14 Ethernet communication
Ethernet overview
IP address
IP address consists of network address and host address, and distinguished by subnet mask. If programming device (such as PC) use network card to connect to LAN, the programming device and PLC must be in the same subnet. You can specify the subnet of a device by combining an IP address with a subnet mask.
The network address could be calculated by performing logic and operation between IP address and subnet mask. If the addresses are in the same network, it means that communication is possible.
| Number | Network device 1 | Network device 2 | Network connection | ||||
| IP | Subnet mask | Network address | IP | Subnet mask | Network address | ||
| 1 | 192.168.0.1 | 255.255.255.0 | 192.168.0.0 | 192.168.0.10 | 255.255.255.0 | 192.168.0.0 | Yes |
| 2 | 192.168.0.1 | 255.255.255.0 | 192.168.0.0 | 192.168.1.10 | 255.255.255.0 | 192.168.1.0 | No |
| 3 | 192.168.0.1 | 255.255.255.1 | 192.168.0.1 | 192.168.0.10 | 255.255.255.1 | 192.168.0.0 | No |
Set PC network address
(1) Click “Control panel”→”Network and Internet”→”Network and sharing center”.
(2) Click “Ethernet”→”Properties”→”Internet protocol version 4”.
(3) Set the IP address and subnet mask on the same network address as the PLC. The IP address that has been used in LAN could not be set. If the IP of PLC is 192.168.8.8, and the subnet mask is 255.255.255.0. The IP address as shown below could be set to connect PC to PLC.
Test the network connection status
Test the connection status between PC and PLC by ping command.
(1) Press “WIN” and “R” keys, and input “cmd”.
(2) If the IP address of PLC is 192.168.8.8.
1) Input “ping 192.168.8.8 ”, and enter. If it display ”100% loss”, it means that PLC could be connected.
2) Input “ping 192.168.8.8 ”, and enter. If it display ”0% loss”, it means that it could be connected to PLC.
3) The command “ping network device IP” could only be use four times. To ping network devices continuously, run “ping network device ip-t” command, it is shown as below.
PLC Editor2 connect to PLC with Ethernet
(1) Transfer settings →Ethernet configuration → Input IP address.(✎Note: The address of NIC must be on the same network segment as that of the PLC.)
(2) Click “Communication test” to comfirm the communication.
(3) After successful connection, PLC is able to operate.
PLC Editor2 Ethernet search funtion
(1) Transfer settings → NIC comfiguration → Device search. (✎Note: The address of NIC must be on the same network segment as that of the PLC.)
(2) The search interface is as below. Click search to display the PLC devices in the LAN, and select the corresponding device and click OK to communicate.
(3) The IP address of one is filled in automatically.
Ethernet configuration
Hardware interface
The LX5V is equipped with standard Ethernet ports (1 channel RJ45 port) and supports Modbus TCP communication protocol.
RJ45 specification
| Contents | Ethernet interfece |
|---|---|
| Transmission speed | 10Mbps: 10BASE-T 100Mbps: 100BASE-TX 10Mbps/100Mbps self-adaptive |
| Modulation | Basband |
| Topology | Starlike |
| Transmission medium | Class 5 or above twisted pairs or shielded twisted pairs with aluminum foil and woven mesh |
| Transmission distance | The distance between nodes: 100m or less |
| Linking number | 8 |
Total numbers of links supported
When LX5V-N series PLC is powered on, ModbusTCP server monitor is automatically enabled by default. 2 to 8 ModbusTCP clients are supported, and the port number is 502. (PLC host computer upload and download, monitor and HMI communication protocol are supported by the ModbusTCP server.)
The number of configurable links is 6. The free configurations of TCP server free protocol, TCP client free protocol, ModbusTCP server and ModbusTCP client are supported.
| Communicaition protocol | Maximum links supported |
| ModbusTCP server | 8 |
| ModbusTCP client | 6 |
| Free TCP server | 6 |
| Free TCP client | 6 |
IP address settings
Set by programming software
Project manager →Parameter→PLC parameters→Ethernet configuration. Download selected parameters through PLC after modification. The download takes effect after STOP->RUN is complete.
Set by special device
Write IP address, subnet mask, and default gateway in SD2680 to SD2691.
SM2680 is set to ON, static IP function is enable. (✎Note: DHCP function is not supported by LX5V currently.)
SM2683 is set to ON, IP identification could be modified.
New IP address takes effect when STOP->RUN or after power-on again.
| SM number | Name | Contents | R/W | SD number | Name |
|---|---|---|---|---|---|
| SM2680 | Static set IP switch | ON: Static set OFF: Automatically configurate IP address by router DHCP, and could not be modify IP. When STOP->RUN takes effect. | R/W | SD2680 | The 1st byte of IP address |
| SM2681 | Display current network information | Refresh current IP gateway subnet mask after ON. Turn OFF after the fresh is complete. | R/W | SD2681 | The 2nd byte of IP address |
| SM2682 | Display current MAC information | Refresh current MAC after ON. Turn OFF after the fresh is complete. | R/W | SD2682 | The 3rd byte of IP address |
| SM2683 | The modification flag of IP, subnet mask and gateway | ON: Modifiable OFF: Unmodifiable (After setting to ON, modify when stop->run, and automatically turn OFF after the modification) | R/W | SD2683 | The 4th byte of IP address |
| SM2684 | SD2684 | The 1st byte of subnet mask | |||
| SM2685 | SD2685 | The 2nd byte of subnet mask | |||
| SM2686 | SD2686 | The 3rd byte of subnet mask | |||
| SM2687 | SD2687 | The 4th byte of subnet mask | |||
| SM2688 | SD2688 | The 1st byte of default gateway | |||
| SM2689 | SD2689 | The 2nd byte of default gateway | |||
| SM2690 | SD2690 | The 3rd byte of default gateway | |||
| SM2691 | SD2691 | The 4th byte of default gateway |
TCP protocol
TCP protocol, short for Transport Control Protocol, is Is a connection-oriented and reliable transport layer protocol. Connection-oriented means that a normal TCP transmission need to be completed by establishing a specific virtual circuit connection between TCP client and TCP server. To transfer data over TCP, a connection must be established between hosts at both ends.
