ABS EIP App 1 50

Fieldbus Appendix
Anybus-S EtherNet/IP
Modbus/TCP, EtherNet/IP & IT Functionality
Rev.1.50
HMS Industrial Networks AB

Germany + 49 - 721 - 96472 - 0 ge-sales@hms-networks.com
Japan + 81 - 45 - 478 -5340 jp-sales@hms-networks.com
Sweden + 46 - 35 - 17 29 20 sales@hms-networks.com
U.S.A + 1 - 773 - 404 - 3486 us-sales@hms-networks.com
UK + 44 (0) 1908 - 359301 uk-sales@hms-networks.com
Table of Contents
Table of Contents
Preface About This Document

How To Use This Document .............................................................................................................P-1
Important User Information...............................................................................................................P-1
Related Documents ..............................................................................................................................P-2
Document History................................................................................................................................P-2
Conventions & Terminology ..............................................................................................................P-3
Support ...................................................................................................................................................P-3
Chapter 1 About the Anybus-S EtherNet/IP

Features .................................................................................................................................................. 1-1
Overview ................................................................................................................................................ 1-2
Status Indicators........................................................................................................................... 1-2
Chapter 2 Basic Operation

EtherNet/IP .......................................................................................................................................... 2-1
General ........................................................................................................................................ 2-1
Data Exchange............................................................................................................................ 2-1
Implementation Notes................................................................................................................... 2-1
Modbus/TCP ........................................................................................................................................ 2-2
General ........................................................................................................................................ 2-2
Addressing Modes ........................................................................................................................ 2-2
Supported Exception Codes .......................................................................................................... 2-2
Anybus Addressing Mode (Default) ............................................................................................. 2-3
Modbus Addressing Mode ............................................................................................................ 2-4
Filesystem............................................................................................................................................... 2-5
General ........................................................................................................................................ 2-5
Filesystem Overview ...................................................................................................................... 2-6
System Files.................................................................................................................................. 2-6
Chapter 3 Basic Network Configuration

TCP/IP Settings.................................................................................................................................... 3-1
Ethernet Configuration File (‘ethcfg.cfg’)......................................................................................... 3-2
General ........................................................................................................................................ 3-2
IP Access Control ................................................................................................................................. 3-3
On/Off Line Configuration................................................................................................................ 3-3
Anybus IPconfig (HICP) ..................................................................................................................... 3-4
Chapter 4 FTP Server

General ................................................................................................................................................... 4-1
Chapter 5 Telnet Server

General ................................................................................................................................................... 5-1
Table of Contents II
General Commands.............................................................................................................................. 5-2

Diagnostic Commands......................................................................................................................... 5-3
File System Operations ........................................................................................................................ 5-3
Chapter 6 Web Server

General ................................................................................................................................................... 6-1
Authorization......................................................................................................................................... 6-2
Content Types ....................................................................................................................................... 6-3
Chapter 7 SMTP Client

General ................................................................................................................................................... 7-1
Email Definitions.................................................................................................................................. 7-2
Chapter 8 Server Side Include (SSI)

Functions................................................................................................................................................ 8-2
Changing SSI output .......................................................................................................................... 8-10
SSI Output String File............................................................................................................... 8-10
Temporary SSI Output change.................................................................................................... 8-11
Chapter 9 CIP Object Implementation

General ................................................................................................................................................... 9-1
Identity Object, Class 01h ................................................................................................................... 9-2
General Information ..................................................................................................................... 9-2
Class Attributes ........................................................................................................................... 9-2
Instance Attributes ....................................................................................................................... 9-2
Device Status................................................................................................................................ 9-3
Reset Service ................................................................................................................................. 9-3
Message Router, Class 02h .................................................................................................................. 9-4
Instance Attributes ....................................................................................................................... 9-4
Assembly Object, Class 04h ................................................................................................................ 9-5
Instance 03h Attributes (Heartbeat, Input-Only).......................................................................... 9-5
Instance 04h Attributes (Heartbeat, Listen-Only) ........................................................................ 9-5
Instance 05h Attributes (Configuration Data) .............................................................................. 9-5
Instance 64h... 69h Attributes (Producing Instances) .................................................................... 9-6
Instance 96h... 9Bh Attributes (Consuming Instance) ................................................................... 9-6
Connection Manager, Class 04h ......................................................................................................... 9-7
Instance Descriptions .................................................................................................................... 9-7
Class 1 Connection Details........................................................................................................... 9-7
Class 3 Connection Details........................................................................................................... 9-8
Table of Contents III
Diagnostic Object, Class AAh ............................................................................................................ 9-9

Instance Attributes, Instance 01h ................................................................................................. 9-9
I/O Data Input Mapping Object, Class A0h ................................................................................. 9-10
General Information ................................................................................................................... 9-10
Class Attributes ......................................................................................................................... 9-10
Instance Attributes, Instance 01h ............................................................................................... 9-10
I/O Data Output Mapping Object, Class A1h .............................................................................. 9-11
Parameter Data Input Mapping Object, Class B0h....................................................................... 9-12
Parameter Data Output Mapping Object, Class B1h.................................................................... 9-13
Port Object, Class F4h....................................................................................................................... 9-14
TCP/IP Interface Object, Class F5h ............................................................................................... 9-15
Instance Attributes ..................................................................................................................... 9-15
Ethernet Link Object, Class F6h...................................................................................................... 9-16
Instance Attributes ..................................................................................................................... 9-16
Chapter 10 Fieldbus Specific Mailbox Commands

Fault Information................................................................................................................................ 10-1
Table of Contents IV
General Configuration Commands.................................................................................................. 10-2

Set Ethernet Configuration (SET_ETN_CONFIG)............................................................... 10-3
Read Ethernet Configuration (READ_ETN_CONFIG)....................................................... 10-4
Get MAC Address (GET_MAC_ADDR)............................................................................ 10-5
Connection Timeout (CONNECT_TIMEOUT) .................................................................... 10-6
Set Host and Domain (SET_HOST_DOMAIN).................................................................. 10-7
Get Host and Domain (GET_HOST_DOMAIN) ................................................................ 10-8
Disable / Enable ARP Config (ARP_CFG_CONTROL) ................................................... 10-9
Disable / Enable HICP (HICP_CFG_CONTROL) ......................................................... 10-10
Disable DHCP (DISABLE_DHCP) .................................................................................. 10-11
Set DNS Server Settings (SET_DNS_SERVERS) ............................................................ 10-12
Get DNS Server Settings (GET_DNS_SERVERS)........................................................... 10-13
Set SMTP Server (SET_SMTP_SERVER)........................................................................ 10-14
Set SMTP Server by Name (SET_SMTP_SERVER_NAME) ........................................ 10-15
Get SMTP Server (GET_SMTP_SERVER)...................................................................... 10-16
Disable Web Server (DISABLE_WEB_SERVER)........................................................... 10-17
Enable Web Server (ENABLE_WEB_SERVER)............................................................ 10-18
Disable FTP server (DISABLE_FTP_SERVER) ............................................................. 10-19
Disable Telnet Server (DISABLE_TELNET_SERVER) ................................................ 10-20
Global Admin Mode (GLOBAL_ADMIN_MODE)......................................................... 10-21
Disable Virtual File System (DISABLE_VFS) ................................................................... 10-22
Mailbox File System Interface......................................................................................................... 10-23
Open File (FILE_OPEN)..................................................................................................... 10-24
Close File (FILE_CLOSE)................................................................................................... 10-25
Read File (FILE_READ)..................................................................................................... 10-26
Write File (FILE_WRITE) .................................................................................................. 10-27
Delete File (FILE_DELETE) ............................................................................................. 10-28
Move File (FILE_MOVE) ................................................................................................... 10-29
Rename File (FILE_RENAME) ......................................................................................... 10-30
Copy File (FILE_COPY) ...................................................................................................... 10-31
Create Directory (DIR_CREATE)........................................................................................ 10-32
Delete Directory (DIR_DELETE)........................................................................................ 10-33
Open Directory (DIR_OPEN) ............................................................................................... 10-34
Read Directory (DIR_READ) ............................................................................................... 10-35
Close Directory (DIR_CLOSE) ............................................................................................. 10-37
Create RAM disc (CREATE_RAM_DISC) ...................................................................... 10-38
Modbus/TCP Specific Commands................................................................................................ 10-39
Modbus Connection Timeout (MB_CONN_TIMEOUT)..................................................... 10-40
Disable Modbus/TCP server (DISABLE_MB_TCP).......................................................... 10-41
Modbus ON/OFF Line Configuration (MB_ON_OFF_LINE_CONFIG) ..................... 10-42
Write Exception Status (WR_EXP_STAT)......................................................................... 10-43
Set Modbus Coil Area Size (MB_SET_COIL_AREA_SIZE).......................................... 10-44
Table of Contents V
EtherNet/IP Specific Commands..................................................................................................10-45

Set Product Info All (PRODUCT_INFO_ALL) ................................................................ 10-46
Set Product Info (SET_PRODUCT_INFO) ........................................................................ 10-47
Set Product Code (SET_PRODUCT_CODE) ..................................................................... 10-48
Parameter Data Input Mapping (PARAMETER_INPUT_MAP) .................................... 10-49
Parameter Data Output Area Mapping (PARAMETER_OUTPUT_MAP) .................... 10-51
I/O Data Input Area Mapping (IO_INPUT_MAP)........................................................... 10-53
I/O Data Output Area Mapping (IO_OUTPUT_MAP) .................................................... 10-55
Send UCMM (SEND_UCMM) .......................................................................................... 10-57
UCMM Request (UCMM_REQUEST).............................................................................. 10-59
Register Class (REGISTER_CLASS).................................................................................. 10-60
Deregister Class (DEREGISTER_CLASS) ........................................................................ 10-61
Enable Routing (ENABLE_ROUTING) ........................................................................... 10-62
Register Port (REGISTER_PORT) ...................................................................................... 10-63
Route Unconnected Send (ROUTE_REQUEST).................................................................. 10-66
Enable Reset Notification (ENABLE_ID_RESET_NOTIFY) ........................................ 10-68
Reset Notification (ID_RESET_NOTIFY).......................................................................... 10-69
Get Reset Parameter (GET_ID_RESET_PARAM)........................................................... 10-70
Copy I/O Status (COPY_IO_STATUS) ............................................................................. 10-71
Disable EtherNet/IP (DISABLE_ETHERNET_IP) ...................................................... 10-72
Change Ethernet Port (CHANGE_ETHERNET_PORT) ............................................... 10-73
Reset on IP Change (RST_ON_IP_CHANGE).................................................................. 10-74
Enable Configuration Assembly (ENABLE_CONFIG_SY) .............................................. 10-75
Configuration Assembly Request (CONFIG_SY_REQUEST)............................................ 10-76
Enable Exact IO Match (ENABLE_IO_MATCH).......................................................... 10-77
Mailbox Socket Interface ................................................................................................................. 10-78
Socket Non-Blocking (SOCKET_NB)................................................................................... 10-79
Socket Blocking (SOCKET_B)............................................................................................... 10-80
Listen (LISTEN) ................................................................................................................... 10-81
Accept (ACCEPT) ................................................................................................................. 10-82
Connect (CONNECT) ........................................................................................................... 10-83
Send (SEND) ......................................................................................................................... 10-85
Receive (RECV)...................................................................................................................... 10-86
Send To (SEND_TO)............................................................................................................ 10-87
Receive From (RECV_FROM) ............................................................................................. 10-88
Close (CLOSE) ...................................................................................................................... 10-89
Send Fragment (SEND_FRAG)........................................................................................... 10-90
Receive Fragment (RECV_FRAG) ....................................................................................... 10-91
Send Fragment To (SEND_FRAG_TO) ............................................................................. 10-93
Receive Fragment From (RECV_FRAG_FROM) ............................................................... 10-94
Get Socket Option (GET_SOCKET_OPTION) ................................................................. 10-96
Set Socket Option (GET_SOCKET_OPTION) .................................................................. 10-97
Other Commands ............................................................................................................................. 10-98
Alter LNK and ACT LED Functionality (ALT_LNK_ACT_LEDS)............................ 10-99
Alter Module Status LED Functionality (ALT_MS_LED_FUNCTION).....................10-100
Alter Network Status LED Functionality (ALT_NS_LED_FUNCTION)...................10-101
Get DIP Switch (GET_DIP_SWITCH)............................................................................10-102
DNS Request (DNS_REQUEST).....................................................................................10-103
Send Email (SEND_EMAIL) ...........................................................................................10-104
Request SSI Data (REQUEST_SSI_DATA) ..................................................................10-106
Write SSI Data (WRITE_SSI_DATA)............................................................................10-107
Write Output Area (WRITE_OUTPUT_AREA) ...........................................................10-108
Table of Contents VI
Chapter 11 Fieldbus Specific Area

Memory Map ....................................................................................................................................... 11-1
Socket Status Structure....................................................................................................................... 11-2
EtherNet/IP Connection Status ...................................................................................................... 11-3
Appendix A Miscellaneous
Control Register Area.......................................................................................................................... A-1
Firmware Upgrade ............................................................................................................................... A-2
Formatting the File System ................................................................................................................ A-2
Appendix B Technical Specification

Electrical Specification .........................................................................................................................B-1
Protective Earth (PE) Requirements.............................................................................................B-1
Power Supply................................................................................................................................B-1
Environmental Specification...............................................................................................................B-1
EMC Compliance (CE)........................................................................................................................B-1
Appendix C Connectors
Application Connector........................................................................................................................ C-1
Ethernet................................................................................................................................................. C-1
Appendix D Mechanical Specification

Measurements, Connectors & LEDs................................................................................................D-1
Preface
About This Document
How To Use This Document

This document is intended to be used in conjunction with the Anybus-S Parallel Design Guide. The
reader of this document is expected to have basic knowledge in the EtherNet/IP and Modbus/TCP net-
working systems, and communication systems in general. Please consult the general Anybus-S Parallel
Design Guide for general information about the Anybus-S platform.
Note: This document describes the functionality provided by the latest firmware release. Some features
may be missing or working somewhat differently in older firmware releases. Please contact HMS to ob-
tain the latest version.
Important User Information

The data and illustrations found in this document are not binding. We, HMS Industrial Networks AB,
reserve the right to modify our products in line with our policy of continuous product development. The
information in this document is subject to change without notice and should not be considered as a com-
mitment by HMS Industrial Networks AB. HMS Industrial Networks AB assumes no responsibility for
any errors that may appear in this document.
There are many applications of this product. Those responsible for the use of this device must ensure
that all the necessary steps have been taken to verify that the application meets all performance and safe-
ty requirements including any applicable laws, regulations, codes, and standards.
Anybus® is a registered trademark of HMS Industrial Networks AB. All other trademarks are the prop-
erty of their respective holders.
The examples and illustrations in this document are included solely for illustrative purposes. Because of
the many variables and requirements associated with any particular implementation, HMS cannot as-
sume responsibility or liability for actual use based on these examples and illustrations.
Warning: This is a class A product. In a domestic environment this product may cause radio interfer-
ence in which case the user may be required to take adequate measures.
ESD Note: This product contains ESD (Electrostatic Discharge) sensitive parts that may be damaged
if ESD control procedures are not followed. Static control precautions are required when
handling the product. Failure to observe this may cause damage to the product.
About This Document P-2
Related Documents
Document name Author
Open Modbus/TCP Specification Schneider Automation
RFC 821 Network Working Group
RFC 1918
ENIP Specifications ODVA
Anybus-S Parallel Design Guide HMS
Anybus-S Ethernet Development Specification v1.16
Document History
Summary of Recent Changes (1.40... 1.50)
Change Page(s)
Major rewrite -
Revision List
Revision Date Author(s) Chapter(s) Description

<1.30 - - - (See previous versions)
1.30 2003-05-23 PeP All Major update
1.31 2003-09-24 PeP 8, 3 Minor update
1.32 2003-10-15 ToT 10 Minor corrections in the response messages
1.40 2005-01-13 PeP All Misc. updates
1.50 2006-06-22 PeP All Major update/rewrite
About This Document P-3
Conventions & Terminology

The following conventions are used throughout this document:
• Numbered lists provide sequential steps
• Bulleted lists provide information, not procedural steps
• Mailbox commands that must to be sent “during module initialization” must be sent between the
“START_INIT” and “END_INIT” commands.
• The term ‘module’ is used when referring to the ABS-EIP-2.
• The term ‘application’ is used when referring to the hardware that is connected to the Anybus
Application Connector.
• Hexadecimal values are written in the format NNNNh or 0xNNNN, where NNNN is the hex-
adecimal value.
• Binary values are written in the format NNNNb, where NNNN is the binary value.
• All pictures in this manual shows the standard version of this product. However, other connec-
tors, leds and switches may be present depending on configuration.
• 16/32 bit values are written in big endian Motorola format
• Floating point values are in the IEEE Standard 754 format
Support
HMS Sweden (Head Office)

E-mail: support@hms-networks.com
Phone: +46 (0) 35 - 17 29 20
Fax: +46 (0) 35 - 17 29 09
Online: www.anybus.com
HMS America
E-mail: us-support@hms-networks.com
Phone: +1-773-404-2271
Toll Free: 888-8-Anybus
Fax: +1-773-404-1797
HMS Germany
E-mail: ge-support@hms-networks.com
Phone: +49-721-96472-0
Fax: +49-721-964-7210
HMS Japan
E-mail: jp-support@hms-networks.com
Phone: +81-45-478-5340
Fax: +81-45-476-0315
Chapter 1
About the Anybus-S EtherNet/IP

The Anybus-S EtherNet/IP communication module provides instant integration in any ethernet based
lan via SMTP, FTP, Telnet, HTTP as well as EtherNet/IP and Modbus/TCP. Additional protocols can
be implemented on top of TCP/IP or UDP using the transparent socket interface.
The data exchange can be monitored via the built in web server, Modbus/TCP, or using event triggered
email messages. SSI (Sever Side Include) technology enables web pages and email messages to carry dy-
namic content such as I/O data, configuration settings, or even application specific data passed to the
Anybus module through the mailbox interface.
As a member of the Anybus concept of interchangeable network products, the Anybus-S EtherNet/IP
is compatible with any product that supports the Anybus-S application interface with only little or no
software adjustments.
Features
General
• Supports shielded (FTP) and unshielded (UTP) cables
• Flexible file system providing both volatile and non-volatile storage areas
• Security framework
• Integrated FTP server provides easy file management using standard FTP clients.
• Server Side Include (SSI) capability
• Web server
• Email client (Messages can be triggered by data events or directly by the application)
Industrial Protocols
• EtherNet/IP
- Group 2 and 3 server
• Modbus/TCP server
- Conforms to Modbus/TCP v1.0
About the Anybus-S EtherNet/IP 1-2
Overview
/LQN$FWLYLW\ 0RGXOH6WDWXV

$FWLYLW\ 1HWZRUN6WDWXV
# Description Comment
1 Application Connector See C-1 “Application Connector”
2 Ethernet Connector See C-1 “Ethernet”
3 Configuration Switch 3-1 “TCP/IP Settings”
4 Anybus Watchdog Consult the general Anybus-S Parallel Design Guide for further information.
5 Status Indicators These LEDs indicate run time status and errors to the user, see below.
Status Indicators
These leds indicate run time status and errors to the user. During power up, a led test sequence is per-
formed according to the EtherNet/IP specification.
Link (Activity)
The behaviour of this led can be altered, see 10-99 “Alter LNK and ACT LED Functionality
(ALT_LNK_ACT_LEDS)”.
• Led configuration 1 (Default)
State Description
Off Link not sensed
Green Link sensed
• Led configuration 2
State Description
Off Link not sensed
Green Link sensed
Green, flashing Activity; receiving/transmitting ethernet packets
Module Status
This led is required for EtherNet/IP conformance and must be labelled with one of the following:
“MS”, “Mod”, “Mod Status” or “Module Status”.
The behaviour of this led can be changed using the command ALT_MS_LED_FUNCTION, see 10-
100 “Alter Module Status LED Functionality (ALT_MS_LED_FUNCTION)”.
State Description
Off No power
Green (1Hz) IP address not set using configuration switch.
Red (1Hz) Invalid MAC address. (Internal Error)
Red (2Hz) Failed to load Ethernet configuration from FLASH
Red (4Hz) Internal error (Fatal)
Red Duplicate IP address detected
State Description
Off Operating at 10Mbit
Green Operating at 100Mbit
Red telephone flash Invalid MAC address.
(2 flashes on, long off)
Red telephone flash Failed to load Ethernet configuration from FLASH
Red telephone flash Internal error (Fatal)
Red telephone flash Duplicate IP address detected
State Description
Off No power
Green Controlled by a Scanner in Run state
Green, flashing Not configured, or Scanner in Idle state
Red, flashing A minor recoverable fault has been detected
Red A major unrecoverable fault has been detected
Alternating Green/Red Self-test in progress
This configuration deactivates this led.
Network Status
This led is required for EtherNet/IP conformance and must be labelled with one of the following: “NS”,
“Net”, “Net Status” or “Network Status”.
The behaviour of this led can be changed using the command ALT_NS_LED_FUNCTION, see 10-
101 “Alter Network Status LED Functionality (ALT_NS_LED_FUNCTION)”
In this configuration, this led indicates the number established Modbus/TCP connections to the
module. The number of established connections is equal to the number of flashes on this led.
This configuration deactivates this led.
State Description
Off No power or no IP address
Green On-line, one or more connections established (CIP Class 1 or 3)
Green, flashing On-line, no connections established
Red Duplicate IP address, fatal error
Red, flashing One or more connections timed out (CIP Class 1 or 3)
Alternating Green/Red Self test in progress
Activity
The behaviour of this led can be altered, see 10-99 “Alter LNK and ACT LED Functionality
(ALT_LNK_ACT_LEDS)”.

