FEH193 All Zrqs1kruxr

series
USER’S MANUAL
SPH Series CPU Module with Built-In Ethernet

<Ethernet Communication>
FEH193e
Preface
Thank you for purchasing Fuji Electric Programmable Controller MICREX-SX Series.
This user's manual describes the Ethernet communication specifications and operations of CPU modules with the Ethernet
function.
Read this manual carefully to ensure correct operation. When using modules or peripheral devices, be sure to read the
corresponding user's manuals listed below:
<Common related manuals for SX-Programmer Expert (D300win) and SX-Programmer Standard>
Title Manual No. Contents

User’s Manual Hardware, FEH201 Explains the system configuration, the specifications and
MICREX-SX series SPH operations of modules in the MICREX-SX series.
User’s Manual SPH3000MM, FEH302 Explains the differences from the SPH3000 series of
MICREX-SX series SPH SPH3000MM.
User’s Manual Motion Controller SPH5000M, FEH319 Explains the product specifications of the motion controller
MICREX-SX series SPH MICREX-SX SPH5000M, EP bus base board of SPH5000M, and
E-SX bus interface module.
<Related manuals for SX-Programmer Expert (300win)>

User’s Manual Instructions, FEH200 Explains the memory, language and system definitions of the
MICREX-SX series MICREX-SX series.
User’s Manual D300win <Reference>, FEH257 Explains the installation procedure, functions and operations of
MICREX-SX series D300winV3.
User’s Manual D300win <LD/FBD Editor>, FEH257-1 Explains the operations of LD/FBD editor added to D300winV3.
MICREX-SX series
User’s Manual SPH3000MG, FEH324 Explains the differences from the SPH3000 series of
MICREX-SX series SPH SPH3000MG.
User’s Manual System Duplex Controller FEH186 Explains the hardware specifications, memory specifications, and
SPH5000H, MICREX-SX series. duplex specifications of the SPH5000H series.
<Related manuals for SX-Programmer Standard>

User’s Manual Instructions, FEH588 Explains the memory, language and system definitions of the
MICREX-SX series MICREX-SX series.
User’s Manual SX-Programmer V2, FEH590 Explains the functions and operations of SX-Programmer
MICREX-SX series Standard V2.
User’s Manual SX-Programmer V3 FEH597 Explains the basic operations of SX-Programmer Standard V3.
Introduction, MICREX-SX series
User’s Manual SX-Programmer V3 FEH598 Explains the detailed functions and operations of SX-Programmer
<Reference>, MICREX-SX series Standard V3.
* This manual is available for both D300win and Standard loader.

* In addition to the above manuals, the following Fuji Electric Co.,Ltd.site offers various manuals and technical documents
associated with MICREX-F and MICREX-SX series.
URL https://www.fujielectric.com
Notes
1. This manual may not be reproduced in whole or part in any form without prior written approval by the manufacturer.
2. The contents of this manual (including specifications) are subject to change without prior notice.
3. If you find any ambiguous or incorrect descriptions in this manual, please write them down (along with the manual No.
shown on the cover) and contact FUJI.
Safety Precautions
Be sure to read the "Safety Precautions" thoroughly before using the module.
Here, the safety precautions items are classified into "Warning" and "Caution".
Warning : Incorrect handling of the device may result in death or serious injury.
Caution : Incorrect handling of the device may result in minor injury or physical damage.
Even some items indicated by "Caution" may result in a serious accident.

Both safety instruction categories provide important information. Be sure to strictly observe these instructions.
Warning
 Do not touch charged parts such as terminals while the power is ON. Touching such parts may result in electric shocks.
 Be sure to turn the power OFF before mounting or removing parts or components, wiring operations, maintenance, or
inspection. Working with the power ON may cause electric shocks, malfunctions, or failures.
 Configure the emergency stop, interlocking, and other circuits outside the PLC. Otherwise, errors, if any, in the PLC
may result in mechanical damages or accidents.
 Do not connect in reverse polarity, charge (except rechargeable ones), disassemble, heat, throw in fire or short-circuit
the batteries, otherwise, they might burst or take fire.
 If batteries have any deformation, spilled fluids, or other abnormality, do not use them. The use of such batteries might
cause explosion or firing.
 Do not open the FG terminal with the LG-FG short circuited. (It must be grounded, otherwise it might cause electric shock.)
Safety Precautions
Caution
 Do not use the product or parts found damaged or deformed when unpacking. If done, fire, malfunctions, or failures
may occur.
 Do not give shock to the product by dropping or turning it over. If done, the product may be damaged or failures may
occur.
 When mounting the product, follow the directions given in the Instruction Manual and the User’s Manual. The product
incorrectly mounted may be dropped or cause malfunctions or failures.
 Use the rated voltage and current specified in the Instruction Manual and the User’s Manual. Otherwise, fire,
malfunctions, or failures may occur.
 Use or keep the product under the environmental conditions described in the Instruction Manual and the User’s Manual.
Use or storage of the product under high temperature, high humidity, dew condensation, dust, corrosive gas, oil, organic
solvent, or excessive vibration or shock may result in electric shock, fire, malfunctions, or failures during operation.
 Select wires with the size appropriate to the applied voltage and current and tighten the wire terminals with the specified
torque. Inappropriate wiring or tightening may cause fire, dropping of the product, malfunctions, or failures.
 Mount the product so that no foreign matters such as dust, wire chips, or iron powder do not enter it. Otherwise, fire,
accidents, malfunctions, or failures may occur.
 After wiring, be sure to remove the dust cover from the module and unit. Using the product without removing the dust
cover may cause fire, accidents, malfunctions, or failures.
 Connect the ground terminal to the ground, otherwise, an erratic operation might occur.
 Periodically check that the terminal and mounting screws are securely tightened. Using the product with the screws not
securely tightened may cause fire or malfunctions.
 Be sure to place the attached connector cover on a connector unused. Otherwise, malfunctions or failures may occur.
 Install the furnished terminal cover on the terminal block, otherwise, electric shock or fire might occur.
 Sufficiently make sure of safety before program change, forced output, starting, stopping or anything else during a run.
The wrong operation might break or cause machine problems.
 Insert the loader connectors in the correct direction. Wrong connections may cause malfunctions.
 Before operating the PLC, touch a grounded metallic object, etc. to discharge static electricity from your body.
Excessive static electricity may cause malfunctions or failures.
 Carry out wirings securely and correctly, observing the instructions described in the Instruction Manual and the User’s
Manual. Incorrect wirings may cause fire, malfunctions, or failures.
 Do not hold the cord when disconnecting the plug from the receptacle. Otherwise, the cable may be broken resulting in
fire or failures.
 Do not attempt to change system configurations (such as installing or removing I/O modules) while the power is ON,
otherwise, failure or erratic operation might occur.
 If the product has a trouble, contact us for repair; never attempt to repair it in the field. When replacing the battery, be
careful of the connecting directions. Wrong connections may cause fire, accidents or failures.
 Clean this product after power-off using a towel that is moistened with lukewarm water and then wrung tightly. Do not use
thinner or other organic solvents, as the module surface might become deformed or discolored.
 Do not remodel or reassemble the product. Doing so may cause failures.
 When discarding the product, handle it as industrial waste observing the related regulations.
 The product described in this User’s Manual has not been designed or manufactured for purposes of use in equipment
or systems which involve human lives.
 If you intend to use the product described in this User’s Manual for nuclear energy control, aerospace, medical
treatment, transportation, or passenger vehicles or special purposes of such systems, please consult your nearest Fuji
Electric agent.
 When using the product described in this User’s Manual for equipment or systems which, in case of failures, may lead to
loss of human lives or serious damages, be sure to provide protective measures.
 External power supply (such as 24V DC power supply) which is connected to DC I/O should be strongly isolated from
AC power supply, otherwise, accident or failure might occur. (Use of EN60950 conforming power supply is recommended.)
 Do not use this equipment in a residential environment.
Revision
* The manual No. is printed at the bottom right of the cover of this manual.
Printed on * Manual No. Revision contents
Jan. 2006 FEH193 First edition
Nov. 2015 FEH193d Some contents were added and modified according to revision of the Japanese
version.
Sep. 2023 FEH193e • Name of this manual was changed.

• Related manuals were added.
• Descriptions regarding SPH3000D, SPH3000MM, SPH3000MG, SPH5000H, and
SPH5000M were added.
• “6-2-2 Communication channel status information” was updated.
• “6-2-5 Error log information” was updated.
• “6-2-6 Error code list” was updated.
Contents
Preface
Safety Precautions
Revision
Contents
Section 1 Overview
1-1 Overview of Ethernet Communication using a CPU with Built-In Ethernet...................................... 1-1
Section 2 Specifications
2-1 Transmission Specifications................................................................................................................. 2-1
2-1-1 List of transmission specifications........................................................................................................................ 2-1
2-1-2 Communication ports of module ......................................................................................................................... 2-2
2-2 Communication Functions.................................................................................................................... 2-3
2-2-1 General Purpose Communication mode.............................................................................................................. 2-3
2-2-2 Fixed Buffer Communication mode...................................................................................................................... 2-4
2-2-3 Loader Command Communication mode............................................................................................................ 2-5
2-2-4 FTP server mode................................................................................................................................................. 2-6
2-3 Names and Functions............................................................................................................................ 2-9
Section 3 Mounting Modules

3-1 Mounting on Base Board....................................................................................................................... 3-1
3-1-1 Mounting position................................................................................................................................................. 3-1
3-1-2 Number of mountable modules............................................................................................................................ 3-1
Section 4 Communication Procedures

4-1 Overview of Communication Procedures............................................................................................ 4-1
4-1-1 General Purpose Communication mode / Fixed Buffer Communication mode................................................... 4-1
4-1-2 Loader Command Communication mode............................................................................................................ 4-1
4-1-3 FTP server communication.................................................................................................................................. 4-1
4-2 Operation Definition of Ethernet Part................................................................................................... 4-2
4-2-1 Basic settings of Ethernet part............................................................................................................................. 4-2
4-2-2 Setting FTP server functions................................................................................................................................ 4-7
4-3 Communication Procedure................................................................................................................... 4-8
4-3-1 Communication in General Purpose Communication mode................................................................................ 4-8
4-3-2 Communication in Fixed Buffer Communication mode........................................................................................ 4-12
4-3-3 Communication in Loader Command Communication mode.............................................................................. 4-17
4-4 Communication Program...................................................................................................................... 4-19
4-4-1 FBs used in communication program.................................................................................................................. 4-19
4-4-2 Channel open (M_OPEN).................................................................................................................................... 4-19
4-4-3 Message send (M_SEND)................................................................................................................................... 4-28
4-4-4 Message receive (M_RECEIVE).......................................................................................................................... 4-29
4-4-5 Remote data write (R_WRITE)............................................................................................................................ 4-31
4-4-6 Remote data read (R_READ).............................................................................................................................. 4-33
4-4-7 Status................................................................................................................................................................... 4-35
Contents
Section 5 SNTP Client and FTP Client Communication

5-1 SNTP Client Communication................................................................................................................ 5-1
5-1-1 Current time acquisition (SNTP_CLIENT)........................................................................................................... 5-2
5-2 FTP Client Communication................................................................................................................... 5-4
5-2-1 List of FTP client FBs........................................................................................................................................... 5-5
5-2-2 Connection open (FTP_OPEN)........................................................................................................................... 5-6
5-2-3 File store (FTP_PUT)........................................................................................................................................... 5-9
5-2-4 File get (FTP_GET).............................................................................................................................................. 5-11
5-2-5 Directory create (FTP_CREATE_DIR)................................................................................................................. 5-13
5-2-6 File delete (FTP_DELETE_FILE)......................................................................................................................... 5-15
5-2-7 Limits on operation............................................................................................................................................... 5-17
5-2-8 Example of client program................................................................................................................................... 5-18
Section 6 Ethernet Communication Information

6-1 Overview of Diagnosis........................................................................................................................... 6-1
6-2 Details of Ethernet Information............................................................................................................. 6-2
6-2-1 Communication channel information.................................................................................................................... 6-2
6-2-2 Communication channel status information......................................................................................................... 6-3
6-2-3 Communication parameter information................................................................................................................ 6-5
6-2-4 Node connection information............................................................................................................................... 6-6
6-2-5 Error log information............................................................................................................................................ 6-7
6-2-6 Error code list....................................................................................................................................................... 6-9
6-2-7 Working information............................................................................................................................................. 6-11
6-3 Details of Mail Information.................................................................................................................... 6-15
Appendix 1 Loader Command

Appendix 1-1 Overview of Loader Command.......................................................................................App.1-1
Appendix 1-2 Transmission Data Format of Commands.....................................................................App.1-2
Appendix 1-3 Detail Description of Loader Commands......................................................................App.1-5
Appendix 1-3-1 Read data.......................................................................................................................................App.1-5
Appendix 1-3-2 Write data........................................................................................................................................App.1-8
Appendix 1-3-3 CPU batch start...............................................................................................................................App.1-9
Appendix 1-3-4 CPU batch initialize and start..........................................................................................................App.1-10
Appendix 1-3-5 CPU batch stop...............................................................................................................................App.1-11
Appendix 1-3-6 CPU batch reset..............................................................................................................................App.1-12
Appendix 1-3-7 CPU individual start........................................................................................................................App.1-13
Appendix 1-3-8 CPU individual initialize and start....................................................................................................App.1-14
Appendix 1-3-9 CPU individual stop.........................................................................................................................App.1-15
Appendix 1-3-10 CPU individual reset.....................................................................................................................App.1-16
Appendix 2 Mail Function

Appendix 2-1 Overview of Mail Function..............................................................................................App.2-1
Appendix 2-2 Mail Specifications..........................................................................................................App.2-2
Appendix 2-3 Programming for Sending Mails....................................................................................App.2-4
Appendix 2-3-1 Setting System Definition................................................................................................................App.2-4
Appendix 2-3-2 Creating a program.........................................................................................................................App.2-8
Appendix 2-4 Sample Program..............................................................................................................App.2-14
Appendix 2-4-1 Mail sending (no log).......................................................................................................................App.2-14
Appendix 2-4-2 Mail sending (with attached file and log).........................................................................................App.2-15
Appendix 2-5 Mail Function Execution Time........................................................................................App.2-18
Contents
Appendix 3 Notes on Module Replacement

Appendix 3-1 Aging Time.......................................................................................................................App.3-1
Appendix 4 Receive Data Packet Merging Phenomenon

Appendix 4-1 Receive Data Packet Merging Phenomenon.................................................................App.4-1
Appendix 5 IP Address Setting

Appendix 5-1 IP Address Setting...........................................................................................................App.5-1
Section 1 Overview
1-1 Overview of Ethernet Communication using a CPU with Built-In Ethernet

This manual describes Ethernet communication using a CPU module with built-in Ethernet. Ethernet communication using a
board type PLC with built-in Ethernet is also described in this manual.
Ethernet node of another company
Programming loader for SX
Ethernet
MICREX-SX MICREX-SX
Ethernet built in CPU Ethernet interface module

(type: NP1L-ET1)
Described in this manual.
Described in the manual No. FEH259.
<Features>
• Ethernet is built in the CPU module.
• The FTP server and client function and mail function are provided.
1-1
Section 1 Overview
<Supported versions of programming loader>

Use the following version of programming loader to perform communication using built-in Ethernet.
Supported loader version

CPU type
D300winV2 D300winV3 Standard loader
V2.2.2.1 or latter
NP1PM-48E V3.3.0 or later
All versions of V3
V2.2.2.1 or latter
SPH2000 NP1PM-256E V3.3.2 or later
All versions of V3
V3.0.2.6 or latter
NP1PM-256H V3.3.4 or later
Not supported by V2
V3.0.2.6 or latter
NP1PU-048E V3.5.0 or later
Not supported by V2
V3.0.7 or latter
SPH3000 NP1PU-128E V3.6.2 or later
Not supported by V2
V3.0.2.6 or latter
NP1PU-256E V3.5.0 or later
Not supported by V2
NP1PU-048EZM No plans to support
NP1PU-096EZM V3.0.16.22 or latter
SPH3000D V3.6.10 or later
NP1PU-128EZM Not supported by V2
NP1PU-256EZM
NP1PU2-048E V3.0.3 or latter
SPH3000MM V3.5.2 or later
NP1PU2-256E Not supported by V2
SPH3000MG NP1PU1-256NE V3.6.2 or later Not supported
SPH5000H NP1PU1-512H V3.6.14 or later Not supported
NP1PA1-096E
NP1PA1-128E V3.1.0 or latter
SPH5000M V3.6.16 or later
NP1PA1-256E Not supported by V2
NP1PA1-512E
<Special notes>
• The built-in Ethernet of NP1PM-256H is used as a bus for data equalization in a redundant system configuration. Therefore,
communication using built-in Ethernet cannot be performed. Communication using a separately installed Ethernet module
(Type: NP1L-ET1) is possible. However, note that the functions specific to the built-in Ethernet (mail server/client and mail
function) are not available.
• “General Purpose Communication mode,” “Fixed Buffer Communication mode,” and “Loader Command Communication
mode” can be used in the almost same way as in an Ethernet module (Type: NP1L-ET1). However there are some
differences in the fine operations and the specifications. For more information, refer to the related sections in this manual
and the user’s manual for the Ethernet module (FEH259). (The Ethernet module may be referred to as ET1 hereafter.)
• Use a HUB by auto negotiation (automatic switching between 10M and 100M). When fixed at 100M or 10M (full duplex),
communication cannot be performed.
• The built-in Ethernet can be used as a starting point of a loader network, but not as a middle point (route).
• Up to a million (1,000,000) bytes (approx. 0.95MB) of file can be exchanged between a memory card inserted in the CPU
and a personal computer at a time during FTP communication.
<General notes on Ethernet>