UDP protocol
UDP protocol, short for User Datagram Protocol, is a connectionless transport layer protocol. There is no guarantee of data order, a risk of data loss. It provides a simple and unreliable information transfer service for transactions and is Mainly used in data broadcasting.
Socket
When the application layer communicates data over the transport layer, TCP encounters the problem of providing concurrent services to multiple application processes at the same time. Multiple TCP connections or multiple application processes may require data to be transmitted over the same TCP protocol port. To distinguish between different application processes and connections, many computer operating systems provide interfaces called sockets for applications to interact with the TCP/IP protocol.
To generate a socket, there are three main parameters: the IP address of the destination of the communication, the transport layer protocol used (TCP or UDP) used, and the port number used. By combining these three parameters and binding to a socket, the application layer and the transport layer can distinguish communication from different application processes or network connections through the socket interface, realizing concurrent services for data transmission.
Establish an Ethernet link by socket
At least one pair of sockets is required to establish a socket link.
For TCP, the two sockets, one running on the TCP client and the other running on the TCP server. The connection process between sockets is divided into three steps: server monitor, client request, connection confirmation, also known as the three-way handshake.
Server monitor: After the server socket is enabled, it does not locate the specific client socket, but is in a state of waiting for the connection, monitoring the network status in real time, and waiting for the client's connection request.
Client request: Refers to a connection request made by a client-side socket, and the target of the connection is the server-side socket. To do this, the client-side socket must first describe the socket of the server to which it is connecting, indicate the address and port number of the server-side socket, and then make a connection request to the server-side socket
Connection confirmation: Refers to when the server-side socket listens to or receives a connection request from the client socket, it responds to the client socket request, establishes a new thread, sends the description of the server-side socket to the client. Once the client confirms this description, the connection is established. The server-side socket continues to listen and continues to receive connection requests from other client-side sockets.
In order to simplify the complexity of ladder programming, sockets have been partially simplified:
For TCP clients, merge socket() and connect() into SOCOOPEN instructions. After this function is enabled, automatically connect to the TCP server.
For TCP server, merge socket(), bind(), listen(), and accept() into SOCOOPEN instructions. After this function is enabled, automatically listen to server connection. If the server is successfully connected, the corresponding position is marked and the IP address and port information of the server are displayed.
For UDP, there is no concept of client and server. Creating a UDP socket only requires local address information and remote address information, without connection operations. Communication could be made when the address information of the local socket and the remote socket could be matched, that is, the remote address of the local socket is the same as the local address of the remote socket, and the local address of the local socket is the same as the remote address of the remote socket. For UDP connections, the connection could be established immediately by calling the SOCOPEN instruction.
LX5V-N socket configuration instructions
LX5V socket could be configured in Project manager→Extended function→Ethernet, right click to create socket configuration, as shown below.
Socket ID: The number of the socket ranges from K0 to K5, and a total of six are supported. The socket is used to specify links, and each ID could be used for one link and could not be defined repeatedly.
Communication protocol: TCP protocol and UDP protocol are supported.
Operating mode: For TCP, client and server could be selected. For UDP, this is meaningless.
Local port:
For TCP client mode, the local port would be automatically allocated by PLC without setting.
For TCP server mode, the local port ranges from 1 to 65535. Port 502 is used for internal ModbusTCP and can not be set to port 502.
For UDP mode, the local port ranges from 1 to 65535. Port 1092 is used for scanning protocol of Wecon and can not be set to port 1092.
Destination IP: It is valid in TCP client mode or UDP mode, and specify the IP of opposite end device to be linked.
Destination port: It is valid in TCP client mode or UDP mode, and specify the port number of opposite end device to be linked.
Receive timeout period(10ms): After the PLC sends the data, If the response of the opposite end device exceeds the timeout period, it is considered that the network has an abnormality and sets the wrong flag.
TCP keep-alive mechanism: When using the TCP protocol for communication, if the communication line is idle in most cases, there is only a small amount of data to be sent and received, but it is necessary to keep the link open continuously, or disconnect in time in the case of a drop, crash or forced end of the process at the other end of the communication, the keep-alive mechanism can be used to communicate.
When the keep-alive function is turned on, after the two parties stop communicating for 5 seconds, the TCP connection that opens the keep-alive function will send a survival confirmation message to the other party. If the other party responds, it means that the other party is alive and online. The connection is normal, and the survival confirmation message is sent again after 5 seconds to continue to confirm. If the other party does not confirm the survival, it means that the other party has a problem, the end that opens the keep-alive will continue to send it a survival confirmation message after 5 seconds. When the opposite end does not respond for 9 consecutive times, it means that the opposite end communication is abnormal, and the end that opens the keep-alive will actively disconnect.
Ethernet instruction
SOCOPEN/Create a socket link
Create socket link specified by (s), and update the data information of this socket link to (d1) and the status information to (d2).
