used for Genius LAN capabilities. The sweep impact for
these intelligent option modules is highly variable.
Fixed Sweep Impact Times of Intelligent Option Modules, RX7i
Sweep Impact Item CPE010 CPE020 CPE030 CPE040
IC698ETM001 104 µs 51 µs 48 µs 36 µs
IC698HSC700 267 µs 157 µs 148 µs 116 µs
IC697BEM731 (GBC) See “Sweep Impact Time of Genius I/O and GBCs”, page 660.
Fixed Sweep Impact Times of RX3i Intelligent Option Modules (µs)

CPU310 CPU315/CPU320 NIU001+
Sweep Impact
Main Exp Main Exp Main Exp
Item
Base Inc Base Inc Base Inc Base Inc Base Inc Base Inc
IC694APU300B 1085 — — — 1109 — — — — — — —
and earlier
IC694APU300-CA
and later
Classic 2759 56 — — — 2043 57 — — — — — — —
Enhanced 407456 — — — 327657 — — — — — — —
IC694BEM331 See page 660 — — — — — — — —
IC694DSM314 See page 669 — — — — See page 669
IC695ETM001 199 — NA NA 188 51 NA NA — — NA NA
IC695HSC304 208.7 173.9 NA NA 136.4 131.0 NA NA — — NA NA
IC695HSC308 282.4 256.5 NA NA 202.6 200.3 NA NA — — NA NA
IC695PBM300 — NA NA — NA NA — — NA NA
No I/O 132 60
100 bytes Input, 196 105
100 bytes Output
200 bytes Output
100 bytes Output
IC695PNC001 NA NA NA NA See NA NA NA NA NA NA NA
page
669
56 CPU firmware version 7.13

57 CPU firmware version 7.14

PROFINET Controller (PNC001) and PROFINET I/O Sweep Impact

The PLC CPU sweep impact for a PROFINET IO network is a function of the number of PNCs, the
number of PROFINET devices, and the number of each PROFINET device’s IO modules. The table
below shows the measured sweep impact of the RX3i PROFINET Controller, supported VersaMax
PROFINET devices, and I/O modules.
CPU315/CPU320
RX3i PROFINET Controller (PNC) 50
RX3i Devices
PROFINET Scanner (PNS) IC695PNS001 46
ALG442 Mixed Analog 54
ALG220 Analog Input 27
ALG390 Analog Output 24
MDL645 Discrete Input 23
MDL740 Discrete Output 22
VersaMax Devices
PROFINET Scanner (PNS), IC200PNS001 40
Discrete Input Module (8/16/32 pt.) 23
Discrete Output Module (8/16/32 pt.) 18
Analog Input Module (15 channel) 59
Analog Output Module (12 channel) 21
CMM020 (64AI/64AQ) 204
To calculate the total expected PLC sweep impact for a PROFINET I/O network, add the individual
sweep impact times for each PROFINET Controller, PROFINET Device, and PROFINET Device I/O
module, using the times provided above.
For example, for a PROFINET I/O network that consists of one PNC and one VersaMax PROFINET
Scanner, which has both an 8 point. input and an 8 point output module:
Expected PLC Sweep Impact = 50 (PNC) + 40 (PNS) + 23 (8pt. Input) + 18 (8pt. Output)
=131 µs.
DSM314 Sweep Impact (µs)

Rx3i CPU310 Rack Rx3i NIU001+ Rack
No. of Axes
Configured Main Exp Main Exp
1 1535 2160 1830 2360
2 2018 2906 2304 3160
3 2500 6371 2840 3920