Note 1: Sufficient safety measures need to be taken when Ethernet is installed.
Installation work should by done by a professional.
For the installation environment, refer to JIS X5252 (ISO 8802-3).
Note 2: For the cable and other peripheral devices, use commercially available ones that conform to IEEE802.3.
* Ethernet is a registered trademark of U.S. based Xerox Corp.
1-2
2-1 Transmission Specifications

2-1-1 List of transmission specifications
Item Specifications
Interface *1 10BASE-T 100BASE-TX 1000BASE-T
Transmission speed 10 Mbps 100 Mbps 1000 Mbps
Medium (physical specification) IEEE802.3u
AUTO MDI/MDI-X Only SPH2000 is not supported.
Interface changeover system Auto negotiation (automatic changeover)
Transmission medium Twisted pair cable
Max. segment length 100m
Max. number of nodes 1 node / segment
Performs communication between SX_CPU and other nodes, using TCP/IP or

General Purpose
UDP/IP protocol. Because of free data format, it is possible to communicate
Communication mode
with all kinds of nodes.
Fixed Buffer
Performs communication using the fixed buffer that Mitsuibishi PLC provides.
Communication mode
Communication Loader Command Performs communication between MICREX-SX series devices or with the host
function Communication mode PC or POD by the dedicated loader commands.
FTP server function Ethernet built-in CPU becomes the FTP server.
FTP client function Ethernet built-in CPU becomes the FTP client.
SNTP client function Obtains time information from the NTP server by a dedicated FB.
Mail function Transmits mails from Ethernet built in CPU.
Access method CSMA/CD
Transmission protocol TCP/IP, UDP/IP, ICMP, ARP
SPH3000MM firmware version V09 or later: 14 stations (ports)/module
SPH5000M: 14 stations (ports)/module
Other than the above: 10 stations (ports)/module
Max. number of simultaneous
Note: The number of communication ports that one CPU can simultaneously
communication
open is 56. When other communication modules exist, be careful that the
nodes (number of communication ports)
number of opened ports per CPU doesn’t exceed 56.
Responses of communication deteriorate as the number of communication
ports increases.
Transmission code Binary/ASCII code
*1 1000Mbps is supported by SPH5000H and SPH5000M. For 10BASE-T, only SPH5000M is not supported.
* Ethernet transmission frame

In Ethernet transmission frame (the figure below), “Type” or “Length” is entered in the field following the source MAC address,
but the CPU module supports only “Type” (DIX Ethernet specification).
Destination Source MAC ...

Type/Length IP header
MAC address address
6 bytes 6 bytes 2 bytes ... ...
2-1
2-1-2 Communication ports of module

(1) Number of communication ports (client ports)
The Ethernet built in the CPU module has 10 ports (Note 5) for communication with other nodes. These communication ports
are shared by the following communication functions. (FTP server/client, SNTP client, and e-mail communication mode are not
counted as ports. However, the communication speed is lowered if multiple functions are simultaneously used.
If an Ethernet module (Type: NP1L-ET1/ET2) is separately mounted, the number of communication ports can be increased.
However, the total communication speed is lowered as more communication ports are used. It is recommended to minimize the
number of ports used per CPU.
Communication No. of Connection

Communication function
type connections type
Max. 8
1) Number of General Purpose Communication mode connections
Message (Note 4)
communication Max. 8
Max. 8 Client
2) Number of Fixed Buffer Communication mode connections in total
(Note 4) connection
(Note 4)
3) Number of Loader Command Communication (send) mode
Max. 4
connections (Note 1)
Loader command
3) Number of Loader Command Communication (receive) mode
communication Server
connections (Note 2) Max. 10 (Note 5)
connection
5) Number of connections to loader (Note3)
Note 1: “Send” means the operation on the node side that sends a request by R_WRITE or R_READ.
Note 2: “Receive” means the operation on the node side that receives a request of R_WRITE or R_READ sent from a remote
node.
Note 3: “Loader connection” means communication performed between the PLC and a personal computer loader, POD, or
personal computer by loader command communication.
Note 4: SPH3000MM firmware version V09 or later, SPH5000M: Max. 12
Note 5: SPH3000MM firmware version V09 or later, SPH5000M: Max. 14
(2) Control of communication ports

The CPU module controls communication ports according to the following rules:
• When the target is client connections (1), 2) and 3) in the above table)
Ports can be opened until there remains no free communication port in the CPU module.
• When the target is server connections (4) and 5) in the above table)
Ports can be opened until the total number of server connections becomes the maximum number of connections or until
there remains no free communication port in the CPU module.
2-2
2-2 Communication Functions

The CPU module can communicate with maximum 10 stations (such as a personal computer and PLC) at a time. The following
seven Ethernet communication modes are available.
1) General Purpose Communication mode
2) Fixed Buffer Communication mode
3) Loader Command Communication mode
4) FTP server mode
5) SNTP client mode
6) FTP client mode
7) E-mail communication mode
Note 1: With regard to the number of stations to communicate with, the number of remote nodes must be 10 (stations) or less in
total of 1), 2) and 3) communication modes above .
Note 2: The communication modes 5) and 6) are supported by the following version of SPH2000 CPU and loader.
CPU version: V**08 or later, Loader (Expert) version: V3.4.1.0 or later
Note that the loader (Standard) does not support them.
Note 3: The communication mode 7) is supported by the following version of SPH2000 CPU and loader.
CPU version: V**10 or later, Loader (Expert) version: V3.4.4.0 or later
Note that the loader (Standard) does not support it.
2-2-1 General Purpose Communication mode

General Purpose Communication mode is used to communicate mainly between an SX_CPU and other nodes such as PLC
systems of other manufacturers, using TCP/IP or UDP/IP protocol. To send data from an SX_CPU to other nodes, use the
channel open FB (M_OPEN) and the message send FB (M_SEND). To receive data from other nodes, use the channel open FB
(M_OPEN) and the message receive FB (M_RECEIVE).
* For the details of the communication procedure, refer to “4-3-1 Communication in General Purpose Communication mode.”
<Features of General Purpose Communication mode>

• Because of free data format, it is possible to communicate with all kinds of node.
• The CPU module can communicate with maximum eight stations.
• When the remote node uses TCP division for data communication, maximum 730 words can be sent or received at a time.
(e.g. MICREX-F, FLEX-PC, and personal computer)
When the remote node uses IP division for data communication, maximum 1017 words can be sent or received at a time.
• Broadcast of UDP/IP is available.
MICREX-SX
Ethernet built in CPU
Send Receive
buffer buffer
Receive data
TCP/IP or UDP/IP
Send data PLC from other

manufacturer
Another node
2-3
2-2-2 Fixed Buffer Communication mode

Fixed Buffer Communication mode is used to communicate data using the fixed buffer that type AJ71E71 Ethernet interface unit
from Mitsubishi Electric Corp. provides.
This mode sets a subcommand in the data part of a TCP/IP or UDP/IP packet for General Purpose Communication mode to
enable the communication of command type data, where handshaking is made for the communication between a PLC and a
specific node.
* For the details of the communication procedure, refer to “4-3-2 Communication in Fixed Buffer Communication mode”.”
<Features of Fixed Buffer Communication mode>

• The CPU module can communicate with maximum 8 stations (PLC system from Mitsubishi Electric Corp.)
• Maximum 1017 words can be sent or received at a time.
MICREX-SX Ethernet built in CPU
Dedicated buffer 1 Dedicated buffer 8
Send Receive Send Receive

buffer buffer buffer buffer
Receive data/response
TCP/IP or UDP/IP
Send data/response
Other manufacturer's PLC
Another node
2-4
2-2-3 Loader Command Communication mode

Loader Command Communication mode communicates data using the loader commands that are dedicated to MICREX-SX
series. This mode is used to communicate data between nodes of an SX system or between an application program of a
personal computer and an SX_CPU. For communication between SX_CPUs, the remote data read FB (R_READ ) and remote
data write FB (R_WRITE) are used on the request sending side. No program is necessary on the request receiving side.
For communication between a personal computer and an SX_CPU, an application program for sending a request to read or
write needs to be created on the personal computer side. No application program is necessary on the SX_CPU side.
* For the details of the communication procedure, refer to “4-3-3 Communication in Loader Command Communication mode.”
<Communication conditions>
Communication mode General purpose

Communication protocol TCP/IP
Open system Unpassive
Self port No. 251 (loader command interface)
<Features of Loader Command Communication mode>

• The CPU module can communicate with maximum 8 stations.
• This mode is used mainly for the communication with another SX system that supports Ethernet or a personal computer.
No application program is necessary for the communication in the local node (the SX_CPU that receives a loader command).
However, to communicate with another SX system, set the self port standard No. to “256” (default). If a value other than the
default is set, communication fails.
MICREX-SX
Ethernt built in CPU
Memory in CPU
Communi- Communi-
cation cation
channel channel
Requested data
Response data
TCP/IP
Requested data
MICREX-SX
Response data
Ethernt built in CPU
Memory in CPU
Depending on the application Communi- Communi-

in the personal computer, “data cation cation
read” or “data write” loader channel channel
Another node
command is issued to SX_CPU.
Data read: R_READ FB

Data write: R_WRITE FB
* Loader command communication port is the self port standard No. + 251.
Default value is 256 + 251 = 507.
For example, when the self port standard No. is set to 1000, 1000 + 251 = 1251 becomes the port No. for loader command
communication.
2-5
2-2-4 FTP server mode

Ethernet built-in the CPU becomes an FTP server. You can access files in a user ROM card (CF or SD card) that is inserted in
the CPU from your personal computer, etc.
* For the details of the communication procedure, refer to “4-1-3 FTP server communication.”
* Number of FTP server control connections: 4
FTP server
Personal computer
Ethernet
Note: During FTP server communication, execution of project download (incl. rewriting of a program while the PLC is running)
and an FB that performs reading and writing of data from and to a user ROM card (incl. F_RAED, F_WRITE, and CSV
interface-related FB) has to wait. Especially when FTP server communication is used in two or more ports consecutively
or simultaneously, execution is kept waiting. Therefore, when performing FTP server communication, be careful of the
access frequency.
2-6
<FTP command supported by Ethernet built in CPU>
The tables below list FTP commands supported by Ethernet built in the CPU.
a: Supported
r: Not supported
(1) FTP access control command
Command Description Support Note
USER NAME Authentication username

a
(USER) (Enter a user name.)
PASSWORD Authentication password

a
(PASS) (Enter a password.)
ACCOUNT Account information

r
(ACCT) (Enter account information.)
CHANGE WORKING
Change working directory.
DIRECTORY a
(Change the working directory.)
(CWD)
CHANGE TO PARENT
Change to Parent Directory.
DIRECTORY a
(Move to the parent directory)
(CDUP)
STRUCTURE MOUNT Mount file structure.

r
(SMNT) (Mount the structure.)
REINITIALIZE Re-initialize the connection.

a
(REIN) (Re-initialization)
LOGOUT Disconnect.
a
(QUIT) (User logout)
(2) FTP transfer parameter command
DATA PORT Specifies an address and port to which the server should connect.
a
(PORT) (Indicates the host port for data connection)
PASSIVE Enter passive mode.

r
(PASV) (Defines the passive listener port.)
REPRESENTATION TYPE Sets the transfer mode (ASCII/binary).

a
(TYPE) (Specifies the data expression method.)
FILE STRUCTURE Set file transfer structure.

a
(STRU) (Indicates the file structure of data.)
TRANSFER MODE Sets the transfer mode (Stream, Block, or Compressed).

a
(MODE) (Indicates the transfer mode.)
2-7
(3) FTP service command

RETRIEVE Retrieve a copy of the file.
a
(RETR) (Retrieve)
STORE Accept data and store data as a file at the server site.
a
(STOR) (Store)
STORE UNIQUE Store file uniquely.

r
(STOU) (Unique store)
APPEND (with create) Append.

a
(APPE) (Append [and create])
ALLOCATE Allocate sufficient disk space to receive a file.

r
(ALLO) (Allocate)
RESTART Restart transfer from the specified point.
r
(REST) (Restart)
RENAME FROM Rename from.
a
(RNFR) (Rename source file)
RENAME TO Rename to.

a
(RNTO) (Rename destination file)
ABORT Abort an active file transfer.

r
(ABOR) (Abort)
DELETE Delete file.

a
(DELE) (Delete)
REMOVE DIRECTORY Remove a directory.
a
(RMD) (Remove directory)
MAKE DIRECTORY Make a directory.
a
(MKD) (Make directory)
PRINT WORKING DIRECTORY Print working directory. Returns the current directory of the host.
r
(PWD) (Display working directory)
Returns information of a file or directory if specified, else information

of the current working directory is returned. If the server supports the
LIST
‘-R’ command (e.g. ‘LIST -R’) then a recursive directory listing will be a
(LIST)
returned.
(File list)
NAME LIST Returns a list of file names in a specified directory.

a
(NLST) (Name list)
SITE PARAMETERS Sends site specific commands to remote server.

r
(SITE) (SITE parameter)
SYSTEM Return system type.
r
(SYST) (System)
STATUS Returns the current status.
r
(STAT) (Status)
Returns usage documentation on a command if specified, else a
HELP
general help document is returned. r
(HELP)
(Help)
NOOP No operation (dummy packet; used mostly as keepalives).
r
(NOOP) (No operation)
2-8
This manual describes the names and functions of SPH2000 as an example.
For information on other CPU modules, refer to the manual of each CPU module.
2-3 Names and Functions

(1) Names
Key switch
User ROM card (optional) Status indication LED

UROM
RUN ONL
CPU No. selection key switch
ERR
UROM
RUN
User ROM card connector cover STOP
ALM
BAT
Nameplate (on the side surface of the module)
TERM
CPU
No. Loader connector
LOADER
User ROM card ejection switch

2) Ethernet communication connector
USB-nimiB connector
3) Version seal 1) Ethernet communication status indication LED
Data backup battery
Battery connector
(2) Functions
This manual describes the specifications of the Ethernet interface part. For more information on other functions, refer to the
user’s manual “Hardware (FEH201).”
1) Ethernet communication status indication LED

These LEDs indicate the current status of the CPU module.
Link status
Name Color Description
Indicates the state of connection to Ethernet.

Link status Green
Lights when connecting to Ethernet.
Data send/receive Indicates the state of data send/receive.

Green
status Lights when a send/receive packet occurs.
Note: The LED color for the link status has been changed into
yellow in SPH2000 with a hardware version of 23 or later.
Data send/receive status
2) 10BASE-T/100BASE-TX connector
This connector connects a 10BASE-T or 100BASE-TX communication cable.
3) Version seal
This seal indicates the hardware and firmware versions of the CPU module.
21 02
Hardware version
Firmware version
2-9
Section 3 Mounting Modules
3-1 Mounting on Base Board

3-1-1 Mounting position
Mount an SPH2000/3000 module on a slot with the processor bus of a MICREX-SX series SPH base board.
For more information, refer to “2-1-4 Module mounting on the base board (2) CPU module” in the user’s manual “Hardware
manual (FEH201).”
SPH5000M can be mounted only on EP bus base boards.
3-1-2 Number of mountable modules

Up to eight CPU modules that support multi-CPUs can be connected in one configuration. (configuration for multi-CPU system)
3-1
4-1 Overview of Communication Procedures

The following chart describes basic procedures to communicate with other nodes.
4-1-1 General Purpose Communication mode / Fixed Buffer Communication mode

1) Initialize * For the setting of the Ethernet parameter,
When the system is powered up, the Ethernet refer to “4-2 Operation Definition of Ethernet
part is initialized according to the setting of the Part.”
CPU parameter in the system configuration.
2) Open * For more information about M_OPEN FB,

communication Using M_OPEN FB, make the system ready for refer to “4-4-2 Channel open (M_OPEN).”
channel communicating with remote node (open the port
to establish connection).
3) Communicate * For more information about communication

with Send or receive data using M_SEND FB or FBs, refer to “4-4-3 Message send (M_SEND)”
remote node M_RECEIVE FB. and “4-4-4 Message receive (M_RECEIVE).”
4) Close
communication Set OFF the open request flag (a variable
channel connected to the EN_C terminal) of M_OPEN FB
to close the port and thus cut out the
communication line with remote node.
4-1-2 Loader Command Communication mode

1) Initialize and open
When the system is powered up, two ports are
communication
automatically opened to enable the
channel
communication using loader commands with
maximum 8 stations.
2) Communicate * For more information about communication FBs,

For communication between nodes of SX series
with refer to “4-4-5 Remote data write (R_WRITE)”
devices, R_READ FB and/or R_WRITE FB are and “4-4-6 Remote data read (R_READ).”
remote node
used. When the remote node of communication
is a personal computer, loader commands (data
read request and data write request) are issued
from application program of the personal
computer.
3) Close
communication No application program is necessary for this.
channel Automatically closed.
4-1-3 FTP server communication

Specify a user name, password and folder in the CPU parameter to use the FTP server function. The FTP server function is
available regardless of other communication modes.
* For the settings to use the FTP server function, refer to “4-2-2 FTP server function setting.”
4-1
To communicate with another node, definition of module operations (by setting module parameters) and a communication
program are necessary.
4-2 Operation Definition of Ethernet Part