The Activity led flashes green each time a packet is received or transmitted.
In this configuration, this led is deactivated and the Activity and Link indications are merged.
Chapter 2
Basic Operation
EtherNet/IP
General
EtherNet/IP is based on the Control and Information protocol (CIP) which is also the application layer
for DeviceNet and ControlNet. The module acts as a Group 2 and 3 server on the EtherNet/IP net-
work.
The Input- and Output Data is accessed using I/O connections or Explicit messages towards the As-
sembly Object and the Parameter Input/Output Mapping Objects.
See also...
• 9-1 “CIP Object Implementation”
Data Exchange
I/O Data is exchanged on change of value, and can be accessed using I/O connections towards the As-
sembly Object. Parameter Data can be accessed acyclically via the Parameter Input- and Output Map-
ping Objects.
See also...
• 21-4 “Assembly Object, Class 04h”
• 21-6 “Parameter Data Input Mapping Object, Class B0h”
• 21-7 “Parameter Data Output Mapping Object, Class B1h”)
• 11-6 “Fieldbus Settings”)
Implementation Notes
Rockwell Automation PLCs uses the first four bytes consumed by a device defined for status informa-
tion. This status information is not defined in the EtherNet/IP specification, but all currently available
PLCs have this implementation.
By default, these four I/O bytes are parsed off and ignored. However, this behaviour can be changed
using the COPY_IO_STATUS mailbox command (see 10-71 “Copy I/O Status
(COPY_IO_STATUS)”.
Basic Operation 2-2
Modbus/TCP
General
The Modbus/TCP protocol is an implementation of the standard Modbus protocol running on top of
TCP/IP. The built in Modbus/TCP server provides access to the Input- and Output Data areas via a
subset of the functions defined in the Modbus/TCP specification.
All Modbus/TCP messages are exchanged through TCP port no. 502. For detailed information regard-
ing the Modbus/TCP protocol, consult the Open Modbus Specification.
Addressing Modes
The module features two different modes of operation regarding the Modbus/TCP communication:
• Anybus Addressing Mode (Default)

Compared to Modbus Addressing Mode, this mode allows data to be addressed in a more flexible
manner. Note however that several function codes can be used to access the same data in the
module.
While this may appear confusing at first, it allows data to be manipulated in ways not possible in
Modbus Addressing Mode (e.g. it is possible to manipulate individual bits of a register by access-
ing coils associated with the same memory location).
See also...
- 2-3 “Anybus Addressing Mode (Default)”
• Modbus Addressing Mode

In this mode, the Input- and Output Data areas are mapped to different function codes.
See also...
- 2-4 “Modbus Addressing Mode”
See also...
• 10-44 “Set Modbus Coil Area Size (MB_SET_COIL_AREA_SIZE)”
Supported Exception Codes
Code Name Description

0x01 Illegal function The function code in the query is not supported
0x02 Illegal data address The data address received in the query is outside the initialized memory area
0x03 Illegal data value The data in the request is illegal
See also...
• 10-43 “Write Exception Status (WR_EXP_STAT)”
Basic Operation 2-3
Anybus Addressing Mode (Default)
Supported Function Codes

The following function codes can be used in this mode:
Modbus Function Function Code Associated with...

Read Coil 1 Input- and Output Data
Read Input Discretes 2
Read Multiple Registers 3
Read Input Registers 4
Write Coil 5 Output Data
Write Single Register 6
Force Multiple Coils 15
Force Multiple Registers 16
Mask Write Register 22
Read/Write Registers 23 Input- and Output Data
Coil & Register Map
The data is mapped to Coils & Registers as follows:
Register # Coil # Area Offset in Area Comments

1 1... 16 Input Data 000h... 001h -
2 17... 32 002h... 003h
3 33... 48 004h... 005h
4 49... 64 006h... 007h
... ... ...
1024 16369... 16384 7FEh... 7FFh
1025 16385... 16400 Output Data 000h... 001h -
1026 16401... 16416 002h... 003h
1027 16417... 16432 004h... 005h
1028 16433... 16448 006h... 007h
... ... ...
2048 32753... 32768 7FEh... 7FFh
Note 1: The table above applies to all function codes.

Note 2: Coils are mapped MSB first, i.e. coil #1 corresponds to bit 15 of register #1.
Basic Operation 2-4
Modbus Addressing Mode
Supported Function Codes

The following function codes can be used in this mode:
Modbus Function Function Code Associated with...

Read Multiple Registers 3 Output Data
Read Input Registers 4 Input Data
Write Single Register 6 Output Data
Force Multiple Registers 16
Mask Write Register 22
Read/Write Registers 13
Input Data
The Input Data is mapped to Coils & Registers as follows:
Register # Input Data Bytes Comments

1 000h + Coil Size In Each register corresponds to two bytes of Input
2 002h + Coil Size In Data.
3 004h + Coil Size In
5 ...
1024 7FEh + Coil Size In
Coil # Input Data Bytes Comments

1... 8 000h Each coil corresponds a single bit of Input Data.
9... 16 001h
17... 24 002h Note: Coils are mapped MSB first, i.e. coil #1 cor-
responds to the most significant bit of Input Data
... ...
byte 000h
16377... 16384 7FFh
Output Data
The Output Data is mapped to Coils & Registers as follows:
Register # Output Data Bytes Comments

1 000h + Coil Size Out Each register corresponds to two bytes of Output
2 002h + Coil Size Out Data.
3 004h + Coil Size Out
5 ...
1024 7FEh + Coil Size Out
Coil # Output Data Byte Comments

1... 8 000h Each coil corresponds a single bit of Output Data
9... 16 001h
17... 24 002h Note: Coils are mapped MSB first, i.e. coil #1 cor-
responds to the most significant bit of Output Data
... ...
byte 000h
16377... 16384 7FFh
Basic Operation 2-5
Filesystem
General
The module features a built in filesystem, which is used to store information such as web files, network
communication settings, email messages etc.
The filesystem can be accessed using FTP, HTTP, Telnet, and directly by the application via the mailbox
interface.
Storage Areas
The filesystem consists of the different storage areas:
• Non-volatile area (approx. 1Mb)

This section is intended for static files such as web files, configuration files etc.
• Volatile area (approx. 1Mb)

This area is intended for temporary storage; data placed here will be lost in case of power loss or
reset. Note that this area is not available by default, and must be mounted by the application dur-
ing initialisation (see 10-38 “Create RAM disc (CREATE_RAM_DISC)”)
Conventions
• ‘\’ (backslash) is used as a path separator
• A ‘path’ originates from the system root and as such must begin with a ‘\’
• A ‘path’ must not end with a ‘\’
• Names may contain spaces (‘ ‘) but must not begin or end with one.
• Names must not contain one of the following characters: ‘\ / : * ? “ < > |’
• Names cannot be longer than 48 characters (plus null termination)
• A path cannot be longer than 256 characters (filename included)
• The maximum number of simultaneously open files is 40
• The maximum number of simultaneously open directories is 40
Important Note:
The non-volatile storage is located in FLASH memory. Each FLASH segment can only be erased ap-
proximately 1000000 times due to the nature of this type of memory.
The following operations will erase one or more FLASH segments:
• Deleting, moving or renaming a file or directory
• Writing or appending data to an existing file
• Formatting the filesystem
Basic Operation 2-6
Filesystem Overview
DGPLQURRW
XVHUURRW
XVHU
VVLBVWUFIJ
KWWSFIJ
HWKFIJFIJ
WHOZHOFIJ
SVZG SURWHFWHG
RQRIIOQFIJ
LSBDFFVFIJ V\VBSVZGFIJ
5$0 YRODWLOHRSWLRQDO HPDLO
HPDLOBFIJ

SVZG SURWHFWHG
HPDLOBFIJ
DGBSVZGFIJ
HPDLO
HPDLOBFIJ
.
.
.
HPDLOBFIJ
System Files
The filesystem contains a set of files used for system configuration. These files, known as “system files”,
are regular ASCII files which can be altered using a standard text editor (such as the Notepad in Micro-
soft Windows™). Note that some of these files may also be altered by the Anybus module itself, e.g.
when using SSI (see 8-1 “Server Side Include (SSI)”).
The format of the system files are based on the concept of ‘keys’, where each ‘key’ can be assigned a
value, see example below.
Example:
[Key1]
value of key1
[Key2]
value of key2
The exact format of each system file is described in detail later in this document.
Chapter 3
Basic Network Configuration
TCP/IP Settings
The module offers three modes of operation regarding the TCP/IP settings:
• Settings specified by Configuration Switches

If the on-board switches are set to a non-zero value, the module will use the following settings:
IP Address: 192.168.0.x (x = binary switch value)
Gateway: 255.255.255.0
Subnet: 255.255.255.0
DHCP: OFF
The switches specify the binary value of the last byte of the IP address as
illustrated by the following example, where the IP address is set to 21
06% /6%
192.168.0.42.
• Settings specified by Application

The application can specify the settings during startup. The module will only use these settings
if the on-board switches are set to 0 (zero).
• Settings specified in ‘ethcfg.cfg’

If the on-board switches are set to 0 (zero), and no settings have been specified by the application
during startup, the module will use the settings stored in the system file ‘ethcfg.cfg’.
If this file is missing, the module will attempt to retrieve the settings via DHCP or HICP for 30
seconds. If no configuration has been received within this period, the module will halt and indi-
cate an error on the on-board LEDs.
EtherNet/IP
The TCP/IP settings can be accessed from EtherNet/IP through the TCP/IP Interface Object.
See also...
• 9-1 “CIP Object Implementation”
DHCP/BootP
The module can retrieve the TCP/IP settings from a DHCP or BootP server. If no DHCP server is
found, the module will fall back on it’s current settings (i.e. the settings currently stored in ‘\ethcfg.cfg’).
If no current settings are available (i.e. ‘ethcfg.cfg’ is missing, or contains invalid settings), the module
will halt and indicate an error on the on-board status LEDs (the settings may however still be accessed
using HICP, see 3-4 “Anybus IPconfig (HICP)”.
Basic Network Configuration 3-2
Ethernet Configuration File (‘ethcfg.cfg’)
General
To be able to participate on the network, the module needs a valid TCP/IP configuration. These settings
are stored in the system file ‘\ethcfg.cfg’.
File Format:
[IP address]
xxx.xxx.xxx.xxx
[Subnet mask]
xxx.xxx.xxx.xxx • IP address
[Gateway address} • Subnet mask

xxx.xxx.xxx.xxx
• Gateway address
[DHCP/BOOTP]
ON or OFF • DHCP/BootP
[SMTP address] ON - Enabled
xxx.xxx.xxx.xxx OFF - Disabled
[SMTP username] • SMTP server/login settings

username
Username and Password is only necessary if required by the
[SMTP password] server.
password
[DNS1 address]
xxx.xxx.xxx.xxx
• Primary and Secondary DNS
[DNS2 address]
xxx.xxx.xxx.xxx
Needed to be able to resolve host names
[Domain name] • Default domain name for not fully qualified host names
domain
• Host name
[Host name]
Anybus
[HICP password] • HICP password

password
The settings in this file may also be affected by...

• EtherNet/IP (See 3-1 “EtherNet/IP”).
• HICP (See 3-4 “Anybus IPconfig (HICP)”)
• SSI (See 8-1 “Server Side Include (SSI)”)
See also...
• 5-1 “FTP Server”
• 11-6 “Fieldbus Settings”
IP Access Control
It is possible to specify which IP addresses that are permitted to connect to the module. This informa-
tion is stored in the system file ‘\ip_accs.cfg’.
File Format:
[Web]
• Nodes listed here may access the web server
xxx.xxx.xxx.xxx
[FTP]
• Nodes listed here may access the FTP server
xxx.xxx.xxx.xxx
[Modbus/TCP]
• Nodes listed here may access the module via Modbus/TCP
xxx.xxx.xxx.xxx
[EtherNet/IP]
• Nodes listed here may access the module via EtherNet/IP
xxx.xxx.xxx.xxx
[All]
• Fallback setting, used by the module when one or several of the
xxx.xxx.xxx.xxx
keys above are omitted
Note: ‘*’ may be used as a wildcard to select IP series.
On/Off Line Configuration

By default, the On/Off Line indication (Event Notification) is triggered by the Link Status. Other trig-
gering options can however be specified in the system file ‘\onoffln.cfg’, which looks as follows:
• ON/OFF-line trigger
File Format: Values: ‘Link’, ‘EIP’ and ‘Modbus’
[ON/OFF-line trigger]
Modbus • Timeout
Value: Timeout value. A value of 10 equals 1000ms.
[Timeout]
10 • Commands (Optional)
[Commands] Selects what Modbus commands that must be
3, 16, 23 received during the timeout period.
If the keyword ‘ALL’ is given, the ON/OFF line
functionality will trigger on all Modbus commands.
The keys ‘[Timeout]’ and ‘[Commands]’ shall only given if the ON/OFF-line Trigger value is set
to ‘Modbus’.
Note: The settings in this file will be ignored if the application has issued
MB_ON_OFF_LINE_CONFIG.
See also...
• 10-42 “Modbus ON/OFF Line Configuration (MB_ON_OFF_LINE_CONFIG)”
• A-1 “Event Notification Cause/Source Registers”
Anybus IPconfig (HICP)

The module supports the HICP protocol used by the Anybus IPconfig utility from HMS, which can be
downloaded free of charge from the HMS website. This utility may be used to configure the network
settings of any Anybus product connected to the network. Note that if successful, this will replace the
settings currently stored in the configuration file (‘ethcfg.cfg’).
Upon starting the program, the network
is scanned for Anybus products. The net-
work can be rescanned at any time by
clicking ‘Scan’. In the list of detected de-
vices, the module will appear as ‘ABS-
EIP’. To alter its network settings, dou-
ble-click on its entry in the list.
A window will appear, containing the IP
configuration and password settings.
Validate the new settings by clicking ‘Set’,
or click ‘Cancel’ to abort.
Optionally, the configuration may be
protected from unauthorized access by a password. To enter a password, click on the ‘Change password’
checkbox, and enter the password under ‘New password’. When protected, any changes in the configu-
ration requires that the user supplies a valid password.
When done, click ‘Set’. The new IP configuration will now be stored in the configuration file (‘eth-
cfg.cfg’).
Chapter 4
FTP Server
General
The built in FTP server provides a way to access the file system using a standard FTP client.
The following port numbers are used for FTP communication:
• TCP, port 20 (FTP data port)
• TCP, port 21 (FTP command port)
See also...
• 10-19 “Disable FTP server (DISABLE_FTP_SERVER)”
Security Levels
The FTP-server features two security levels; admin and normal.
• Normal-level users
The root directory will be ‘\user’.
• Admin-level users
The root directory will be ‘\’, i.e. the user has unrestricted access to the file system.
User Accounts
The user accounts are stored in two files, which are protected from web access:
• ‘\user\pswd\sys_pswd.cfg’
This file holds the user accounts for normal-level users.
• ‘\pswd\ad_pswd.cfg’
This file holds the user accounts for admin-level users.
File Format:
The format of these files are as follows:
Username1:Password1
Username2:Password2
Username3:Password3
Note 1: If no valid user accounts have been defined, or if the mailbox command
‘GLOBAL_ADMIN_MODE’ has been issued during startup, the module will grant Admin-level access
to all users. In such case, the FTP accepts any username/password combination, and the root directory
will be ‘\’.
Note 2: The FTP server shares user accounts with the Telnet server.
FTP Server 4-2
FTP Connection Example (Windows Explorer)

The built in FTP client in Windows Explorer can easily be used to access the file system as follows:
1. Open the Windows Explorer by right-clicking on the ‘Start’ button and selecting ‘Explore’.
2. In the address field, type FTP://<user>:<password>@<address>

- Substitute <address> with the IP address of the Anybus module
- Substitute <user> with the username
- Substitute <password> with the password
3. Press enter. The Explorer will now attempt to connect to the module using the specified settings.
If successful, the built in file system is displayed in the Explorer window.
Chapter 5
Telnet Server
General
The built in Telnet server provides a way to access the file system using a standard Telnet client. The
server communicates through TCP port 23.
See also...
• 10-20 “Disable Telnet Server (DISABLE_TELNET_SERVER)”
Security Levels
Just like the FTP server, the Telnet server features two security levels; admin and normal.
• Normal-level users
The root directory will be ‘\user’.
• Admin-level users
The root directory will be ‘\’, i.e. the user has unrestricted access to the file system.
User Accounts
The Telnet server shares user accounts with the FTP server. If no valid user accounts have been defined,
or if the mailbox command ‘GLOBAL_ADMIN_MODE’ has been issued during startup, the module
will grant Admin-level access to all users. In such case, no login is required, and the root directory will
be ‘\’.
For more information, see 4-1 “User Accounts”
Telnet Server 5-2
General Commands
admin
• Syntax
admin
• Description
Provided that the user can supply a valid admin username/password combination, this command
provides Admin access rights to Normal-level users.
exit
• Syntax
exit
• Description
This command closes the Telnet session.
help
• Syntax
help [general|diagnostic|filesystem]
• Description
If no argument is specified, the following menu will be displayed.
General commands:
help - Help with menus

version - Display version information
exit - Exit station program
Also try ‘help [general|diagnostic|filesystem]’
version
• Syntax
version
• Description
This command will display version information, serial number and MAC ID of the module.
Telnet Server 5-3
Diagnostic Commands
arps
• Syntax
arps
• Description
Display ARP stats and table
iface
• Syntax
iface
• Description
Display net interface stats
routes
• Syntax
routes
• Description
Display IP route table
sockets
• Syntax
sockets
• Description
Display socket list
File System Operations