4 2990 4430 3350 4680
A-3.8 I/O Interrupt Performance and Sweep Impact

There are several important performance numbers for I/O interrupt blocks. The sweep impact of an
I/O interrupt invoking an empty block measures the overall time of fielding the interrupt, starting up
the block, exiting the block, and restarting the interrupted task. The time to execute the logic
contained in the interrupt block affects the limit by causing the CPU to spend more time servicing I/O
interrupts and thus reduce the maximum I/O interrupt rate.
The minimum, typical, and maximum interrupt response times reflect the time from when a single I/O
module sees the input pulse until the first line of ladder logic is executed in the I/O interrupt block.
Minimum response time reflects a 300 microsecond input card filter time + time from interrupt
occurrence to first line of ladder logic in I/O interrupt block. The minimum response time can only be
achieved when no intelligent option modules are present in the system and the programmer is not
attached. Typical response time is the minimum response time plus a maximum interrupt latency of
2.0 milliseconds. This interrupt latency time is valid, except when one of the following operations
occurs:
 The programmer is attached.
 A store of logic, RUN mode store, or word-for-word change occurs.
 A fault condition (logging of a fault) occurs.
 Another I/O interrupt occurs.
 The CPU is transferring a large amount of input (or output) data from an I/O controller (such as a
GBC). Heavily loaded I/O controllers should be placed in the main rack whenever possible.
 An event that has higher priority and requires a response occurs. An example of this type of
event is clearing the I/O fault table.
Any one of these events extends the interrupt latency (the time from when the interrupt card signals
the interrupt to the CPU to when the CPU services the interrupt) beyond the typical value. However,
the latency of an interrupt occurring during the processing of a preceding I/O interrupt is unbounded.
I/O interrupts are processed sequentially so that the interrupt latency of a single I/O interrupt is
affected by the duration of the execution time of all preceding interrupt blocks. (The worst case is
that every I/O interrupt in the system occurs at the same time so that one of them has to wait for all
others to complete before it starts.)
The maximum response times shown below do not include the two unbounded events.
I/O Interrupt Block Performance and Sweep Impact Times
CPE305 CPU310 CPU315/ CPE010 CPE020 CPE030 CPE040
Sweep Impact Item CPE310 (µs) CPU320 (µs) (µs) (µs) (µs)
(µs)
I/O interrupt sweep impact — 58 127.8 - 309.7 335 125.6 24
58 Not available for this release.

Minimum response time — 151.7 326.1 392.4 334 330.6 315.2

Typical response time 175.0 327.3 396.1 336 331.5 315.5
Maximum response time 302.7 346.2 434.9 359 375.1 325.7
Note that the min, typical, and max response times include a 300 µs Input card filter time.
Dropped Interrupts
When multiple interrupts are triggered during the interrupt latency period, it is possible that interrupt
blocks will only be executed one time even though the interrupt trigger has occurred more than
once. The likelihood of this occurring will increase if the system interrupt latency has increased due
to the specific configuration and use of the system.
This will not cause the CPU to miss a given interrupt; just consolidate the number of times an
interrupt block is executed even though the interrupt stimulus had occurred more than one time.
Interrupt Trigger
Interrupt Logic Block
Interrupt
Logic
Suspended
Higher-priority event
Figure 60: Interrupt Execution Considerations

Worksheet D: Programmer, IOM, I/O Interrupt Sweep Time
The following worksheet can be used to calculate the sweep impact times of programmer sweep
impact, intelligent option modules, and I/O Interrupts. For time data, refer to the following tables:
Programmer Sweep Impact Times, page 654
RX7i I/O Module Types, page 656 or
RX3i I/O Module Types, page 658
Sweep Impact Time of Genius I/O and GBCs, page 660
Programmer sweep impact = ______
IOM—first module (open comm. window) ______
IOM—per module (polling) + ______
LAN module I/O scan + ______
Total IOM Sweep Impact = ______
CPU memory access from IOMs = ______

I/O interrupt sweep impact ______

I/O interrupt response time + ______ = ______
Predicted Sweep Time (Other) ______

A-3.9 Timed Interrupt Performance

The sweep impact of a timed interrupt invoking an empty program block or timed program measures
the overall time of fielding the interrupt, starting up the program or block, exiting the program or
block, and restarting the interrupted task. The minimum, average, and maximum interrupt period
reflect the time period from when the first line of ladder logic is executed in the timed interrupt block.
Timed Interrupt Performance and Sweep Impact Times for a 0.001s Timed Interrupt Block
Sweep Impact Item CPU310 CPU315 CPE010 CPE020 CPE030 CPE040
(µs) CPU320 (µs) (µs) (µs) (µs)
(µs)
Timed interrupt sweep impact 87.3 26.2 88.6 28 31.2 23.3
Minimum interrupt period 908.3 969.8 951.4 946 922.8 973
Average interrupt period 1000 1000.0 1005.5 999.7 1000.0 999.9
Maximum interrupt period 1081.2 1030.8 1056.6 1054 1077.0 1026.9