-[SOCOPEN (s) (d1) (d2)]
Content, range and data type
| Parameter | Content | Range | Data type | Data type (label) |
| (s) | Socket ID | 0 to 5 | Signed BIN 16 bit | ANY16 |
| (d1) | The start device that stores the data information of socket links | - | Signed BIN 16 bit | ANY_ELEMENTARY |
| (d2) | The start device that stores the status information of socket links | - | Bit | ANY_BOOL |
Device used
| Instruction | Parameter | Devices | Offset modification | Pulse extension | |||||||||||
| Y | M | S | SM | D.b | T | C | D | R | SD | K | H | [D] | XXP | ||
| SOCOPEN | Parameter 1 | ● | ● | ||||||||||||
| Parameter 2 | ● | ● | ● | ● | ● | ||||||||||
| Parameter 3 | ● | ● | ● | ● | ● | ||||||||||
Features
✎Create the socket link specified in (s) and update the link information in (d1) and (d2).
✎When the instruction is turned on, the devices specified in (d1) and (d2) will be used in other Ethernet instructions using the same socket ID. (SOCSEND, SOCRECV, SOCCLOSE, SOCMTCP)
✎(d1) Specifies the following information (a total of 14 word devices):
| Device | Function |
| （d1） | Local port number |
| （d1+1） | The 1st segment of the destination IP |
| （d1+2） | The 2nd segment of the destination IP |
| （d1+3） | The 3rd segment of the destination IP |
| （d1+4） | The 4th segment of the destination IP |
| （d1+5） | Destination port number |
| （d1+6） | Receive timeout period(10ms) |
| （d1+7） | Actual receiving length (byte) |
| （d1+8） | Current link error code |
| （d1+9） | Numbers of communication errors high bit |
| （d1+10） | Numbers of communication errors low bit |
| （d1+11） | Reserved |
| （d1+12） | Reserved |
| （d1+13） | Reserved |
✎(d2) Specifies the following information (a total of 14 bit devices):
| Device | ON status | OFF status |
| （d2） | Connecting | The connection is not turned on |
| （d2+1） | Connection completed | Connecting or not connected |
| （d2+2） | Sending data(used by SOCSEND instruction) | Data is not sent or data sending is complete |
| （d2+3） | Data sending completed(used by SOCSEND instruction) | The instruction is not started or being sent. |
| （d2+4） | Receiving data(used by SOCRECV instruction) | No data or receiving is completed |
| （d2+5） | Data receiving completed(used by SOCRECV instruction) | The instruction is not started or received |
| （d2+6） | Connection is closing | The instruction is not started or is receiving |
| （d2+7） | Connection close completed | The instruction is not started or close is complete |
| （d2+8） | Communication completed(used by SOCMTCP instruction) | In communication |
| （d2+9） | Connection error | No error in connection |
| （d2+10） | Reserved | Reserved |
| （d2+11） | Reserved | Reserved |
| （d2+12） | Reserved | Reserved |
| （d2+13） | Reserved | Reserved |
Features
Local port number:
Establish a TCP client: PLC automatically allocates the local communication port, ranging from 49152 to 65535. The port number is automatically incremented by 1 each time it is turned on.
Establish a TCP server: specified by Ethernet socket configuration of the host computer.
Establish a UDP connection: specified by Ethernet socket configuration of the host computer.
Destination IP:
Establish a TCP client: The destination address is specified by Ethernet socket configuration of the host computer.
Establish a TCP server: After the remote client connection is successful, display the IP address of the remote connection.
Establish a UDP connection: The destination address is specified by Ethernet socket configuration of the host computer.
Destination port number:
Establish a TCP client: The destination port number is specified by Ethernet socket configuration of the host computer.
Establish a TCP server: After the remote client connection is successful, display the port number of the remote connection.
Establish a UDP connection: The destination port number is specified by Ethernet socket configuration of the host computer.
Receive timeout period(10ms): specified by Ethernet socket configuration of the host computer.
Actual receiving length: This parameter is valid only when the SOCRECV instruction is used. It indicates the number of bytes received after the instruction is enabled.
Current link error code: Display the current error information. For details, Refer to Ethernet error code List.
Numbers of communication errors: total number of communication errors after successful connection (double word).
Error codes
| Error code | Content |
| 4085H | The device specified in application instruction (d1) and (d2) exceeds the corresponding device range. |
| 5080H | The specified socket is already connected and cannot be opened again. |
| 5082H | The socket used by parameter 1 exceeds the range of 0 to 5. |
| 5083H | Failed to establish TCP server. |
| 5084H | Failed to create links. |
| 5086H | The specified (d) is not configured socket or the socket is not enabled. |
| 5089H | 502 port could not be used on the TCP server because the 502 port is enabled by default. |
SOCCLOSE/Close socket link
Close socket link specified by (s).
-[SOCCLOSE (s)]
Content, range and data type
| Parameter | Content | Range | Data type | Data type (label) |
| (s) | Socket ID | 0 to 5 | Signed BIN 16 bit | ANY16 |
Device used
| Instruction | Parameter | Devices | Offset modification | Pulse extension | |
| K | H | [D] | XXP | ||
| SOCCLOSE | Parameter 1 | ● | ● | ||
Features
✎Close the socket link specified in (s).
✎When the TCP server is closed, the reset request will be sent to the remote client. At the moment, in bit device specified by SOCOPEN, the status of connection closure will be set. The socket is not actually released until the connection closure state is set and the next connection is opened
✎If the socket specified by (s) is not connected to the remote end, it cannot be closed and the instruction error occurs.
Error codes
| Error code | Content |
| 5081H | The socket specified by is not connected, and could not be closed |
| 5082H | The data specified in (s) exceeds the range of 0 to 5 |
SOCSEND/Ethernet free-form communication sending
Send the data in (s2) to the socket link specified by (s1) at the length specified by (S3).