For commands where filenames, directory names or paths shall be given as an argument the names can
be written directly or within quotes. For names including spaces the filenames must be surrounded by
quotes. It is also possible to use relative pathnames using ‘.’, ‘\’ and ’..’
append
• Syntax
append [file] [“The line to append”]
• Description
Appends a line to a file.
Telnet Server 5-4
cd
• Syntax
cd [path]
• Description
Changes current directory.
copy
• Syntax
copy [source] [destination]
• Description
This command creates a copy of the source file at a specified location.
del
• Syntax
del [file]
• Description
Deletes a file.
dir
• Syntax
dir [path]
• Description
Lists the contents of a directory. If no path is given, the contents of the current directory is listed.
df
• Syntax
df
• Description
Displays filesystem info.
format
• Syntax
format
• Description
Formats the filesystem. This command is only valid for admin level users.
Telnet Server 5-5
md
• Syntax
md [directory]
• Description
Creates a directory. If no path is given, the directory is created in the current directory.
mkfile
• Syntax
mkfile [filename]
• Description
Creates an empty file.
move
• Syntax
move [source] [destination]
• Description
This command moves a file or directory from the source location to a specified destination.
rd
• Syntax
rd [directory]
• Description
Removes a directory. The directory can only be removed if it is empty.
ren
• Syntax
ren [old name] [new name]]
• Description
Renames a file or directory.
type
• Syntax
type [filename]
• Description
Types the contents of a file.
Chapter 6
Web Server
General
The Anybus module features a flexible web server with SSI capabilities. The built in web pages can be
customized to fit a particular application and allow access to I/O data and configuration settings.
The web server communicates through port 80.
See also...
• 10-17 “Disable Web Server (DISABLE_WEB_SERVER)”
• 10-18 “Enable Web Server (ENABLE_WEB_SERVER)”
Protected Files
For security reasons, the following files are protected from web access:
• Files located in ‘\user\pswd’
• Files located in ‘\pswd’
• Files located in a directory which contains a file named ‘web_accs.cfg’
Default Web Pages

The Anybus module contains a set of virtual files that can be used when building a web page for con-
figuration of network parameters. These virtual files can be overwritten (not erased) by placing files with
the same name in the root of disc 0.
This makes it possible to, for example, replace the HMS logo by uploading a new logo named ‘\logo.jpg’.
It is also possible to make links from a web page to the virtual configuration page. In that case the link
shall point to ‘\config.htm’.
These virtual files are:
\index.htm - Points to the contents of config.htm
\config.htm - Configuration frame page
\configform.htm - Configuration form page
\configform2.htm - Configuration form page
\store.htm - Configuration store page
\logo.jpg - HMS logo
\configuration.gif - Configuration picture
\boarder.bg.gif - picture
\boarder_m_bg.gif - picture
Web Server 6-2
Authorization
Directories can be protected from web access by placing a file called ‘web_accs.cfg’ in the directory to
protect. This file shall contain a list of users that are allowed to access the directory and its subdirectories.
File Format:
Username1:Password1
Username2:Password2 • List of approved users.
...
UsernameN:PasswordN
• Optionally, a login message can be specified by including the
key [AuthName]. This message will be displayed by the web
[AuthName]
(message goes here)
browser upon accessing the protected directory.
The list of approved users can optionally be redirected to one or several other files.
Example:
In this example, the list of approved users will be loaded from the files ‘here.cfg’ and ‘too.cfg’.
[File path]
\i\put\it\over\here.cfg
\i\actually\put\some\of\it\over\here\too.cfg
[AuthName]
Yeah. Whatsda passwoid?
Note that when using this feature, make sure to put the user/password files in a directory that is pro-
tected from web access, see 6-1 “Protected Files”.
Web Server 6-3
Content Types
By default, the following content types are recognized by their file extension:
Content Type File Extension

text/html *.htm, *.html, *.shtm
image/gif *.gif
image/jpeg *.jpeg, *.jpg, *.jpe
image/x-png *.png
application/x-javascript *.js
text/plain *.bat, *.txt, *.c, *.h, *.cpp, *.hpp
application/x-zip-compressed *.zip
application/octet-stream *.exe, *.com
text/vnd.wap.wml *.wml
application/vnd.wap.wmlc *.wmlc
image/vnd.wap.wbmp *.wbmp
text/vnd.wap.wmlscript *.wmls
application/vnd.wap.wmlscriptc *.wmlsc
text/xml *.xml
application/pdf *.pdf
It is possible to configure/reconfigure the reported content types, and which files that shall be scanned
for SSI. This is done in the system file ‘\http.cfg’.
File Format:
[FileTypes]
FileType1:ContentType1
FileType2:ContentType2
...
FileTypeN:ContentTypeN
[SSIFileTypes]
FileType1
FileType2
...
FileTypeN
Note: Up to 50 content types and 50 SSI file types may be specified in this file.
Chapter 7
SMTP Client
General
The built in email client can send predefined email messages based on trigger-events in the dual port
memory (DPRAM). The application can also use the client directly via the mailbox interface.
The client supports SSI, however note that some SSI functions cannot be used in email messages (spec-
ified separately for each SSI function).
See also...
• 8-1 “Server Side Include (SSI)”
• 10-104 “Send Email (SEND_EMAIL)”
Server Settings
The module needs a valid SMTP server configuration in order to be able to send email messages. These
settings are stored in the system file ‘\ethcfg.cfg’. This file is read once during startup, i.e. any changes
requires that the module is restarted in order to have effect. See also...
• 10-14 “Set SMTP Server (SET_SMTP_SERVER)”
• 10-104 “Send Email (SEND_EMAIL)”
Event-Triggered Messages
As mentioned previously, the email client can send predefined message based on events in the DPRAM.
In operation, this works as follows:
1. The trigger source is fetched from the dual port memory
2. A logical AND is performed between the trigger source and a mask value
3. The result is compared to a reference value according to a specified operand
4. If the end result is true, the email is sent to the specified recipient(s).
Which events that shall cause a particular message to be sent, is specified separately for each message.
For more information, see 7-2 “Email Definitions”.
Note that the DPRAM is scanned once every 0.5 second, i.e. a trigger-event must be present longer than
0.5 seconds to ensure that it is detected by the Anybus module.
SMTP Client 7-2
Email Definitions
The email definitions are stored in the following two directories:
• ‘\user\email’
This directory holds up to 10 messages which can be altered by normal-level FTP-users.
• ‘\email’
This directory holds up to 10 messages which can be altered by admin-level FTP-users.
Email definition files must be named ‘email_1.cfg’, ‘email_2.cfg’... ‘email_10.cfg’ in order to be properly
recognized by the module.
File Format:
[Register]
Area, Offset, Type
[Register Match]
Value, Mask, Operand
[To]
recipient
[From]
sender
[Subject]
subject line
[Headers]
Optional extra headers
[Message]
message body
Key Value Scanned for SSI

Area Source area in DPRAM. Possible values are ‘IN’ or ‘OUT’ No
Offset Source offset, written in decimal or hexadecimal.
Type Source data type. Possible values are ‘byte’, ‘word’, and ‘long’
Value Used as a reference value for comparison.
Mask Mask value, applied on the trigger source prior to comparison (logical AND).
Operand Possible values are ‘<‘, ‘=’ or ‘>’
To Email recipient Yes
From Sender email address
Subject Email subject. One line only.
Headers Optional; may be used to provide additional headers.
Message The actual message.
Note: Hexadecimal values must be written with the prefix ‘0x’ in order to be recognized by the module.
Chapter 8
Server Side Include (SSI)
General
Server Side Include (from now on referred to as SSI) functionality enables dynamic content to be used
on web pages and in email messages.
SSI are special commands embedded in the source document. When the Anybus module encounters
such a command, it will execute it, and replace it with the result (when applicable).
Syntax
The ‘X’s below represents a command opcode and parameters associated with the command.
<?--#exec cmd_argument=’XXXXXXXXXXXXXXXXXXXXXX’-->
Example
The following example causes a web page to display the Ethernet Mac ID of the module:
<HTML>
<HEAD><TITLE>SSI Test</TITLE></HEAD>
<BODY>
The Ethernet Mac ID of the Anybus module is:
<?--#exec cmd_argument=’DisplayMacID’-->
</BODY>
</HTML>
Resulting webpage:
Server Side Include (SSI) 8-2
Functions
DisplayMacID
This function returns the MAC ID in format xx:xx:xx:xx:xx:xx.
Syntax:
<?--#exec cmd_argument=’DisplayMacId’-->
DisplaySerial
This function returns the serial number of the Anybus module.
Syntax:
<?--#exec cmd_argument=’DisplaySerial’-->
DisplayFWVersion
This function returns the main firmware revision of the Anybus module.
Syntax:
<?--#exec cmd_argument=’DisplayFWVersion’-->
DisplayBLVersion
This function returns the bootloader firmware revision of the Anybus module.
Syntax:
<?--#exec cmd_argument=’DisplayBLVersion’-->
DisplayIP
This function returns the currently used IP address.
Syntax:
<?--#exec cmd_argument=’DisplayIP’-->
DisplaySubnet
This function returns the currently used Subnet mask.
Syntax:
<?--#exec cmd_argument=’DisplaySubnet’-->
DisplayGateway
This function returns the currently used Gateway address.
Syntax:
<?--#exec cmd_argument=’DisplayGateway’-->
DisplayDNS1
This function returns the address of the primary DNS server.
Syntax:
<?--#exec cmd_argument=’DisplayDNS1’-->
DisplayDNS2
This function returns the address of the secondary DNS server.
Syntax:
<?--#exec cmd_argument=’DisplayDNS2’-->
DisplayHostName
This function returns the hostname.
Syntax:
<?--#exec cmd_argument=’DisplayHostName’-->
DisplayDomainName
This function returns the default domain name.
Syntax:
<?--#exec cmd_argument=’DisplayDomainName’-->
DisplayDhcpState
This function returns whether DHCP/BootP is enabled or disabled.
Syntax:
<?--#exec cmd_argument=’DisplayDhcpState( "Output when ON", "Output when OFF"
)’-->
DisplayDhcpSupport
DHCP support can be disabled using the mailbox command DISABLE_DHCP, see 10-11 “Disable
DHCP (DISABLE_DHCP)”. This function returns ‘Arg1’ if it’s enabled and ‘Arg2’ if it’s disabled.
Syntax:
<?--#exec cmd_argument=’DisplayDhcpSupport( "Arg1", "Arg2" )’-->
DisplayEmailServer
This function returns the currently used SMTP server address.
Syntax:
<?--#exec cmd:argument=’DisplayEmailServer’-->
DisplaySMTPUser
This function returns the username used for SMTP authentication.
Syntax:
<?--#exec cmd:argument=’DisplaySMTPUser’-->
DisplaySMTPPswd
This function returns the password used for SMTP authentication.
Syntax:
<?--#exec cmd:argument=’DisplaySMTPPswd’-->
StoreEtnConfig
Note: This function cannot be used in email messages.
This SSI function stores a passed IP configuration in the configuration file ‘ethcfg.cfg’.
Syntax:
<?--#exec cmd_argument=’StoreEtnConfig’-->
Include this line in a HTML page and pass a form with new IP settings to it.
Accepted fields in form:

SetIp
SetSubnet
SetGateway
SetEmailServer
SetDhcpState - value "on" or "off"
SetDNS1
SetDNS2
SetHostName
SetDomainName
SetSMTPUser
SetSMTPPswd
Default output:
Invalid IP address!
Invalid Subnet mask!
Invalid Gateway address!
Invalid IP address or Subnet mask!
Invalid Email Server IP address!
Invalid DHCP state!
Invalid DNS1!
Invalid DNS2!
Configuration stored correctly.
Failed to store configuration.
GetText
This SSI function gets the text from an object and stores it in the OUT area.
Syntax:
<?--#exec cmd arbgument=’GetText( "ObjName", OutWriteString ( offset ), n )’-->
ObjName - Name of object.

offset - Specifies the offset from the beginning of the OUT area.
n - Specifies maximum number of characters to read (Optional)
Default output:
Success - Write succeeded
Failure - Write failed
printf
This SSI function includes a formatted string, which may contain data from the Anybus IN/OUT area,
on a web page. The formatting of the string is equal to the standard C function printf().
Syntax:
<?--#exec cmd_argument=’printf("String to write", Arg1, Arg2, ..., ArgN)’-->
Like the standard C function printf() the "String to write" for this SSI function contains two types of
objects: Ordinary characters, which are copied to the output stream, and conversion specifications, each
of which causes conversion and printing of the next successive argument to printf. Each conversion
specification begins with the character % and ends with a conversion character. Between the % and the
conversion character there may be, in order:
• Flags (in any order), which modify the specification:

- which specifies left adjustment of the converted argument in its field.
+ which specifies that the number will always be printed with a sign
(space) if the first character is not a sign, a space will be prefixed.
0 for numeric conversions, specifies padding to the field with leading zeroes.
# which specifies an alternate output form. For o, the first digit will be zero. For x or
X, 0x or 0X will be prefixed to a non-zero result. For e, E,f, g and G, the output will
always have a decimal point; for g and G, trailing zeros will not be removed.
• A number specifying a minimum field width. The converted argument will be printed in a field
at least this wide, and wider if necessary. If the converted argument has fewer characters than the
field width it will be padded on the left (or right, if left adjustment has been requested) to make
up the field width. The padding character is normally space, but can be 0 if the zero padding flag
is present.
• A period, which separates the field width from the precision.
• A number, the precision, that specifies the maximum number of characters to be printed from a
string, or the number of digits to be printed after the decimal point for e, E, or F conversions,
or the number of significant digits for g or G conversion, or the minimum number of digits to
be printed for an integer (leading 0s will be added to make up the necessary width)
• A length modifier h, l (letter ell), or L. "h" Indicates that the corresponding argument is to be
printed as a short or unsigned short; "l" indicates that the argument is along or unsigned long.
The conversion characters and their meanings are shown below. If the character after the % is not a con-
version character, the behaviour is undefined.
Character Argument type, Converted to

d, i byte, short; decimal notation (For signed representation. Use signed argument)
o byte, short; octal notation (without a leading zero).
x, X byte, short; hexadecimal notation (without a leading 0x or 0X), using abcdef for 0x or ABCDEF for
0X.
u byte, short; decimal notation.
c byte, short;single character, after conversion to unsigned char.
s char*; characters from the string are printed until a "\0" is reached or until the number of characters
indicated by the precision have been printed
f float; decimal notation of the form [-]mmm.ddd, where the number of d’s is specified by the preci-
sion. The default precision is 6; a precision of 0 suppresses the decimal point.
e, E float; decimal notation of the form [-]m.dddddd e+-xx or[-]m.ddddddE+-xx, where the number of d’s
specified by the precision. The default precision is 6; a precision of 0 suppresses the decimal point.
g, G float; %e or %E is used if the exponent is less than -4 or greater than or equal to the precision; oth-
erwise %f is used. Trailing zeros and trailing decimal point are not printed.
% no argument is converted; print a %
The arguments that can be passed to the SSI function printf are:
Argument Description
InReadSByte(offset) Read a signed byte from position offset in the IN area
InReadUByte(offset) Read an unsigned byte from position offset in the IN area
InReadSWord(offset) Read a signed word from position offset in the IN area
InReadUWord(offset) Read an unsigned word from position offset in the IN area
InReadSLong(offset) Read a signed longword from position offset in the IN area
InReadULong(offset) Read an unsigned longword from position offset in the IN area
InReadString(offset) Read a string (char*) from position offset in the IN area
InReadFloat(offset) Read a floating point (float) value from position offset in the IN area
OutReadSByte(offset) Read a signed byte from position offset in the OUT area
OutReadUByte(offset) Read an unsigned byte from position offset in the OUT area
OutReadSWord(offset) Read a signed word (short) from position offset in the OUT area
OutReadUWord(offset) Read an unsigned word (short) from position offset in the OUT area
OutReadSLong(offset) Read a signed longword (long) from position offset in the OUT area
OutReadULong(offset) Read an unsigned longword (long) from position offset in the OUT area
OutReadString(offset) Read a null-terminated string from position offset in the OUT area
OutReadFloat(offset) Read a floating point (float) value from position offset in the OUT area
MbReadSByte(id) Read a signed byte (short) from the application via the mailbox interface
MbReadUByte(id) Read an unsigned byte (short) from the application via the mailbox inter-
face
MbReadSWord(id) Read a signed word from the application via the mailbox interface
MbReadUWord(id) Read an unsigned word from the application via the mailbox interface
MbReadSLong(id) Read a signed longword from the application via the mailbox interface
MbReadULong(id) Read an unsigned longword from the application via the mailbox inter-
face
MbReadString(id) Read a null-terminated string from the application via the mailbox inter-
face
MbReadFloat(id) Read a floating point (float) value from the application via the mailbox in-
terface
scanf
This SSI function reads a string passed from an object in a HTML form, interprets the string according
to the specification in format, and stores the result in the OUT area according to the passed arguments.
The formatting of the string is equal to the standard C function call scanf()
Syntax:
<?--#exec cmd_argument=’scanf( "ObjName", "format", Arg1, ..., ArgN), ErrVal1,
..., ErrvalN’-->
ObjName - The name of the object with the passed data string
format - Specifies how the passed string shall be formatted
Arg1 - ArgN - Specifies where to write the data
ErrVal1 -ErrValN - Optional; specifies the value/string to write in case of an error.
Character Input, Argument Type

d Decimal number; byte, short
i Number, byte, short. The number may be in octal (leading 0(zero)) or hexadecimal (leading 0x
or 0X)
o Octal number (with or without leading zero); byte, short
u Unsinged decimal number; unsigned byte, unsigned short
x Hexadecimal number (with or without leading 0x or 0X); byte, short
c Characters; char*. The next input characters (default 1) are placed at the indicated spot. The
normal skip over white space is suppressed; to read the next non-white space character, use
%1s.
s Character string (not quoted); char*, pointing to an array of characters large enough for the
string and a terminating "\0" that will be added.
e, f, g Floating-point number with optional sign, optional decimal point and optional exponent; float*
% Liteal %; no assignment is made.
The conversion characters d, i, o, u and x may be preceded by l (letter ell) to indicate that a pointer to
‘long’ appears in the argument list rather than a ‘byte’ or a ‘short’
The arguments that can be passed to the SSI function scanf are:
Argument Description
OutWriteByte(offset) Write a byte to position offset in the OUT area
OutWriteWord(offset) Write a word to position offset in the OUT area
OutWriteLong(offset) Write a long to position offset in the OUT area
OutWriteString(offset) Write a string to position offset in the OUT area
OutWriteFloat(offset) Write a floating point value to position offset in the OUT area
MbWriteByte(id) Write a byte to the application via the mailbox interface
MbWriteWord(id) Write a word to the application via the mailbox interface
MbWriteLong(id) Write a longword to the application via the mailbox interface
MbWriteString(id) Write a string to the application via the mailbox interface
MbWriteFloat(id) Write a floating point value to the application via the mailbox interface
Default output:
Write succeeded
Write failed
IncludeFile
This SSI function includes the contents of a file on a web page.
Syntax:
<?--#exec cmd_argument=’IncludeFile( "File name" )’-->
Default output:
Success - <File content>
Failure - Failed to open <filename>
SaveToFile
This SSI function saves the contents of a passed form to a file. The passed name/value pair will be writ-
ten to the file "File name" separated by the "Separator" string. The [Append|Overwrite] parameter de-
termines if the specified file shall be overwritten, or if the data in the file shall be appended.
Syntax:
<?--#exec cmd_argument=’SaveToFile( "File name",
"Separator",[Append|Overwrite] )’-->
Default output:
Success - Form saved to file
Failure - Failed to save form
SaveDataToFile
This SSI function saves the data of a passed form to a file. The “Object name” parameter is optional, if
specified, only the data from that object will be stored. If not, the data from all objects in the form will
be stored.
The [Append|Overwrite] parameter determines if the specified file shall be overwritten, or if the data
in the file shall be appended.
Syntax:
<?--#exec cmd_argument=’SaveDataToFile( "File name", "Object
name",[Append|Overwrite] )’-->
Default output:
Success - Form saved to file
Failure - Failed to save form
DisplayRemoteUser
This SSI function returns the user name on an authentication session.
Syntax:
<?--#exec cmd_argument=’DisplayRemoteUser’-->
Changing SSI output