A-3.10 Example of Predicted Sweep Time Calculation

The sweep time estimate in this example does not include a time for logic execution. The calculated
sweep is for normal sweep time with point faults disabled, and the programmer is not attached. The
times used in the calculation are extracted from the following tables:
Base Sweep Times, page 651
RX7i I/O Module Types, page 656 or
RX3i I/O Module Types, page 658
Sweep Impact Time of Genius I/O and GBCs, page 660
A sample calculation of predicted sweep times is provided after the example.
Sample RX7i System Configuration
PS CPE010 BTM 32PT 32PT 32PT 32PT 8CHN 4CHN ETM

Input Input Output Output Analog Analog
Input Output
0 1 2 3 4 5 6 7 8 9
MAIN RACK
Sweep Calculations (in µS)
Predicted Sweep = Base Sweep + I/O Scan Impact
Base Sweep Time = 465

I/O Scan Impact …
Number of discrete input type 2 modules—main rack 2
Sweep impact time per discrete I/O module x 37.9 = 75.8
Number of discrete output type 2 modules—main rack 2
Sweep impact time per discrete I/O module x 80.4 = 80.4
Number of analog input modules—main rack 1
Sweep impact time per analog base and output module x 49.3 = 49.3
Number of analog output modules—main rack 1
Sweep impact time per analog base and output module x 49.7 = 49.7
Ethernet Module 1 x 55 = 55.0
Predicted Sweep Time = 775.2

Appendix B User Memory Allocation
User Memory Size is the number of bytes of memory available to the user for PLC applications.
Model User Memory Size

IC695CPE305 5MB
IC695CPU310, IC695CPE310, IC698CPE010,
10MB
IC698CPE020, IC698CRE020
IC695CPU315 20MB
IC695CPU320, IC695CRU320 64MB
64MB
For a list of items that count against user memory, see below.
B-1 Items that Count Against User Memory

The following items count against the CPU memory and can be used to estimate the minimum
amount of memory required for an application. Additional space may be required for items such as
Advanced User Parameters, zipped source files, user heap, and published symbols.
Register Memory Size (%R) Bytes = %R references configured × 2
Word Memory Size (%W) Bytes = %W references configured × 2
Analog Inputs (%AI) If point faults enabled: Bytes = %AI references configured × 3
If point faults disabled: Bytes = %AI references configured × 2
Analog Outputs (%AQ) If point faults enabled: Bytes = %AQ references configured × 3
If point faults disabled: Bytes = %AQ references configured × 2
Discrete Point Faults If point faults enabled: Bytes = 3072
Managed Memory The total number of bytes required for symbolic and I/O variables. Calculated as follows:
(Symbolic Variable and I/O [(number of symbolic discrete bits) × 3 / (8 bits/byte)]
Variable Storage) + [(number of I/O discrete bits) × Md / (8 bits/byte)]
+ [(number of symbolic words) × (2 bytes/word)]
+ [(number of I/O words) × (Mw bytes/word)]
Md = 3 or 4. The number of bits is multiplied by 3 to keep track of the force, transition,
and value of each bit. If point faults are enabled, the number of I/O discrete bits is
multiplied by 4.
Mw = 2 or 3. There are two 8-bit bytes per 16-bit word. If point faults are enabled, the
number of bytes is multiplied by 3 because each I/O word requires an extra byte.
EGD (included in HWC) Bytes = 0 if no Ethernet Global Data pages are configured
I/O Scan Set File Based on number of scan sets used.
(included in HWC) Note: 32 bytes of user memory are consumed if the application scans all I/O every
sweep (the default).
User Programs See “User Program Memory Usage” page 675 for details on user programs.
B-2 User Program Memory Usage

Space required for user logic includes the following items.

Appendix B. User Memory Allocation
B-2.1 %L and %P Program Memory

%L and %P are charged against your user space and sized depending on their use in your
applications. The maximum size of %L or %P is 8192 words per block.
The %L and %P tables are sized to allow extra space for Run Mode Stores according to the following
rules.
 If %L memory is not used in the block, the %L memory size is 0 bytes. If %L memory is used in the
block, a buffer is added beyond the highest %L address actually used in logic or in the variable
table. The default buffer size is 256 bytes, but can be changed by editing the Extra Local Words
parameter in the block Properties.
 The same rules apply for the size of %P memory, but %P memory can be used in any block in the
program.
 The buffer cannot make the %P or %L table exceed the maximum size of 8,192 words. In such a
case, a smaller buffer is used.
 You can add, change, or delete %L and/or %P variables in your application and Run Mode Store
the application if these variables fit in the size of the last-stored %L/%P tables (where the "size"
includes the previous buffer space), or if going from a zero to non-zero size.
 The size of the %L/%P tables is always recalculated for Stop Mode Stores.