4-2-1 Basic settings of Ethernet part
Set operation specifications of the CPU module by setting the parameter the CPU module parameters. The following table
shows the setting items.
Item Description Default

IP address IP address 192.168.0.1
Gateway Subnet mask 255.255.255.0
Default gateway None
TCP sending and receiving timeout value: 0 to 300 (in 0.1-second steps) 300
Maximum TCP end timer value: 0 to 600 (in 0.1-second steps) 0 (1 second)
Response watch timer value: 0 to 300 (in 0.1-second steps) 300 (30 seconds)
Loader command watch timer value: 0 to 3000 (in 0.1-second steps) 3000 (300 seconds)
Detail setting Sending retry interval 0 to 10 (in 1-second steps) 0
Sending retry number of times 0 to 30 times 12 times
Close process during TCP sending timeout Channel not closed
Close process during response receiving timeout Channel not closed
Self port standard No.: 0 to 65280 256
Communication target port standard No.: 0 to 65280 256
1) IP address
Set an IP address for the CPU module (determined by the network administrator). An IP address identifies each node on
Ethernet. It consists of 32-bit binary data and is defined as a combination of an IP network address and an IP host address. An
IP network address identifies the network; An IP host address is the ID for identifying the host (node) in a network.
2) Subnet mask
Controlling many nodes connected to one network is hard. To divide one network into multiple subnets (groups), set the subnet
mask value. A subnet uses a part of the host address, masking the IP network address and subnetwork with “1” and the IP host
address with “0.” When no subnet exist, set “0.0.0.0.”
Example 1) When a class B network is divided into 16 subnets, set as follows.
“255.255.240.0” (FFFFF000)
Example 2) When a class B network is divided into 256 subnets, set as follows.
“255.255.255.0” (FFFFFF00)
4-2
3) Gateway
An IP router (default gateway) allows multiple IP network segments to be connected. When networks are connected by an IP
router, communication with another network becomes possible via the router. Set the gateway to enable communication with
another network.
Default
gateway
172.16.0.22
Network address: 172.16.0.0
Local node 172.16.0.1
The actual operations according to gateway settings differs depending on the CPU module version in SPH2000.
(Other CPUs operate in the same way as V**07 or later version of SPH2000 shown in the table below.)
Memory status Gateway address value Gateway operation

in CPU to be downloaded Earlier than V**07 V**07 or later
At factory shipment Not specified (blank) Operates assuming that 0.0.0.0. Operates assuming that no
(Note 1) is set. gateway address is set.
0.0.0.0
(Note 2)
255.255.255.255
Others: Operates using a downloaded value.
(0.0.0.1 to 255.255.255.254)
When system definition Not specified (blank) No changes from the original Operates assuming that no
is downloaded at least value. gateway address is set.
0.0.0.0
once (Note 2)
255.255.255.255 Operates assuming that 0.0.0.0.
is set.
Others: Operates using a downloaded value
(0.0.0.1 to 255.255.255.254)
Note 1: This means the status of a band-new CPU where system definition has never been downloaded. When system definition
is downloaded (written), the CPU operates in the way described in the lower column of the table above even if the
default gateway is not set.
Note 2: The gateway is not available in active open mode.
The gateway is available in passive open mode including Unpassive/Fullpassive open mode or loader command
communication with a personal computer since the remote station attempts open.
4-3
<Operations of loader command communication with a personal computer>
In loader command communication with a personal computer (loader command transmission from an SX to PC using the R_
READ and R_WRITE FBs or loader command reception from a PC to SX), response operation to the remote station differs
depending on the version when communication is performed via the gateway as shown below.
Memory status in PLC Response operation to the remote station

(gateway setting)
Earlier than V**07 V**07 or later
Gateway is not set or Sends broadcast address (255.255.255.255) Replies to the remote station that has sent a
an invalid value is set. (Note 2) loader command.
・ 0.0.0.0 (Note 1)
・ Not set
・ 255.255.255.255
Gateway is set. Common operation in all versions

・ 0.0.0.1 to The CPU module receives a loader command from Replies to the remote station that has sent a
255.255.255.254 the set gateway and the network address of the loader command.
gateway matches that of the CPU module.
The CPU module receives a loader command from Sends the broadcast address
a gateway other than the set one and the network (255.255.255.255).
address of the gateway does not match that of the (Note 2)
CPU module.
Note 1: A response is returned to the received address (IP address for the remote station, MAC address for the gateway).
Note 2: Avoid this usage as much as possible since it becomes broadcast transmission that imposes a burden on the network.
4) TCP sending and receiving timeout value (setting range: 1 to 300, in 0.1-second steps)
Set a value for communication error monitoring timer when TCP connection is opened and data is sent or received.
If opening of a connection or data sending fails during TCP/IP communication, Ethernet automatically retries it.
The retry interval increases exponentially, like 3 seconds, 6 seconds, 12 seconds, ......
1) If open processing has started but cannot end normally although Ethernet repeatedly retries it, the open processing ends
abnormally after the set timeout time elapses .
2) If data sending has started but cannot end normally although Ethernet repeatedly retries it, the sending ends abnormally
when the timing of retry is reached after the set timeout time elapses.
For example, the internal operation before an error is detected when TCP send timeout value is set to 15 seconds and 30
seconds is as follows.
15s 30s
Total time
3s 6s 12s
t
Retry Retry Retry
Send error Send timeout Send timeout

occurrence (when set to 15 s) (when set to 30 s)
5) Maximum TCP end timer value (setting range: 0 to 600, in 0.1-second steps)
Set the waiting time to keep the socket for a specified time after the closing of a TCP connection was attempted from the local
station and ended normally. The maximum waiting time until the processing for closing the remote station is completed normally
when the closing of a TCP connection is attempted from the local station is twice the set TCP send timeout value.
If the processing for closing the remote station cannot be completed normally (when no FIN is received), RST is sent to the
remote node to forcibly close the connection.
When set to “0,” the waiting time is 1 second. (In the case of ET1, 0 means no waiting time.)
* If a small value is set for this timer value when communication on the network is slow (network load is high), the connection on
the network may not be closed normally and reconnection may fail. Perform communication on the actual network, and then
change the timer value to a proper value as needed.
4-4
6) Loader command watch timer value (setting range: 0 to 3000, in 0.1-second steps)
Set the time to automatically break the connection when a client of another node has logged in, however, no command is sent
from the client for a specified period of time in Loader Command Communication mode.
Set this timer value to 0 if you do not want to break the connection even when no command is sent from the client, for example,
when the loader is connected via the CPU module.
7) Sending retry interval (setting range: 0 to 10 seconds, in 1-second steps)

Set the interval between retries of sending when no ACK frame is received for the specified period of time during TCP sending
operation.
When the sending retry interval is set to 1 to 10, sending is retried the set number of times (set in “sending retry number of
times”) at the set retry intervals. For example, if the retry interval is 3 and the retry count is 5, sending is retried 5 times at
3-minute intervals (15 seconds in total).
When the sending retry interval is set to 0, the retry interval increases exponentially like 3 seconds, 6 seconds, 12 seconds .....
and sending is retried the set number of times (set in “sending retry number of times”).
8) Sending retry number of times (setting range: 0 to 30 times)

Set the number of times to retry sending when no ACK frame is received for the specified period of time during TCP sending
operation.
Since sending retry operation is independent of “TCP sending and receiving timeout value,” if a large value is specified for the
sending retry interval and number of times, retry is continued even after a timeout occurs. The product of “sending retry number
of times” and “sending retry interval” must be equal to or smaller than “TCP sending and receiving timeout value.”
Even during sending retry, when EN_C of the M_OPEN FB is set to OFF, the channel is forcibly closed and the sending retry
can be aborted.
9) Close process during TCP sending timeout

Select how to handle the connection if no ACK is returned even after sending is retried in the specified way and a TCP sending
timeout occurs during communication using TCP/IP protocol.
(In ET1, this setting is disabled.)
10) Close process during response receiving timeout

Select how to handle the connection if a response receiving timeout occurs.
11) Self port standard No. (setting range: 0 to 65280)

Set the self port standard No. for TCP/IP or UDP/IP communication. The actual port No. is determined by adding the set self port
standard No. to the local port No. (SPORT_NO) specified by the M_OPEN FB (user application).
The following shows an example of how to determine the actual port No.
When the settings in the “CPU parameter” screen are
Self port standard No. = 256
Communication target port standard No. = 256
and the settings of M_OPEN FB are
RPORT_NO = 1
SPORT_NO = 2,
the actual port No. of the CPU module becomes 258 obtained by the self port standard No. + SPORT_NO, and
the actual port No. of the communication partner (personal computer) becomes 257 obtained by the communication target
port standard No. + RPORT_NO.
12) Communication target port standard No. (setting range: 0 to 65280)

Set the communication target port standard No. for TCP/IP or UDP/IP communication. TCP/IP or UDP/IP communication is
performed using the port No. determined by adding the set communication target port standard No. to the communication port
No. specified by M_OPEN FB (user application).
(In ET1, when RPORT_NO is equal to or greater than 257, the actual port No. of the communication partner becomes RPORT_
NO.)
Note 1: When communication is performed between MICREX-SX systems using R_READ and R_WRITE, both the self port
standard No. and communication target port standard No. must be “256.”
Note 2: The actual port No. must be equal to or greater than 256 on both the CPU module and communication partner sides.
13) Response watch timer value (setting range: 0 to 300, in 0.1-second steps)
Set the waiting time until a response is returned after a command is sent in Fixed Buffer Communication mode. This timer value
is also applied to the waiting time for receiving data.
4-5
<Setting procedure>
Open the “Module properties” dialog box of the CPU module, click “Parameter,” and then click “IP-address/Gateway setting”
tub. The Ethernet parameter setting screen opens.
Set “IP-address” and “Subnet mask.” If necessary, also set “Default gateway IP-address.”
* The factory default settings are as follows.

IP address: 192.168.0.1, Subnet mask 255.255.255.0
Click the “Detail Setting” button. The “Detail Setting” dialog box opens. Set all the necessary items, and then click the “OK”
button.
4-6
4-2-2 Setting FTP server functions

To access a file in a user ROM card inserted in the CPU module using the FTP server function, you need to perform user
registration to FTP. The following table describes the setting items.
Setting item Description

R/W (reading/writing) User setting Set a user name and a password.
R (read) User setting Set a user name and a password.
Specify a folder in a user ROM card to access from a personal computer, etc.
Working Folder
“DATA” is specified by default.
<Setting procedure>
Click the “User Setting” button in the Ethernet parameter setting screen. The “FTP user setting” dialog box opens.
Set all the necessary items, and then click the “OK” button.
* You can access the folders in the ROM card installed in the CPU module by FTP command of the computer. However, do
not open a file in the ROM card directly. If you want to view the contents of a file, copy and save it in the hard disk of the
computer, and then open it. Directly opening a file leads to depletion of FTP server connection. If a file is directly opened and
an error occurs in FTP processing, stop access from the computer, and then access again after more than five minutes have
passed (FTP watch timeout time in the CPU module). Alternatively, log off from Windows or reboot the computer to release the
connection.
4-7
4-3 Communication Procedure

4-3-1 Communication in General Purpose Communication mode
(1) Data sending
To send data to another node, establish connection by M_OPEN, and then send data by M_SEND.
SX_CPU
M_OPEN FB
Open request
(EN_C)
1) 6)
M_OPEN FB
Open valid
(VALID)
M_SEND FB
Send data Send data set
(SD)
2)
M_SEND FB
Send request
(REQ)
M_SEND FB
Send end 5)
(DONE) 3)
* When communication protocol is

TCP/IP and receipt confirmation is
enabled, SX_CPU is notified of
Ethernet completion of sending after ACK is
Send buffer
part received from the remote node.
4)
ACK
Remote node
1) Open a communication channel by the M_OPEN FB first. Set ON the open request (EN_C) to establish a connection with the
remote node according to the setting of M_OPEN. The open valid flag (VALID) is set ON.
2) Set data to be sent in the send data (SD) of the M_SEND FB to set ON the send request (REQ).
3) The data is sent to the send buffer in the CPU module at the rising edge of the send request (REQ)
4) The CPU module adds a header part necessary for communication to the data and then sends it to the remote node.
5) When the data sending is completed, the send end (DONE) of the M_SEND FB is set ON for one scan. When the
communication protocol is TCP/IP and receipt confirmation is enabled, the send end flag (DONE) is set ON for one scan after
a data reception signal (ACK) is received from the remote node.
Note: If the data sending is not completed normally, the send error (ERROR) is set ON for one scan. In this case, set the send
request OFF, and then re-execute processing for sending data (from the step 3).
6) To break the communication channel when communication ends, set OFF the open request (EN_C) of the M_OPEN FB.
VALID is set OFF when the close processing is completed.
4-8
(2) Data receiving

To receive data from another node, establish a connection by M_OPEN, and then receive data by M_RECEIVE.
Remote node
SX_CPU 3)
Ethernet
part Receive buffer
2) Receive valid
M_OPEN FB
Open request
(EN_C)
1) 5)
M_OPEN FB
Open valid
(VALID)
M_RECEIVE FB
Enable receive
(REQ)
M_RECEIVE FB
Receive data Receive data
(RD)
4)
M_RECEIVE FB
Receive end
(NDR)
remote node according to the setting of the M_OPEN FB. The open valid flag (VALID) is set ON.
2) Set ON the enable receive (EN_R) of the M_RECEIVE FB to make the CPU module ready for receiving data.
3) The receive buffer receives data from the remote node.
4) The received data that is stored in the receive buffer in the CPU module is stored in the receive data (RD) of the M_RECEIVE
FB, and then the receive end (NDR) is set ON for one scan.
The CPU module returns into the waiting state if the enable receive is ON. Once the CPU module goes into the waiting state,
it keeps waiting for reception of data even after EN_R is set OFF. To stop the CPU module from waiting for reception, set OFF
the open request (EN_C) of the M_OPEN FB to break the channel.
Note: If abnormal data is received, the receive end (NDR) is not set ON and the received data is not stored in the receive buffer.
4-9
(3) Data format

Data sent to or received from another node
Header part of Data part of

TCP/IP or UDP/IP TCP/IP or UDP/IP
Max. 2034 bytes (binary code)

Max. 4068 bytes (ASCII code)
1) Header part
The header part is a header for Ethernet TCP/IP or UDP/IP. When data is sent to another node by an application program, the
CPU module automatically adds a header to the data before sending it to the remote node. When data is received from another
node, the CPU module removes the header part from the received data, and sends only the data part to the FB.
2) Data part
The data part is data for Ethernet TCP/IP or UDP/IP. When data is sent to another node by M_SEND, data that is transferred to
the send buffer in the CPU module is set in the data part of Ethernet TCP/IP or UDP/IP, and then sent. When data in binary code
is set in the send buffer, it is sent without change. When data in ASCII code is set in the send buffer, it is sent after converted
into ASCII characters.
When data is received from another node, data of the data part of TCP/IP or UDP/IP is stored in the receive buffer in the CPU
module. When data in binary code is received, it is stored in the receive buffer without change. When data in ASCII code is
received, it is stored in the receive buffer after converted into binary code.
<Binary code (without data swap)>
Packet of TCP/IP
or UDP/IP Same as data length (max. 2034 bytes)
Send/receive buffer Header part D1L D1H D2L D2H D3L D3H ··· DnL
in CPU module
1 D1H D1L
2 D2H D2L
3 D3H D3L
n DnL
The data length shows the number of bytes of data stored in the send/receive buffer in decimal (Max. 2034 bytes).
If the data length is an odd number, data up to the low-order byte of the last word is effective.
<Binary code (with data swap)>
Packet of TCP/IP
or UDP/IP Same as data length (max. 2034 bytes)
Send/receive buffer Header part D1H D1L D2H D2L D3H D3L ··· DnH
in CPU module
1 D1H D1L
2 D2H D2L
3 D3H D3L
n DnH
If the data length is an odd number, data up to the high-order byte of the last word is effective.
4-10
<ASCII code>
Packet of TCP/IP
or UDP/IP Twice the data length (max. 4068 bytes)
Send/receive buffer Header part D1H D1L D2H D2L DnH

in CPU module
1 D1H D1L
2 D2H D2L
ASCII
conversion
n DnH
If the data length is an odd number, data up to the high-order byte of the last word is effective.
4-11
4-3-2 Communication in Fixed Buffer Communication mode

(1) Data sending
To send data to another node, establish a connection by M_OPEN, and then send data by M_SEND.
SX_CPU
M_OPEN FB
Open request
(EN_C)
1) 6)
M_OPEN FB
Open valid
(VALID)
M_SEND FB
Send data Send data set
(SD)
2)
M_SEND FB
Send request
(REQ)
M_SEND FB
Send end 5)
(DONE) 3)
Ethernet
Send buffer
part
4)
Response
Remote node
1) Open a communication channel by the M_OPEN FB first. Set ON the open request (EN_C) to establish a connection with
the remote node according to the setting of the M_OPEN FB. The open valid flag (VALID) is set ON.
2) Set data to be sent in the send data (SD) of the M_SEND FB to set ON the send request (REQ).
3) The data is sent to the send buffer in the CPU module at the rising edge of the send request (REQ)
4) The CPU module adds a header part necessary for communication to the data and then sends it to the remote node.
5) When the data sending is completed and a response is received from the remote node, the send end (DONE) of the M_SEND
FB is set ON for one scan.
Note: If the data sending is not completed normally (no response is returned from the remote node or the end code of
the response is a value other than “0”), the send error (ERROR) is set ON for one scan. In this case, set OFF the send
request, and then re-execute processing for sending data from the step 3).
* When Fixed Buffer Communication mode is used, set separate ports for sending and receiving.
(Two M_OPEN FBs are required: one for sending and one for receiving.)
4-12
(2) Data receiving