-[SOCSEND (s1) (s2) (s3)]
Content, range and data type
| Parameter | Content | Range | Data type | Data type (label) |
| (s1) | Socket ID | 0 to 5 | Signed BIN 16 bit | ANY16 |
| (s2) | The start device that send the data | - | Signed BIN 16 bit | ANY_ELEMENTARY |
| (s3) | Sent length | 1 to 256 | Bit | ANY16 |
Device used
| Instruction | Parameter | Devices | Offset modification | Pulse extension | ||||||
| T | C | D | R | SD | K | H | [D] | XXP | ||
| SOCSEND | Parameter 1 | ● | ● | |||||||
| Parameter 2 | ● | ● | ● | ● | ● | |||||
| Parameter 3 | ● | ● | ● | ● | ● | ● | ● | |||
Features
✎Send the data specified in (s2) from the socket connected to (s1), and the length is (s3).
✎According to the devices specified by SOCOPEN, the information such as the sending status and the total sending length could be queried. For details, refer to the SOCOPEN instruction.
✎It must be used with the SOCOPEN instruction, and data can only be sent after a full link has been established.
Error codes
| Error code | Content |
| 4084H | The data in (s3) exceeds the specified range. |
| 5081H | The socket specified by is not connected, and could not be sent. |
| 5082H | The data specified in (s) exceeds the range of 0 to 5. |
SOCRECV/Ethernet free-form communication reveiving
Receive the data from the socket link in (s1) and store in the start device of (s2) at the length of (S3).
-[SOCRECV (s1) (S2) (S3)]
Content, range and data type
| Parameter | Content | Range | Data type | Data type (label) |
| (s1) | Socket ID | 0 to 5 | Signed BIN 16 bit | ANY16 |
| (s2) | The start device that receive the data | - | Signed BIN 16 bit | ANY_ELEMENTARY |
| (s3) | Receive length | 1 to 256 | Bit | ANY16 |
Device used
| Instruction | Parameter | Devices | Offset modification | Pulse extension | ||||||
| T | C | D | R | SD | K | H | [D] | XXP | ||
| SOCRECV | Parameter 1 | ● | ● | |||||||
| Parameter 2 | ● | ● | ● | ● | ● | |||||
| Parameter 3 | ● | ● | ● | ● | ● | ● | ● | |||
Features
✎Receive the data from the socket link in (s1) and store in the start device of (s2) at the length of (S3).
✎According to the devices specified by SOCOPEN, the information such as the sending status and the total sending length could be queried. For details, refer to the SOCOPEN instruction.
✎It must be used with the SOCOPEN instrcution, and data can only be sent after a full link has been established.
✎When used with SOCSEND, it could not be opened at the same time.
Error codes
| Error code | Content |
| 4084H | The data in (s3) exceeds the specified range. |
| 5081H | The socket specified by is not connected, and could not be sent. |
| 5082H | The data specified in (s) exceeds the range of 0 to 5. |
| 5087H | Receiving data timeout |
SOCMTCP/Ethernet ModbusTCP communication
Ethernet ModbusTCP client communication instruction
-[SOCMTCP (s1) (s2) (s3) (s4) (s5)]
Content, range and data type
| Parameter | Content | Range | Data type | Data type (label) |
| (s1) | Socket ID | 0 to 5 | Signed BIN 16 bit | ANY16 |
| (s2) | High byte is station number, low byte is function code | - | Signed BIN 16 bit | ANY_ELEMENTARY |
| (s3) | The Modbus address that need communication | 1 to 65536 | Unsigned BIN 16 bit | ANY16 |
| (s4) | Sent length or received length | Signed BIN 16 bit | ANY16 | |
| (s5) | Sent or received start device | Signed BIN 16 bit | ANY_ELEMENTARY |
Device used
| Instruction | Parameter | Devices | Offset modification | Pulse extension | ||||||
| T | C | D | R | SD | K | H | [D] | XXP | ||
| SOCMTCP | Parameter 1 | ● | ● | |||||||
| Parameter 2 | ● | ● | ● | ● | ● | ● | ● | |||
| Parameter 3 | ● | ● | ● | ● | ● | ● | ● | |||
| Parameter 4 | ● | ● | ● | ● | ● | ● | ● | |||
| Parameter 5 | ● | ● | ● | ● | ● | |||||
Features
✎(s1) specify the socket link. The other parameters are compatible with RS instruction Modbus master protocol.
✎(s2) high byte is station number. For ModbusTCP, the station number can be set freely.
✎(s2) low byte is function code.For details, refer to Modbus protocol description.
✎(s3) Modbus communication address, ModbusTCP server address that needs to be read or written.
✎(s4): the length read or written by Modbus.
✎(s5): the start device that Modbus receive read data or or store written data.
✎It must be used with the SOCOPEN instruction, and data can only be sent after a full link has been established.
✎This instruction can only be used when a TCP client socket link is established.
✎The communication completion information and the number of received and transmitted could be viewed in the soft devices specified in the SOCOPEN instruction.
Error codes
| Error code | Content |
| 5081H | The socket specified by is not connected, and could not communicate. |
| 5082H | The data specified in (s1) exceeds the range of 0 to 5. |
| 5086H | The socket specified by (s1) is not configured in the host computer or enabled. |
| 5088H | The SOCMTCP instruction only supports TCP client mode. |
Ethernet applications
Data exchange between two PLCs through ModbusTCP
| Parameters | PLC No.1 | PLC No.2 |
| Port number | Free internal distribution | 502 |
| IP address | 192.168.8.10 | 192.168.8.8 |
| Protocol type | ModbusTCP client | ModbusTCP server |
The socket configuration of PLC No.1
Ladder diagram logic: Automatically connect socket 0 after power on 1s. Read the 0 address length 20 of PLC No.2 to D100 to D119 after the link is successful, and set the value of D100 to D119 to address 100 of PLC No.2 after the communication is successful. Close the link when communicate successfully again, and wait 1s to re-connect after closing successfully. Repeat the actions above.
The ladder diagram of PLC No.1
As a ModbusTCP server, PLC No. 2 does not need to write instructions. (Open two links by default, and could be modified in [PLC parameters]→[Ethernet settings]. A maximum of eight links are supported.)