Appendix B. User Memory Allocation
B-2.2 Program Logic and Overhead

The data area for C (.gefelf) blocks is considered part of the user program and counts against
the user program size. Additional space is required for information internal to the CPU that is
used for execution of the C block.
The program block is based on overhead for the block itself plus the logic and register data
being used (that is, %L).
Note: The program stack of the LD is not counted against the CPU’s memory size.
Note: If your application needs more space for LD logic, consider changing some %P or %L
references to %R, %W, %AI, or %AQ. Such changes require a recompilation of the program
block and a Stop Mode store to the CPU.

Clear fault tables, 389
Clocks, 83
Index elapsed time clock, 16, 19, 37, 83
reading with SVCREQ #16 or #50, 83
time-of-day clock, 16, 19, 37, 40, 83
reading and setting, 83, 376
@ synchronizing to SNTP server, 84
@ CMM, 478
indirect references, 127 Communication requests (COMM_REQ), 242
serial I/O, 489
serial IO
A calling from CPU sweep, 487
SNP, 534
Access control, 62 using to configure serial ports, 482
Addition of I/O module, 601 Communications Coprocessor, 478
Addition of IOC, 596 Communications failure during store, 580
Addition of or extra rack, 552 Compatibility
Address operators, 450 CPE310 with CPU310, 24
Alarm contacts, 548 Configuration
Analog expander modules CPE310 as CPU310, 25, 50, 66
fault locating references, 547 invalid port combinations, 483
Analog I/O diagnostic information, 94 parameters, CPU, 49
Analog input register references (%AI), 127 storing (downloading), 65
Analog output register references (%AQ), 127 system, 95
Application fault, 569 Constant sweep timer
Arrays, 124 change or read, 368
accessing elements with variable index, 124 exceeded, 566
Auto-Located symbolic variables, 121 Convenience references. See System status references
Corrupted user program on power-up, 574
B CPU hardware failure, 561
CPU memory validation, 95
Base sweep time, 649 CPU performance data
Battery base sweep time, 649
CPE305, CPE310, real time clock, 27 Boolean execution times, 622
status faults, 565 calculating predicted sweep times, 668
Baud rates, serial port, 477 I/O module sweep impact times
Bit in Word references, 128 worksheet, 657
Bit references, 129 instruction timing, 623
Block switch, 607 interrupt latency, 665
Blocks sweep impact, 648
external, 107 CPU redundancy, 57, 578
parameterized, 100 CPU sweep
program, 100 Stop mode, 78
types of, 99 Cyclic redundancy check (CRC), 509
UDFBs, 103
Boolean execution times, 622
Bulk memory, 127 D
Data coherency in communications windows, 77
C Data Initialize
ASCII, 248
Cables Communications Request, 249
for CPE305 RS-232 port, 473 Data mapping
maximum length, 476 default conditions, 91
Changing window modes Genius I/O data mapping, 92
Background task window mode and timer, 373 Data retentiveness
Backplane communications window mode and timer, power cycle, 96
372 Stop to Run mode transition, 133
Controller communications window, 371 Data scope, 134
Checksum Data types, 140
change or read number of words, 374
GFK-2222T November 2014 i