To receive data from another node, establish a connection by M_OPEN, and then receive data by M_RECEIVE.
Remote node
SX_CPU 3)
Ethernet
part Receive buffer
2) Receive valid
M_OPEN FB
Open request
(EN_C)
1) 5)
M_OPEN FB
Open valid
(VALID)
M_RECEIVE FB
Enable receive
(REQ)
M_RECEIVE FB
Receive data Receive data
(RD)
4)
M_RECEIVE FB
Receive end
(NDR)
remote node according to the setting of the M_OPEN FB. The open valid flag (VALID) is set ON.
2) Set ON the enable receive (EN_R) of the M_RECEIVE FB to make the CPU module ready for receiving data.
3) The receive buffer receives data from the remote node.
4) The received data that is stored in the receive buffer in the CPU module is stored in the receive data (RD) of the M_RECEIVE
FB, and then the receive end (NDR) is set ON for one scan. When the receive end is set ON, the CPU module returns a
response to the remote node.
The CPU module returns into the waiting state if the enable receive is ON. Once the CPU module goes into the waiting state,
it keeps waiting for reception of data even after EN_R is set OFF. To stop the CPU module from waiting for reception, set OFF
the open request of the M_OPEN FB to break the channel.
During reception processing, the data length to receive and the size of received data part are checked. The CPU module
continues receiving until all the remaining data is received. Receiving is completed when all the data is received.
If the size of received data is greater than the data length to receive, “E052(h)” is returned as a response (E052: abnormal
number of data words). In this case, the receive error (ERROR) is not set ON in M_RECEIVE, and the received data is
discarded.
Note: If abnormal data is received, the receive end (NDR) is not set ON and the received data is not stored in the receive buffer.
* When Fixed Buffer Communication mode is used, set separate ports for sending and receiving.
(Two M_OPEN FBs are required: one for sending and one for receiving.)
4-13
(3) Data format

Data sent to or received from another node
Header part of Data part of

TCP/IP or UDP/IP TCP/IP or UDP/IP
Command/response
Max. 2038 bytes (binary code)

Max. 4076 bytes (ASCII code)
1) Header part
The header part is a header of Ethernet TCP/IP or UDP/IP. When data is sent to another node by an application program, the
CPU module automatically adds a header to the data before sending it to the remote node. When data is received from another
node, the CPU module removes the header part from the received data, and sends only the data part to the FB.
2) Data part
The data part is data for Ethernet TCP/IP or UDP/IP. When data is sent to another node by M_SEND, a sub-header is added to
the data that is transferred to the send buffer in the CPU module. The data with the sub-header is set in the data part of TCP/IP
or UDP/IP, and then sent. When data in binary code is set in the send buffer, it is sent without change. When data in ASCII code
is set in the send buffer, it is sent after converted into ASCII characters.
When data is received from another node, the data is stored in the receive buffer in the CPU module after the sub-header is
removed from the data pert of TCP/IP or UDP/IP. When data in binary code is received, it is stored in the receive buffer without
change. When data in ASCII code received, it is stored in the receive buffer after converted into binary code.
<Command format>
Communication in binary code
Sub-header Data length Data
2 bytes 2 bytes Variable length (max. 2034 bytes)
Communication in ASCII code
Sub-header Data length Data
4 bytes 4 bytes Variable length (max. 4068 bytes)
<Response format>
Communication in binary code
Sub-header
2 bytes
Communication in ASCII code
Sub-header
4 bytes
4-14
<Sub-header>
XXh
7 6 5 4 3 2 1 0
* 1 1 0 0 0 0 0
Command/response type
(The above digure shows the state during communication in Fixed Buffer mode)
Command/response flag
0: Command
1: Response
Command Response
Binary code
60h 00h E0h End code
ASCII code
36h 30h 36h 30h 45h 30h End code
“6” “0” “6” “0” “E” “0”
End code
Binary code ASCII code Meaning Description
00h 30h 30h Normal end
50h 35h 30h Command/response An unspecified code is set for the type of
type definition error command/response in sub-header.
52h 35h 32h Abnormal number of Data length exceeds the specified value.
data words
35h 34h ASCII conversion During communication in ASCII code, an ASCII
error code that cannot be converted into a binary code
was sent from the remote node.
<Data, binary code (without data swap)>
Packet of Data for the number of data specified by

TCP/IP or UDP/IP data length (max. 2034 bytes)
60h 00h nL nH D1L D1H D2L D2H D3L D3H DnL DnH
Send/receive buffer
of CPU module
Sub-header Data length
0 Data length n Automatically set

1 D1H D1L
2 D2H D2L
3 D3H D3L
n DnH DnL
* Data length is the number of bytes of the data that is stored in the send or receive buffer (Max. 1017 words).
4-15
<Data, binary code (with data swap)>
Packet of Data for the number of data specified by

TCP/IP or UDP/IP data length (max. 2034 bytes)
60h 00h nL nH D1H D1L D2H D2L D3H D3L DnH DnL
Send/receive buffer
of CPU module
0 Data length n Automatically set

1 D1H D1L
2 D2H D2L
3 D3H D3L
n DnH DnL
<Data, ASCII code>
Data for the number of data specified

Packet of by data length (max. 4068 bytes)
TCP/IP or UDP/IP
36h 30h 30h 30h nL nH D1H D1L D2H D2L DnH DnL
Automatically set
Send/receive buffer
of CPU module
0 Data length n
1 D1H D1L
2 D2H D2L
n DnH DnL
4-16
4-3-3 Communication in Loader Command Communication mode

(1) Data writing
To write data to a remote SX node (memory in SX_CPU), use R_WRITE.
R_WRITE automatically opens a communication channel and writes data in a remote node (SX system).
SX_CPU
R_WRITE FB
Write data Send data set
1)
R_WRITE FB
Write request
(REQ)
R_WRITE FB
Write normal end 4)
(DONE) 2)
Ethernet part
3)
Response
Remote node
MICREX-SX
1) Set data to be sent in the send data (SD) of the R_WRITE FB to set ON the write request (REQ).
2) When the write request (REQ) of the R_WRITE FB is set ON, a communication channel to the CPU module is automatically
opened.
3) When the connection is established, data is written in the remote SX node via Ethernet by the loader command.
4) The remote SX node (SX_CPU) executes the write command issued by R_WRITE and sends the processing result (response)
to the CPU module. When a normal end signal is received, the write normal end (DONE) is set ON for one scan.
Note: If the data writing is not completed normally (no response is returned from the remote node or the end code of the response
is a value other than “0”), the write error (ERROR) is set ON for one scan. In this case, set OFF the write request once,
and then re-issue it.
4-17
(2) Data reading

To read data from a remote SX node (memory in CPU), use R_READ.
R_READ automatically opens a communication channel and reads data from a remote node (SX system).
SX_CPU
R_READ FB
Read request
(REQ)
1)
R_READ FB
Read noraml end
(DONE)
R_READ FB
Read data set
Read data
Ethernet part
3) Response
2)
(read data)
Remote node
MICREX-SX
1) When the read request (REQ) of the R_READ FB is set ON, a communication channel to the CPU module is automatically
opened.
2) When a connection is established, a request to read the memory in an SX_CPU is issued to the remote SX node (SX_CPU)
via Ethernet by the loader command.
3) The remote SX node (SX_CPU) executes the read command issued by R_READ and returns the processing result (read
data and status). When a normal end signal and read data is received, the read normal end (DONE) is set ON for one scan.
Note: If the data reading is not completed normally (no response is returned from the remote node or the end code of the
response is a value other than “0”), the read error (ERROR) is set ON for one scan. In this case, set OFF the read request
once, and then re-issue it.
4-18
4-4 Communication Program

4-4-1 FBs used in communication program
Ethernet communication programs use the following FBs.
Communication mode Used FB Purpose
Used in order for the CPU module to open a local port for the Ethernet
General Purpose M_OPEN
communication part to establish a connection.
Communication mode
Fixed Buffer M_SEND Used to send data from an SX_CPU (SX system) to another node.
Communication mode
M_RECEIVE Used in order for an SX_CPU to receive data sent from another node.
Used to write data from an SX_CPU (SX system) into the Ethernet node in
R_WRITE
another SX system. No application program is necessary on the written side
Loader Command
Communication mode Used in order for an SX_CPU (SX system) to read data from the Ethernet
R_READ node in another SX system. No application program is necessary on the side
that receives the read request.
Note: Loader Command Communication mode requires no program to open a communication port since a communication port
is automatically opened at the rising edge of the CPU module.
4-4-2 Channel open (M_OPEN)

The channel open FB (M_OPEN) is used in order for the CPU module to open a local port for the Ethernet communication part
and establish a connection to enable communication between the CPU module and another node connected via Ethernet.
(Up to 10 ports can be simultaneously opened.)
When the open processing is completed normally, a connection No. is outputted to prove that the connection is established.
After this, the M_SEND and M_RECEIVE FBs perform communication using this connection No..
(1) Operation of the instruction

1) Processing for opening an Ethernet communication port is performed at the rising edge of “EN_C.” (The open processing
does not end within one scan.)
2) When the open processing is completed normally, “VALID” is set ON, and a connection No. is outputted to “CON_NO.”
Then, the M_SEND and M_RECEIVE FBs become available.
3) If the open processing is not completed normally, “ERROR” is set ON for one scan and an error code is outputted to “STATUS.”
If “EN_C” is ON at this time, the open processing is retried.
4) When “EN_C” is set OFF, close processing starts. (The close processing does not end within one scan.)
5) When the close processing is completed, “VALID” is set to zero. (Close processing is always completed normally.)
Note 1: There are the following two modes for opening ports: “Passive mode” for receiving and “Active mode” for sending.
To send data, the remote node must be ready for receiving data. Therefore, the processing for opening ports in “passive
mode” for receiving data needs to be completed in advance.
Note 2: If the same port (the same self port and same communication port) is attempted to be reopened, the connection is
established during the retry that is performed three seconds later because it takes one second to open the socket.
4-19
(2) FB format
FB No. (instance name)
Data type M_OPEN_ Data type
M_OPEN
BOOL EN_C VALID BOOL
UINT MODULE_NO ERROR BOOL
UINT CHANNEL_NO STATUS INT
UDINT STATION_NO CON_NO UINT
UINT MODULE_TYPE
UINT MODE
UINT SUB_MODE
UINT RPORT_NO
UINT SPORT_NO
4-20
(3) Description of FB parameters
Terminal function Terminal name Data

I/O Description
name (parameter) type
Open request EN_C BOOL IN ON: Processing for opening ports starts at the rising edge of this
signal.
OFF: Processing for opening ports starts at the falling edge of this
signal.
Communication MODULE_NO UINT IN Specifies the SX bus station No. of the CPU module.
module No. For CPU No. 0, 254 is set.
(FYI: For an Ethernet module, specify the SX bus station No.)
Communication CHANNEL_NO UINT IN For the CPU module, this terminal is fixed to “524.”
channel No. (FYI: For an Ethernet module, this terminal is fixed to “0.”)
Remote station No. STATION_NO UDINT IN Specifies the IP address of the communication destination node.
*1
Module type MODULE_TYPE UINT IN Sets the network type of the CPU module.
This terminal is fixed to “1”.
Communication MODE UINT IN Sets the communication conditions for the port to be opened.
mode *2
Communication SUB_MODE UINT IN Enables/disables the receipt confirmation.
submode 0: Disable, 1: Enable
Remote port No. RPORT_NO UINT IN Specifies the port No. of the communication destination node.
(1 to 65535)
Local port No. SPORT_NO UINT IN Specifies the port No. of the CPU module.
(Setting range: 1 to 127).
Open enable VALID BOOL OUT Turns ON when the open processing is completed normally and the
CPU module becomes ready for communication.
Turns OFF when the close processing is performed (when EN_C is
set OFF).
Error ERROR BOOL OUT Turns ON for one scan if the open processing ends abnormally.
Status STATUS INT OUT The result of the open processing is outputted by a status code.
Refer to “4-4-7 Status” for more information.
Connection No. CON_NO UINT OUT A connection No. is assigned when the open processing is
completed. The M_SEND and M_RECEIVE FBs use this No.
Note 1: When using the FTP client and server mode, do not use the following port Nos.
20, 21, and 25001 to 25100
Note 2: The remote port No. and local port No. are not actual port Nos. on the network. For more information on the actual port
Nos., read the description of “Self port standard No.” and “Communication target port standard No.” in “4-2-1 Basic
settings of Ethernet part.”
*1 Remote station No.

Set the IP address in the following manner. The following shows an example when the IP address is “172.16.0.1.”
172 16 0 1 Expression for D300win UDINT#16#AC100001
ACh 10h 00h 01h Convert to decimal number
Expression for the Standard loader
AC100001h 2886729729
* When UDP/IP protocol is used, broadcast transmission is available by specifying “255.255.255.255” and partial broadcast
transmission is available by specifying “***.***.***.255.”
Broadcast reception is not available.
* When either TCP/IP or UDP/IP is used and a port is opened in Unpassive mode, this setting becomes disabled and
communication can be performed with a desired node. If you want to know the destination IP address and port No. by an
application program in Unpassive open mode, enable the “Destination Addition mode.”
4-21
*2 Communication mode
Set communication conditions for the connection where a channel is to be opened in the following format.
15 (F) 8 7 0
Expression for D300win: UINT#16#****
Expression for Standard loader: H****
Receive data length storage

0: Disable
1: Enable
Open mode Communication mode
00: Active Destination 000: Fixed Buffer Communication mode
11: Fullpassive Addition mode 001: General Purpose Communication mode
10: Unpassive 0: Disabled
1: Enabled Automatic reopen
0: Disable
Passive open mode 1: Automatic reopen mode
0: Open completed without
confirming the establishment Data swap
of the connection 0: Disable
1: Open completed at the Send data length selection
1: Enable
establishment of the 0000: Word
connection 0001: Byte Transmission code
0: Binary
1: ASCII
Communication protocol
0: TCP/IP
1: UDP/IP
4-22
<Open mode>
To open a connection via TCP/IP, open processing to Fullpassive/Unpassive node must be finished before active open
processing is performed.
CPU Ethernet part Ethernet part Remote node

1) Fullpassive/ Open
Unpassive request
open
2) Waits for open Open
request from Connection request
Completion active node
of open 3) Active open
4) Completion
of open
5) Completion
of open
1) Active open mode

Active open processing is performed to another node that is ready for reception (in Fullpassive/Unpassive open mode).
Active open mode is equivalent to a client in the relation between a server and a client.
Open processing can also be performed when both local and remote nodes are put in Active open mode. In this case, a
node that receives an open request performs passive open processing automatically. If both stations are put in Fullpassive or
Unpassive open mode, the connection cannot be opened.
2) Fullpassive open mode
The local node receives only an open request via TCP/IP issued by another node that has the IP and port No. specified in
M_OPEN. (The IP address and port No. of the remote node are checked.)
3) Unpassive open mode
The local node receives a request via TCP/IP issued by any node. (The IP address and port No. of the remote node that are
specified in M_OPEN are ignored.)
Fullpassive and Unpassive open modes are equivalent to a server in the relation between a server and a client.
UDP/IP
UDP provides connectionless communication without the concept of open. However, the operation differs depending on the
selected open mode as follows.
1) Active open mode
The local node communicates only with another node that has the IP and port No. specified in M_OPEN.
Communication can also be performed when both local and remote nodes are put in Active open mode. If both stations are
put in Fullpassive or Unpassive open mode, communication cannot be performed.
2) Fullpassive open mode
The operation in Fullpassive open mode is the same as in Active open mode.
3) Unpassive open mode
The local node can communicate with any node. (The IP address and port No. of the remote node that are specified in
M_ OPEN are ignored.) After the open request (EN_C of M_OPEN) is set ON, the local node becomes ready for receiving
data from the remote node. The local node cannot send data before receiving the first data. Once data communication is
performed, the local node stores the remote node and thereafter communicates only with it.
When the open request (EN_C of M_OPEN) is set OFF, the stored information is reset and the local node is ready for access
from any node again.
4-23
<Passive open mode>
Passive open mode is enabled only for TCP/IP communication. If “open completed at the establishment of the connection” is
selected,” VALID of M_OPEN is set ON when Ethernet connection is established.
If the connection is not established for 30 seconds after M_OPEN request is issued, an open error occurs (Status: 193).
<Destination Addition mode>

This setting is effective in “General Purpose Communication mode” and “Fixed Buffer Communication mode.”
When Destination Addition mode is enabled, the first four words of data are used as a destination information area.
When communicating with a desired station via TCP/IP in Unpassive open mode or via UDP/IP, enable this mode to obtain the
IP address and port No. of the communication partner.
An application program on the PLC side uses data shown below.
Information on the first four bytes of the data is not sent to the communication partner. (Only send/receive data part is exchanged.)
When using TCP/IP

Sending Receiving
Reserved Receive data length (number of bytes)
IP address of
Reserved
communication partner (L)
IP address of
Reserved
communication partner (H)
Max. 1021 words Max. 1021 words
Reserved Port No. of
communication partner
Send data Receive data
When using UDP/IP
Sending Receiving
Reserved Receive data length (number of bytes)
IP address of IP address of
communication partner (L) communication partner (L)
* *
IP address of IP address of
communication partner (H) communication partner (H)
Port No. of Port No. of
communication partner communication partner
Send data Receive data
• An IP address and a port No. are stored in hexadecimal.