Data exchange between two PLCs through Free TCP
| Parameters | PLC No.1 | PLC No.2 |
| Port number | Free internal distribution | 520 |
| IP address | 192.168.8.10 | 192.168.8.8 |
| Protocol type | Free TCP client | Free TCP server |
The IP setting of PLC No.1
[Project manager]→[Parameter]→[PLC parameter]→[Ethernet settings]
The socket comfiguration of PLC No.1
[Project manager]→[Extended function]→[Ethernet],and right click to create.
The ladder diagram of PLC No.1
Ladder diagram logic: Automatically connect socket one after power on. Send character string ”hello word” initiatively to PLC No.2 after connecting successfully.
After receiving "hello word" and verifying it correctly, PLC No.2 would reply “abcdefghijklmnopqrstuvwxyz”. If PLC No.1 receives the reply of PLC No.2, the link closed.
The socket configuration of PLC No.2
[Project manager]→[Parameter]→[PLC parameter]→[Ethernet settings]
The socket comfiguration of PLC No.2
[Project manager]→[Extended function]→[Ethernet],and right click to create.
The ladder diagram of PLC No.2
Ladder diagram logic: Automatically open the monitor server link of socket one after power on. The data sent by the client is continuously read after connecting successfully. After receiving "hello word", PLC No.2 would reply “abcdefghijklmnopqrstuvwxyz”.
Data exchange between two PLCs through Free UDP
| Parameters | PLC No.1 | PLC No.2 |
| Port number | 666 | 666 |
| IP address | 192.168.8.10 | 192.168.8.8 |
| Protocol type | Free UDP | Free UDP |
The IP setting of PLC No.1
The socket configuration of PLC No.1
The ladder diagram of PLC No.1
Ladder diagram logic: After setting the NIC state bit, establish UDP socket. After the link is established successful, send a data of 20 bytes that start from D100 to 192.168.8.10: 666. After the data is sent successfully, wait for the reply data of the other party. After the reply succeeds, continues the process, and so on
The IP address configuration of PLC No.2
The socket configuration of PLC No.2
The ladder diagram of PLC No.2
Ladder diagram logic: After setting the NIC state bit, establish UDP socket. After the link is established successful, send a data of 20 bytes that start from D300 to 192.168.8.10: 666. After the data is sent successfully, wait for the reply data of the other party, and so on.
Server address table
| Word address | ||||
| Address type | Occupy | Address range | Decimal address | Total reserved address size |
| T0 to T511 | 512 WORD | 0x0000-0x01ff | 0 | 1536 |
| C0 to C255 | 256 WORD | 0x0600-0x06ff | 1536 | 1024 |
| LC0 to LC255 | 512 WORD | 0x0A00-0x0BFF | 2560 | 1024 |
| HSC0 to HSC15 | 32 WORD | 0x0E00-0x0E1F | 3584 | 512 |
| D0 to D7999 | 8000 WORD | 0x1000-0x2F3F | 4096 | 16384 |
| SD0 to SD4095 | 4096 WORD | 0x5000-0x5FFF | 20480 | 12288 |
| R0 to R29999 | 30000 WORD | 0x8000-0xF52F | 32768 | 30000 |
| Bit address | ||||
| Address type | Occupy | Address range | Decimal address | Total reserved address size |
| T0 to T511 | 512 bit | 0x0000-0x01ff | 1536 | |
| C0 to C255 | 256 bit | 0x0600-0x06ff | 1536 | 1024 |
| LC0 to LC255 | 256 bit | 0x0A00-0x0AFF | 2560 | 1024 |
| HSC0 to HSC15 | 16 bit | 0x0E00-0x0E0F | 3584 | 512 |
| M0 to M7999 | 8000 bit | 0x1000-0x2F3F | 4096 | 16384 |
| SM0 to SM4095 | 4096 bit | 0x5000-0x5FFF | 20480 | 12288 |
| Reserved | 0x8000-0xBFFF | 16383 | ||
| S0 to S4095 | 4096 bit | 0xC000-0xCFFF | 49152 | 8192 |
| X0 to X1777 | 1024 bit | 0xE000-0xE3FF | 57344 | 4096 |
| Y0 to Y1777 | 1024 bit | 0xF000-0xF3FF | 61440 | 4096 |
List of special device related to Ethernet
| SM number | Name | Content | R/W | Power down retentive |
| SM2681 | Display current network information | Refresh current IP gateway subnet mask after ON. Turn OFF after the fresh is complete. | R/W | × |
| SM2682 | Display current MAC information | Refresh current MAC after ON. Turn OFF after the fresh is complete. | R/W | × |
| SM2683 | The modification flag of IP, subnet mask and gateway | ON: Modifiable OFF: Unmodifiable (After setting to ON, modify when stop->run, and turn OFF automatically after the modification) | R/W | √ |
| SM2684 | The connecting status of NIC | ON: The network is connected OFF: The network is not connected. Please check whether the network cable is connected. | R | √ |
| SM2692 | MAC address modification flag | ON: Modifiable OFF: Unmodifiable (After setting to ON, modify when stop->run, and automatically turn OFF after the modification) | R/W | √ |
| SM2700 | ModbusTCP keep-alive mechanism | ON: open OFF: close (default) | R/W | √ |
| SM2701 | ModbusTCP server force close | ON: open OFF: close (default) (After enabling, automatically changes to OFF After it is successfully turned OFF) | R/W | × |
| SM2710 | Ethernet error flag | ON: Ethernet error. Please check SD2710 and SD2711 OFF: No Ethernet error. | R | × |
| SM2740 | ModbusTCP server connection status 1 | ON: The client is connected OFF: The client is not connected | R | × |
| SM2760 | ModbusTCP server connection status 2 | ON: The client is connected OFF: The client is not connected | R | × |
| SM2780 | ModbusTCP server connection status 3 | ON: The client is connected OFF: The client is not connected | R | × |
| SM2800 | ModbusTCP server connection status 4 | ON: The client is connected OFF: The client is not connected | R | × |
| SM2820 | ModbusTCP server connection status 5 | ON: The client is connected OFF: The client is not connected | R | × |
| SM2840 | ModbusTCP server connection status 6 | ON: The client is connected OFF: The client is not connected | R | × |
| SM2860 | ModbusTCP server connection status 7 | ON: The client is connected OFF: The client is not connected | R | × |
| SM2880 | ModbusTCP server connection status 8 | ON: The client is connected OFF: The client is not connected | R | × |
| SD number | Name | Content | R/W | Power down retentive |
| SD2680 | The 1st byte of IP address | Local IP address | R/W | √ |
| SD2681 | The 2nd byte of IP address | R/W | √ | |
| SD2682 | The 3rd byte of IP address | R/W | √ | |
| SD2683 | The 4th byte of IP address | R/W | √ | |