Index
Datagrams CPE010, CPE020, CRE020, 36

permanent, 534 CPE030/CRE030, CPE040/CRE040, 39
Diagnostic information, analog I/O, 94 embedded
Diagnostic information, discrete I/O, 93 RX3i, 30, 471
Diagnostic Logic Blocks (DLBs), 609 RX7i, 41, 471
example, 616 Examples
execution mode, 612 diagnostic logic blocks, 616
heartbeat, 612 Expressions
removing, 614 Structured Text, 450
restrictions, 610 External blocks, 107
variables, 611 Extra block fault, 603
Diagnostics Extra I/O module, 602
controller faults, 549
Diagnostic Logic Blocks, 609
fault contacts, 546
F
fault handling, 536 Fault contacts, 546
fault tables, 538 Fault handling
I/O faults, 583 actions, 537
point faults, 547 CPU configuration, 56
system fault references, 542 overview, 536
Disable/enable EXE block and standalone C program system, 542
checksums, 409 system response, 536
Discrete references, 129 Fault references
size and default, 130 alarm contacts, 548
DLAN Interface, 480 fault locating, 546
Documentation, 11 point faults, 547
Downloading configuration, 65 Faults
Drum, 197 Controller, 549
in function blocks, 198 CPU system software failure, 578
fault contacts, 546
E I/O, 583
system, 542
Elapsed time clock, 83 non-configurable, 544
accuracy, 16, 19, 37 tables, 538
reading with SVCREQ #16 or #50, 83 tables, Controller, 538
Energy Pack, RX3i, 35 tables, IO, 540
Enhanced security, 62, 88 user-defined, 137, 404, 539
compared to legacy mode, 89 Features
with RDSD, 31 PACSystems CPUs, common, 5
Error checking and correction (ECC) RX3i, 7
CRE020, 38 RX7i, 9
CRE030, CRE040, 41 Flash memory
CRU320, 21 operation, 80
Errors configuration, 49
in floating point numbers, 143 Floating point numbers, 142
Ethernet global data, 6 errors in, 143
sweep impact times, 660 Forced and unforced circuit, 599
timestamping, 84 Formal parameters
Ethernet Interface in ST calls, 457
embedded restrictions, 102
configuring, 66 Function Block Diagram language, 114, 325
embedded
RX7i, 41
embedded
G
RX3i, 470 GBC software exception, 606
embedded GBC stopped reporting, 605
RX7i, 470 GBC Stopped Reporting fault, 605
rack-based, 471 GENA (Genius Network Adapter), 584
Ethernet ports Genius global data, 93, 131
ii PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Index
Genius I/O, 92
analog grouped block, 92
L
default conditions, 92 Ladder Diagram language, 113, 151
diagnostic data collection, 93 Last scans, 53, 78
Genius I/O data mapping, 92 LDPROG01, 98
low-level analog blocks, 92 LEDs
Global data references (%G), 129 CPE010, CPE020, CRE020, 36
CPE030/CRE030, CPE040/CRE040, 39
H CPE305 and CPE310, 29
CPU310, 15
Hardware variables, 122 CPU315, CPU320, CRU320, 18
RX7i Ethernet interface, 42
Logic Driven Read of Nonvolatile Storage (SVC_REQ #56),
I 416
I/O bus faults, 594 Logic Driven Write to Nonvolatile Storage. See Service
I/O circuit faults, 587 Request (SVC_REQ) functions, (#57)
I/O data mapping Logic Driven Write to Nonvolatile Storage (#57)
default conditions, 91 maximum number of erase cycles, 421
Genius I/O data mapping, 92 Logic/configuration power-up source, 81
I/O fault sweep impact, 653 Loss of I/O module, 600
I/O fault table full, 568 Loss of IO Controller, 597
I/O interrupts, 118 Loss of or missing option module, 551
performance and sweep impact, 665 Loss of or missing rack, 550
I/O module faults, 595 LREAL numbers
I/O module sweep impact times internal format of, 142
worksheet, 657
I/O scan sets, 91 M
configuration, of, 91
I/O scan sweep impact, 653 Mapping, I/O data
I/O system default conditions, 91
analog I/O diagnostic information, 94 Genius I/O data mapping, 92
discrete I/O diagnostic information, 93 Mask/unmask IO interrupt, 395
initialization, 96 Mask/unmask timed interrupts, 406
I/O variables, 122 Memory
Indirect references configuration, 53
word, 127 retention of data memory across power cycle, 96
Initialize Port function, 491 type codes, 418, 582
Input Buffer, Flush, 492 usage, 669
Input Buffer, Set Up, 491 Modbus slaves
Input references (%I), 129 station address, 58, 504
Instruction set Mode transition
operands stop-to-run, 79
LD, 147 Modem, Hayes-compatible, 497
Instruction timing, CPU, 623 Modes of operation, CPU, 78
Intelligent option modules Module hardware failure, 562
self-test completion, 95 Module interrupts, 119
sweep impact times, 663 Multiple I/O scan sets, 91
DSM314, 664
Internal references (%M), 129
Interrupt blocks, 117
N
I/O interrupts, 118 NaN (Not a Number)
interrupt handling, 117 defined, 143
module interrupts, 119 Nested calls, 99
scheduling, 119 New features, 2
timed interrupts, 118 No user program on power-up, 573
Interrupt latency, 665 Noncritical CPU software event, 581
IOC (I/O controller), 543 Normal block scheduling, 119
IOC hardware failure, 604 Normal sweep mode
IOC software fault, 598
GFK-2222U November 2014 iii