• In UDP/IP communication, data is sent to the station set in the above. The user sets it by the application.
• Data set in the reserved area is ignored.
• Enter the actual port No. for “Port No. of communication partner.” (Refer to 12) in 4-2.)
4-24
<Send data length selection>
This setting is effective in “General Purpose Communication mode” only.
When “Word” is selected, data is sent in units of words. The specified (SIZE) number of words from the beginning of the data
that is set in the send area (SD of M_OPEN) is sent. (Range of number of words: 1 to 1017 words)
When “Byte” is selected, data is sent in units of bytes. In the first word of the data that is set in the send area, enter the number
of bytes in hexadecimal that you want to send to the Ethernet communication channel. In the second and the following words,
set data to be practically sent. Data set in the second and the following words are outputted to the channel. (Range of number of
bytes: 1 to 2034 bytes)
* When “Byte” is selected, “Destination Addition mode” cannot be used together. If “Byte” is selected with Destination Addition
mode “enabled,” the setting is ignored and the operation is same as when “Word” is selected.
Send data length (number of bytes)
Send data SIZE of M_SEND

Max. 1018 words
Max. 1017 words
(2034 bytes)
When the number of bytes is an odd number, the last one byte of the data becomes as follows according to the data swap
setting.
• When data swap is disabled
The last one byte is entered on the low-order side.
Packet of
TCP/IP or UDP/IP
Header D1L D1H D2L D2H D3L D3H DnL

Send buffer of
CPU module
Send data length
D1H D1L
D2H D2L
D3H D3L
DnL
• When data swap is enabled

The last one byte is entered on the high-order side.
Packet of
TCP/IP or UDP/IP
Header D1H D1L D2H D2L D3H D3L DnH

Send buffer of
CPU module
Send data length
D1H D1L
D2H D2L
D3H D3L
DnH
<Data swap>
When the transmission code is set to binary, the treatment of high-order and low-order bytes of transmission data are reversed.
When the transmission code is set to ASCII, disable the data swap.
4-25
<Automatic reopen>
If Automatic Reopen mode is enabled when “Fullpassive” or “Unpassive” open mode is selected, the CPU module automatically
starts close processing when a close request is received from the remote node after the connection is established, and then
automatically moves into a state of waiting for an open request. Automatic reopen is executed when “Channel forcible close (status:
199)” is outputted to “M_SEND” or “M_RECEIVE”
<Receive data length storage>

This setting is effective in “General Purpose Communication mode” only.
When “Receive data length storage” is enabled, the length of received data is stored in the first word of the receive buffer as
shown below.
Receive data length (number of bytes)
Receive data
Max. 1018 words
Max. 1017 words
*3 Communication submode
“Communication submode” specifies whether or not to enable receipt confirmation when data is sent using TCP/IP protocol.
1) Operation when receipt confirmation is disabled (SUB_MODE = 0 [UINT#0])
CPU Ethernet part Remote node

Send
M_SEND request
REQgON Data sending
Sending
M_SEND completion
DONEgON
ACK
SX bus Ethernet
* Data sending is completed when the data is sent onto Ethernet without waiting for ACK from the remote node.
2) Operation when receipt confirmation is enabled (SUB_MODE = 1 [UINT#1])
CPU Ethernet part Remote node

Send
M_SEND request
REQgON Data sending
Sending
ACK
completion
M_SEND
DONEgON
SX bus Ethernet
* Data sending is completed after waiting for ACK being sent from the remote node.
* When receipt confirmation is “enabled,” ASK reception is checked every 100 ms. Therefore, the send end (DONE) of the
M_SEND FB is delayed for up to 100ms compared with when receipt confirmation is “disabled.”
4-26
<Notes when “receipt confirmation” is disabled in communication submode>
When “receipt confirmation is disabled,” if no ASK is received from the remote node due to a communication error such as
power interruption or LAN cable disconnection, the CPU module retries sending (for five minutes by default). No error occurs in
the M_OPEN or M_SEND FB during and after retry.
M_OPEN or M_SEND FB cannot be executed during retry operation. In other words, if a communication error occurs, the port
becomes unavailable for five minutes by default. In the CPU module, to shorten this time, specify a small value other than 0 for
“Sending retry interval” and a small value for “Sending retry number of times.”
When “receipt confirmation is enabled,” if a communication error occurs, ERROR of M_SEND is set ON for one scan after the
period of time specified in “TCP sending and receiving timeout value (30 seconds by default)” has elapsed and an error code
195 is outputted to STATUS. In this mode, another M_OPEN or M_SEND FB can be executed after an error has been detected. (No
need to wait for five minutes.)
*4 Status
For information on the status, refer to “4-4-7 Status.”
4-27
4-4-3 Message send (M_SEND)

Message send (M_SEND) FB is used to send data to another node to which SX_CPU opens a communication channel to
enable communication in General Purpose Communication mode or Fixed Buffer Communication mode.

1) A message is sent to the station having the connection No. that is set in “CON_NO” at the rising edge of “REQ.”
(The processing for sending a message is not completed within one scan.)
2) When the message sending is completed normally, “DONE” is set ON for one scan.
3) If the message sending is not completed normally, “ERROR” is set ON for one scan, and the corresponding error code is
outputted to “STATUS”
Note 1: Up to 1017 words of data can be sent at a time.
Note 2: Additional “REQ” command (OFF to ON) is disabled during message sending (until “DONE” or “ERROR”is set ON
after the rising edge of “REQ.”
Note 3: Do not change “SD” during message sending. Otherwise, the send data cannot be guaranteed.
Note 4: If the number of data specified in “SIZE” exceeds the variable size specified in “SD,” the data for the excess part
becomes undefined. Be sure to enter the specified size of variable for “SIZE.”
Note 5: The send request “REQ” must be programmed to be set ON after “VALID” of M_OPEN is set ON.
(2) FB format
M_SEND_
Data type Data type
M_SEND
BOOL REQ DONE BOOL
UINT CON_NO ERROR BOOL
STATUS INT
ANY SD SD ANY
UINT SIZE

I/O Description
Send request REQ BOOL IN Data set in “SD” is sent at the rising edge of this signal.
Connection No. CON_NO UINT IN A connection No. that is opened by M_OPEN is set.
The “CON_NO” terminal of M_OPEN is connected to this one.
Send data size *1, 2 SIZE UINT IN Sets the size of data to be sent in units of words.
Send data *3 SD ANY IN-OUT Connects a variable where data to be sent is stored.
Send end DONE BOOL OUT Turns ON for one scan when the message sending is
completed normally.
Send error ERROR BOOL OUT Turns ON for one scan when the message sending ends
abnormally.
Status STATUS INT OUT The result of the message sending is outputted by a status
code. Refer to “4-4-7 Status” for more information.
*1 When “Destination Addition mode” is enabled, four words of destination information are added to the send buffer.
Set this terminal to the send data size plus four words.
*2 When “byte” is selected for “send data length selection,” the first one word of the send buffer is the data size.
Set this terminal to the send data size plus one word.
*3 When “Destination Addition mode” is enabled, four words of destination information are added to the send buffer.
For the send data “SD,” reserve an area of send data size plus four words.
4-28
4-4-4 Message receive (M_RECEIVE)

Message receive (M_RECEIVE) FB is used to receive data from another node to which SX_CPU opens a communication
channel to enable communication in General Purpose Communication mode or Fixed Buffer Communication mode.

1) A message is received from the station having the connection No. that is set in “CON_NO” at the rising edge of “EN_R.”
(The processing for receiving a message is not completed within one scan.)
2) When the message receiving is completed normally, “NDR” is set ON for one scan.
3) If the message receiving is not completed normally, “ERROR” is set ON for one scan, and the corresponding error code is
outputted to “STATUS”
Note 1: Up to 1017 words of data can be received at a time.
Note 2: During message receiving (until “NDR” or “ERROR” is set ON after the rising edge of “EN_R”), keep “EN_R” ON.
The receiving is halted if “EN_R” is set OFF.
Note 3: The receiving is resumed when “EN_R” is set ON after being halted. Even if “CON_NO,” “SD,” or “SIZE” is changed,
the receiving is resumed using the values set before being halted. These changes are not reflected in the processing for
receiving a message.
Note 4: If “EN_R” is set ON in the next scan after the message receiving is completed, processing for receiving a message
restarts.
Note 5: Do not change “RD” during message receiving. Otherwise, the receive data cannot be guaranteed.
Note 6: If the number of data specified in “SIZE” exceeds the variable size specified in “RD,” the data for the excess part
becomes undefined. Be sure to enter the specified size of variable for “SIZE.”
Note 7: The receive request “EN_R” must be programmed to be set ON after “VALID” of M_OPEN is set ON.
(2) FB format
Data type M_RECEIVE_ Data type
M_RECEIVE
BOOL EN_R NDR BOOL
UINT CON_NO ERROR BOOL
STATUS INT
ANY RD RD ANY
UINT SIZE
Terminal function Terminal name Data I/O Description

Receive request EN_R BOOL IN When this signal is set ON, receiving is enabled and the CPU
module is ready for receiving a message.
Connection No. CON_NO UINT IN A connection No. that is opened by M_OPEN is set.
The “CON_NO” terminal of M_OPEN is connected to this one.
Receive data size SIZE UINT IN Sets the size of data to be received in units of words.
Receive data *1 RD ANY IN-OUT Connects a variable where the received data is stored.
Receive end NDR BOOL OUT Turns ON for one scan when the message receiving is
completed normally.
Receive error ERROR BOOL OUT Turns ON for one scan when the message receiving ends
abnormally.
Status STATUS INT OUT The result of the message receiving is outputted by a status
code. Refer to “4-4-7 Status” for more information.
4-29
*1 When “Destination Addition mode” is enabled, four words of destination information are added to the receive buffer.
For the receive data “RD,” reserve an area of receive data size plus four words.
<Notes on using M_SEND and M_RECEIVE>

1) In General Purpose Communication mode using UDP/IP protocol, no receipt confirmation or flow control is performed. If the
processing on the receiver side is too slow, the receive buffer becomes full and the data sent after that is discarded. As a
result, mismatch occurs between the number of data successfully sent from the sender and the number of data successfully
received by the receiver.
Since it takes approximately 10 seconds to release the buffer that becomes full, processing for receiving data may be halted
in the interim.
2) In Full Passive open mode, if an open request is received from a remote node whose IP address and port No. do not match,
the connection is established first, and then Full Passive side issues a close request to the Active side.
As a result, on the Active side, “channel forcible close” error (error code 199) occurs after processing for opening ports is
completed normally and data is sent.
3) If the port No. on the sender side does not match that on the receiver side, a send error occurs and the receiver side forcibly
closes the port. As a result, “channel forcible close” error (error code 199) occurs.
4) During communication between MICREX-SX devices, if sending operation is performed consecutively, the receiver side may
receives two words by linking the first received one word with the second received one word depending on the timing of
M_RECEIVE.
Reduce the communication load to make execution of data receive less than execution of data send.
When one-word data is sent, the buffer area for two words must be secured on the receiver side. When two or more words
are sent, the buffer area for the same number of words as that of send data must be secured on the receiver side.
5) When data is sent after converted into ASCII code in General Purpose Communication mode using UDP/IP protocol, if the
number of bytes of send data exceeds 1017, the sender side divides the data into two pieces and performs the send
processing twice to send them separately. Therefore, a receive request needs to be sent twice to the receiver side. In
addition, the buffer area of the receiver side must be greater than the send data.
4-30
4-4-5 Remote data write (R_WRITE)

Remote data write FB (R_WRITE) is used in Loader Command Communication mode to write data directly in the internal
memory in a CPU of a MICREX-SX system via Ethernet from an SX_CPU. This FB can be used only when the remote node is
an SX system.

1) Data set in “SD” is written in the area that is specified in “MODULE_NO,” “CHANNEL_NO,” “STATION_NO,” and
“REMOTE_VAR.” (This processing is not completed within one scan.)
2) When the writing is completed normally, “DONE” is set ON for one scan.
3) If the writing is not completed normally, “ERROR” is set ON for one scan and the corresponding error code is outputted to
“STATUS.”
Note 1: “REQ” is enabled at its rising edge and disabled during data writing (until “DONE” or “ERROR” is set ON after the rising
edge of “REQ.”
Note 2: Do not change “SD” during data writing. Otherwise, the write data cannot be guaranteed.
Note 3: “SIZE” is not limited when “VAR_TYPE” is set to zero. When a value other than zero is set, “SIZE” is limited by the
communication module through which data is sent.
Note 4: If the number of data specified in “SIZE” exceeds the variable size specified in “SD,” the data for the excess
part becomes undefined. Be sure to enter the specified size of variable for “SIZE.”
Note 5: To execute “R_WRITE” consecutively, set the default maximum TCP end timer value to zero.
Note 6: To execute “R_READ and/or “R_WRITE” consecutively, set the self and correspondent port standard Nos. to the default
value (256).
(2) FB format
Data type R_WRITE_ Data type
R_WRITE
BOOL REQ DONE BOOL
UDINT STATION_NO
UINT VAR_TYPE
ANY REMOTE_VAR REMOTE_VAR ANY
UINT SIZE
ANY SD SD ANY
4-31

I/O Description
Write request REQ BOOL IN The instruction is executed at the rising edge of this signal.
channel No.
Remote station No. STATION_NO UDINT IN Specifies the IP address of the remote node.
Variable specification VAR_TYPE UINT IN Sets the method for specifying variables.
method For the CPU module, this terminal is fixed to zero.
Target variable to REMOTE_VAR ANY IN Specifies the remote SX_CPU (top address) where data is
access written.
Write data size *1 SIZE UINT IN Sets the size of data to be written in units of words.
Write data SD ANY IN-OUT Connects a variable where data to be written is stored.
Write end DONE BOOL OUT Turns ON for one scan when the writing is completed
normally.
Write error ERROR BOOL OUT Turns ON for one scan when the writing is failed.
Status STATUS INT OUT The result of the writing is outputted by a status code.
*1 Target variable to access (REMOTE_VAR)

Specify the top address of the SX_CPU internal memory in the following format:
<For D300win>
15 0
CPU No.
UINT type array Memory type

data of 4 elements Low-order byte of address
High-order byte of address
Standard memory: UINT#1
Retain memory: UINT#3
System memory: UINT#10
Note: Values other than the above must not be set for memory type.
<For Standard loader>
15 (F) 0
CPU No.
Consecutive Memory type

data areas Low-order byte of address
Standard memory: 1 (H1)
Retain memory: 3 (H3)
System memory: 10 (HA)
4-32
4-4-6 Remote data read (R_READ)

Remote data read FB (R_READ) is used to directly read data in the CPU internal memory of a MICREX-SX system from a
SX_CPU via Ethernet.