There is two methods of changing the output strings from SSI functions:
1. Changing SSI output defaults by creating a file called "\ssi_str.cfg" containing the output strings
for all SSI functions in the system
2. Temporary changing the SSI output by calling the SSI function "SsiOutput()".
SSI Output String File
If the file "\ssi_str.cfg" is found in the file system and the file is correctly according to the specification
below, the SSI functions will use the output strings specified in this file instead of the default strings.
The files shall have the following format:
[StoreEtnConfig]
Success: "String to use on success"
Invalid IP: "String to use when the IP address is invalid"
Invalid Subnet: "String to use when the Subnet mask is invalid"
Invalid Gateway: "String to use when the Gateway address is invalid"
Invalid Email server: "String to use when the SMTP address is invalid"
Invalid IP or Subnet: "String to use when the IP address and Subnet mask does
not match"
Invalid DNS1: "String to use when the primary DNS cannot be found"
Invalid DNS2: "String to use when the secondary DNS cannot be found"
Save Error: "String to use when storage fails"
Invalid DHCP state: "String to use when the DHCP state is invalid"
[scanf]
Failure: "String to use on failure"
[IncludeFile]
Failure: "String to use when failure"1
[SaveToFile]
Failure: "String to use on failure"1
[SaveDataToFile]
Success: “String to use on success”
Failure: “String to use on failure”1
[GetText]
Success: “String to use on success”
Failure: “String to use on failure”
The contents of this file can be redirected by placing the line ‘[File path]’ on the first row, and a file path
on the second.
Example:
[File path]
\user\ssi_strings.cfg
In this example, the settings described above will be loaded from the file ‘user\ssi_strings.cfg’.
1. ‘%s’ includes the filename in the string

Temporary SSI Output change
The SSI output for the next called SSI function can be changed with the SSI function “SsiOutput()” The
next called SSI function will use the output according to this call. Thereafter the SSI functions will use
the default outputs or the outputs defined in the file ‘\ssi_str.cfg’. The maximum size of a string is 128
bytes.
Syntax:
<?--#exec cmd_argument=’SsiOutput( "Success string", "Failure string" )’-->
Example:
This example shows how to change the output strings for a scanf SSI call.
<?--#exec cmd_argument=’SsiOutput ( "Parameter1 updated", "Error" )’-->
<?--#exec cmd_argument="scanf( "Parameter1", "%d", OutWriteByte(0) )’-->
Chapter 9
CIP Object Implementation
General
The following CIP-objects are implemented in this product:
Mandatory Objects
Object Page
Identity Object, Class 01h 9-2
Message Router, Class 02h 9-4
Assembly Object, Class 04h 9-5
Connection Manager, Class 04h 9-7
Port Object, Class F4h 9-14
TCP/IP Interface Object, Class F5h 9-15
Ethernet Link Object, Class F6h 9-16
Vendor Specific Objects
Object Page
Diagnostic Object, Class AAh 9-9
I/O Data Input Mapping Object, Class A0h 9-10
I/O Data Output Mapping Object, Class A1h 9-11
Parameter Data Input Mapping Object, Class B0h 9-12
Parameter Data Output Mapping Object, Class B1h 9-13
CIP Object Implementation 9-2
Identity Object, Class 01h
General Information
Object Description
-
Supported Services
Class services: Get Attribute All
Get Attribute Single
Instance services: Get Attribute All
Reset
Class Attributes
# Access Name Type Value Description

1 Get Revision UINT 0001h Revision 1
Instance Attributes

1 Get Vendor ID UINT Default: 005Ah HMS Industrial Networks AB
2 Get Device Type UINT Default: 000Ch Communication Adapter
3 Get Product Code UINT Default: 0002h Anybus-S EtherNet/IP
4 Get Revision Struct of: -
USINT Major fieldbus version
USINT Minor fieldbus version
5 Get Status WORD - Device status, see table below
6 Get Serial Number UDINT Serial number (set at production)
7 Get Product Name SHORT_STRING ‘Anybus-S EtherNet/IP’ Name of product
Device Status
bit(s) Name
0 Module Owned
1 (reserved, ignore)
2 Configured
3 (reserved, ignore)
4... 7 Extended Device Status:
Value: Meaning:
0000b Unknown
0010b Faulted I/O Connection
0011b No I/O connection established
0100b Non-volatile configuration bad
0110b Connection in Run mode
0111b Connection in Idle mode
(other) (reserved)
8 Set for minor recoverable faults
9 Set for minor unrecoverable faults
10 Set for major recoverable faults
11 Set for major unrecoverable faults
12... 15 (reserved, ignore)
Reset Service
The Identity object provides a reset service. There are two different types of reset requests:
• Type 0: ‘Power Cycling Reset’
This service emulates a power cycling of the module.
• Type 1: ‘Out of box reset’
This service sets a “out of box” configuration and performs a reset.
Upon receiving a reset request, the default behaviour for the module is to reset itself. If the request is of
type 1 (‘Out of box reset’), the configuration file ‘ethcfg.cfg’ is erased.
If the application shall be notified about the reset (i.e. for resetting itself), there are two options for this:
1. Issue ENABLE_ID_RESET_NOTIFY to the module during initialisation.

The reset service will then cause the module to issue ID_RESET_NOTIFY, and if necessary de-
lete the configuration file ‘ethcfg.cfg’. ID_RESET_NOTIFY specifies the type of reset request
that was issued.
It is then up to the application to reset itself and the module.
2. Set the RST bit in the Module Status and Interrupt Notification registers when initialising the
module (ANYBUS_INIT.)
The reset service will then generate an Event Notification. The type of reset request that was is-
sued can be retrieved using GET_ID_RESET_PARAM.
It is then up to the application to reset itself and the module.
See also...
• 10-69 “Reset Notification (ID_RESET_NOTIFY)”
• 10-70 “Get Reset Parameter (GET_ID_RESET_PARAM)”
• 10-74 “Reset on IP Change (RST_ON_IP_CHANGE)”
• A-1 “Event Notification Cause/Source Registers”
Message Router, Class 02h
General Information
Object Description
-
Supported Services
Class services: -
Instance services: -
Class Attributes
Instance Attributes
-
Assembly Object, Class 04h
General Information
Object Description
This object provides access to I/O Data.
See also...
• 2-1 “EtherNet/IP”
Supported Services
Class services: Get Attribute Single
Instance services: Get Attribute Single
Set Attribute Single
Class Attributes

2 Get Max Instance UINT - The highest initiated instance no.
Instance 03h Attributes (Heartbeat, Input-Only)
This instance is used as heartbeat for Input-Only connections, and does not carry any data.
Instance 04h Attributes (Heartbeat, Listen-Only)
This instance is used as heartbeat for listen-only connections, and does not carry any data.
Instance 05h Attributes (Configuration Data)
No attributes are implemented for this instance.

See also...
• 10-75 “Enable Configuration Assembly (ENABLE_CONFIG_SY)”
• 10-76 “Configuration Assembly Request (CONFIG_SY_REQUEST)”
Instance 64h... 69h Attributes (Producing Instances)
# Name Access Type Value

3 Produced Data Get Array of BYTE This data corresponds to the Input I/O Data
Note that by default, only instance 64h is enabled. The remainder can be created by the application using
the I/O Data mapping functionality.
See also...
• 2-1 “Data Exchange”
• 9-10 “I/O Data Input Mapping Object, Class A0h”
• 10-53 “I/O Data Input Area Mapping (IO_INPUT_MAP)”
Instance 96h... 9Bh Attributes (Consuming Instance)
# Name Access Type Value

3 Consumed Data Set Array of BYTE This data corresponds to the Output I/O Data.
Note that by default, only instance 96h is enabled. The remainder can be created by the application using
the I/O Data mapping functionality.
See also...
• 2-1 “Data Exchange”
• 2-1 “Implementation Notes”
• 9-11 “I/O Data Output Mapping Object, Class A1h”
• 10-55 “I/O Data Output Area Mapping (IO_OUTPUT_MAP)”
• 10-71 “Copy I/O Status (COPY_IO_STATUS)”
Connection Manager, Class 04h
General Information
Object Description
-
Supported Services
Class services: -
Instance services: Forward_Open
Forward_Close
Unconnected_Send1
Instance Descriptions
(No supported instance attributes)
Class 1 Connection Details
General
Class 1 connections are used to transfer I/O data, and can be established to instances in the Assembly
Object. Each Class 1 connection will establish two data transports; one consuming and one producing.
The heartbeat instances can be used for connections that shall only access inputs. Class 1 connections
use UDP transport.
• Total number of supported class 1 connections: 31
• Max input connection size: 509 bytes
• Max output connection size: 505 bytes
• Supported API: 2... 3200ms
• T->O Connection type: Point-to-point, Multicast
• O->T Connection type: Point-to-point
• Supported trigger type: Cyclic
1. Only if routing has been enabled. See 10-62 “Enable Routing (ENABLE_ROUTING)”.
Connection Types
• Exclusive-Owner connection
This type of connection controls the outputs of the Anybus module and does not depend on oth-
er connections.
- Max. no. of Exclusive-Owner connections: 1 per connection point
- Connection point O ⇒ T: Assembly Object, instance 96h (Default)
- Connection point T ⇒ O: Assembly Object, instance 64h (Default)
• Input-Only connection
This type of connection is used to read data from the Anybus module without controlling the
outputs. It does not depend on other connections.
- Max. no. of Input-Only connections: Up to 311
Note: If an Exclusive-Owner connection has been opened towards the module and times out,
the Input-Only connection times out as well. If the Exclusive-Owner connection is properly
closed, the Input-Only connection remains unaffected.
• Listen-Only connection
This type of connection requires another connection in order to exist. If that connection (Exclu-
sive-Owner or Input-Only) is closed, the Listen-Only connection will be closed as well.
- Max. no. of Input-Only connections: Up to 312
• Redundant-Owner connection
This connection type is not supported by the module.
Class 3 Connection Details
• Explicit message connection

Class 3 connections are used to establish connections towards the message router. Thereafter,
the connection is used for explicit messaging. Class 3 connections use TCP transport.
- No. of simultaneous Class 3 connections: 16
- Supported API: ≥2ms
- T->O Connection type: Point-to-point
- O->T Connection type: Point-to-point
- Supported trigger type: Application
1. Shared with Exclusive-Owner and Listen-Only connections

2. Shared with Exclusive-Owner and Input-Only connections
Diagnostic Object, Class AAh
General Information
Object Description
This object groups diagnostic information.
Supported Services
Class Attributes

Instance Attributes, Instance 01h
# Access Name Type Description

01h Get Module serial number UDINT Serial number
02h Get Vendor ID UINT Manufacturer Vendor ID
03h Get Fieldbus Type UINT Fieldbus Type
04h Get Module Software version UINT Module software version
0Ah Get Module Type UINT Module Type
0Fh Get IN cyclic I/O length UINT Size of I/O Input area (in bytes)
11h Get IN total length UINT Total number of IN bytes supported
12h Get OUT cyclic I/O length UINT Size of I/O Output area (in bytes)
14h Get OUT total length UINT Total number of OUT bytes supported
I/O Data Input Mapping Object, Class A0h
General Information
Object Description
This object can be used to access I/O Data, and is set up dynamically by the application. The mapped
attribute id:s are also available as vendor specific instance attributes (64h to 69h) in the Assembly Object.
See also...
Supported Services
Class Attributes

1 Get Data UINT 0001h Revision 1

1 Get Data Array of USINT Mapped I/O data (also available in Assembly Instance 64h)
I/O Data Output Mapping Object, Class A1h
General Information
Object Description
This object can be used to access I/O Data, and is set up dynamically by the application. The mapped
attribute id:s are also available as vendor specific instance attributes (96h to 9Bh) in the Assembly Ob-
ject.
See also...
Supported Services
Class Attributes

1 Get Data UINT 0001h Revision 1

1 Get/Set Data Array of USINT Mapped I/O data (also available in Assembly Instance 96h)
5 Get/Set Data Array of USINT Mapped I/O data (also available in Assembly Instance 9Ah)
6 Get/Set Data Array of USINT Mapped I/O data (also available in Assembly Instance 9Bh)
Parameter Data Input Mapping Object, Class B0h
General Information
Object Description
This object can be used to access Parameter Data acyclically, and is set up dynamically by the application.
See also...
• 9-13 “Parameter Data Output Mapping Object, Class B1h”
• 10-49 “Parameter Data Input Mapping (PARAMETER_INPUT_MAP)”
Supported Services
Class Attributes

Each attribute corresponds to a block of Input Parameter Data. Note that the size and location of each
block must be specified using by the application.
See also...

01h Get Data Array of USINT Mapped block if Input Parameter Data
... ... ... ... ...
Parameter Data Output Mapping Object, Class B1h
General Information
Object Description
This object can be used to access Output Data acyclically, and is set up dynamically by the application.
See also...
• 10-51 “Parameter Data Output Area Mapping (PARAMETER_OUTPUT_MAP)”
Supported Services
Class Attributes

Each attribute corresponds to a block of Output Parameter Data. Note that the size and location of each
block must be specified using by the application.
See also...

01h Get/Set Data Array of USINT Mapped block of Output Parameter Data
... ... ... ... ...
Port Object, Class F4h
General Information
Object Description
-
Supported Services
Class Attributes

2 Get Max Instance UINT 0002h 2 is the highest instance number
3 Get No. of instances UINT 0001h 1 instance is implemented
8 Get Entry Port UINT 0002h Returns the instance of the Port object that
describes the port.
9 Get All Ports Array of STRUCT 0000h 0000h Array of structure containing attributes 1 and
{UINT; UINT;} 0000h 0000h 2 from each instance. Instance 1 is at byte
0004h 0002h offset 4. Instance 2 is at byte offset 8, etc.
The 4 bytes at offset 0 shall be 0. (Default)
# Access Name Type Value Comments

1 Get Port Type UINT 0004h TCP/IP
2 Get Port Number UINT 0002h Port 2
3 Get Port Object Struct of:
Path Size UINT 0002h -
Path Padded EPATH 20 F5 24 01h TCP class, Instance 1
4 Get Port Name SHORT_STIRNG ‘TCP/IP’ Name of port
8 Get Node Address Padded EPATH - -
TCP/IP Interface Object, Class F5h
General Information
Object Description
This object groups TCP/IP-related settings.
See also...
• 4-1 “Basic Network Configuration”
• 11-6 “Fieldbus Settings”
Supported Services
Class Attributes

Instance Attributes

1 Get Status DWORD - -
2 Get Configuration DWORD 00000014h - Attribute #5 is settable
Capability - Capable of obtaining network configuration via
DHCP.
3 Get/Set Configuration DWORD - Value: Meaning:
Control 0 Configuration from non-volatile memory
(i.e. ‘ethcfg.cfg’)
2 Configuration from DHCP
4 Get Port Object Struct of: Path to Ethernet Class, Instance 1
Path Size UINT 0002h
Path Padded EPATH 20 F6 24 01h
5 Get/Set Interface Con- Struct of:
figuration
IP Address UDINT - IP address
Subnet Mask UDINT - Subnet mask
Gateway UDINT - Gateway Address
Address
Name Server 1 UDINT - Primary DNS
Name Server 2 UDINT - Secondary DNS
Domain Name STRING - Default domain name
6 Get/Set Host Name STRING - Host name
Ethernet Link Object, Class F6h
General Information
Object Description
This object groups diagnostic information for the Ethernet interface.
See also...
• 4-1 “Basic Network Configuration”
Supported Services
Class Attributes

Instance Attributes

1 Get Interface Speed UDINT 10 or 100 Actual ethernet interface speed
2 Get Interface Flags DWORD - -
3 Get Physical Address Array of 6 USINTS (MAC ID) Physical network address
6 Get/Set Interface Control Struct of: - Auto-negotiation, duplex, and speed.
WORD
UINT
Chapter 10
Fieldbus Specific Mailbox Commands
Fault Information
When a mailbox command cannot be processed, the Message Information register in the header of the
response will indicate that an error occurred (Consult the Anybus-S Parallel Design Guide for more in-
formation). If the error code is ‘Invalid Other’ (Fh), extended error information is available in the Fault
Information register (Extended word 8).
The fault codes in the Fault Information register are:
Register Value Description

0001h Invalid IP-address or Subnet mask
0002h Invalid socket type
0003h No free socket
0004h Invalid socket
0005h Not connected
0006h Command failed
0007h Invalid data size
0008h Invalid fragment type
0009h Fragment error
000Ah Invalid timeout time
000Bh Can’t send more
000Ch Failed to open file or file not found
000Dh Invalid file descriptor
000Eh Invalid open method
000Fh No email server configured
0010h Command aborted
0011h Too many registered objects
0012h Object already registered
0013h Deregistering invalid object
0015h Unsupported Command
0016h Failed to send UCMM command
0017h No timeout
0018h Invalid port number
0019h Duplicate port number
001Ah EPATH too big
001Bh Mapping Failed
001Ch Reset notification unsupported
001Dh Too many open files
001Eh Failed to create directory
001Fh Failed to delete directory
0020h Failed to rename file
0021h Failed to move file
0022h Failed to copy file
0023h Too many open directories
0024h Failed to open directory or directory not found
0025h Failed to resolve hostname with DNS
0026h Timed out resolving hostname with DNS
10-2
General Configuration Commands

Commands in this category:
Mailbox Commands Description Page

Set Ethernet Configuration
Set network settings 10-3
(SET_ETN_CONFIG)
Read Ethernet Configuration
Retrieve the currently used network settings 10-4
(READ_ETN_CONFIG)
Get MAC Address
Retrieve the ethernet MAC address from the module 10-5
(GET_MAC_ADDR)
Connection Timeout
Set the connection timeout value 10-6
(CONNECT_TIMEOUT)
Set Host and Domain
Set host and default domain names 10-7
(SET_HOST_DOMAIN)
Get Host and Domain
Returns the currently used host and domain 10-8
(GET_HOST_DOMAIN)
Disable / Enable ARP Config
Disable/enable ARP support 10-9
(ARP_CFG_CONTROL)
Disable / Enable HICP
Disable/enable HICP support 10-10
(HICP_CFG_CONTROL)
Disable DHCP (DISABLE_DHCP) Disable DHCP support 10-11
Set DNS Server Settings

Configures the DNS server settings 10-12
(SET_DNS_SERVERS)
Get DNS Server Settings
Returns the currently used DNS server settings 10-13
(GET_DNS_SERVERS)
Set SMTP Server
Configures the SMTP server IP address 10-14
(SET_SMTP_SERVER)
Set SMTP Server by Name
Configures the SMTP server address 10-15
(SET_SMTP_SERVER_NAME)
Get SMTP Server
Returns the currently used SMTP server IP address 10-16
(GET_SMTP_SERVER)
Disable Web Server
This command disables the built in web server 10-17
(DISABLE_WEB_SERVER)
Enable Web Server
This command enables the built in web server 10-18
(ENABLE_WEB_SERVER)
Disable FTP server
This command disables the built in FTP server 10-19
(DISABLE_FTP_SERVER)
Disable Telnet Server
This command disables the built in telnet server 10-20
(DISABLE_TELNET_SERVER)
Global Admin Mode
This command instruct the module to run in global admin mode 10-21
(GLOBAL_ADMIN_MODE)
Disable Virtual File System
Disable the virtual file system 10-22
(DISABLE_VFS)
10-3
Set Ethernet Configuration (SET_ETN_CONFIG)
Description
This command can be used to set the IP address, Gateway address, and Subnet mask. The settings in
this command overrides the settings in ‘ethcfg.cfg’.
Note: This command may only be issued during initialisation.
Initiated by Application
Command no. 0001h
Extended Header Fault information
Message data Network settings.
Response data (the response holds a copy of the command data)
Command and response layout
Command Expected response

Message ID (ID) (ID)
Message information 4002h 0002h Fieldbus Specific Message
Command 0001h 0001h SET_ETN_CONFIG
Data size 000Ch 000Ch 12 bytes of data (6 words)
Frame count 0001h 0001h
Frame number 0001h 0001h
Offset high 0000h 0000h
Offset low 0000h 0000h
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information
Message dataword 1 IP address (high) IP address (high)
Message dataword 2 IP address (low) IP address (low)
Message dataword 3 Subnet mask (high) Subnet mask (high)
Message dataword 4 Subnet mask (low) Subnet mask (low)
Message dataword 5 Gateway address (high) Gateway address (high)
Message dataword 6 Gateway address (low) Gateway address (low)
10-4
Read Ethernet Configuration (READ_ETN_CONFIG)
Description
This command returns the currently used network settings.
Note: This command may only be issued during runtime.
Command no. 0002h
Extended Header -
Message data -
Response data Currently used network settings.