Index
application program task execution, 70 sweep impact, 648

programmer communications window, 71 Permanent datagrams, 534
system communications window, 71 PID function
Null system configuration for RUN mode, 577 control block, 430
Numerical data, 140 reference array, 430
time interval, 438
Pin assignments
O embedded Ethernet ports, 471
OEM protection, 87 serial ports, 473
Off Delay Timer, 311 PLC system fault table full, 567
On Delay Stopwatch Timer, 313 Point faults, 547
On Delay Timer, 316 Port Status, read, 493
Online editing, 101, 570 Power-down sequence, 96
OPC UA, 6 Power-up self-test, 95
Operands for instructions, 147 Power-up sequence, 95
Operation, Protection, and Module Status, 5 CPU memory validation, 95
Operators, Structured Text, 450 I/O system initialization, 96
Option module logic/configuration source, 81
dual port interface tests, 96 option module dual port interface tests, 96
self-test completion, 95 option module self-test completion, 95
Option module software failure, 563 power-up self-test, 95
Output references (%Q), 129 system configuration, 95
Output scan, 70 Preemptive block scheduling, 119
Overflow Privilege levels, 87
floating point numbers, 143 Program block
math functions, 279, 350 how blocks are called, 98
math functions, 350 program blocks and local data, 110
Overhead sweep impact times, 648 Program block checksum failure, 564
base sweep time, 649 Program execution
calculating predicted sweep times, 668 controlling, 116
DSM314, 664 Program name, 98
Genius I/O and GBCs, 658 Program register references (%P), 127
I/O interrupt performance and sweep impact, 665 Program scan, 70
I/O module sweep impact times Program structure
worksheet, 657 how blocks are called, 98
I/O modules, 653 program blocks and local data, 110
I/O scan, 653 Programmable Coprocessor Module, 479
intelligent option modules, 663 Programmer sweep impact times, 652
PROFINET Controller and IO, 664 Protection level request, 87
programmer sweep impact time, 652 Protocol errors, 487
Override bits, 132 Protocols supported, 472
Stop mode, 60
P
R
Parameter passing mechanisms, 111
Parameterized block, 100 Read Bytes, 500
and local data, 101 Read controller ID, 386
reference out of range, 101 Read controller run state, 387
referencing formal parameters, 101 Read elapsed power down time, 410
Part numbers Read elapsed time clock, 393, 413
station manager cable, 40 Read fault tables, 399
Password access failure, 576 Read from flash (SVC_REQ #56), 416
Passwords, 86 Read IO forced status, 397
enabling after disabled, 87 Read last-logged fault table entry, 390
PCM, 479 Read master checksum, 407
Performance Read String, 502
CPE305 differences, 25 Read sweep time, 384, 415
CPE310 vs CPU310, 25 Read target name, 385
instruction timing, 623 Read window modes and times, 370
iv PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Index
REAL numbers Initialize Port function, 490