1) Data specified in “MODULE_NO,” “CHANNEL_NO,” “STATION_NO,” and “REMOTE_VAR” is read and set in the variable
area specified in “RD.” (This processing is not completed within one scan.)
2) When the reading is completed normally, “DONE” is set ON for one scan.
3) If the reading is not completed normally, “ERROR” is set ON for one scan and the corresponding error code is outputted
to “STATUS.”
Note 1: Additional “REQ” command is disabled during data reading (until “DONE” or “ERROR” is set ON after the rising edge of
“REQ.”
Note 2: Do not change “RD” during data reading. Otherwise, the read data cannot be guaranteed.
Note 3: “SIZE” is not limited when “VAR_TYPE” is set to zero. When a value other than 0 is set, “SIZE” is limited by the
communication module through which data is sent.
Note 4: If the number of data specified in “SIZE” exceeds the variable size specified in “RD,” another variable area is rewritten.
Be sure to enter the specified size of variable for “SIZE.”
Note 5: To execute “R_READ” consecutively, set the default maximum TCP end timer value to zero.
(2) FB format
Data type R_READ_ Data type
R_READ
BOOL REQ DONE BOOL
UDINT STATION_NO
UINT VAR_TYPE
ANY REMOTE_VAR REMOTE_VAR ANY
UINT SIZE
ANY RD RD ANY
4-33
Terminal function Terminal name Data I/O Description

Read request REQ BOOL IN The instruction is executed at the rising edge of this signal.
channel No.
Remote station No. STATION_NO UDINT IN Specifies the IP address of the remote node.
Variable specification VAR_TYPE UINT IN Sets the method for specifying variables.
method For the CPU module, this terminal is fixed to zero.
*1 Target variable to REMOTE_VAR ANY IN Specifies the remote SX_CPU (top address) where data is
access read.
Read data size SIZE UINT IN Sets the size of data to be read in units of words.
Read data RD ANY IN-OUT Connects a variable where data to be read is stored.
Read end DONE BOOL OUT Turns ON for one scan when the reading is completed
normally.
Read error ERROR BOOL OUT Turns ON for one scan when the reading is failed.
Status STATUS INT OUT The result of the reading is outputted by a status code.
*1 Target variable to access (REMOTE_VAR)

Specify the top address of the SX_CPU internal memory in the following format:
<For D300win>
15 0
CPU No.
UINT type array Memory type

data of 4 elements Low-order byte of address
Standard memory: UINT#1
Retain memory: UINT#3
System memory: UINT#10
<For Standard loader>
15 (F) 0
CPU No.
Consecutive Memory type

data areas Low-order byte of address
Standard memory: 1 (H1)
Retain memory: 3 (H3)
System memory: 10 (HA)
4-34
4-4-7 Status
Error code Cause
CHANNEL_NO error
32
• A value other than 524 is set for CHANNEL_NO.
Transmission interlock error

35
• A remote CPU is in the middle of operation such as program download and cannot reply.
Memory address setting error

68
• A wrong address is specified in REMOTE_VAR.
Memory size over
69 • The total of the address specified in REMOTE_VAR and SIZE exceeds the effective address range of the
remote CPU.
Message send destination setting error
160
• A remote CPU No. specified in REMOTE_VAR does not exist.
No response for command

162
• No response is returned from the remote node due to defective wiring or condition of the remote node.
Message sending error

164
• The remote node is disconnected.
Message control resource full
• More than 57 message FBs were simultaneously executed.
• More number of message FBs than the maximum number of connections for message communication
170
simultaneously use a port of the built-in Ethernet.
• More number of ports of the built-in Ethernet than the maximum number of connections for loader command
communication are simultaneously used.
Internal resources exhausted

171 • More than 4 R_READ and R_WRITE FBs were simultaneously executed.
* In this case, restart after waiting a while.
Parameter error
• Zero was entered in the SIZE terminal.
• An out-of-range value was entered in VAR_TYPE.
177 • A value other than 1 to 56 was entered for the connection No.
• The send/receive data area exceeds the memory boundary.
• ”Byte” is selected for “Send data length selection” in the MODE setting of M_OPEN, however, the first word
(number of bytes) of the SD terminal of M_SEND is zero.
Channel open error

• An abnormal value is specified for the station No.
• An abnormal value is specified for the communication mode.
193
• Active” is set for open mode (on the sender side), however, the station No. (IP address) of the remote node
and RPORT_NO cannot be found on the network.
• Connection is not established.
Message sending error (communication error between the CPU module and another node)
• No data can be sent to the communication module at the remote node.
195
• No response is returned from the communication module at the remote node (sending is completed,
(Note)
however, no ACK is returned).
• Other transmission errors on the network
196 Message receive error (communication error between the CPU module and another node)
Channel forcible close (communication error between the CPU module and another node)
199 • A close request is received from the remote node.
* If this code is received, close the corresponding port once, and then re-execute the open processing.
Port setting error

200 • The code specified in SPORT_NO is out of the range of 1 to 127.
• The same value is already specified for SPORT_NO.
Connection No./Client port full

201
• Ports exceeding the specified number were attempted to be opened. (57 or more)
4-35
Buffer over
206
• Data exceeding the specified receive data size was received. *Receive data is not updated.
Connection No. error

• A connection No. that is not yet opened is used.
• “EN_R” (receive enable) is set ON when “EN_C” (open request) of M_OPEN is set OFF.
207 * “Receive enable” must be programmed to be set OFF simultaneously when “open request” of M_OPEN is
set OFF.
• A currently used connection No. is used.
(When two M_SEND FBs are used in parallel for one connection, for example)
Note: When the communication protocol is UDP/IP, no communication is performed when a channel is opened. Therefore, no
error occurs even if the station No. (IP address) of the remote node cannot be found on the network. In addition, in UDP/IP
communication, no connection is established when a channel is opened. The connection is considered to be established
when the CPU module receives data from the remote node.
4-36
5-1 SNTP Client Communication

Simple Network Time Protocol (SNTP) is a protocol used to synchronize the clocks of computers via a TCP/IP network. SNTP is
a simplified version of NTP.
This FB enables to acquire the current time from an NTP server on a network that is connected to Ethernet built in the CPU. In
addition, all the clocks in the PLC system can be synchronized by connecting the data to an FB such as HW_RTC.
The CPU module accesses a device where the NTP server is installed to acquire time information.
This function is supported by V**08 or later version of SPH2000 and all versions of other CPU modules.
Access to NTP server (example)
Start “W32Time” service

NTP server access of Windows and operate
(UDP/IP: Port No. 123) it as an SNTP server.
SNTP request
The number of seconds that has elapsed

Converted into UTC since 00:00:00, 1 January 1900
(00:00:00, 1 January 1970)
Synchronize the time with

an external NTP server.
NTP server on the Internet

For example,
National Astronomical Observatory of Japan:
gpsntp.miz.nao.ac.jp
NASA:
ntp.nasa. gov
For an SNTP request, the sent time data is outputted to the NTP server as it is.
The time until the CPU module receives the time data sent from the NTP server is not taken into account.
In an extreme case, if the CPU module receives a frame sent from the NTP server after five seconds, a time value delayed by
five seconds is outputted.
5-1
5-1-1 Current time acquisition (SNTP_CLIENT)

(1) FB format
SNTP_CLIENT_
Data type Data type
SNTP_CLIENT
BOOL REQ DONE BOOL
UDINT IP_ADDR ERROR BOOL
STATUS INT
UTC_DT DT

I/O Description
Current time REQ BOOL IN A current time request is issued to the NTP server at the rising
request edge of this signal.
NTP server IP_ADDR UDINT IN Specifies the IP address of the NTP server.
IP address The IP address is expressed as follows:
Example: 192.168.0.100
192 168 0 100

C0h A8h 00h 64h
g UDINT#16#C0A80064
End flag DONE BOOL OUT Turns ON for one scan when the current time acquisition is
completed normally.
Error flag ERROR BOOL OUT Turns ON for one scan when the current time acquisition is failed.
(For example, no server exists or the NTP service is not supported.)
Status STATUS INT OUT Outputs the error contents.
Current time UTC_DT DT OUT Outputs the current time (Coordinated Universal Time [*1]: UTC) in
the date/time (DT) type.
(The number of seconds that has elapsed since 00:00:00, 1 January
1970 is outputted.)
Outputs in other cases are indefinite.
*1 Coordinated Universal Time (UTC)

Coordinated Universal Time (UTC) is the time standard commonly used across the world. UTC is adjusted with leap seconds
to always be within less than one second of Universal Time (UT1), which is a time standard based on Earth's rotation, by the
international standards.
Japan Standard Time (JST) is the standard timezone in Japan, and is 9 hours ahead of UTC. It is expressed as "+0900 (JST).”
NTP uses the number of seconds that has elapsed since 00:00:00, 1 January 1900, which is expressed as an unsigned double
integer value.

1) A current time request is issued to the NTP server that is specified in “IP_ADDR” at the rising edge of “REQ.”
When the current time can be acquired from the NTP server normally, “DONE” is set ON for one scan and the current time (UTC)
is outputted to “UTC_DT.”
3) If the current time cannot be acquired from the NTP server normally (e.g. when no server exists or the NTP service is not
supported), “ERROR” is set ON for one scan. (In this case, UTC_DT is an indefinite value.)
4) A timeout occurs when no response is returned from the NTP server after 30 seconds, current time acquisition results in
an error (status: 193).
5-2
(4) Status list
Status code Status Description

193 Connection open error Outputted when connection to the NTP server was failed.
• The communication partner specified in “IP_ADDR” does not exist.
• Port 123 cannot be used. (The remote node rejects reception.)
195 NTP communication error Outputted when communication with the NTP server was failed.
• A timeout occurs when no response is returned from the NTP server.
(30 seconds)
(4) How to use the FB

The following figure shows an example of using the FB.
<Example of using SNTP client FB>
SNTP_CLIENT
REQ DONE
IP_ADDR ERROR
ADD_DT_T
UTC_DT
TIME#9h
Japan Standard Time (JST)
is 9 hours ahead of UTC.
HW_RTC
EN
PDT
<Example of time difference>

UTC+9 Japan, Korea, etc.
UTC+8 China (Hong Kong, Macao), Taiwan, Philippines, etc.
5-3
5-2 FTP Client Communication

File Transfer Protocol (FTP) is a protocol used to transfer files on a TCP/IP network such as the Internet or an Intranet.
A file can be obtained and stored by issuing a request from an FTP client to an FTP server (file server).
This function is supported by V**08 or later version of SPH2000 and all versions of other CPU modules.
Example of connection
NAS PC for instruction and monitoring Database server

(Network Attached Storage)
FTP server NAS FTP server FTP server
LAN line Data backup

(Under the condition that Port 21
is a network that is not blocked.)
PUT
Reading a file such as a

GET parameter file from PC
Measurement Measurement Measurement

instrument, instrument, instrument,
FTP client etc. etc. etc. Control network
installed
User ROM
Ethernet
Various data including control data and backup

data is stored in a file, accumulated in a user ROM,
and then transfered to other devices such as
the database server or NAS.
GET User ROM Ethernet
FTP server
* Network Attached Storage (NAS)

NAS is a device that can be directly connected to a network (Ethernet) and used as a file server.
5-4
5-2-1 List of FTP client FBs

To perform the FTP client function, FBs for FTP connection and FBs for file access are provided.
<List of FTP client function FBs>
Name Description
FTP_OPEN Establishes a connection to the FTP server.
FTP_PUT Stores a file in the FTP server.
FTP_GET Obtains a file from the FTP server.
FTP_CREATE_DIR Creates a directory in the FTP server.
FTP_DELETE_FILE Deletes a file in the FTP server.
The following restrictions are imposed on the entire FTP client function when performed.
1) Prohibited to establish multiple FTP connections
Since only one FTP_OPEN can be simultaneously executed, the number of servers that can be simultaneously accessed is
limited to one.
It is possible to place multiple FTP_OPEN FBs that are programmed not to be simultaneously executed.
2) Prohibited to execute GET, PUT, CREATE, and DELETE simultaneously
After FTP_OPEN (connection to the FTP server is opened), multiple requests cannot be simultaneously issued. It is possible
to issue another request in one OPEN. In this case, issue the next request after the previous request is completed.
3) File is not guaranteed when the application stops.
If a stop request is issued during FTP data transfer, the file transfer is halted and the FTP connection is broken. When the
transfer is halted, the file data is cut and not guaranteed.
4) Functions unexecutable by FTP FB
Passive mode (*), file name change, directory delete, additional data writing in an existing file, and relative path access (using
the current directory)
* Passive mode
When security such as firewall is set for the client device and a usual FTP communication cannot be performed, an available
port is notified by the client side to enable file transfer. Passive mode is not supported in the CPU module because security
is not set for ports.
5) FTP communication port
Since FTP communication uses TCP/IP protocol, the TCP/IP port No. is used.
FTP has two types of connections: control connection for command notification and data connection for file transfer by PUT
or GET.
Control connection
Client side (CPU module) Server side (e.g. PC)
Self port: Automatic Self port: 21
Remote port: 21 Remote port: CPU module self port
Data connection
Client side (CPU module) Server side (e.g. PC)
Self port: 25001 to 25100 Self port: 20 (Some devices obtain an arbitrary port)
Remote port: PC self port Remote port: 25001 to 25100
Self port standard No. set in the system definition is not applied when the FTP client function is used.
Note: When using the FTP client function, do not use 25001 to 25100 for the self and remote port No. of the message FB
(M_OPEN) that uses directly connected Ethernet.
6) Prohibited to allocate user name, password, or file path character strings to GM space
User name or file path character strings of FTP_OPEN and file path character strings of other FBs are prohibited to be
allocated to the global memory (GM) space. Otherwise, the FB ends abnormally.
Terminal output when the FB ends abnormally
ERROR terminal: Turns ON for one scan
STATUS terminal: Outputs a code = 177 (parameter error)
SUB_STATUS terminal: Outputs zero. (because this is not a communication error)
5-5
5-2-2 Connection open (FTP_OPEN)

The connection open FB (FTP_OPEN) is used to issue a request to open or break a connection to the FTP server.
(1) FB format
FTP_OPEN_
Data type Data type
FTP_OPEN
BOOL EN_C VALID BOOL
UDINT IP_ADDR ERROR BOOL
STATUS INT
SUB_STATUS UDINT
CON_NO UDINT
(Note 1)
NAME:ARRAY[1..N]OF WORD; USER_NAME USER_NAME NAME
(Note 1)
PASS:ARRAY[1..N]OF WORD; PASSWORD PASSWORD PASS
(2) Description of FB terminals

I/O Description
Execution request EN_C BOOL IN Establishes a connection to the FTP server at the rising edge of
this signal (0 g 1).
Breaks the connection to the FTP server at the falling edge this
signal (0 g 1).
NTP server IP_ADDR UDINT IN Specifies the IP address of the FTP server.
IP address The IP address is expressed as follows:
Example: 192.168.0.100
192 168 0 100

C0h A8h 00h 64h
g UDINT#16#C0A80064
User name USER_NAME Note 1 IN-OUT Specifies the user name to access the FTP server.
The user name can be up to 63 characters.
Password PASSWORD Note 1 IN-OUT Specifies the password for the user to access the FTP server.
The password can be up to 63 characters.
Connection VALID BOOL OUT Remains ON when the connection is established successfully.
enable output
Error flag ERROR BOOL OUT Turns ON for one scan when the connection to the FTP server is
failed.
Status STATUS INT OUT Outputs the error contents.
Sub-status SUB_STATUS UDINT OUT Outputs the detailed status after the request completion.
(This terminal is enabled when the request ends abnormally
and outputs zero when completed normally.)
Connection No. CON_NO UDINT OUT Outputs the connection No. when the connection to the FTP server
is successfully established.
Note 1: Connect a word-type array and set a ASCII code.

Do not change “USER_NAME” and “PASSWORD” during FB processing. Otherwise, the send data is not guaranteed.
5-6

1) Connection to the FTP server that is specified in “IP_ADDR” is established when “EN_C” is set to 1.
2) When the connection to the FTP server is completed normally, “VALID” is set ON, and the connection No. is outputted to
“CON_NO.”
3) If the connection cannot be established because no FTP server exists or the user name and password do not match, “ERROR”
is set ON for one scan and an error contents are outputted to “STATUS.”
4) The connection is broken when “EN_C” is set to 0.
5) A number from 25001 to 25100 is used for the self port No. during TCP/IP communication when the FTP server is connected.
6) If the connection is failed, “ERROR” is set ON for one scan. The error code is outputted to the “STATUS” and the detailed
contents to “SUB_STATUS” at the same time. (Zero is outputted when completed normally.)
(4) Status list
Status Sub-status
Status Cause Description
code code
177 Parameter A value out of the specified “IP_ADDR” does not exist. 1
error range was entered.
The user name or password exceeds the maximum 1
length.
The user name or password includes control characters. 1
The user name or password is allocated to the GM 0

space.
193 Channel open Connection to the FTP FTP control connection was failed. 3
error server was failed.
Two or more FTP open requests were simultaneously 2
issued. (Only one FTP connection can be established.)
The access was rejected by the server. 3
The login was failed due to mismatch of the user name 4

and password.
195 FTP Communication with the The current directory path exceeds 255 characters. 16
communication FTP server was failed. (out of range)
error • IP communication was
The current directory path cannot be set. 17
failed. (Other than 193)
The acquisition of the internal work memory was failed. 11
The server (PWD, CWD) rejected the command request. 19
An error occurred on the network during command 20

communication.
5-7
(5) How to hide the user name and password

Since the user name and password of a normal FTP_OPEN FB can be monitored on an application, a security problem may
occur. The following describes how to hide the user name and password.
1) Create a user FB that is an FTP_OPEN FB without user name and password setting.
2) Save the created user FB with a password.
3) Read and use the FTP_OPEN created as a user FB as a user library in a new project.
(The library cannot be monitored since it is protected by the password of the project.)
5-8
5-2-3 File store (FTP_PUT)

The file store FB (FTP_PUT) is used to store a file in the FTP server.
(1) FB format
FTP_PUT_
Data type Data type
FTP_PUT
BOOL REQ DONE BOOL
UDINT CON_NO ERROR BOOL
UINT FLAG STATUS INT
SUB_STATUS UDINT
(Note 1)
NAME:ARRAY[1..N]OF WORD; LOCAL_FILE LOCAL_FILE NAME
(Note 1)
NAME:ARRAY[1..N]OF WORD; NEW_R_FILE NEW_R_FILE NAME

I/O Description
Execution request REQ BOOL IN A storage request is issued to the FTP serve at the rising edge
of this signal (0 g 1).
Connection No. CON_NO UDINT IN Connection No. of FTP_OPEN

Transfer mode FLAG UINT IN Specifies the file transfer mode.
setting 16#0000 and from 0003: Default (file contents not specified)
16#0001: ASCII file transfer
16#0002: Binary file transfer
Local file LOCAL_FILE Note 1 IN-OUT A file in the PLC (in the user ROM)
Up to 255 characters can be set including the file name.
Store file NEW_R_FILE Note 1 IN-OUT A file created in the FTP server
End flag DONE BOOL OUT Turns ON for one scan when “a normal response to the file store
request” is received from the FTP server.
Error flag ERROR BOOL OUT Turns ON for one scan when the file is unable to be stored in the
FTP server.
Error status STATUS INT OUT Outputs the error code contents.
Substatus SUB_STATUS UDINT OUT Outputs the detailed status after the request completion.
Note 1: Connect a word-type array and specify the full path of the file as an ASCII code.
An example of specifying a path: “/DATA/Sample/Sample.text”
Do not change the “LOCAL_FILE” and “NEW_R_FILE” during FB processing. Otherwise, the send data is not
guaranteed.
5-9

1) A file in the user ROM is created in the FTP server area at the rising edge of “REQ.”
2) When a normal response to the file transfer is returned from the FTP server, “DONE” is set ON for one scan.
3) If an abnormal response to the file transfer is returned from the FTP server, no connection has been established, no file
exists in the user ROM, or overwriting of the file in the server is prohibited, “ERROR” is set ON for one scan and “STATUS” is
outputted.
4) If an error occurs, “ERROR” is set ON for one scan. The error code is outputted to the “STATUS” and the detailed contents
to “SUB_STATUS” at the same time. (Zero is outputted when completed normally.)
(4) Status list
Status Sub-status
code code
65 File name error The specified file name The specified file name does not exist in the user ROM. 13
does not exist.
The server rejected access to the specified file. 6
66 File access An error occurred during An error occurred while the file in the user ROM was 18
error file access. being read.
177 Parameter A value out of the specified The number of the file path characters exceeds the limit. 1
The file path character string is allocated to the GM 0
space.
195 FTP Connection to the FTP The server rejected the request of the command. 19
communication server was failed.
An error occurred on the network during command 20
error
communication.
Acquisition of the internal work memory was failed. 11
Data connection establishment was failed. 9
A timeout occurred during file transfer. 10
(More than 30 seconds has elapsed per transfer.)
207 Connection A wrong connection No. An unopened connection No. was specified. 5
No. error was specified.
A communication request was issued to the connection 5
No. that was in the middle of communication.
(This error occurs when PUT and GET are operated in
parallel.)
5-10
5-2-4 File get (FTP_GET)

The file get FB (FTP_GET) is used to obtain a file in the FTP server.
(1) FB format
FTP_GET_
Data type Data type
FTP_GET
BOOL REQ DONE BOOL
UDINT CON_NO ERROR BOOL
UINT FLAG STATUS INT
SUB_STATUS UDINT
(Note 1)
NAME:ARRAY[1..N]OF WORD; NEW_FILE NEW_FILE NAME
(Note 1)
NAME:ARRAY[1..N]OF WORD; R_FILE R_FILE NAME

I/O Description
Execution request REQ BOOL IN A file is downloaded from the FTP serve to the PLC (user ROM) at
the rising edge of this signal (0 g 1).