Command 0002h 0002h READ_ETN_CONFIG
Data size 0000h 000Ch 12 bytes of data (6 words)
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
IP address (high) Response dataword 1
IP address (low) Response dataword 2
Subnet mask (high) Response dataword 3
Subnet mask (low) Response dataword 4
Gateway address (high) Response dataword 5
Gateway address (low) Response dataword 6
10-5
Get MAC Address (GET_MAC_ADDR)
Description
This command returns the MAC address of the module.
Command no. 0010h
Extended Header -
Message data -
Response data MAC Address, 6 bytes

Command 0010h 0010h GET_MAC_ADDR
Data size 0000h 0006h 6 bytes of data (3 words)
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
MAC Address (high) Response dataword 1
MAC Address (mid) Response dataword 2
MAC Address (low) Response dataword 3
10-6
Connection Timeout (CONNECT_TIMEOUT)
Description
This mailbox command configures the timeout value used when trying to establish a connection to a
host.
Note: This command may only be issued during initialization.
Command no. 0003h
Message data Timeout Value

Command 0003h 0003h CONNECT_TIMEOUT
Data size 0001h 0001h 1 data byte
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message databyte 1 Timeout Value Timeout Value
• Timeout Value
Valid timeout values range from 1 to 255 seconds (Default = 75).
10-7
Set Host and Domain (SET_HOST_DOMAIN)
Description
This command is used to set the host and the default domain name.
Command no. 0032h
Message data Host and Domain settings

Command 0032h 0032h SET_HOST_DOMAIN
Data size (size) (size)
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Host name Host name

(string, null-terminated) (string, null-terminated)
Message data
Domain name Domain name
(string, null-terminated) (string, null-terminated)
10-8
Get Host and Domain (GET_HOST_DOMAIN)
Description
This command returns the configured host and default domain name settings.
Command no. 0034h
Extended Header -
Message data -
Response data Currently used Host and Domain settings

Command 0034h 0034h GET_HOST_DOMAIN
Data size 0000h (size)
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Host name
(string, null-terminated)
Response data
Domain name
10-9
Disable / Enable ARP Config (ARP_CFG_CONTROL)
Description
This command is used to enable / disable the ARP functionality.
Command no. 0014h
Message data ARP state

Command 0014h 0014h ARP_CFG_CONTROL
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message databyte Config Value Config Value
• Config Value
00h: Disable
01h: Enable
10-10
Disable / Enable HICP (HICP_CFG_CONTROL)
Description
This command is used to enable / disable support for HICP (Anybus IP Config).
Command no. 0013h
Extended Header -
Message data HICP state

Command 0013h 0013h HICP_CFG_CONTROL
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message databyte Config Value Config Value
• Config Value
00h: Disable
01h: Enable
10-11
Disable DHCP (DISABLE_DHCP)
Description
This command disables support for DHCP, and overrides the DHCP setting in the configuration file
‘ethcfg.cfg’. Furthermore, the DHCP configuration checkbox on the default web page will be excluded,
and the Anybus module will not report its DHCP status via HICP.
Command no. 0015h
Extended Header -
Message data -
Response data The response indicates if the command was accepted.

Command 0015h 0015h DISABLE_DHCP
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
10-12
Set DNS Server Settings (SET_DNS_SERVERS)
Description
This command configures the DNS server settings.
Note: This command may only be issued to during initialisation.
Command no. 0031h
Extended Header -
Message data DNS server settings

Command 0031h 0031h SET_DNS_SERVERS
Data size 0008h 0008h 8 bytes (4 words) of data
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message data word 1 Primary DNS (msb) Primary DNS (msb)
Message data word 2 Primary DNS (lsb) Primary DNS (lsb)
Message data word 3 Secondary DNS (msb) Secondary DNS (msb)
Message data word 4 Secondary DNS (lsb) Secondary DNS (lsb)
• Primary DNS
IP address to primary DNS server.
• Secondary DNS
IP address to secondary DNS server, or 0.0.0.0 when using primary DNS only.
10-13
Get DNS Server Settings (GET_DNS_SERVERS)
Description
This command returns the currently used DNS server settings.
Command no. 0033h
Extended Header -
Message data -
Response data DNS server settings.

Command 0033h 0033h GET_DNS_SERVERS
Data size 0000h 0008h (size of data)
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Primary DNS (msb)
Primary DNS (lsb)
Secondary DNS (msb)
Secondary DNS (lsb)
• Primary DNS
IP address to primary DNS server, or 0.0.0.0 if unused.
• Secondary DNS
IP address to secondary DNS server, or 0.0.0.0 if unused.
10-14
Set SMTP Server (SET_SMTP_SERVER)
Description
This mailbox command may be used to specify the IP address of the SMTP server.
Note 1: This command overrides the settings stored in the configuration file ‘ethcfg.cfg’.
Note 2: This command may only be issued during initialisation.
Command no. 000Eh
Message data SMTP server address

Command 000Eh 000Eh SET_SMTP_SERVER
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message dataword 1 SMTP IP address (high) SMTP IP address (high)
Message dataword 2 SMTP IP address (low) SMTP IP address (low)
10-15
Set SMTP Server by Name (SET_SMTP_SERVER_NAME)
Description
This command may be used to specify the address to the SMTP server in ASCII form.
Note 1: This command overrides the settings stored in the configuration file ‘ethcfg.cfg’.
Note 2: This command may only be issued during initialisation.
Command no. 0016h
Extended Header -
Message data SMTP server (string)

Command 0016h 0016h SET_SMTP_SERVER_NAME
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
SMTP Server SMTP Server
Message Data
(String, null-terminated) (String, null-terminated)
• SMTP Server
ASCII string, null terminated (e.g. “192.168.1.42” or “smtp.server.com”)
10-16
Get SMTP Server (GET_SMTP_SERVER)
Description
This function returns the currently used SMTP server IP address.
Command no. 000Fh
Extended Header -
Message data -
Response data SMTP server IP address

Command 000Fh 000Fh GET_SMTP_SERVER
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
SMTP IP address (high) Response dataword 1
SMTP IP address (low) Response dataword 2
10-17
Disable Web Server (DISABLE_WEB_SERVER)
Description
This command disables the onboard web server. The web server is enabled by default.
Command no. 0004h
Extended Header -
Message data -
Response data -

Command 0004h 0004h DISABLE_WEB_SERVER
Data size 0000h 0000h
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-18
Enable Web Server (ENABLE_WEB_SERVER)
Description
This command enables the onboard web server. The web server is enabled by default.
Command no. 0005h
Extended Header -
Message data -
Response data -

Command 0005h 0005h ENABLE_WEB_SERVER
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-19
Disable FTP server (DISABLE_FTP_SERVER)
Description
This command disables the FTP server.
Command no. 0006h
Extended Header -
Message data -
Response data -

Command 0006h 0006h DISABLE_FTP_SERVER
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-20
Disable Telnet Server (DISABLE_TELNET_SERVER)
Description
This command disables the onboard Telnet server.
Command no. 0008h
Extended Header -
Message data -
Response data -

Command 0008h 0008h DISABLE_TELNET_SERVER
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-21
Global Admin Mode (GLOBAL_ADMIN_MODE)
Description
This command instructs the module to run in Global Admin Mode. For more information, see 3-2 “Se-
curity Framework”.
Command no. 000Bh
Extended Header -
Message data -
Response data -

Command 000Bh 000Bh GLOBAL_ADMIN_MODE
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-22
Disable Virtual File System (DISABLE_VFS)
Description
This command disables the virtual files in the file system.
Command no. 0011h
Extended Header -
Message data -
Response data -

Command 0011h 0011h DISABLE_VFS
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-23
Mailbox File System Interface

The filesystem is available to the application through the mailbox interface. Note that the application
always has unrestricted access to the filesystem, regardless of security mode.
Mailbox Command Description Page
Open File (FILE_OPEN) Open a file for reading, writing, or appending. 10-24
Close File (FILE_CLOSE) Close a file previously opened using FILE_OPEN 10-25
Read File (FILE_READ) Read data from a file 10-26
Write File (FILE_WRITE) Write data to a file. 10-27
Delete File (FILE_DELETE) Delete a file 10-28
Move File (FILE_MOVE) Moves a file 10-29
Rename File (FILE_RENAME) Rename a file 10-30
Copy File (FILE_COPY) Copy a file 10-31
Create Directory (DIR_CREATE) Create a new directory 10-32
Delete Directory (DIR_DELETE) Delete an empty directory 10-33
Open Directory (DIR_OPEN) Open a directory 10-34
Read Directory (DIR_READ) Read contents of a directory previously opened using DIR_OPEN 10-35
Close Directory (DIR_CLOSE) Close a directory previously opened using DIR_OPEN 10-37
Create RAM disc

Mounts the RAM disc into a specified directory in the file system. 10-38
(CREATE_RAM_DISC)
10-24
Open File (FILE_OPEN)
Description
This command opens a file for reading, writing, or appending.
Command no. 0060h
Extended Header Mode, Filesize & Fault information
Message data Name and path to the file to open (NULL terminated)
Response data File Handle

Command 0060h 0060h FILE_OPEN
Data size (size) 0004h
Extended word 1 Mode Filesize (high)
Extended word 2 - Filesize (low)
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Path + filename File Handle (high) Response data word 1
Message data
(String, null-terminated) File Handle (low) Response data word 2
• Mode
Value Mode
0000h Open a file in read mode
0001h Open a file in write mode. If the specified file does not exist, it will be created. If the
specified file already exists, it will be overwritten.
0002h Open a file in append mode. If the specified file does not exist, it will be created. If the
specified file exists, any data written to the file will be appended at end-of-file.
• Filesize
Current filesize (if applicable).
• File Handle
Unique identifier which must be used on all further operations associated with the file.
10-25
Close File (FILE_CLOSE)
Description
This command closes a file previously opened using FILE_OPEN.
Command no. 0061h
Extended Header File Handle, Filesize & Fault information.
Message data -
Response data -

Command 0061h 0061h FILE_CLOSE
Extended word 1 File Handle (high) File Handle (high)
Extended word 2 File Handle (low) File Handle (low)
Extended word 3 - Filesize (high)
Extended word 4 - Filesize (low)
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
• File Handle
Handle of the file to close. See also 10-24 “File Handle”.
• Filesize
Size of the file.
10-26
Read File (FILE_READ)
Description
This command reads data from a file previously opened in read mode using FILE_OPEN.
Command no. 0062h
Extended Header File Handle, no. of bytes to read & Fault information
Message data -
Response data The read data is returned in the response data field.

Command 0062h 0062h FILE_READ
Data size 0000h (size) Bytes read
Extended word 3 No. of bytes No. of bytes Maximum 256 bytes.
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Data Response data
• File Handle
File handle of the file to read data from. See also 10-24 “File Handle”.
• No. of bytes
Number of bytes to read minus 1 (i.e. a value of 42 will read 43 bytes).
• Data
The actual data read from the file (if applicable).
10-27
Write File (FILE_WRITE)
Description
This mailbox command writes data to a file previously opened in write or append mode using
FILE_OPEN.
Command no. 0063h
Extended Header File Handle & Fault information
Message data Data to write
A ‘Data size’ value of 0 (zero) indicates that the command was unsuccessful,
Response data
possibly due to a faulty handle, or that the module has run out of storage.

Command 0063h 0063h FILE_WRITE
Data size (number of bytes to write) (number of written bytes) Max. 256 bytes
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message data Data Data
• File Handle
File handle of the file to write data to. See also 10-24 “File Handle”.
• No. of bytes
Number of bytes to write minus 1 (i.e. a value of 42 will read 43 bytes).
• Data
The actual data that shall be written.
10-28
Delete File (FILE_DELETE)
Description
This mailbox command deletes a file from the file system.
Command no. 0064h
Message data Name and path to the file to delete (NULL terminated)
Response data The response data is a copy of the command data.

Command 0064h 0064h FILE_DELETE
Data size (size) (size) Maximum 256 bytes
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Path + filename Path + filename
Message data
10-29
Move File (FILE_MOVE)
Description
This command renames a file in the filesystem.
Note: Although the filesystem supports path lengths of up to 256 characters, the total length of the
source and destination paths summed together must be less than 256 characters when using this com-
mand due to limitations in the mailbox command structure.
Command no. 0065h
Message data Name + Path of source and destination, both NULL terminated

Command 0065h 0065h FILE_MOVE
Data size (size) (size) Size of path strings
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Source: Path + filename Source: Path + filename
Message data
Destination: Path + filename Destination: Path + filename
10-30
Rename File (FILE_RENAME)
Description
This command renames a file in the filesystem.
Note: Although the filesystem supports path lengths of up to 256 characters, the total length of the two
pathnames summed together must be less than 256 characters when using this command due to limita-
tions in the mailbox command structure.
Command no. 0066h

Command 0066h 0066h FILE_RENAME
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Old: Path + filename Old: Path + filename
Message data
New: Path + filename New: Path + filename
10-31
Copy File (FILE_COPY)
Description
This command copies a file in the filesystem to a specified location.
Note: Although the filesystem supports path lengths of up to 256 characters, the total length of the
source and destination paths summed together must be less than 256 characters when using this com-
mand due to limitations in the mailbox command structure.
Command no. 0067h

Command 0067h 0067h FILE_COPY
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Source: Path + filename Source: Path + filename
Message data
Destination: Path + filename Destination: Path + filename
10-32
Create Directory (DIR_CREATE)
Description
This command creates a directory in the file system.
Command no. 0068h
Message data Path and name of the new directory, null terminated.

Command 0068h 0068h DIR_CREATE
Data size (size) (size) Size of path string
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Path + name Path + name
Message data
10-33
Delete Directory (DIR_DELETE)
Description
This command deletes an empty directory from the file system.
Command no. 0069h
Extended Header -
Message data Path and name of the directory, null terminated.

Command 0069h 0069h DIR_DELETE
Data size (size) (size) Size of path string
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Path + name Path + name
Message data
10-34
Open Directory (DIR_OPEN)
Description
This command opens a directory and returns a descriptor that should be used on all further operations
on the directory.
See also 10-36 “Reading the Contents of a Directory”.
Command no. 006Ah
Extended Header -
Message data Path and name of the directory, null terminated.
Response data Directory handle & Fault information

Command 006Ah 006Ah DIR_OPEN
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Path + name Directory Handle (high) Response data word 1
Message data (String, null-terminated) Directory Handle (low) Response data word 2
• Directory Handle
Unique identifier which must be used on all further operations associated with the directory.
10-35
Read Directory (DIR_READ)
Description
This command reads the contents of a directory previously opened using DIR_OPEN. This must be
repeated until the response to the command is empty (i.e. until the response data size equals zero).
Command no. 006Bh
Extended Header Directory Handle & Fault information
Message data -
Response data Details about one object in the directory.

Command 006Bh 006Bh DIR_READ
Data size 0000h (size)
Extended word 1 Directory Handle (high) Directory Handle (high) (See DIR_OPEN)
Extended word 2 Directory Handle (low) Directory Handle (low)
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Response data byte 1
Object Size Response data byte 2
(long) Response data byte 3
Response data byte 4
Object Flags Response data byte 5
Object Name
Response data...
10-36
• Directory Handle
Unique identifier which must be used on all further operations associated with the directory.
• Object Size
Size of object (i.e. filesize).
• Object Flags
Various flags specifying the nature of the object:
b7 b6 b5 b4 b3 b2 b1 b0
(reserved) SYS H RO DIR
Bit Description
DIR Directory flag 0: Object is a file
1: Object is a directory
RO Read only 0: Object can be read or written
1: Object is read-only
H Hidden 0: Object is visible
1: Object is hidden
SYS System 0: User object
1: System object
• Object Name
Name of object, null-terminated (e.g. filename or directory name).
Reading the Contents of a Directory

The following flowchart illustrates the process of reading the contents of a directory:
6WDUW
2SHQGLUHFWRU\
XVLQJ',5B23(1
5HDGRQHGLUHFWRU\REMHFW
XVLQJ',5B5($'
SURFHVVGLUHFWRU\REMHFW
5HVSRQVHVL]H 1R
]HUR"
<HV
&ORVHWKHGLUHFWRU\
XVLQJ',5B&/26(
'RQH
10-37
Close Directory (DIR_CLOSE)
Description
This command closes a directory previously opened using DIR_OPEN.
Command no. 006Ch
Extended Header Directory Handle & Fault information
Message data -
Response data -

Command 006Ch 006Ch DIR_CLOSE
Extended word 1 Directory Handle (high) Directory Handle (high) (See DIR_OPEN)
Extended word 2 Directory Handle (low) Directory Handle (low)
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
10-38
Create RAM disc (CREATE_RAM_DISC)
Description
This command mounts the RAM disc into a specified directory in the file system.
• The directory must be empty
• If the directory doesn’t exist it will be created.
Command no. 0018h
Extended Header -
Message data String containing RAM disc location, null terminated

Command 0018h 0018h CREATE_RAM_DISC
Data size (size) (size) Size of data in bytes
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Path Path
Message data
• Path
RAM-disc location. Must be empty, or the command will fail.
10-39
Modbus/TCP Specific Commands

Mailbox Commands Description Page

Modbus Connection Timeout Set the timeout value for Modbus/TCP connections
10-40
(MB_CONN_TIMEOUT)
Disable Modbus/TCP server Disables the Modbus/TCP server
10-41
(DISABLE_MB_TCP)
Modbus ON/OFF Line Configuration Configures the Modbus ON/OFF line setting
10-42
(MB_ON_OFF_LINE_CONFIG)
Write Exception Status Defines the response to the Modbus command ‘Read Exception
10-43
(WR_EXP_STAT) Status’
Set Modbus Coil Area Size This command affects the Modbus addressing scheme and defines
10-44
(MB_SET_COIL_AREA_SIZE) part of the I/O data as coil-based
10-40
Modbus Connection Timeout (MB_CONN_TIMEOUT)
Description
This mailbox command configures the timeout value used for Modbus/TCP connections. If an estab-
lished Modbus/TCP connection does not receive a request within the specified time, the connection will
be shut down by the Modbus/TCP server.
Valid timeout values are:
• 0 - No timeout is used for Modbus connections
• 10 - 65535 - Timeout value in seconds.
The default value is 60 seconds.
Command no. 0020h
Extended Header -
Message data Timeout value

Command 0020h 0020h MB_CONN_TIMEOUT
Data size 0002h 0002h 2 bytes (1 word)
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message data word 1 Timeout value Timeout value
10-41
Disable Modbus/TCP server (DISABLE_MB_TCP)
Description
This mailbox command disables the Modbus/TCP server.
Note: This may only be issued during initialization.
Command no. 0021h
Extended Header -
Message data -
Response data -

Command 0021h 0021h DISABLE_MB_TCP
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-42
Modbus ON/OFF Line Configuration (MB_ON_OFF_LINE_CONFIG)
Description
This command configures the Modbus ON/OFF line setting.
Note: This command overrides the configuration stored in the configuration file ‘ethcfg.cfg’.
Command no. 0023h
Extended Header Time out value.
List of triggering modbus commands (up to 11 entries).
Message data
Data size = 0 = trigger for all commands.