| SD2684 | The 1st byte of subnet mask | Local subnet mask | R/W | √ |
| SD2685 | The 2nd byte of subnet mask | R/W | √ | |
| SD2686 | The 3rd byte of subnet mask | R/W | √ | |
| SD2687 | The 4th byte of subnet mask | R/W | √ | |
| SD2688 | The 1st byte of default gateway | Local default gateway | R/W | √ |
| SD2689 | The 2nd byte of default gateway | R/W | √ | |
| SD2690 | The 3rd byte of default gateway | R/W | √ | |
| SD2691 | The 4th byte of default gateway | R/W | √ | |
| SD2692 | The 1st byte of MAC | Local MAC address | R/W | √ |
| SD2693 | The 2nd byte of MAC | R/W | √ | |
| SD2694 | The 3rd byte of MAC | R/W | √ | |
| SD2695 | The 4th byte of MAC | R/W | √ | |
| SD2696 | The 5th byte of MAC | R/W | √ | |
| SD2697 | The 6th byte of MAC | R/W | √ | |
| SD2700 | Communication speed display | 0: 100Mbps/Half-duplex 1: 100Mbps/Full-duplex 2: 10Mbps/Half-duplex 3: 10Mbps/Full-duplex | R | × |
| SD2702 | Maximum link number supported by ModbusTCP server | Maximum link number of simultaneous client links supported by local ModbusTCP server | R/W | × |
| SD2703 | The number of links of ModbusTCP | The number of links of local ModbusTCP | R | × |
| SD2710 | Error code | Ehternet error code | R | × |
| SD2711 | The socket ID of current error | -1: default ModbusTCP server 0 to 5: Custom socket error | R | × |
| SD2720 | Input low bit of number of ping request | The number of external input ping command | R | × |
| SD2721 | Input high bit of number of ping request | R | × | |
| SD2722 | Input low bit of number of ping response | The number of replies after receiving external ping command | R | × |
| SD2723 | Input high bit of number of ping response | R | × | |
| SD2724 | Input low bit of number of ping request | The number of sending ping command | R | × |
| SD2725 | Input high bit of number of ping request | R | × | |
| SD2726 | Input low bit of number of ping response | The number of replies after receiving external ping command sent | R | × |
| SD2727 | Input high bit of number of ping response | R | × | |
| SD2728 | The number of arp pack sent | Count of the number of arp packets sent | R | × |
| SD2729 | The number of arp pack received | The number of arp pack received | R | × |
| SD2730 | The number of IP pack sent | The number of IP pack sent | R | × |
| SD2731 | The number of IP pack received | The number of IP pack received | R | × |
| SD2732 | The number of TCP pack sent | The number of TCP pack sent | R | × |
| SD2733 | The number of TCP pack received | The number of TCP pack received | R | × |
| SD2734 | The number of UDP pack sent | The number of UDP pack sent | R | × |
| SD2735 | The number of UDP pack received | The number of UDP pack received | R | × |
| SD2740 | Connection one Local port number | The first ModbusTCP client to connect the connection information and error information of this PLC. | R | × |
| SD2741 | Connection one The 1st byte of IP address | R | × | |
| SD2742 | Connection one The 2nd byte of IP address | R | × | |
| SD2743 | Connection one The 3rd byte of IP address | R | × | |
| SD2744 | Connection one The 4th byte of IP address | R | × | |
| SD2745 | Connection one Opposite end port number | R | × | |
| SD2746 | Reserved | R | × | |
| SD2747 | Reserved | |||
| SD2748 | Connection one Error code | R | × | |
| SD2749 | Connection one Error communication times low word | R | × | |
| SD2750 | Connection one Error communication times high word | R | × | |
| SD2760 | Connection two Local port number | The second ModbusTCP client to connect the connection information and error information of this PLC. | R | × |
| SD2761 | Connection two The 1st byte of IP address | R | × | |
| SD2762 | Connection two The 2nd byte of IP address | R | × | |
| SD2763 | Connection two The 3rd byte of IP address | R | × | |
| SD2764 | Connection two The 4th byte of IP address | R | × | |
| SD2765 | Connection two Opposite end port number | R | × | |
| SD2766 | Reserved | R | × | |
| SD2767 | Reserved | |||
| SD2768 | Connection two Error code | R | × | |
| SD2769 | Connection two Error communication times low word | R | × | |
| SD2770 | Connection two Error communication times high word | R | × | |
| SD2780 | Connection three Local port number | The third ModbusTCP client to connect the connection information and error information of this PLC. | R | × |
| SD2781 | Connection three The 1st byte of IP address | R | × | |
| SD2782 | Connection three The 2nd byte of IP address | R | × | |
| SD2783 | Connection three The 3rd byte of IP address | R | × | |
| SD2784 | Connection three The 4th byte of IP address | R | × | |
| SD2785 | Connection three Opposite end port number | R | × | |
| SD2786 | Reserved | R | × | |
| SD2787 | Reserved | |||
| SD2788 | Connection three Error code | R | × | |
| SD2789 | Connection three Error communication times low word | R | × | |
| SD2780 | Connection three Error communication times high word | R | × | |
| SD2800 | Connection four Local port number | The forth ModbusTCP client to connect the connection information and error information of this PLC. | R | × |
| SD2801 | Connection four The 1st byte of IP address | R | × | |
| SD2802 | Connection four The 2nd byte of IP address | R | × | |
| SD2803 | Connection four The 3rd byte of IP address | R | × | |
| SD2804 | Connection four The 4th byte of IP address | R | × | |
| SD2805 | Connection four Opposite end port number | R | × | |
| SD2806 | Reserved | R | × | |
| SD2807 | Reserved | |||
| SD2808 | Connection four Error code | R | × | |
| SD2809 | Connection four Error communication times low word | R | × | |
| SD2810 | Connection four Error communication times high word | R | × | |
| SD2820 | Connection five Local port number | The fifth ModbusTCP client to connect the connection information and error information of this PLC. | R | × |
| SD2821 | Connection five The 1st byte of IP address | R | × | |
| SD2822 | Connection five The 2nd byte of IP address | R | × | |
| SD2823 | Connection five The 3rd byte of IP address | R | × | |