Transfer mode FLAG UINT IN Specifies the file transfer mode.
setting 16#0000 and from 0003: default (file contents not specified)
16#0001: ASCII file transfer
16#0002: Binary file transfer
New file NEW_FILE Note 1 IN-OUT A file created in the PLC (in the user ROM)
File in server R_FILE Note 1 IN-OUT A file in the FTP server
End flag DONE BOOL OUT Turns ON for one scan when “a normal response to the file get
Error flag ERROR BOOL OUT Turns ON for one scan when the file is unable to obtain from the FTP
server.
Error status STATUS INT OUT Outputs the error contents.

An example of specifying a path: “/DATA/Sample/Sample.txt”
Do not change the “NEW_FILE” and “R_FILE” during FB processing. Otherwise, the send data is not guaranteed.
5-11

1) A file in the FTP server is created in the user ROM area at the rising edge of “REQ.”
2) When a normal response to the file transfer is returned from the FTP server, “DONE” is set ON for one scan.
3) If an abnormal response to the file transfer is returned from the FTP server, no connection has been established, no file exists
in the user ROM, or overwriting of the file in the user ROM is prohibited, “ERROR” is set ON for one scan and “STATUS” is
outputted.
4) If an error occurs, “ERROR” is set ON for one scan. The error code is outputted to the “STATUS” and the detailed contents to
“SUB_STATUS” at the same time. (Zero is outputted when completed normally.)
(4) Status list
Status Sub-status
code code
65 File name error The specified file name The server rejected access to the specified file or the 6
does not exist. specified file name does not exist.
66 File access An error occurred during An error occurred while the file in the user ROM was being 18
error file access. read.
Data obtained from the server is unable to be stored with 7
the specified file name in the user ROM.
(The same file name already exists in the user ROM.)
The file path character string is allocated to the GM 0
space.
communication server failed. An error occurred on the network during command 20
error communication.
Acquisition of the internal work memory was failed. 11
Data connection establishment was failed. 9
A timeout occurred during file transfer. 10
(More than 30 seconds has elapsed per transfer.)
No. error was specified. A communication request was issued to the connection 5
parallel.)
5-12
5-2-5 Directory create (FTP_CREATE_DIR)

The directory create FB (FTP_CREATE_DIR”) is used to create a directory in the FTP server.
(1) FB format
FTP_CREATE_DIR_
Data type Data type
FTP_CREATE_DIR
BOOL REQ DONE BOOL
INT CON_NO ERROR BOOL
STATUS INT
SUB_STATUS UDINT
(Note 1)
NAME:ARRAY[1..N]OF WORD; DIRECTORY DIRECTORY NAME

I/O Description
Execution request REQ BOOL IN A directory is created in the FTP server at the rising edge of this
signal (0 g 1).
Directory name DIRECTORY Note 1 IN-OUT A directory name to be created in the FTP server
Up to 255 characters can be set including the directory name.
End flag DONE BOOL OUT Turns ON for one scan when “a normal response to the file delete
Error flag ERROR BOOL OUT Turns ON for one scan when a file is unable to be created in the
FTP server.
Example of specifying a path: “/DATA/Sample”
Do not change the “DIRECTORY” during FB processing. Otherwise, the send data is not guaranteed.
5-13

1) A directory is created in the FTP server at the rising edge of “REQ.”
2) When a normal response to the directory create is returned from the FTP server, “DONE” is set ON for one scan.
3) If an abnormal response to the directory create is returned from the FTP server, “ERROR” is set ON for one scan and “STATUS”
is outputted.
(4) Status list
Status Sub-status
code code
65 File name error The specified file name An already existing directory is attempted to be created. 15
does not exist. The server rejected creation of the specified directory. 6
177 Parameter A value out of the specified The number of the directory path characters exceeds the 1
error range was entered. limit.
The directory path character string is allocated to the GM 0
space.
communication server failed. An error occurred in the server during command 20
No. error was specified.
Communication request was issued to the connection No. 5
that was in the middle of communication.
parallel.)
5-14
5-2-6 File delete (FTP_DELETE_FILE)

The file delete FB (FTP_DELETE_FILE) is used to delete a file in the FTP server.
(1) FB format
FTP_DELETE_FILE_
Data type Data type
FTP_DELETE_FILE
BOOL REQ DONE BOOL
INT CON_NO ERROR BOOL
STATUS INT
SUB_STATUS UDINT
(Note 1)
NAME:ARRAY[1..N]OF WORD; FILE_NAME FILE_NAME NAME

I/O Description
Execution request REQ BOOL IN A file in the FTP server is deleted at the rising edge of this signal
(0 g 1).
File name FILE_NAME Note 1 IN-OUT A file name to be deleted from the FTP server
End flag DONE BOOL OUT Turns ON for one scan when “a normal response to the file delete
Error flag ERROR BOOL OUT Turns ON for one scan when a file is unable to be deleted from the
FTP server.
(This terminal is enabled when the request ends normally
An example of specifying a path: “/DATA/Sample/Sample.txt”
Do not change the “FILE_NAME” during FB processing. Otherwise, the send data is not guaranteed.
5-15

1) A file in the FTP server is deleted at the rising edge of “REQ.”
2) When a normal response to the file delete is returned from the FTP server, “DONE” is set ON for one scan.
3) If an abnormal response to the file delete is returned from the FTP server, “ERROR” is set ON for one scan and “STATUS” is
outputted.
(4) Status list
Status Sub-status
code code
65 File name error The specified file name The server rejected deletion of the specified file. 6
does not exist.
error range was entered. 0
The file path character string is allocated to the GM
space.
communication server was failed. An error occurred in the server during command 20
207 Connection A wrong connection No. An unopened connection No. is specified. 5
No. error was specified. A communication request was issued to the connection 5
parallel.)
5-16
5-2-7 Limits on operation

The tables below show the operation when a program created by a loader that supports newly added instructions is used in a
loader without them and operation depending on the combination of a loader that supports newly added instructions and a CPU.
(CPUs other than SPH2000/3000/5000 series, SPH2000 CPUs without newly added instructions, and SPH2000 CPUs that
support them and SPH3000/5000 series CPUs).
a) Operation when a project that contains newly added instructions is used in Expert that does not support them
Project format Open project Compile

UROM in PC Possible Compile error
UROM in PLC Possible
Zip project Possible
b) Operation depending on the combination of Expert supporting newly added instructions and a CPU
Download
Target CPU Compile
Loader User ROM
Other than Compile error ー Type mismatch
SPH2000/3000/5000 series
SPH2000 not supporting Normal Download error Fatal fault
the newly added instructions (PLC version that does not support (Undefined FB/FCT) (Note)
the newly added instructions)
SPH2000 supporting the Normal Normal

newly added instructions
and SPH3000/5000 series
Note: Pay attention to the version. Otherwise, a fatal fault occurs when an instruction is executed.
5-17
5-2-8 Example of client program

(*FTP Connection destination selection*)
USER_NAME and PASSWPORD
must be programmed not to be
changed during processing of OPEN.
(*FTP Connection establishment*)
When OPEN is failed, set OPEN

request to FALSE since retry is
performed while EN_C is TRUE.
(*PUT execution determination No request is accepted during PUT processing*)
No request must be accepted during

file access.
(*FTP Access file name selection*)

A file name must be created only when
PUT execution FTP access is executed and not be
changed until the access is completed.
(*FTP PUT (File write to the server)*)

PUT execution
PUT execution
5-18
6-1 Overview of Diagnosis

You can diagnose Ethernet communication built in the CPU module using the failure diagnosis function of the loader. In the “Failure
Diagnosis” dialog box, select the CPU module to display various information about the CPU module.
<Procedure>
Open the “Failure Diagnosis” dialog box, select the CPU in the “Composition” screen, and then click the “Ethernet Information”
tab on the top right. Information on the built-in Ethernet is displayed on the right side of the screen. When you click “Mail
information,” information on the mail is displayed.
* “Ethernet Information” and “Mail Information” are cleared when the power supply of the PLC is reset.
“Ethernet Information” includes the following.

1) Communication channel information
2) Communication channel status information
3) Communication parameter information
4) Node connection information
5) Error log information
6) Operation information
“Mail Information” includes the following.

1) SMTP server address
2) Local station mail address
3) SMTP port No.
4) SMTP authentication
5) SMTP user ID
6) Error information
6-1
6-2 Details of Ethernet Information

6-2-1 Communication channel information
Information on the communication ports being used at the time when they were opened is shown (The figure below shows an
example of a CPU with maximum 10 channels of connections.). Communication information for one channel consists of 24
words as shown below.
Channel information 1
Reserved
Passive open mode

00h Communication mode 0: Open completed without confirming
the establishment of a connection.
01h Local module port No. 1: Open completed when a connection
is established.
02h Remote node IP address (L)
15 8 7 0
03h Remote node IP address (H)
Channel
04h Remote node port No. information 1 Receive data
length storage
05h 0: Disable
1: Enable
Reserved Open mode Communication mode
(Fixed to zero) 00: Active Destination
000: Fixed Buffer
11: Fullpassive Addition mode
Communication mode
17h 10. Unpassive 0: Disable
001: General Purpose
18h 1: Enable
Communication mode
Automatic reopen
0: Disable
Send data length 1: Automatic reopen mode
selection Data swap
0000: Word 0: Disable
0001: Byte 1: Enable
Communication
protocol Transmission code
0: TCP/IP 0: Binary
1: UDP/IP 1: ASCII
6-2
6-2-2 Communication channel status information
Information on the status of communication ports being used is displayed (The figure below shows an example of a CPU with
maximum 10 channels of connections.). Communication status information for one channel consists of 24 words as shown
below.
Channel 1
Channel 2
Channel 10
Reserved
+00h Open status code +08h Reserved +10h Send count
Reserved Number of receive data Send error count
Send status code Sending operation time (max.) Receive count
Reserved Sending operation time (min.) Receive error count
Reserved Sending operation time (current) Reserved
Number of send data Receiving operation time (max.) Reserved
Receive status code Receiving operation time (min.) Reserved
+07h Receive error code +0Fh Receiving operation time (current) +17h Reserved
1) Open status code

The open status of a channel is stored in this area.
0000: Not open, 0001: Opening, 0002: Already open, 0003: Closing, 8xh: Forcible close
2) Send status code
The status of data sending operation is stored in this area.
0000: No send request or sending completed, 0001: Sending
3) Number of send data
A binary value for the number of send data that is specified when data sending is requested is stored in this area. Zero is stored
when no send request has been issued.
* The error code is cleared when the next opening operation is completed normally or communication is started.
4) Receive status code
The status of data receiving operation is stored in this area.
0000: No receive request or receiving completed, 0001: Receiving, 0002: Receive data exists (when no receive request issued.)
5) Receive error code
A binary value for the code of an error that occurred while receiving data is stored in this area. For more information on the
receive error codes, refer to “6-2-6 Error code list”.
To clear the error code, execute one of the following operations:
* The error code is cleared when the next opening operation is completed normally, communication is started, or receiving is
completed normally.
6) Number of receive data
A binary value for the number of bytes of receive data that is transferred to the receive data storage area during receipt confirmation
after a receive request has been issued is stored in this area.
6-3
7) Sending operation time
The maximum, minimum and current values of the operation time for sending in each communication performed are stored in
these areas.
(a) The operation time is stored by a binary value in steps of 55 ms.
(b) The time required until the local module completes sending after a send request is issued is stored.
* This data is cleared when the next opening operation is completed or communication is started.
8) Receiving operation time
The maximum, minimum and current values of the operation time for receiving in each communication performed are stored in
these areas.
(a) The operation time is stored by a binary value in steps of 55 ms.
(b) For the operation time for receiving, the following values are stored:
<General Purpose Communication mode>
The time until receipt confirmation is called by a user program after the local module completes receiving
<Fixed buffer communication mode>
The time until receipt confirmation is called by a user program and the local module completes the operation to return a
response after the local module completes receiving.
9) Send count
The total number of normally completed operations for sending data to another node is stored in this area.
(a) Counted when the communication of a command and a response is completed normally.
(b) Counted when one of the following communications is completed normally.
• Sending data to another node in Fixed Buffer Communication mode
• Reading data of the shared buffer from another node in Shared Buffer Communication mode
• Sending data to another node in General Purpose Communication mode
10) Send error count
The total number of communication errors that occurred in sending data to another node (when the communication of a
command and a response ends abnormally) is stored in this area.
11) Receive count
The total number of normally completed operations for receiving data from another node is stored in this area.
(a) Counted when the communication of a command and a response is completed normally.
(b) Counted when one of the following communications is completed normally.
• Receiving data from another node in Fixed Buffer Communication mode
• Writing data in the sheared buffer from another node in Shared Buffer Communication mode
• Receiving data from another node in General Purpose Communication mode
12) Receive error count
The total number of communication errors that occurred in receiving data from another node (when the communication of a
command and a response ended abnormally) is stored in this area.
6-4
6-2-3 Communication parameter information
Information on the MAC address, IP address, and communication definition of the CPU module is displayed.
MAC address IP address
Close processing
00h MAC address (L) 08h Default gateway address (L) 10h at receiving timeout
MAC address (M) Default gateway address (H) Self port standard No.
TCP sending and receiving Communication target port

MAC address (H)
timeout value standard No.
Reserved TCP end timer value Response watch timer value
Loader command Preferred DNS

IP address (L)
watch timer value server address (L)
Set value of Preferred DNS
IP address (H)
send retry interval server address (H)
Alternate DNS
Subnet mask (L) Sending retry number of times server address (L)
Close processing Alternate DNS
07h Subnet mask (H) 0Fh 0Fh
at sending timeout server address (H)
<How to read addresses>

5FB8 MAC address (L) Mac address is
1A11 MAC address (M) 00401A115FB8
0040 MAC address (H)
IP address is
0001 IP address (L)
C0A8 IP address (H) C0 A8 00 01 192.168.0.1
192 168 0 1
6-5
6-2-4 Node connection information
Intensive information on the communication status of each communication channel that is specified by a client port No. of the
CPU module is displayed (The figure below shows an example of a CPU with maximum 10 channels of connections.).
Connection status
Error code
00h Connection status (channel 1)
Connection status (channel 2)
09h Connection status (channel 10)
0Ah
Not used
20h
21h Error code (channel 1)
Not used
3Fh
1) Connection status
The open status of each channel is stored in this area.
0000: Not open
0001: Opening
0002: Already open
0003: Closing
8x: Forcible close
2) Error code
A binary value for the code of an error that occurs when opening a channel, sending or receiving data is stored in this area.
For more information on the error codes, refer to "6-2-6 Error code list."
* The data is cleared when the next opening operation is completed normally or communication is started.
6-6
6-2-5 Error log information
Error information that is detected during Ethernet communication is stored. Error log is stored in ring files. Using 8 words for a
piece of information, maximum 64 error codes can be stored.
Total counter
Max. number
Log type Counter of data
Size of data part
Error code 1
Error code 2
Error code 64
00h Log type (L)

Fixed to 500C0001
01h Log type (H)
02h Counter (L)

Indicates the storage position
03h Counter (H) of the latest error code
04h Max. number of data (L)

Max. storage number of error codes
05h Max. number of data (H) Fixed to 00000040 (64 codes)
06h Size of data part (L)

Fixed to 00000010
07h Size of data part (H)
08h Reserved
09h Reserved
0Ah Reserved
0Bh Reserved
0Ch Total counter (L)
0Dh Total counter (H) 10h No.
0Eh Reserved 11h Type
0Fh Reserved 12h Detail code
10h Error code 13h Error code