Command 0023h 0023h MB_ON_OFF_LINE_CONFIG
Data size (size) (size) Up to 11 bytes
Extended word 1 Timeout value -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message databyte 1 Trigger command 1 Trigger command 1
Message databyte 2 Trigger command 2 Trigger command 2
... ... ...
Message databyte <=11 Trigger command <=11 Trigger command <=11
• Timeout Value
A value of 1 equals 100ms.
A value of 0 configures the ON/OFF line functionality to be triggered by the Link Status.
• Trigger Commands
Trigger Command = Modbus function code to trigger from
10-43
Write Exception Status (WR_EXP_STAT)
Description
This command is used to define the response to the Modbus command ‘Read exception status’ (FC7).
This means that the exception status value is set by the application, not by the Anybus module.
Command no. 0022h
Extended Header -
Message data Exception status byte

Command 0022h 0022h WR_EXP_STAT
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message data byte 1 Exception status byte Exception status byte
10-44
Set Modbus Coil Area Size (MB_SET_COIL_AREA_SIZE)
Description
This command causes the module to operate in Modbus Address Mode, and defines part of the Input/
Output Areas as coil based.
See also...
• 2-2 “Modbus/TCP”
Command no. 0024h
Extended Header -
Message data Coil Size In, Coil Size Out

Command 0024h 0024h Set Modbus Coil Area Size
Data size 0004h 0004h 4 bytes of data
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message data word 1 Coil Size In Coil Size In
Message data word 2 Coil Size Out Coil Size Out
• Coil Size In
Number of bytes in the Input Area that shall be treated as coils.
• Coil Size Out

Number of bytes in the Output Area that shall be treated as coils.
10-45
EtherNet/IP Specific Commands

Command Description Page

Set Product Info All
10-46
(PRODUCT_INFO_ALL)
Set Product Info
Customizes EtherNet/IP product info 10-47
(SET_PRODUCT_INFO)
Set Product Code
10-48
(SET_PRODUCT_CODE)
Parameter Data Input Mapping
10-49
(PARAMETER_INPUT_MAP)
Maps Parameter Data to the Parameter Input/Output Objects
Parameter Data Output Area Map-
10-51
ping (PARAMETER_OUTPUT_MAP)
I/O Data Input Area Mapping
10-53
(IO_INPUT_MAP)
Maps I/O data to the Assembly Object
I/O Data Output Area Mapping
10-55
(IO_OUTPUT_MAP)
10-57
Send UCMM (SEND_UCMM) Sends an unconnected message to another node
UCMM Request Issued by the module when a UCMM request is addressed to a

10-59
(UCMM_REQUEST) user-registered object
10-60
Register Class (REGISTER_CLASS) Registers an EtherNet/IP object in the message router object
Deregister Class
De-registers a previously registered class from the message router 10-61
(DEREGISTER_CLASS)
Enable Routing
Enables the routing and bridging functionality 10-62
(ENABLE_ROUTING)
10-63
Register Port (REGISTER_PORT) Registers a port in the port object
Route Unconnected Send Issued by the module upon receiving an unconnected send mes-
10-66
(ROUTE_REQUEST) sage
Enable Reset Notification
Enables Identity Object reset notification 10-68
(ENABLE_ID_RESET_NOTIFY)
Reset Notification
Reset notification 10-69
(ID_RESET_NOTIFY)
Get Reset Parameter
Get reset parameter 10-70
(GET_ID_RESET_PARAM)
Copy I/O Status
Changes the default behaviour regarding the I/O Status bytes 10-71
(COPY_IO_STATUS)
Disable EtherNet/IP
Disables the EtherNet/IP protocol support 10-72
(DISABLE_ETHERNET_IP)
Change Ethernet Port
Changes the port number reported in the Port Object 10-73
(CHANGE_ETHERNET_PORT)
Reset on IP Change Causes the module to issue a reset request to the identity object
10-74
(RST_ON_IP_CHANGE) when the IP configuration has been changed over EtherNet/IP
Enable Configuration Assembly Enables the application to take advantage of the configuration data
10-75
(ENABLE_CONFIG_SY) in the Forward_Open-request.
Configuration Assembly Request
Issued by the module upon receiving the Forward_Open-request 10-76
(CONFIG_SY_REQUEST)
Enable Exact IO Match Forces the module to only accept IO connection requests which
10-77
(ENABLE_IO_MATCH) exactly matches the sizes specified in Anybus_INIT
10-46
Set Product Info All (PRODUCT_INFO_ALL)
Description
This command is used to change Vendor ID, Device Type, Product Code, Major Revision, Minor Re-
vision, and Product Name in the Identity object to customize the developed product. Note that the
EDS-file must be modified accordingly.
Contact HMS for more information about obtaining a Product Code.
Note: This command can only be issued during module initialisation.
Command no. 0089h
Extended Header -
Vendor ID, Device Type, Product Code, Major/Minor Revision, Name length,
Message data
Name (ascii)

Command 0089h 0089h PRODUCT_INFO_ALL
Data size (size) (size) Message data size
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message data byte 1 Vendor ID (high byte) Vendor ID (high byte) Vendor ID
Message data byte 2 Vendor ID (low byte) Vendor ID (low byte)
Message data byte 3 Device type (high byte) Device type (high byte) Device Type
Message data byte 4 Device type (low byte) Device type (low byte)
Message data byte 5 Product code (high byte) Product code (high byte) Product Code
Message data byte 6 Product code (low byte) Product code (low byte)
Message data byte 8 Major revision Major revision Major revision
Message data byte 9 Minor revision Minor revision Minor revision
Message data byte 10 Product name length Product name length Length of prod. name
Message data byte 11 Product name 1st character Product name 1st character Product name 1st character
... ... ... ...
Message data byte n Product name last character Product name last character Last character
10-47
Set Product Info (SET_PRODUCT_INFO)
Description
This mailbox command is used to customize the Vendor ID, Product Code and Product Name in the
Identity object. The EDS file needs to be adjusted accordingly.
Command no. 0082h
Extended Header -
Message data Vendor ID, Product code, Name length, Name

Command 0082h 0082h SET_PRODUCT_INFO
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message data byte 1 Vendor ID (high byte) Vendor ID (high byte) Vendor ID
Message data byte 2 Vendor ID (low byte) Vendor ID (low byte) “
Message data byte 3 Product code (high byte) Product code (high byte) Product code
Message data byte 4 Product code (low byte) Product code (low byte) “
Message data byte 5 Product name length Product name length Product name, max 32 char.
Message data byte 6 Product name 1st character Product name 1st character “
Message data byte 7 Product name 2st character Product name 2st character “
... ... ... “
Message data byte n Product name last character Product name last character “
10-48
Set Product Code (SET_PRODUCT_CODE)
Description
This mailbox command is used to customize the Product Code of the module. This enables a configu-
ration tool to identify the product as a special implementation instead of a general Anybus-S module.
The EDS file needs to be adjusted accordingly.
Command no. 0083h
Extended Header -
Message data Product code

Command 0083h 0083h SET_PRODUCT_CODE
Data size 0002h 0002h 2 bytes of data (1 word)
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message data word 1 Product Code Product Code
10-49
Parameter Data Input Mapping (PARAMETER_INPUT_MAP)
Description
This command maps blocks of Input Parameter Data to the Parameter Data Input Mapping Object, al-
lowing a ‘Get_Attribute_Single’-request to return a specified block of data. Up to 50 blocks can be
mapped this way.
Attributes are mapped in sequence, i.e. the first mapping specified corresponds to attribute #1, the sec-
ond to attribute #2 etc. The size and location of each block is specified separately for each attribute.
If zero length is specified for an attribute, that attribute will not be mapped. This way, it’s possible to for
example map only attributes 1 and 10 by specifying zero length for attributes 2 through 9. It is only nec-
essary to specify mapping information up to the last used attribute; the remainder will not be mapped.
If the mapping information for an attribute is invalid, the length and offset for that attribute will be set
to zero in the response, and the attribute will not be mapped.
See also...
Note: This command may only be issued during module initialisation, after Anybus_INIT.
Command no. 0084h
Message data Mapping information
10-50
Command and response layout (example when only setting attribute 1-5)

Command 0084h 0084h PARAMETER_INPUT_MAP
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message data word 1 Offset Offset Offset
Message data word 2 Length Length Number of bytes to map
Message data word 3 Offset Offset Attribute 2
Message data word 4 Length Length
10-51
Parameter Data Output Area Mapping (PARAMETER_OUTPUT_MAP)
Description
This command maps blocks of Output Parameter Data to the Parameter Data Output Mapping Object,
allowing a ‘Set_Attribute_Single’- or ‘Get_Attribute_Single’-request to set/return a specified block of
data. Up to 50 blocks can be mapped this way.
Attributes are mapped in sequence, i.e. the first mapping specified corresponds to attribute #1, the sec-
ond to attribute #2 etc. The size and location of each block is specified separately for each attribute.
See also...
• 9-13 “Parameter Data Output Mapping Object, Class B1h”
Note: This command may only be issued during module init.
Command no. 0085h
Message data Offset and length of the instances to map
10-52
Command and response layout (example when only setting attribute 1-5)

PARAMETER_OUTPUT_M
Command 0085h 0085h
AP
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
10-53
I/O Data Input Area Mapping (IO_INPUT_MAP)
Description
This command maps blocks of Input I/O Data to the I/O Data Input Mapping Object. Attributes are
mapped in sequence, i.e. the first mapping specified corresponds to attribute #1, the second to attribute
#2 etc. The size and location of each block is specified separately for each attribute. Up to 6 blocks can
be mapped this way.
The mapped attribute will be mirrored to the Assembly Object, instances 64h... 69h. If no mapping in-
formation is specified (i.e. if this command is never issued), all Input I/O data will be grouped in As-
sembly Object instance 64h.
See also...
Note: This command may only be issued during module initialisation., after Anybus_INIT.
Command no. 0086h
10-54

Command 0086h 0086h IO_INPUT_MAP
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message data word 3 Offset Offset Instance 65h
10-55
I/O Data Output Area Mapping (IO_OUTPUT_MAP)
Description
This command maps blocks of Output I/O Data to the I/O Data Output Mapping Object. Attributes
are mapped in sequence, i.e. the first mapping specified corresponds to attribute #1, the second to at-
tribute #2 etc. The size and location of each block is specified separately for each attribute. Up to 6
blocks can be mapped this way.
The mapped attribute will be mirrored to the Assembly Object, instances 96h... 6Bh. If no mapping in-
formation is specified (i.e. if this command is never issued), all Output I/O data will be grouped in As-
sembly Object instance 96h.
See also...
Note: This command may only be issued during module initialisation., after Anybus_INIT.
Command no. 0087h
10-56

Command 0087h 0087h IO_OUTPUT_MAP
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message data word 9 Offset Offset Instance 9Ah
Message data word 11 Offset Offset Instance 9Bh
10-57
Send UCMM (SEND_UCMM)
Description
This mailbox command is used to send an explicit unconnected message from the application directly
to a node in the network. The format of the message is the message router / request format. (For more
information, consult the EtherNet/IP Specification volume 1, section 2-4). This command will not re-
spond until the response from the remote host is received or a timeout has occurred.
Command no. 008Ah
Extended Header Destination IP address
Message data Unconnected message request
Response data Unconnected message response

Message ID ID ID
Command 008Ah 008Ah SEND_UCMM
Data size (data size) (data size) Size of data
Extended word 1 Destination IP high word Destination IP high word Destination IP high word
Extended word 2 Destination IP low word Destination IP low word Destination IP low word
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault Information
Message data byte 1 Service Request
Message data byte 2 Request Path Size (in words)
Message data byte 3
Padded EPATHa (Service Dependant)
...
...
(optional service data)
Message data byte n
a. See EtherNet/IP Specification, Appendix C - ‘Data Management’
The following example (see next page) uses the SEND_UCMM command to retrieve data from a node
on the network. The remote node is an Allen Bradley ControlLogix5000 with a 1756-ENBT/A Ethernet/
IP module. It has VendorID 0001h, Product Type 000C, Product Code 003Ah, Version 1.33 and Serial
Number 00121E63h. The request that is sent to the remote node is ‘Get_Attribute_All’ (0x01) to Class
0x01 and Instance 0x01. This is the identity object, see 5-2.2 in the EtherNet/IP specification for more
information about the response.
10-58
Send UCMM Example

Message ID ID ID
Command 008Ah 008Ah SEND_UCMM
Data size 0006h 001Eh Size of data
Extended word 1 0A0Ah 0A0Ah Destination IP (high word)
Extended word 2 0E50h 0E50h Destination IP (low word)
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Data byte 1 (Service Request) 01h (Get_Attribute_All) 81h Get_Attiribute_All reply
Data byte 2 (Request Path Length) 02h (2 words) 00h (reserved)
Data byte 3 (Segment Type) 20ha 00h General Status
Data byte 4 (Segment Data) 01h (Class #1) 00h Additional Status
Data byte 5 (Segment Type) 24hb 01h Vendor ID (LSB)
Data byte 6 (Segment Data) 01h (Instance #1) 00h Vendor ID (MSB)
0Ch Product Type (LSB)
00h Product Type (MSB)
3Ah Product Code (LSB)
00h Product Code (MSB)
01h Version (Major)
21h Version (Minor)
30h Status (LSB)
00h Status (MSB)
63h Serial no. (LSB)
a. Segment Type = Logical Segment 1Eh Serial no.
Logical Type = Class ID 12h Serial no.
Logical Format = 8bit Logical Address
00h Serial no. (MSB)
0Bh (11) Product Name Length
b. Segment Type = Logical Segment
Logical Type = Instance ID 31h (‘1’) Product Name Char #1
Logical Format = 8bit Logical Address. 37h (‘7’) Product Name Char #2
35h (‘5’) Product Name Char #3
36h (‘6’) Product Name Char #4
2Dh (‘-’) Product Name Char #5
45h (‘E’) Product Name Char #6
4Eh (‘N’) Product Name Char #7
42h (‘B’) Product Name Char #8
54h (T1’) Product Name Char #9
2Fh (‘/’) Product Name Char #10
41h (‘A’) Product Name Char #11
10-59
UCMM Request (UCMM_REQUEST)
Description
This message is used when the application has registered an EtherNet/IP class (See 10-60 “Register
Class (REGISTER_CLASS)”) in the module, and an explicit message request has been generated to this
class from a node in the EtherNet/IP network.
The format of the message is the message router / request format. (See EtherNet/IP Specification vol-
ume 1 section 2-4). The application will have to process the message, and respond to the module with
the data necessary to generate a response on the explicit message request for the object.
Initiated by Anybus
Command no. 008Dh
Extended Header -
Message data Explicit message request
Response data Requested data (or an error code)

Command 008Dh 008Dh UCMM_REQUEST
Data size (size) (size) Data size
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message data byte 1 Service Request Reply Service
Message data byte 2 Request Path Size (in words) Reserved (00h)
Message data byte 3 General Status
Padded EPATHa
... Size of Additional Status
... Additional Status
(optional service data)
Message data byte n Response_data
a. Request path according to the EtherNet/IP Specification, Appendix C - ‘Data Management’
10-60
Register Class (REGISTER_CLASS)
Description
This mailbox command makes it possible for the application to register objects inside the message router
object. If there is a node on the network that sends an explicit message request to the module, address
to the registered class, the explicit message will generate an explicit message request telegram, which will
be sent from the module to the application. See 10-59 “UCMM Request (UCMM_REQUEST)”.
Command no. 008Bh
Extended Header -
Message data Class ID

Command 008Bh 008Bh REGISTER_CLASS
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message data byte 1 Class ID (high byte) Class ID (high byte)
Message data byte 2 Class ID (low byte) Class ID (low byte)
10-61
Deregister Class (DEREGISTER_CLASS)
Description
This mailbox command makes it possible for the application to deregister objects inside the message
router object.
The following classes cannot be deregistered with this command;
• Class 02h - Message Router
• Class 04h - Assembly Object
Command no. 008Eh
Extended Header -
Message data Class ID

Command 008Eh 008Eh DEREGISTER_CLASS
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message data byte 1 Class ID (high byte) Class ID (high byte)
Message data byte 2 Class ID (low byte) Class ID (low byte)
10-62
Enable Routing (ENABLE_ROUTING)
Description
This mailbox command enables the routing functionality of the module.
Note: This command can only be sent during module initialization.
Command no. 0091h
Extended Header -
Message data -
Response data -

Command 0091h 0091h ENABLE_ROUTING
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-63
Register Port (REGISTER_PORT)
Description
This command is used to register a port in the Port Object (See EtherNet/IP specification vol. 1 chap-
ters 3 - 7). This must be done for each port in the application if routing is enabled. (See 10-62 “Enable
Routing (ENABLE_ROUTING)”). The message data shall contain the instance attributes 1, 2, 3, 4 and
7, in that order. The class attributes will be updated automatically after each received mailbox command.
Port 2 is reserved for the Anybus-S module, and it is not possible to register the same port twice.
Command no. 0090h
Extended Header -
Message data Instance attributes 1,2,3,4 and 7.

Command 0090h 0090h REGISTER_PORT
Data size (size) (size) Size of data in bytes
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Data byte 1 Port Type (high) Port Type (high)
Data byte 2 Port Type (low) Port Type (low)
Data byte 3 Port Number (high) Port Number (high)
Data byte 4 Port Number (low) Port Number (low)
Data byte 5 Port Object Size (high) Port Object Size (high)
Data byte 6 Port Object Size (low) Port Object Size (low)
Data byte 7
Port Object EPATH Port Object EPATH
...
(Padded)a (Padded)a
Data byte n
Data byte n+1 Port Name Length Port Name Length
Data byte n+2 Port Name Char #1 Port Name Char #1
Data byte n+3 Port Name Char #2 Port Name Char #2
... ... ... (Continued on next page)
Data byte z Port Name Char #n Port Name Char #n
Data byte z+1 Node address Node address
Data byte z+2 Node address Node address
10-64
a. See EtherNet/IP Specification, Appendix C - ‘Data Management’
Register Port Example

The following example registers a ControlNet redundant port (3) with port number 3. The port object
points to class F0h (ControlNet object) instance 01h. The name of the port is “ControlNet”, and the
node address is 8 on port 3.

Command 0090h 0090h REGISTER_PORT
Data size 0017h 0017h 23 bytes of data
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Data byte 1 00h 00h Port Type (high)
Data byte 2 03h 03h Port Type (low)
Data byte 3 00h 00h Port Number (high)
Data byte 4 03h 03h Port Number (low)
Data byte 5 00h 00h Port Object Size (high)
Data byte 6 02h 02h Port Object Size (low)
Data byte 7 20h 20h Port Object EPATH
Data byte 8 F0h F0h Port Object EPATH
Data byte 11 0Ah 0Ah Port Name Length
Data byte 12 43h 43h Port name: “C”
Data byte 13 6Fh 6Fh Port name: “o”
Data byte 14 6Eh 6Eh Port name: “n”
Data byte 15 74h 74h Port name: “t”
Data byte 16 72h 72h Port name: “r”
Data byte 17 6Fh 6Fh Port name: “o”
Data byte 18 6Ch 6Ch Port name: “l”
Data byte 19 4Eh 4Eh Port name: “N”
Data byte 20 65h 65h Port name: “e”
Data byte 21 74h 74h Port name: “t”
Data byte 22 03h 03h Port to leave node = 3
Data byte 23 08h 08h On ControlNet = 8
Continued on next page...