| SD2824 | Connection five The 4th byte of IP address | R | × | |
| SD2825 | Connection five Opposite end port number | R | × | |
| SD2826 | Reserved | R | × | |
| SD2827 | Reserved | |||
| SD2828 | Connection five Error code | R | × | |
| SD2829 | Connection five Error communication times low word | R | × | |
| SD2830 | Connection five Error communication times high word | R | × | |
| SD2840 | Connection six Local port number | The sixth ModbusTCP client to connect the connection information and error information of this PLC. | R | × |
| SD2841 | Connection six The 1st byte of IP address | R | × | |
| SD2842 | Connection six The 2nd byte of IP address | R | × | |
| SD2843 | Connection six The 3rd byte of IP address | R | × | |
| SD2844 | Connection six The 4th byte of IP address | R | × | |
| SD2845 | Connection six Opposite end port number | R | × | |
| SD2846 | Reserved | R | × | |
| SD2847 | Reserved | |||
| SD2848 | Connection six Error code | R | × | |
| SD2849 | Connection six Error communication times low word | R | × | |
| SD2850 | Connection six Error communication times high word | R | × | |
| SD2860 | Connection seven Local port number | The seventh ModbusTCP client to connect the connection information and error information of this PLC. | R | × |
| SD2861 | Connection seven The 1st byte of IP address | R | × | |
| SD2862 | Connection seven The 2nd byte of IP address | R | × | |
| SD2863 | Connection seven The 3rd byte of IP address | R | × | |
| SD2864 | Connection seven The 4th byte of IP address | R | × | |
| SD2865 | Connection seven Opposite end port number | R | × | |
| SD2866 | Reserved | R | × | |
| SD2867 | Reserved | |||
| SD2868 | Connection seven Error code | R | × | |
| SD2869 | Connection seven Error communication times low word | R | × | |
| SD2870 | Connection seven Error communication times high word | R | × | |
| SD2880 | Connection eight Local port number | The eighth ModbusTCP client to connect the connection information and error information of this PLC. | R | × |
| SD2881 | Connection eight The 1st byte of IP address | R | × | |
| SD2882 | Connection eight The 2nd byte of IP address | R | × | |
| SD2883 | Connection eight The 3rd byte of IP address | R | × | |
| SD2884 | Connection eight The 4th byte of IP address | R | × | |
| SD2885 | Connection eight Opposite end port number | R | × | |
| SD2866 | Reserved | |||
| SD2867 | Reserved | R | × | |
| SD2888 | Connection eight Error code | R | × | |
| SD2889 | Connection eight Error communication times low word | R | × | |
| SD2890 | Connection eight Error communication times high word | R | × |
Ethernet error codes table
Operational error
| Error code | Description | Action | Processing scheme | Test time |
| 3680 | Ethernet data reception error | Continue to run | Check the environment for interference. | When the instruction is executed |
| 3681 | Ethernet data reception timeout | Continue to run | Check whether the network cable is loose. Check whether the network opposite end is faulty and cannot send data. Check whether the network opposite end is not responding in time and the data is too late. For this reason, try increasing the receive timeout in the socket configuration. | When the instruction is executed |
| 3684 | ModbusTCP station number configuration error | Continue to run | Check the setting of slave station number. Check whether there is a problem with the receiving and sending mechanism of the slave station. | When the instruction is executed |
| 3685 | ModbusTCP send buffer overflow | Continue to run | Contact the technician for the error | When the instruction is executed |
| 3686 | ModbusTCP function code error | Continue to run | Check whether the function code set is supported by the PLC. | When the instruction is executed |
| 3687 | ModbusTCP address error | Continue to run | Check whether the slave station has the address. (Please refer to Modbus abnormality 02) | When the instruction is executed |
| 3688 | ModbusTCP length error | Continue to run | Check whether the communication length exceeds the range of Modbus. | When the instruction is executed |
| 3689 | ModbusTCP data error | Continue to run | Check whether the parameter of instruction is incorrect. Check whether the value set is supported by slave. (Please refer to Modbus abnormality 03) | When the instruction is executed |
| 368A | ModbusTCP slave station is busy | Continue to run | Slave returns message: Slave is busy. (Please refer to Modbus abnormality 06) | When the instruction is executed |
| 368B | ModbusTCP slave station does not support function code | Continue to run | Check whether the function code is supported by slave. (Please refer to Modbus abnormality 01) | When the instruction is executed |
| 368C | ModbusTCP slave station fault | Continue to run | Slave returns message: Slave is faulty. (Please refer to Modbus abnormality 04) | When the instruction is executed |
| 368D | ModbusTCP slave station confirmation | Continue to run | Slave returns message: Slave confirmation. (Please refer to Modbus abnormality 05) | When the instruction is executed |
| 368E | ModbusTCP protocol currently does not support this instruction | Continue to run | RS instruction could not be used when set to slave protocol. Please change protocol or close the contact before the RS instruction. | When the instruction is executed |
| 368F | Network port sending timeout | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 3690 | Receiving cache overflow | Continue to run | Check whether the other device has been sending data. | When the instruction is executed |
| 36A0 | ModbusTCP unavailable gateway | Continue to run | Slave returns message: Unavailable gateway. (Please refer to Modbus abnormality 0A) | When the instruction is executed |
| 36A1 | ModbusTCP No response was received from the target device. Generally it means that the device is not on the network. | Continue to run | Slave returns message: The device is not on the network. (Please refer to Modbus abnormality 0B) | When the instruction is executed |