internal format of, 142 Input Buffer function, 491
Real-time clock battery, 27 Read Bytes function, 500
References, 127 Read Port Status function, 493
associated transitions and overrides, 132 Read String function, 502
data scope, 134 Write Bytes function, 497, 499
discrete references, 129 Write Port Control function, 495
fault locating, 133, 546 Serial ports
indirect, 127 CPE010, CPE020, CRE020, 36
register references, 127 CPE030/CRE030, CPE040/CRE040, 39
size and default value, 130 CPE305 and CPE310, 30
system fault references, 542 CPU parameters, 58
system status (%S), 135 CPU310, 14
Related documents, 11 CPU320/CRU320, 17
Removable Data Storage Devices (RDSDs), 31 Series 90 applications, 10
Enhanced Security with, 31 Service requests, 365
Reset module, 408 example, 366
Reset of IOC, 608 Set run enable/disable, 398
Reset of, addition of, or extra option module, 553 Setting loop gains for PID
Reset watchdog timer, 383 Ideal tuning, 445
Retentiveness Ziegler and Nichols tuning, 444
of logic and data across power cycle, 96 Settings
of logic and data across Stop to Run mode transition, CPU, 49
133 Shut down CPU, 388
variables associated with coils, 174 Skip next I/O scan, 412
RTU messages, 513 SNP master, 487
RTU slave, 487 SNP slave protocol, 534
end-of-frame timeout, 508 Specifications
protocol, 487, 504 CPE010, CPE020, CRE020, 37
message format, 504 CPE030/CRE030, CPE040/CRE040, 40
receive-to-transmit delay, 505 CPE305 and CPE310, 23
turnaround time, 505 CPU310, 16
Run/stop operations, 78 CPU310, 16
run/outputs disabled, 78 CPU315, CPU320, 19
run/outputs enabled, 78 CRU320, 20
serial protocol configuration, 60 Station address
stop mode protocol configuration, 473 Modbus slaves, 58, 504
stop/IO scan, 78 STOP mode, 78
stop/No IO scan, 78 Storing configuration, 65
switch enable/disable, 50 Structure of application programs, 98
Structure variables, 104
Structured Text
S expressions, 450
Scan parameters, 51 language, 115, 449
Scan sets operators, 450
operation, 91 statement types, 453
parameters, 61 syntax, 452
Scope Structured Text statement types
data, 134 argument present, 466
Security, system, 86 assignment, 454
privilege levels, 87 CASE, 460
Self-test EXIT, 467
I/O system initialization, 96 FOR, 462
option module dual port interface tests, 96 function call, 454
option module self-test completion, 95 IF, 459
power-up self-test, 95 REPEAT, 465
Serial I/O RETURN, 458
Cancel Operation function, 496 WHILE, 464
Flush Input Buffer function, 492 Subroutines
GFK-2222U November 2014 v

Index
Call function, 116 comparison, 181

Suspend/resume IO interrupt, 411 POSCOIL and NEGCOIL, 178
Sweep impact, 648 PTCOIL and NTCOIL, 180
DSM314, 664 Transition contacts
Ethernet global data, 660 comparison, 190
GBC, 658 POSCON and NEGCON (legacy), 186, 189, 192, 207, 214,
Genius I/O, 658 216, 218, 220, 224, 226, 227, 258, 306, 307, 312, 314,
I/O scan, 653 317, 330, 383, 393, 413
intelligent option, 663 PTCON and NTCON (IEC), 189
local I/O, 653 Turnaround time
PROFINET Controller and IO, 664 RTU slave, 505
programmer, 652
timed interrupt, 667
Sweep, CPU, 68
U
base sweep time, 649 UDFBs
modes, 72 defining, 103
Stop mode, 78 instance data, 104
Switches instances, 104
CPU reset, 5 internal variables, 106
Run/Stop mode, 5 logic restrictions, 107
RX7i Ethernet restart, 45 parameters, 105
Symbolic variables, 121 scope, 104
System bus error, 560 User defined types, 144
System configuration, 95 User references, 127
System configuration mismatch, 554 system fault references, 542
System fault references, 542 User-defined faults, 539
System operation logging, 404
clocks and timers, 83
I/O system, 90
power-down sequence, 96 V
power-up sequence, 95
Variables, 121
retention of data memory across power cycle, 96
C, initialization, 108
system security, 86
I/O, 122
System register references (%R), 127
mapped, 121
System status references (%S), 129, 135
member, 103
symbolic, 121
T
Table of Contents, i W
Table of Figures, xiv
Watchdog timer, 84
Technical Support. See page iii
restarting, 84
Temporary references (%T), 129
Window completion failure, 575
Time tick references, 135
Window modes, 76
Timed contacts, 135
Constant Window mode, 76
Timed interrupts, 118
Limited mode, 76
performance impact, 667
Run-to-Completion, 76
Time-of-day clock, 83
Word references, 127
accuracy, 16, 19, 37, 40
Word register references (%W), 127
reading and setting, 83, 376
Word-for-word changes
synchronizing to SNTP server, 84
attempting to correct parameterized block reference,
Timers, 83
101
function block data, 224
defined, 149
in function blocks, 310
privilege level, 86
in parameterized blocks, 197, 308
symbolic variables, 149
watchdog timer, 84
Write Bytes, 499
Timing, instruction, 623
Write to flash. See Service Request (SVC_REQ) functions,
Transfer List parameters, 57
(#57)
Transition bits, 132
Transition Coils
vi PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

Index
Y
Y0 parameter, 100, 101
Z
Ziegler and Nichols tuning, 444
GFK-2222U November 2014 vii

GE Intelligent Platforms Additional Resources
Information Centers For more information, please
Headquarters: visit the GE Intelligent
1-800-433-2682 or 1-434-978-5100 Platforms web site:
Global regional phone numbers www.ge-ip.com
are available on our web site
www.ge-ip.com
g
Copyright ©2014 General Electric Company.
All Rights Reserved
*Trademark of General Electric Company.
All other brands or names are property of their GFK-2222U
respective holders.