10-65
The [Port] section in the .EDS file should look like this to fit the example above:
[Port]
Port1 =
TCP, $ Port type
“TCP/IP”, $ Port name
“20 F5 24 01”, $ Path to object supporting this port
2; $ Port number
Port2 =
ControlNet, $ Port type
“ControlNet”, $ Port name
“20 F0 24 01”, $ Path to object supporting this port
3; $ Port number
10-66
Route Unconnected Send (ROUTE_REQUEST)
Description
This mailbox message is generated by the module when it receives a valid unconnected send message,
i.e. a message addressed to a port registered by the application. The message data contains the whole
unconnected send message (See EtherNet/IP spec. Vol. 1 3-5.5.4). The response message from the ap-
plication shall contain either a successful or unsuccessful unconnected send response (See EtherNet/IP
spec. Vol. 1 3-5.5.4).
If 16 or more message requests are waiting to be processed by the application, the module will answer
with a “No resource” error code for all new requests until there are less than 16 unprocessed requests.
Note: This function requires routing to be enabled, see 10-62 “Enable Routing
(ENABLE_ROUTING)”.
Initiated by Anybus
Command no. 008Fh
Extended Header -
Message data The unconnected send message received by the module
Response data The application shall respond with the data returned by the target device.
10-67

Command 008Fh 008Fh ROUTE_REQUEST
Data size (size) (size) Datasize
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message data byte 1 Transaction ID (low)
Message data byte 2 Transaction ID (high) Successful response:
Priority / Time tick Transaction ID (low) Response data byte 1
Time-out ticks Transaction ID (high) Response data byte 2
Msg. req. size (low) General Status = 00h
Msg. req. size (high) 00h (Reserved)
Service Code
Service Response Data
Request Path Size Response data byte n
Req. Path (Padded EPATH)
Message Request
Unsuccessful response:
Request Data Transaction ID (low) Response data byte 1
Transaction ID (high) Response data byte 2
00h (PAD) General Status = 00h
(Only if Msg.req.size is odd) Size of additional status
Route Path Size
Additional status
00h (reserved)
Message databyte n Route Path Remaining path size Response data byte n
10-68
Enable Reset Notification (ENABLE_ID_RESET_NOTIFY)
Description
This command enables reset notification. When reset notification is enabled and the identity object re-
ceives a valid reset request, the module will send an ID_RESET_NOTIFY to the application. (See 10-
69 “Reset Notification (ID_RESET_NOTIFY)”)
It is possible to change how the module should react when the identity object receives a valid reset re-
quest, by altering the Notify Type Value (See below)
Note: This command can only be sent during module initialisation.
Command no. 0092h
Extended Header -
Message data Notify type

Command 0092h 0092h ENABLE_ID_RESET_NOTIFY
Data size 0001h 0001h 1 byte of data
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message Databyte Notify type Notify type (See below)
• Notify Type Value

00h: When the identity object receives a valid reset request, the module sends
an ID_RESET_NOTIFY to the application.
01h: When the identity object receives a valid reset request, the configuration
file is erased, and the module sends an ID_RESET_NOTIFY to the application.
10-69
Reset Notification (ID_RESET_NOTIFY)
Description
If reset notification is enabled (see 10-68 “Enable Reset Notification
(ENABLE_ID_RESET_NOTIFY)”), this mailbox message is sent to the applications when the identity
object receives a valid reset request.
The message data contains the type of reset received, see ENIP spec. 5-2.3.1 Reset Service.
Initiated by Anybus
Command no. 0093h
Extended Header -
Message data Reset Type

Command 0093h 0093h ID_RESET_NOTIFY
Data size 0001h 0001h 1 byte of data
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message Databyte Reset Type Reset Type (See below)
• Reset Type Value

00h: Power on reset
01h: Out of box configuration
10-70
Get Reset Parameter (GET_ID_RESET_PARAM)
Description
Using this command, it is possible to determine what type of reset that was received via EtherNet/IP
Command no. 0095h
Extended Header -
Message data -
Response data Reset Type

Command 0095h 0095h GET_ID_RESET_PARAM
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Reset Type Response Databyte
• Reset Type Value

00h: Power on reset
01h: Out of box configuration
10-71
Copy I/O Status (COPY_IO_STATUS)
Description
When this message is sent to the module, the first four bytes in the connection a.k.a. Run/Idle header
is not stripped of the data but is passed to the DPRAM memory in front of the actual I/O data.
Command no. 0094h
Extended Header -
Message data -
Response data -

Command 0094h 0094h COPY_IO_STATUS
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-72
Disable EtherNet/IP (DISABLE_ETHERNET_IP)
Description
This mailbox command disables support for the EtherNet/IP protocol.
Command no. 000Ah
Extended Header -
Message data -
Response data -

Command 000Ah 000Ah DISABLE_ETHERNET_IP
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
10-73
Change Ethernet Port (CHANGE_ETHERNET_PORT)
Description
This command changes the port number reported by the Port Object.
Command no. 0096h
Extended Header -
Message data -
Response data -

Command 0096h 0096h Change Ethernet Port
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message Databyte Port no. Port no.
• Port no.
Desired port number.
10-74
Reset on IP Change (RST_ON_IP_CHANGE)
Description
This command instructs the module to issue a reset request towards the Identity Object when attribute
#5 in the TCP/IP Interface Object (TCP/IP Interface Object, Class F5h) has been altered. If the Iden-
tity Object is registered in the application, this causes a reset message to be sent to the application.
Command no. 0097h
Extended Header -
Message data -
Response data -

Command 0097h 0097h RST_ON_IP_CHANGE
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-75
Enable Configuration Assembly (ENABLE_CONFIG_SY)
Description
This command enables the module (application) to take advantage of the configuration data in a
Forward_Open-request, and will cause the module to issue CONFIG_SY_REQUEST upon reception
of a Forward_Open-request that contains a data segment.
Command no. 0098h
Extended Header -
Message data -

Command 0098h 0098h ENABLE_CONFIG_SY
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-76
Configuration Assembly Request (CONFIG_SY_REQUEST)
Description
If enabled, this command is issued spontaneously by the module upon reception of a Forward_Open-
request that contains a data segment.
Initiated by Anybus
Command no. 0099h
Extended Header -
Message data -
Response data -

Command 0099h 0099h CONFIG_SY_REQUEST
Extended word 1 Fragment Type Fragment Type
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Prod. Conn. Point (word) Prod. Conn. Point (word)
Fragmented Message Data Con. Conn. Point (word) Con. Conn. Point (word)
Configuration Data Configuration Data
• Fragment Type
Fragment Type Description

0000h First fragment of new message
0001h Subsequent fragment
0002h Last fragment. Signals the end of the fragmented data.
• Fragmented Message Data

The data in this message is fragmented, which means that the message will be issued repeatedly
until all data has been transferred. The first fragment contains the Producing/Consuming Con-
nection Point, followed by a block of Configuration Data. The remaining fragments only con-
tains Configuration Data.
The application must monitor the Fragment Type-register. Upon reception of the last fragment,
the application shall assemble and process the Configuration Data as a complete message.
10-77
Enable Exact IO Match (ENABLE_IO_MATCH)
Description
This command forces the module to only accept IO connection requests which exactly matches the sizes
specified in Anybus_INIT.
Note: This command may only be issued during module initialization.
Command no. 009Ah
Extended Header -
Message data -
Response data -

Command 009Ah 009Ah ENABLE_IO_MATCH
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
10-78
Mailbox Socket Interface

The Anybus module features a transparent socket interface, allowing the application to send and receive
transparent data via TCP/IP or UDP/IP. The mailbox socket interface can be used in two modes:
• Non-blocking
All mailbox operations on these sockets will respond directly - not block until the command is
performed. Up to 16 simultaneous non-blocking sockets are supported.
Note: Status information for all non-blocking sockets are available in the fieldbus specific area,
see 11-1 “Fieldbus Specific Area”.
• Blocking
Blocking sockets means that the Anybus will not respond to further socket commands until the
previous one has been completed (However, non-socket related commands can still be proc-
essed as normal). Up to 32 simultaneous blocking sockets are supported.
Note: Blocking sockets do not have any status information in the fieldbus specific area.

Socket non-blocking Creates a socket in non-blocking mode. 10-79
(SOCKET_NB)
Socket blocking Creates a socket in blocking mode. 10-80
(SOCKET_B)
Listen Starts listen on a socket for incoming connections. 10-81
(LISTEN)
Accept Accepts connections for sockets in blocking mode. 10-82
(ACCEPT)
Connect Tries to connect a socket to a client. 10-83
(CONNECT)
Send Sends a message to a connected socket. 10-85
(SEND)
Receive Receives a message form a connected socket. 10-86
(RECEIVE)
Send To Sends a message to an unconnected UDP socket to a specified 10-87
(SEND_TO) host.
Receive From Receives a message from an unconnected UDP socket. 10-88
(RECV_FROM)
Close Closes a socket (and connection). 10-89
(CLOSE)
Send Fragment Sends a fragment of a message with a maximum total size of 4096 10-90
(SEND_FRAG) bytes.
Receive Fragment Receives a fragment of a message with a total maximum size of 10-91
(RECV_FRAG) 4096 bytes.
Send Fragment To Sends a fragment of a message with a total maximum size of 4096 10-93
(SEND_FRAG_TO) bytes to an unconnected UDP socket.
Receive Fragment From Receives a fragment of a message with a total maximum size of 10-94
(RECV_FRAG_FROM) 4096 bytes from an unconnected UDP socket.
Get Socket Option Read options from a socket. 10-96
(GET_SOCKET_OPTION)
Set Socket Option Sets options to a socket 10-97
(SET_SOCKET_OPTION)
10-79
Socket Non-Blocking (SOCKET_NB)
Description
This mailbox command creates a socket in non-blocking mode and associates it to a specific port
number. If the specified port number is 0, the Anybus module selects a free port.
The response message contains a socket descriptor and the port number. The socket descriptor shall be
used on all following operations on the socket.
Command no. 0040h
Extended Header -
Message data The socket type (TCP or UDP) and the port number to bind the socket to.
The response indicates if the command was accepted.
Response data The response indicates which socket descriptor that is used and the port
number the socket is associated to.

Command 0040h 0040h SOCKET_NB
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message dataword 1 Socket type Socket descriptor
Message dataword 2 Port number Port number
• Socket Type
Value Socket type

0001h TCP socket
0002h UDP socket
10-80
Socket Blocking (SOCKET_B)
Description
This mailbox command creates a socket in blocking mode and associates it to a specific port number. If
the specified port number is 0, the Anybus module selects a free port.
The response message contains a socket descriptor and the port number. This descriptor shall be used
on all following operations on this socket.
Command no. 003Fh
Extended Header -
Message data The socket type (TCP or UDP) and the port number to bind the socket to.
The response indicates if the command was accepted.
Response data The response indicates which socket descriptor that is used and the port
number the socket is associated to.

Command 003Fh 003Fh SOCKET_B
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message dataword 1 Socket type Socket descriptor
Message dataword 2 Port number Port number
• Socket Type
Value Socket type

0001h TCP socket
0002h UDP socket
10-81
Listen (LISTEN)
Description
This mailbox command makes a socket listen for new connections. If the Anybus module detects a con-
nection request on the specified socket, a new connected socket will be created, and the current socket
will continue listening for new connections. This means that multiple hosts can connect to one listening
socket simultaneously.
Note: This command can only be used on a TCP socket.
• Non-blocking sockets
Information about active connections on this socket can be read in the fieldbus specific area, see
11-1 “Memory Map” and 11-2 “Socket Status Structure”.
• Blocking sockets
Socket descriptors for new connections connected to this socket can be received by the mailbox
command ACCEPT, see 10-82 “Accept (ACCEPT)”.
Command no. 0041h
Extended Header Socket Descriptor, Fault Information
Message data -
Response data -

Command 0041h 0041h LISTEN
Extended word 1 Socket descriptor Socket descriptor
Extended word 2 (reserved, set to 0000h) -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
10-82
Accept (ACCEPT)
Description
When a connection request to a listening socket in blocking mode is received, this command receives
the socket descriptor of the newly created connected socket.
This command is blocking and will not respond until a connection request is received.
Command no. 0050h
Extended Header Socket Descriptor, Fault Information, Local Port no, Host Port no, Host IP
Message data -
Response data New socket descriptor

Command 0050h 0050h ACCEPT
Extended word 1 Socket descriptor Socket Descriptor
Extended word 2 (reserved, set to 0000h) Local Port No.
Extended word 3 - Host Port No.
Extended word 4 - Host IP-address word 1
Extended word 5 - Host IP-address word 2
Extended word 6 - -
Extended word 7 - -
New socket descriptor Response dataword
10-83
Connect (CONNECT)
Description
This mailbox command tries to establish a connection to a specified IP address and port number.
If the socket is of UDP type this command specifies the peer with which the socket is to be associated,
the address is to which datagrams are sent and the only address from which datagrams are received.
If the socket is of TCP type this command attempts to make a connection to another socket. TCP sock-
ets may CONNECT only once, while UDP sockets may use CONNECT multiple times to change their
association.
If this command is correctly sent, it will be accepted regardless it’s possible to establish a con-
nection or not. The result of the operation is available in the fieldbus specific area, see 11-1
“Fieldbus Specific Area”.
This command will block until a connection is established or the connection request is cancelled
due to timeout or connection error.
Command no. 0042h
Extended Header Socket Descriptor, Fault Information, Connection Result
Message data IP address, Port number
10-84

Command 0042h 0042h CONNECT
Extended word 1 Socket descriptor New Socket Descriptor
Extended word 2 (reserved, set to 0000h) Connection result
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message data word 1 IP address (high) IP address (high)
Message data word 2 IP address (low) IP address (low)
Message data word 3 Port number Port number
• Connection Result Code (Only for blocking sockets)
Code Status
0003h Connected
0004h Connection Refused
0005h Connection Timeout
0006h Connection Failed
10-85
Send (SEND)
Description
This mailbox command writes data to a connected socket. A maximum of 256 bytes of data can be sent
using this command.
If there isn’t enough space available for the data in the output buffers, the response will indicate
that the amount of data actually sent was less than requested.
If there isn’t buffer space available for the data in the output buffers this command will block
until there is.
Command no. 0043h
Message data Data to send

Command 0043h 0043h SEND
Data size (size) (size) Max. 256 bytes
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message data Data to send Sent data
10-86
Receive (RECV)
Description
This mailbox command receives data from a connected socket.
If the specified socket is of TCP type this command will return the requested number of bytes from the
received data stream. If the available data is less than requested, all available data will be returned.
If the specified socket is of UDP type this command will return the requested amount of data from the
next received datagram. If the datagram is smaller than requested, the entire datagram will be returned
in the response message. If the datagram is larger than requested, the excess bytes will be discarded.
A maximum of 256 bytes of data can be received using this command.
If no data is available on the socket the response will indicate that 0 bytes of data was received.
If this command is called and no data is available the command will block until there is. If the
response indicates that 0 bytes of data was received the connection has been closed by the host.
The socket however is still valid and must be closed using the mailbox command CLOSE.
Command no. 0044h
Extended Header Socket Descriptor, Bytes to receive, Fault Information
Message data -
Response data Received data

Command 0044h 0044h RECV
Data size 0000h (size) Maximum 256 bytes
Extended word 2 Bytes to receive (in bytes) -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Received data Response data
10-87
Send To (SEND_TO)
Description
This mailbox command sends a UDP datagram to a specified IP address and port number. A maximum
of 256 bytes of data can be sent using this command. (Unconnected UDP sockets only)
Command no. 0045h
Extended Header Socket Descriptor, IP-address, Port number, Fault Information
Response data Sent data

Command 0045h 0045h SEND_TO
Data size (size) (size) Maximum 256 bytes
Extended word 2 IP-address (high) IP-address (high) Destination IP address
Extended word 3 IP-address (low) IP-address (low)
Extended word 4 Port number Port number Port number
Extended word 6 - -
Extended word 7 - -
10-88
Receive From (RECV_FROM)
Description
This mailbox command reads the next received datagram from a UDP type socket. The response mes-
sage contains the IP address and port number of the sender.
If the received datagram is smaller than requested, the entire datagram will be returned in the response
message. If the received datagram is larger than requested, the excess bytes will be discarded.
A maximum of 256 bytes of data can be received using this command.
If the amount of data available on the socket is less than requested, this is reflected in the data
size of the response.
If this command is called and no data is available the command will block until there is.
Command no. 0045h
Socket Descriptor, Bytes to receive, IP-address, Port number, Fault Informa-
Extended Header
tion
Message data -

Command 0046h 0046h RECV_FROM
Data size 0000h (size) Maximum 256 bytes
Extended word 2 Receive data size IP address (high) Senders IP-address
Extended word 3 (reserved, set to 0000h) IP address (low)
Extended word 4 - Port number Sender port number
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
10-89
Close (CLOSE)
Description
This mailbox command causes a connected socket to shut down and release its socket descriptor.
Commands still blocking on the socket when it is closed will be aborted and return indicating
0010h (Command aborted)
Note: If a host closes a TCP connection while there is still data available to read on the socket in the
client, the client socket will be indicated as connected until all data is read. In this case, if the client tries
to send data the mailbox response will report “Can’t send more”.
Command no. 0047h
Message data -
Response data -

Command 0047h 0047h CLOSE
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
10-90
Send Fragment (SEND_FRAG)
Description
This mailbox command is used when sending messages larger than 256 bytes. Internally the fragments
are stored in a buffer until the last fragment is received. The message is then sent to the socket. The
maximum size of a fragmented message is 4096 bytes.
It is not possible to send multiple fragmented messages simultaneously. A fragmented message must be
completely sent before another fragmented message can be sent on the same or another socket.
If there isn’t enough space available for the data in the output buffers, the response will indicate
that the amount of data actually sent was less than requested.
If there isn’t buffer space available for the data in the output buffers this command will block
until there is.
Command no. 005Eh
Extended Header Socket descriptor, Fragment Type
Response data Sent Data

Command 005Eh 005Eh SEND_FRAG
Data size (size) (size) Max. 256 bytes/fragment
Extended word 2 Fragment type Fragment type See below
Extended word 3 (reserved, set to 0000h) No. of sent bytes (Only in last fragment)
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
• Fragment Type Value
Value Description
0000h First fragment of a new message
0001h Subsequent fragment of the message
0002h Last fragment of the message. When this fragment is sent the entire message will be
sent to the socket.
10-91
Receive Fragment (RECV_FRAG)
Description
This mailbox command is used to receive fragmented messages larger than 256 bytes from a connected
socket. Internally the entire message will be read from the socket to a buffer. The fragments of the mes-
sage can then be read from the buffer using this command.
If the specified socket is of TCP type this command will return the requested number of bytes from the
received data stream. If the available data is less than requested, all available data will be returned.
If the specified socket is of UDP type this command will return the requested amount of data from the
next received datagram. If the datagram is smaller than requested, the entire datagram will be returned
in the response message. If the datagram is larger than requested, the excess bytes will be discarded.
The maximum size of a fragmented message is 4096 bytes.
If no data is available the command will block until there is. If the response indicates that 0 bytes
of data was received the connection has been closed by the host. The socket however is still valid
and must be closed using the mailbox command CLOSE.
Command no. 005Fh
Extended Header Socket descriptor, Fragment Type, Receive Data Size, Bytes Remaining,
Fault information
Message data -
Response data Received Data
10-92

Command 005Fh 005Fh RECV_FRAG
Data size 0000h (size) Max. 256 bytes/fragment
Extended word 3 Receive data sizea Bytes remaining
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
a. The receive data size is only used if the Fragment type = 0000h
Value Description
0000h Receive first fragment of a new message. This receives a new message from the net-
work. Any unread fragments from earlier received datagrams will be overwritten.
0001h Receive the next fragment of the message.
10-93
Send Fragment To (SEND_FRAG_TO)
Description
This mailbox command sends a UDP datagram to a specified IP address and port number. This com-
mand is used when sending a fragment of a message larger than 256 byte. Internally the fragments are
stored in a buffer until the last fragment is received. The message is then sent to the socket. The maxi-
mum size of a fragmented message is 4096 bytes.
Command no. 005Ch
Extended Header Socket descriptor, Fragment Type, IP-address, Port number, No. of sent
bytes, Fault information
Response data Sent data