| 36C0 | ModbusTCP transaction identifier error | Continue to run | Check whether the network is congested and data cannot be received. | When the instruction is executed |
| 36C1 | ModbusTCP The server is full of available links | Continue to run | Check whether SD2702 and SD2703 have too many clients to link. | When the instruction is executed |
| 36C8 | The Ethernet protocol stack is running out of space | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36C9 | The number of links exceeded the limit | Continue to run | Check whether the total number of links exceeds the limit. | When the instruction is executed |
| 36CA | The last sending is not complete | Continue to run | Use the send completion flag to judge the current send is complete before sending the next one. | When the instruction is executed |
| 36CB | TCP abnormal write | Continue to run | Use flag bit device to judge whether the connection is normal. If not, not data is sent. For example, after the closing flag is set,no data is sent. | When the instruction is executed |
| 36CC | TCP abnormal output | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36CD | The IP address has been used | Continue to run | Check whether a connection using the same address information exists. | When the instruction is executed |
| 36CE | The server receiving link error | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36CF | TCP receiving buffer overflow | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36D0 | TCP connection failed | Continue to run | The TCP client may be enabled when the network cable is not connected. | When the instruction is executed |
| 36D1 | Abnormal when closing the link initiative | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36D2 | An abnormal shutdown occurred inside the protocol stack | Continue to run | It may be closed because of no response for a long time. Check whether the opposite end is online, and whether it could be pinged. | When the instruction is executed |
| 36D3 | Initiate an RST link on the opposite end | Continue to run |
| When the instruction is executed |
| 36D4 | A single-ended shutdown of the protocol stack occurs | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36D5 | There is an IP address conflict | Continue to run | There are the same IP devices in the LAN, please change the IP address. | When the instruction is executed |
| 36D6 | There is an MAC address conflict | Continue to run | There are the same MAC devices in the LAN, please change the MAC address. | When the instruction is executed |
| 36D7 | TCP sending buffer overflow | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36D8 | UDP abnormal connection | Continue to run | IP address and port number may have been used. | When the instruction is executed |
| 36D9 | UDP sending buffer overflow | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36DA | UDP insufficient memory space when sending | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36DB | UDP failed to send | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36DC | UDP memory release failure | Continue to run | Contact the technician for the error. | When the instruction is executed |
| 36DD | UDP receiving buffer overflow | Continue to run | The data length that UDP received exceeds the limit value 512. | When the instruction is executed |
| 4084 | The data input in the application instruction exceeds the specified range. | Continue to run | Modify application instruction parameter. | When the application instruction is executed |
| 4085 | The output result in the read application instruction exceeds the device range. | Continue to run | Modify application instruction parameter. | When the application instruction is executed |
| 4086 | The output result in the read application instruction exceeds the device range. | Continue to run | Modify application instruction parameter. | When the application instruction is executed |
| 5080 | The Ethernet socket is already linked and could not be opened again | Continue to run | Check whether the SOCOPEN instruction is executed repeatedly. | When the application instruction is executed |
| 5081 | The Ethernet socket is not opened and could not be operated | Continue to run | Check whether the connected bit of SOCOPEN instruction (d2) parameter is set. | When the application instruction is executed |
| 5082 | The socket ID that Ethernet instruction inputs exceeds the range | Continue to run | Modify application instruction parameter. | When the application instruction is executed |
| 5083 | Failed to create TCP server | Continue to run | Check whether the link is full. | When the application instruction is executed |
| 5084 | Failed to create links | Continue to run | Check whether the link is full. | When the application instruction is executed |
| 5086 | The socket ID used by Ethernet instruction is not configured in the host computer or is not enabled after configuration | Continue to run | Check the Ethernet configuration of the host computer. | When the application instruction is executed |
| 5087 | SOCRECV instruction reception timeout | Continue to run |
| When the application instruction is executed |
| 5088 | The socket specified by SOCMTCP instruction uses the configuration mode of non-TCP client | Continue to run | Check the Ethernet configuration of the host computer. | When the application instruction is executed |
| 5089 | When Ethernet socket configures a TCP server, specify the local port as 502 | Continue to run | The port 502 is occupied by the system. Please modify the local port number. | When the application instruction is executed |
| 508A | The UDP port is set to 1092 | Continue to run | The UDP port 1092 is occupied by the system and could not be used. Please modify the local port number. | When the application instruction is executed |
| 5090 | Abnormal network cable connection | Continue to run | Check whether the network cable is connected | When the application instruction is executed |