Gfk2222u Pacsystems Rx3i Rx7i Cpu Ref Manual

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Gfk2222u Pacsystems Rx3i Rx7i Cpu Ref Manual

Uploaded by

Copyright:

Available Formats

Programmable Control Products

Note: Notes merely call attention to information that is especially significant

* indicates a trademark of General Electric Company and/or its subsidiaries.

©Copyright 2014 General Electric Company.

General Contact Information

Europe, the Middle East, and Africa

1.1. Revisions in this Manual ............................................................................................................. 2

1.2. PACSystems Control System Overview .................................................................................... 3

1.3. Common CPU Features ............................................................................................................... 5

1.4. RX3i Overview ............................................................................................................................... 7

1.5. RX7i Overview ............................................................................................................................... 9

1.6. Migrating Series 90 Applications to PACSystems ................................................................ 10

1.7. PACSystems Documentation ................................................................................................... 11

Chapter 2 CPU Features & Specifications .......................................................................................... 13

2.1. RX3i Features and Specifications ............................................................................................ 14

2.2. RX7i Features and Specifications ............................................................................................ 36

Chapter 3 CPU Configuration............................................................................................................... 47

3.1. Configuring the CPU .................................................................................................................. 48

3.2. Configuration Parameters........................................................................................................ 49

GFK-2222U October 2014 i

3.2.3 Scan Parameters ...................................................................................................................................................................51

3.3. Setting a Temporary IP Address .............................................................................................. 63

3.4. Storing (Downloading) Hardware Configuration ................................................................. 65

3.5. Configuring the Embedded Ethernet Interface .................................................................... 66

Chapter 4 CPU Operation ..................................................................................................................... 67

4.1. CPU Sweep ................................................................................................................................... 68

4.2. Program Scheduling Modes ..................................................................................................... 75

4.3. Window Modes ........................................................................................................................... 76

4.4. Data Coherency in Communications Windows.................................................................... 77

4.5. Run/Stop Operations ................................................................................................................. 78

4.6. Flash Memory Operation .......................................................................................................... 80

4.7. Logic/Configuration Source and CPU Operating Mode at Power-up ............................... 81

4.8. Clocks and Timers ...................................................................................................................... 84

4.9. System Security .......................................................................................................................... 87

ii PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

4.10. PACSystems I/O System ............................................................................................................ 91

4.11. Power-Up and Power-Down Sequences ................................................................................ 96

Chapter 5 Program Organization........................................................................................................ 99

5.1. Structure of a PACSystems Application Program .............................................................. 100

5.2. Controlling Program Execution ............................................................................................. 118

5.3. Interrupt-Driven Blocks .......................................................................................................... 119

Chapter 6 Program Data .................................................................................................................... 123

6.1. Variables .................................................................................................................................... 124

6.2. Reference Memory ................................................................................................................... 130

6.3. User Reference Size and Default ........................................................................................... 133

GFK-2222U November 2014 iii

6.4. Genius Global Data .................................................................................................................. 134

6.5. Transitions and Overrides ...................................................................................................... 135

6.6. Retentiveness of Logic and Data .......................................................................................... 136

6.7. Data Scope ................................................................................................................................ 137

6.8. System Status References ...................................................................................................... 138

6.9. How Program Functions Handle Numerical Data.............................................................. 143

6.10. User Defined Types (UDTs) ..................................................................................................... 147

6.11. Operands for Instructions ...................................................................................................... 150

6.12. Word-for-Word Changes ........................................................................................................ 152

Chapter 7 Ladder Diagram (LD) Programming............................................................................... 153

7.1. Advanced Math Functions ...................................................................................................... 154

7.2. Bit Operation Functions .......................................................................................................... 159

iv PACSystems* RX7i & RX3i CPU Reference Manual GFK-2222U

7.3. Coils ............................................................................................................................................ 176

7.4. Contacts ..................................................................................................................................... 184

7.5. Control Functions ..................................................................................................................... 193

7.6. Conversion Functions .............................................................................................................. 212