Command 005Ch 005Ch SEND_FRAG_TO
Data size (size) (size) Max. 256 bytes/fragment
Extended word 3 IP-address (high)a IP-address (high)a Destination IP address
Extended word 4 IP-address (low)a IP-address (low)a
Extended word 5 Port numbera Port numbera Destination Port number
Extended word 6 (reserved, set to 0000h) No. of sent bytes (Only in last fragment)
Extended word 7 - -
a. IP-address and Port Number shall only be given in the first fragment.
Value Description
0000h First fragment of a new message.
0001h Subsequent fragment of the message
0002h Last fragment of the message. When this fragment is sent the entire message will be
sent to the socket.
10-94
Receive Fragment From (RECV_FRAG_FROM)
Description
This mailbox command reads the next received datagram from a UDP type socket. The response mes-
sage contains the IP address and port number of the sender.
This command is used to receive a fragment of a message larger than 256 bytes. The maximum total size
of a fragmented message is 4096 bytes. The maximal size of each fragment is 256 bytes.
If the received datagram is smaller than requested, the entire datagram will be returned in the response
message. If the received datagram is larger than requested, the excess bytes will be discarded.
For blocking sockets, the first fragment will block until there is data available on the socket.
Internally the entire message is read from the socket to a buffer. The fragments can then be read from
the buffer using this command.
If this command is called but there is no data available on the socket the command will block
and not return until there is data available.
Command no. 005Dh
Extended Header Socket descriptor, Fragment Type, Received data size, Bytes remaining, IP-
address, port number, Fault information
Message data -
10-95

Command 005Dh 005Dh RECV_FRAG_FROM
Data size 0000h (size) Max. 256 bytes/fragment
Extended word 2 Fragment type Fragment type
Extended word 3 Receive data size Bytes remaining
Extended word 4 (reserved, set to 0000h) IP-address (high) The senders IP address
Extended word 5 - IP-address (low)
Extended word 6 - Port number The senders port number
Extended word 7 - -
Value Description
0000h Receive first fragment of a new message. This receives a new message from the net-
work. Any unread fragments from earlier received datagrams will be overwritten.
0001h Receive the next fragment of the message.
10-96
Get Socket Option (GET_SOCKET_OPTION)
Description
This command reads options from a socket.
Command no. 0051h
Extended Header Socket descriptor, Socket Option
Message data -
Response data Option Data

Command 0051h 0051h GET_SOCKET_OPTION
Data size 0000h 0000h (no message data)
Extended word 1 Socket Descriptor Socket Descriptor
Extended word 2 Socket Option (msb) Socket Option (msb)
Extended word 3 Socket Option (lsb) Socket Option (lsb)
Extended word 4
Extended word 5
Extended word 6
Extended word 7
Extended word 8
Option Data Response data
• Socket Options
Value Description
0000 0080h Get socket linger option (On/OFF and linger time)
0000 0008h Get socket keep-alive option (ON/OFF)
0000 0004h Get socket reuse address option (ON/OFF)
0000 000Ah Get multicast TTL value
0000 000Bh Get multicast loopback option
• Option Data
Data related to the specified socket option.
10-97
Set Socket Option (GET_SOCKET_OPTION)
Description
This command changes the settings for a specified socket.
Command no. 0052h
Extended Header Socket descriptor, Socket Option
Message data Option Data
Response data -

Command 0052h 0052h GET_SOCKET_OPTION
Data size 0000h 0000h (no message data)
Extended word 1 Socket Descriptor Socket Descriptor
Extended word 2 Socket Option (msb) Socket Option (msb)
Extended word 3 Socket Option (lsb) Socket Option (lsb)
Extended word 4
Extended word 5
Extended word 6
Extended word 7
Extended word 8 Fault Information
Message data Option Data
• Socket Options
Value Description
0000 0080h Get socket linger option (On/OFF and linger time)
0000 0008h Get socket keep-alive option (ON/OFF)
0000 0004h Get socket reuse address option (ON/OFF)
0000 000Ah Get multicast TTL value
0000 000Bh Get multicast loopback option
0000 000Ch Add multicast membership to the socket
0000 000Dh Drop multicast membership from the socket
0000 2002h Turns off delayed ACKs (nagle algorithm)
• Option Data
Data related to the specified socket option.
10-98
Other Commands

Alter LNK and ACT Led Functionality Alter the behaviour of the Link and Activity LEDs. 10-99
(ALT_LNK_ACT_LEDS)
Alter Module Status LED Functionality Alter the behaviour of the Module Status LED 10-100
(ALT_MS_LED_FUNCTION)
Alter Network Status LED Functionality Alter the behaviour of the Network Status LED 10-101
(ALT_NS_LED_FUNCTION)
Get DIP Switch Returns the setting of the onboard DIP switch 10-102
GET_DIP_SWITCH
DNS Request Asks the configured DNS server for the IP address of a spec- 10-103
(DNS_REQUEST) ified host
Send Email Sends an email message to a specified recipient 10-104
(SEND_EMAIL)
Request SSI Data Requests SSI data from the application 10-106
(REQUEST_SSI_DATA) (issued by the Anybus module)
Write SSI Data (WRITE_SSI_DATA) Writes SSI data to the application 10-107
(issued by the Anybus module)
Write Output Area Writes data to the Output Area 10-108
(WRITE_OUTPUT_AREA)
10-99
Alter LNK and ACT LED Functionality (ALT_LNK_ACT_LEDS)
Description
This command alters the behaviour of the Link and Activity LEDs.
Command no. 0017h
Extended Header -
Message data LED function

Command 0017h 0017h ALT_LNK_ACT_LEDS
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Message databyte 1 LED configuration LED configuration
• LED Configuration Value
Value Description
01h Led configuration 1 (Led 1 = Link, Led 4 = Activity)
02h Led configuration 2 (Led 1 = Link/Activity, Led 4 = Disabled)
10-100
Alter Module Status LED Functionality (ALT_MS_LED_FUNCTION)
Description
This function alters the behaviour of the Module Status LED.
Command no. 000Ch
Extended Header -

Command 000Ch 000Ch ALT_MS_LED_FUNCTION
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
• LED Configuration byte value
Value Description
01h Led configuration 1
04h Led configuration 4 (Disable)
10-101
Alter Network Status LED Functionality (ALT_NS_LED_FUNCTION)
Description
This function alters the behaviour of the Network Status LED.
Command no. 000Dh
Extended Header -

Command 000Dh 000Dh ALT_NS_LED_FUNCTION
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
• LED Configuration byte value
Value Description
10-102
Get DIP Switch (GET_DIP_SWITCH)
Description
This command returns the setting of the onboard switch.
Command no. 0012h
Extended Header -
Message data -
Response data Switch value

Command 0012h 0012h GET_DIP_SWITCH
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Switch Value Response databyte
• Switch Value
b7 b6 b5 b4 b3 b2 b1 b0
Switch 1 Switch 2 Switch 3 Switch 4 Switch 5 Switch 6 Switch 7 Switch 8
A set bit indicates that the switch is in ON position.

10-103
DNS Request (DNS_REQUEST)
Description
This command sends a request to the configured DNS server for the IP address of a specified host.
Command no. 0030h
Extended Header -
Message data Host (string, null-terminated)
Response data IP address of host, or 0.0.0.0 if not found.

Command 0030h 0030h DNS_REQUEST
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Host IP address (high) Response data word 1
Message data (string, null-terminated) IP address (low) Response data word 2
10-104
Send Email (SEND_EMAIL)
Description
This command sends an email to a specified recipient. The message data is sent as several fragments,
with a total maximum size of 1024 bytes. The maximum size of each fragment is 256 bytes.
Command no. 0070h
Message data Email message specification, fragmented.

Command 0070h 0070h SEND_EMAIL
Data size (fragment size) (fragment size) Max. 256 bytes / fragment
Extended word 1 Fragment Type -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - SMTP Error (Last fragment only)
Message data Fragment Data Fragment Data

10-105
• Fragment Type
This value must match the sequence of the fragments as follows:
Value Description
0000h This is the first fragment
0001h This is a subsequent fragment
0002h This is the last fragment
• SMTP Error
If an SMTP error occurred, the ‘SMTP Error’ word contains the error code from the SMTP serv-
er, see RFC 821 “Simple Mail Transfer Protocol” for more information.
• Fragment Data
The different parts of the email message shall be sent in the following order:
Fragment no. Fragment Type Description

1st 0000h Recipient(s), separated by semicolon (string, null-terminated)
2nd 0001h Sender address (string, null-terminated)
3rd Subject line (string, null-terminated)
4th Message body
...
...
...
...
(last fragment) 0002h
10-106
Request SSI Data (REQUEST_SSI_DATA)
Description
This message is issued by the Anybus module when a SSI has requested data from the application.
Example:
The following SSI...
<?--#exec cmd_argument=’printf( “Data: %u”, MbReadWord( 42 ) )’-->
... will cause the module to issues a REQUEST_SSI_DATA message. The value ‘42’ will be
passed to the application.
See also 8-5 “printf”.
Initiated by Anybus
Command no. 00A0h
Extended Header SSI Identifier
Message data SSI Data
Response data -

Command 00A0h 00A0h REQUEST_SSI_DATA
Data size 0000h (data size) (size of data)
Extended word 1 SSI Identifier SSI Identifier
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
SSI Data Response Data
• SSI Identifier
Identifier which can be used as desired by the application to address a specific block of data.
• SSI Data
Data associated with the specified SSI Identifier.
10-107
Write SSI Data (WRITE_SSI_DATA)
Description
This message is issued by the Anybus module when a SSI writes data to the application.
Example:
The following SSI...
<?--#exec cmd_argument=’scanf( “Input”, ”%i”, MbWriteWord( 24 ) )’-->
... will cause the module to issues a WRITE_SSI_DATA message each time a form with an object
named “Input” is sent to the web server. The value ‘24’ will be passed to the application.
See also 8-7 “scanf”.
Initiated by Anybus
Command no. 00A0h
Extended Header SSI Identifier
Message data -
Response data SSI Data

Command 00A1h 00A1h WRITE_SSI_DATA
Data size (data size) 0000h (size of data)
Extended word 1 SSI Identifier SSI Identifier
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message Data SSI Data
• SSI Identifier
Identifier which can be used as desired by the application to address a specific block of data.
• SSI Data
Data associated with the specified SSI Identifier.
10-108
Write Output Area (WRITE_OUTPUT_AREA)
Description
This command writes data to the Output Area.
Command no. 00C0h
Extended Header Offset, No. of bytes
Message data Data
Response data The response data field holds a copy of the command data.

Command 00C0h 00C0h WRITE_OUTPUT_AREA
Data size (data size) 0000h (size of data)
Extended word 1 Offset -
Extended word 2 No. of Bytes -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - -
Message Data Data Data
• Offset
Destination in Output Area.
• No. of Bytes
Number of bytes to write.
• Data
Data that shall be written.
Chapter 11
Fieldbus Specific Area
Memory Map
The Anybus module can handle 16 non-blocking sockets simultaneously. These can be accessed using
the mailbox socket interface to send and receive transparent data over the network. Information about
these 16 sockets can be read in the fieldbus specific area, see memory map below.
Address Contents Access
640h - 64Bh Socket Status (Descriptor 0) RO
64Ch - 657h Socket Status (Descriptor 1) RO
658h - 663h Socket Status (Descriptor 2) RO
664h - 66Fh Socket Status (Descriptor 3) RO
670h - 67Bh Socket Status (Descriptor 4) RO
67Ch - 677h Socket Status (Descriptor 5) RO
688h - 693h Socket Status (Descriptor 6) RO
694h - 69Fh Socket Status (Descriptor 7) RO
6A0h - 6ABh Socket Status (Descriptor 8) RO
6ACh - 6B7h Socket Status (Descriptor 9) RO
6B8h - 6C3h Socket Status (Descriptor 10) RO
6C4h - 6CFh Socket Status (Descriptor 11) RO
6D0h - 6DBh Socket Status (Descriptor 12) RO
6DCh - 6E7h Socket Status (Descriptor 13) RO
6E8h - 6F3h Socket Status (Descriptor 14) RO
6F4h - 6FFh Socket Status (Descriptor 15) RO
700h - 7A7h Reserved -
7B0h - 7B1h EtherNet/IP Connection Status RO
7B1h - 7FFh Reserved -

Fieldbus Specific Area 11-2
Socket Status Structure

Offset Register Type
000h Socket Type Byte
001h Socket Status Byte
002h - 003h Socket Information Word
004h - 005h Local Port Number Word
006h - 007h Host Port Number Word
008h - 00Bh Host IP Address Long
Socket Type
Value Description
00h No active socket (free to use)
01h TCP socket
02h UDP socket
03h - FFh (reserved)
Socket Status
Value Description
00h Not active
01h Listening
02h Connecting
03h Connected
04h Connection refused
05h Connection timed out
06h Connection failed
07h - FFh (reserved)
Socket Information
b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0

(reserved) DA
Bit Description
DA 0: Data Not Available
1: Data Available
Local Port Number

This is the local port number that the socket is associated with.
Host Port Number

This is the host port number that the socket is associated with or connected to.
Host IP-address
This is the host IP-address that the socket is associated with or connected to.
Fieldbus Specific Area 11-3
EtherNet/IP Connection Status

b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
(reserved) Status
7B0h (MSB) 7B1h (LSB)
Status
Value Status
00h No connection
01h Connected
02h Connection time out
Appendix A
Miscellaneous
Control Register Area
Fieldbus Type
The fieldbus type value for this product is 0083h.
Module Type
The module type value for this product is 0101h (Anybus-S).
Watchdog Counter Input (7D2h... 7D3h)

If the application has enabled the Watchdog Counter Input and doesn’t update it properly, the module
will seize all network participation (the MAC controller will be held in reset).
Event Notification Cause/Source Registers
• ON/OFF Line Indication (FBON/FBOF)

By default, these bits are triggered by the Link Status.
For other options, see...
- 3-3 “On/Off Line Configuration”
- 10-42 “Modbus ON/OFF Line Configuration (MB_ON_OFF_LINE_CONFIG)”
• Network Reset Functionality (RST)

The reset functionality is triggered by the reset service in the Identity Object. Additionally,
the application can be notified of reset requests through the mailbox interface.
See also...
- 9-3 “Reset Service”
- 10-69 “Reset Notification (ID_RESET_NOTIFY)”
- 10-70 “Get Reset Parameter (GET_ID_RESET_PARAM)”
- 10-74 “Reset on IP Change (RST_ON_IP_CHANGE)”
Miscellaneous A-2
Firmware Upgrade
The Anybus module supports firmware updates via FTP. Follow the steps below:
1. As a precaution, make a backup copy of the filesystem contents before proceeding.
2. Upload the new firmware file(s) to the system root (“\”), or to the ‘user\’-directory.
3. Reset the module and wait until the watchdog LED flashes 2Hz green (may take up to 1 minute).
4. Reset the module again. The new firmware is now operational.
Formatting the File System

In case of major file system damage, it is possible to re-initialise the file system as follows:
1. Short jumper named ‘J2’
2. Apply power
3. Wait until the watchdog LED turns red
4. Disconnect power
5. Remove jumper
6. Apply power
7. Wait approx. 1 minute while the filesystem is being formatted.
Appendix B
Technical Specification
Electrical Specification
Protective Earth (PE) Requirements
All Anybus-S/M modules feature cable shield filters designed in accordance with each network standard.
To be able to support this, the application must provide a connection to PE (Protective Earth) as de-
scribed in the general Anybus-S Parallel Design Guide. HMS cannot guarantee proper EMC behaviour
unless this requirement is fulfilled.
Power Supply
Supply Voltage
The module requires a regulated 5V power supply as specified in the Anybus-S Parallel Design Guide.
Power Consumption
The maximum power consumption is 450mA.
Environmental Specification
• Temperature
Test performed according to IEC-68-2-1 and IEC 68-2-2.
Operating: 0 to 70°C (32 to 158°F)
Storage: -25 to +85°C (-13 to 185°F)
• Humidity
The product is designed for a relative humidity of 5 to 95% non-condensing.
Test performed according to IEC 68-2-30.
EMC Compliance (CE)

The EMC pre-testing has been conducted according to the following standards:
• Emission: EN 50 081-2:1993
Tested per EN 55022 Class A: 1997
EN 55022 Class A: 1997
• Immunity: EN 61000-6-2: 1999

Tested per EN 61000-4-2:1995
EN 61000-4-3:1996
EN 61000-4-4:1995
EN 61000-4-5:1995
EN 61000-4-6:1996
Appendix C
Connectors
Application Connector
(Consult the general Anybus-S Parallel Design Guide for more information)
Ethernet
The module supports RJ45 and board-to-board connectors:
RJ45 (Standard)
Pin Signal
1 TD+
2 TD-
3 RD+
4 Termination
5 Termination
1 8
6 RD-
7 Termination
8 Termination
Board to Board
Pin Signal
1 Shield
2 Termination (Connected to RJ45 pin 4 and 5)
1
4 NC
5 TD+
6 TD-
7 RD+
8 Termination (Connected to RJ45 pin 7 and 8) 10
9 RD-
Appendix D
Mechanical Specification
Measurements, Connectors & LEDs

MM

ABS EIP App 1 50

Uploaded by

Copyright:

Available Formats

ABS EIP App 1 50

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ABS EIP App 1 50

Uploaded by

Copyright:

Available Formats

Fieldbus Appendix

HMS Industrial Networks AB

Preface About This Document

Chapter 1 About the Anybus-S EtherNet/IP

Chapter 2 Basic Operation

Chapter 3 Basic Network Configuration

Chapter 4 FTP Server

Chapter 5 Telnet Server

General Commands.............................................................................................................................. 5-2

Chapter 6 Web Server

Chapter 7 SMTP Client

Chapter 8 Server Side Include (SSI)

Chapter 9 CIP Object Implementation

Diagnostic Object, Class AAh ............................................................................................................ 9-9

Chapter 10 Fieldbus Specific Mailbox Commands

General Configuration Commands.................................................................................................. 10-2

EtherNet/IP Specific Commands..................................................................................................10-45

Chapter 11 Fieldbus Specific Area

Appendix B Technical Specification

Appendix D Mechanical Specification

About This Document

How To Use This Document

Important User Information

Summary of Recent Changes (1.40... 1.50)

Revision Date Author(s) Chapter(s) Description

Conventions & Terminology

HMS Sweden (Head Office)

About the Anybus-S EtherNet/IP

/LQN $FWLYLW\   0RGXOH6WDWXV

• Led configuration 1 (Default)

• Led configuration 3 (Default)

• Led configuration 3 (Default)

• Led configuration 1 (Default)

• Anybus Addressing Mode (Default)

• Modbus Addressing Mode

Supported Exception Codes

Code Name Description

Anybus Addressing Mode (Default)

Supported Function Codes

Modbus Function Function Code Associated with...

Coil & Register Map

The data is mapped to Coils & Registers as follows:

Register # Coil # Area Offset in Area Comments

Note 1: The table above applies to all function codes.

Modbus Addressing Mode

Supported Function Codes

Modbus Function Function Code Associated with...

Register # Input Data Bytes Comments

Coil # Input Data Bytes Comments

Register # Output Data Bytes Comments

Coil # Output Data Byte Comments

• Non-volatile area (approx. 1Mb)

• Volatile area (approx. 1Mb)

5$0 YRODWLOHRSWLRQDO HPDLO

Basic Network Configuration

• Settings specified by Configuration Switches

• Settings specified by Application

• Settings specified in ‘ethcfg.cfg’

Ethernet Configuration File (‘ethcfg.cfg’)

/LQN$FWLYLW\ 0RGXOH6WDWXV

5$0 YRODWLOHRSWLRQDO HPDLO