One error log
14h Log time (L)
15h Log time (H)
16h Reserved
17h Reserved
20Fh
* For more information on the error codes, refer to "6-2-6 Error code list."
“0” or a socket number will be entered in detail code. (This code is not related to the error occurred.)
Socket number refers to a number that is assigned internally when a port opens.
6-7
1) No.
A No. of error log is stored.
The storage position of the latest error log (counter value) is the position of the error log No. indicated by a counter value minus
one.
When an error occurs, error log is accumulated in order from error log No. 00 to 3Fh.
2) Type
An error type is stored.
0001: Parameter error, 0002: Sequence error, 0003: Upper layer error, 0004: Communication error from physical layer to
transport layer
3) Error code, Detail code
Error contents are stored. * For more information on the error codes, refer to "6-2-6 Error code list (2) Detail error codes for
individual error type."
4) Log time
A time of error code storage is stored. The free-run counter from power-on is used. The unit is µs.
6-8
6-2-6 Error code list
The error codes stored in "error log information," "communication channel status information" or "node connection information"
as well as their contents are described below:
(1) Error code format

The following shows the format of error codes stored in "communication channel status information" and "node connection
information."
15 8 7 0
Error code Error detected channel No.
Error type
0001: Parameter error
0010: Sequence error
0011: Communication error in upper layer
0100: Communication error between physical layer and transport layer
(2) Detail error codes for individual error type

The error codes for “Error log information” are indicated in the parentheses in the list below.
1) Parameter error
Code Description
01h (0010h) “0.0.0.0” or “255.255.255.255” is specified for the IP address of the local module.
02h (0020h) There is an error in the parameter for initial processing.
The number of bits of the subnet mask is smaller than the number of bits of the
03h (0030h)
netmask that is obtained from the IP address of the CPU module.
04h (0040h) “0.0.0.0” or “255.255.255.255” is specified for the IP address of the default gateway.
06h (0060h) Ethernet part hardware error
The IP address of the local module, “0.0.0.0” or “255.255.255.255” is specified for the
10h (0100h)
IP address of another node.
The same combination of “a port No. of the local module” and “a port No. of another
13h (0130h)
node” as that for already opened connection is set.
16h (0160h) A wrong communication mode is specified.
20h (0200h) The send data length is out of the specified range (1017 words).
22h (0220h) The storage area for receive data is smaller than the receive data length.
2) Sequence error
Code Description
01h (0010h) The local module does not yet complete the processing for starting communication.
02h (0020h) The processing for opening the channel is not yet completed.
03h (0030h) Data was sent or received while the channel is being closed.
6-9
3) Communication error in upper layer
Code Description
A code other than 00h (normal end) was returned from another node as the end code
01h (0010h)
for a response in Fixed Buffer Communication mode.
02h (0020h) A response watch timeout occurred in Fixed Buffer Communication mode.
03h (0030h) A response receiving timeout occurred in Fixed Buffer Communication mode.
4) Communication error from physical layer to transport layer
Code Description
02h (0020h) Connection could not be established during processing for opening a TCP connection.
03h (0030h) Checksum error was found in the receive data during communication using TCP protocol.
04h (0040h) Checksum error was found in the receive data during communication using UDP protocol.
• TCP send timeout occurred during communication using TCP/IP protocol.

05h (0050h)
• No ACK was returned from another node during communication using TCP/IP protocol.
06h (0060h) Invalid IP address (network No.) is used.
07h (0070h) Invalid IP address (host No.) is used.
08h (0080h) Invalid port No. is used.
09h (0090h) IP packet was destroyed due to increased traffic.
0Ah (00A0h) Assembly timeout occurred at the remote node
0Bh (00B0h) ICMP error packet not supported by the system was received.
• No Ethernet address corresponding to the specified IP address exists.
0Ch (00C0h)
• Invalid IP address (network No., host No.) or invalid port No. is used.
0Eh (00E0h) Header checksum error of received IP packet
0Fh (00F0h) Channel cannot be opened because the internal buffer for opening channels is full.
10h (0100h) Send error occurred.
11h (0110h) No send buffer could be secured.
12h (0120h) TCP timeout occurred during communication using TCP/IP protocol.
13h (0130h) ASCII conversion error
14h (0140h) Receive error occurred.
15h (0150h) Open error (socket)
16h (0160h) Open error (bind)
17h (0170h) Open error (listen)
18h (0180h) Open error (accept)
19h (0190h) Open error (connect)
1Ah (01A0h) Close error
1Bh (01B0h) Close error, no socket
6-10
6-2-7 Working information
Working information shows the frequency of occurrences of an event during Ethernet communication. They are overwritten
whenever updated to always provide the newest information. Eight words are used for a piece of running status information as
shown below.
No. Counter Reserved

Working information 1
Working information 2
* In the No. area, a No. is stored when an event occurs.
No. Description
0 Ethernet send count (SMC send end count)
1 Ethernet receive count (SMC receive end count)
2 Ethernet send interruption count
3 Ethernet receive interruption count
4 Send delay collision count
5 Carrier lost count
6 Underrun error count
7 16 collision count
8 Send allocation incompletion count (when requested)
9 Send allocation incompletion count (when held)
A Send queuing count
B Send queue full count
C Send buffer no request source count
D Send request count (TASK)
E Send request count (INT)
F Send completion count
10 Receive alignment error count
11 Receive CRC error count
12 Receive long packet count
13 Receive short packet count
14 Receive data size over count
15 Receive overrun count
16 Receive completion count
17 Receive USNET queue full count
18 Receive USNET buffer full count
19 Ethernet controller memory reset count
1A Ethernet controller memory start count
1B Reserved
6-11
Code Description
1C Count of illegal code detection in receive data
1D Count of no starting point of stream delimiter found in receive data
1E Count of no end point of stream delimiter found in receive data
1F Jabber detection count
20 Count of changeover from half duplex to full duplex
21 Count of changeover from full duplex to half duplex
22 Reserved
23 Reserved
24 Socket error count
25 Bind error count
26 Connect error count
27 Listen error count
28 Accept error count
29 Send error count
2A Snedto error count
2B Recv error count
2C Recvfrom error count
2D Closesocket error count
2E Set socket option error count
2F Reserved
30 Function code error count
31 Count of no connection information setting detection
32 Count of failure of connection information notification area acquisition
33 Count of send request issue cancellation
34 Count of parameter error detection during send request
35 Count of receive request issue cancellation
36 Count of parameter error detection during receive request
37 Failure of receive descriptor acquisition
38 Count of command abnormal end of loader command server
39 Count of channel No. acquisition failure
3A Count of ASCII conversion work resource full
3B Data size error
3C ACK receive timeout count
3D ASCII g binary conversion error
3E Reserved
3F Reserved
40 Command code error count (Fixed Buffer)
41 Response frame error count (Fixed Buffer)
42 Response timeout count
43 End code error count when response received
6-12
Code Description
44 Reserved
45 Reserved
46 Reserved
47 Reserved
48 Reserved
49 Reserved
4A Reserved
4B Reserved
4C Reserved
4D Reserved
4E Reserved
4F Reserved
50 Self diagnosis send error
51 Self diagnosis receive error
52 Mismatch of number of self diagnosis receive data
53 Self diagnosis data comparison error
54 Self diagnosis MMU stop timeout
55 Self diagnosis memory allocation error
56 Self diagnosis send status error
57 Self diagnosis receive status error
58 TCP Active Open Request
59 TCP Active Open Complete
5A TCP Active Close Request
5B TCP Active Close Complete
5C TCP Active Send Request
5D TCP Active Send Complete
5E TCP Active Receive Request
5F TCP Active Receive Complete
60 TCP Passive Open Request
61 TCP Passive Open Complete
62 TCP Passive Close Request
63 TCP Passive Close Complete
64 TCP Passive Send Request
65 TCP Passive Send Complete
66 TCP Passive Receive Request
67 TCP Passive Receive Complete
68 UDP Open Request
69 UDP Open Complete
6A UDP Close Request
6B UDP Close Complete
6-13
Code Description
6C UDP Send Request
6D UDP Send Complete
6E UDP Receive Request
6F UDP Receive Complete
70 LDC Open Request
71 LDC Open Complete
72 LDC Close Request
73 LDC Close Complete
74 LDC Message Request
75 LDC Message Complete
76 Reserved
77 Reserved
78 TCP Active Normal Event
79 TCP Active Error Event
7A TCP Passive Normal Event
7B TCP Passive Error Event
7C UDP Normal Event
7D UDP Error Event
7E LDC Normal Event
7F LDC Error Event
6-14
6-3 Details of Mail Information

You can check information on the mail settings and an error that occurs during mail send.
000h
SMTP server address
:
(64 words)
03Fh
040h
: Reserved
0BFh
0C0h
Local station mail address
:
(64 words)
0FFh
100h SMTP port No.
101h Reserved
102h Reserved
103h SMTP authentication
104h
SMTP user ID
:
(32 words)
123h
124h
: Reserved
147h
148h Error information pointer
149h Reserved
14Ah
: Error information block 1
1CDh
1CEh
251h
252h
2D5h
2D6h
359h
35Ah
3DDh
3DEh
461h
462h
4E5h
4E6h
569h
6-15
1) SMTP server address
The SMTP server address (domain name or IP address) set in the system definition is stored in ASCII codes.
• Example of domain name
• Example of IP address
An IP address expressed in a decimal value is stored in ASCII code as shown below.
2) Local station mail address

The local station mail address set in the system definition is stored in ASCII codes.
3) SMTP port No.

The SMTP port No. (decimal value) set in the system definition is converted into a hexadecimal value and stored.
When the default value "25" is set in the system definition, it is converted into a hexadecimal and "0019h" is stored.
4) SMTP authentication
Information on SMTP authentication set in the system definition is stored.
0000: SMTP authentication is used
0001: SMTP authentication is not used
5) SMTP user ID
The SMTP user ID set in the system definition is stored in ASCII codes.
6) Error information pointer

The block number to store error information is stored (range: 0 to 7)
When the error pointer exceeds the max value 7, it is reset to zero and restarted.
When no error has occurred: Pointer = 0

When the 1st error occurred: Pointer = 1 (The latest error is block 1)
When the 2nd error occurred: Pointer = 2 (The latest error is block 2)
:
When the 7th error occurred: Pointer = 7 (The latest error is block 7)
:
7) Error information blocks 1 to 8

If an error occurs during mail send, the destination address, error occurrence time, status, and substatus (123 words in total) are
stored.
Up to eight errors are stored in order in this area starting from the error information block 1. The error information blocks are ring
buffers, where the error information block 1 is overwritten when the 9th error occurs. Thereafter, the error information blocks 2
ans 3 are overwritten in order.
6-16
<Details of error information blocks>
The error information block consists of a destination address (128 words), error occurrence time (2 words), error status (1 word),
and substatus (1 word) in order.
+00h
Destination mail address
:
(128 words)
+7Fh
+80h Error occurrence time (L)
+81h Error occurrence time (H)
+82h Error status
+83h Substatus
• Destination address
The destination address set in the M_SEND FB is stored in ASCII codes.
• Error occurrence time

The time information on error occurrence is stored as 32-bit DT-type data. The time of the clock built in the PLC is converted into
a hexadecimal value, which is the same type as the HW_RTC FB can read.
• Error status and substatus

The error status and substatus of the MAIL_SEND FB are stored as they are.
For more information, refer to "Appendix 2."
6-17
Appendix 1-1 Overview of Loader Command

When accessing data of the internal memory of a MICREX-SX series CPU module from an intelligent device such as a personal
computer via Ethernet, you can read or write data by issuing a "request command" from the personal computer. No application
program for data sending/receiving is necessary in the CPU module. The following 10 commands are provided.
(FYI: The commands are the same as those in an Ethernet module.)
Classification Command name Command Mode Description

Read Read data 00h 00h Reads data from the specified data memory.
Write Write data 01h 00h Writes data in the specified data memory.
PLC control CPU batch start 04h 00h Starts all the CPUs existing in a configuration in a batch.
CPU batch Initializes and starts all the CPUs existing in a configuration
01h
initialize and start in a batch.
CPU batch stop 02h Stops all the CPUs existing in a configuration in a batch.
CPU batch reset 03h Resets all the CPUs existing in a configuration in a batch.
CPU individual start 04h Starts the CPUs individually by specifying them.
CPU individual Initializes and starts the CPUs individually by specifying
05h
initialize and start them.
CPU individual stop 06h Stops the CPUs individually by specifying them.
CPU individual reset 07h Resets the CPUs individually by specifying them.
Note: When "CPU batch initialize and start" or "CPU individual initialize and start" is executed, the retain memory is cleared
before the CPUs are started.
<Image of data access>

A request command is created by an application program installed in the personal computer, and the command is issued to the
CPU module via the built-in Ethernet. On receiving the request command, the CPU returns a response command.
No data communication program is necessary in the application program installed in the CPU module.
Personal computer
Request command
Ethernet
Response command
MICREX-SX
SX_CPU Ethernet interface module
* The response monitoring time on the personal computer side must be 3 seconds or more.
<Notes on access to high-speed memory>

To access a high-speed memory in SPH300 using a loader command requires 81 tacts. (It takes longer to access a high-speed
memory compared with other memories.) Therefore, it is not recommended to access a high-speed memory using a loader
command.
In addition, access across the boundary between high-speed and standard memories is not allowed.
App.1-1
Appendix 1-2 Transmission Data Format of Commands

The transmission data consists of "TCP/IP header part," “Protocol header part," and "Command part" (request command and
response command). The format is the same for both request command and response command. The data are all binary codes
(not ASCII codes).
Usually, the user needs to pay attention when sending or receiving “Protocol header part," and "Command part." Since the
Ethernet communication driver automatically attaches "TCP/IP header part," the user does not need to pay attenthion to it.
TCP/IP header part
DP (FBh fixed)
Protocol header part SP (80h fixed)

(4 bytes)
Transaction (fixed to 80h)
Transmission status (fixed to 00h)
Operation status
Connection mode
Connection ID (L)
Command part Connection ID (H)

Command header (16 bytes)
+ (11h fixed)
Data part
(00h fixed)
(00h fixed)
(00h fixed)
(00h fixed)
(00h fixed)
Command
Mode
(00h fixed)
(01h fixed)
Number of bytes of data part (L)
Number of bytes of data part (H)
Data part
(max. 492 bytes)
App.1-2
<Detail description of transmission data>
1) TCP/IP header part
In the case of a request command, this part is added at the top of the transmission data part of a loader command on the
personal computer side before the command is sent. In the case of a response command, this part is added at the top of the
transmission data part by the CPU module before the response data is returned. Normally, the Ethernet communication driver
automatically adds this part, therefore, the user do not need to pay attention to this.
2) DP (Destination Port)
For request (PC g PLC)
Destination port number on the destination module (not TCP/IP port No.). This is specified by the requester.
* In general, 251 (FBh) is specified, which is the loader interface server port on CPU0.
* When accessing CPU0, 253 (FDh) can be specified, which is the loader command server port.
* The positions of DP and SP are replaced in response data.
For response (PLC g PC)
The same DP as the one sent by the sender is returned.
3) SP (Source Port)
Requester port No. on the source module. This No. is specified by the requester and fixed to 128 (80h).
For request (PC g PLC)
Fixed to 80h.
* The positions of DP and SP are replaced in response data.
For response (PLC g PC)
SP is any number from 80 to 87h. (The PLC automatically determines an arbitrary No.)
4) Transaction
By specifying Yes/No of transaction, Request/Response, and Transaction ID, you can manage communication sequence on the
personal computer. If you do not need to manage it, set 80H on the PC. The response from the PLC becomes C0H.
Yes/No of transaction must be set by the requester (PC). Transaction ID must be dynamically assigned on the PC side when a
request is issued. The response bit is set by the CPU module when a response is returned.
* The requester (PC) must set the transaction ID and also perform transaction ID collation of response data.
7 0
Yes/No of transaction (0: No, 1: Yes)
Request/Response (0: Request, 1: Response)
Transaction ID (0 to 63)
5) Transmission status
Indicates the result of transmission via the SX bus or network
* Fixed to 00h when a request is issued.
* In a response command, a value other than 00h means abnormal end. The meaning of individual codes is the same as
“operation status”.
App.1-3
6) Operation status
Indicates the result of individual operations requested by a command. It is checked by a response command. A request command
is issued when this item is set to FFh (fixed).
Code Status Description

00h Ended normally Command processing is completed normally.
10h CPU error Command cannot be executed because an error occurred in the CPU.
11h CPU running Command cannot be executed because the CPU is running.
12h Command unexecutable Command cannot be executed due to the key switch condition of the CPU.
20h Undefined command CPU received undefined command or mode.
22h Parameter error Setting error was found in command header part.
23h Transmission interlocked Transmission is interlocked by a command from another device.
28h Processing a command Requested command cannot be executed because another command is now being
executed.
2Bh Another loader processing Requested command cannot be executed because the loader is now performing
another processing (including program change).
2Fh Initialization not competed Requested command cannot be executed because the system is now being initialized.
40h Data setting error Invalid data type or number was specified.
41h Inexistent data Specified data cannot be found.
44h Memory address setting Specified address exceeds the valid range.
error
45h Memory size over Address + the number of read/write words exceed the valid range.
A0h Command send destination No module exists at specified destination station No.
setting error
A2h No response to command No response data is returned from the destination module.
A4h SX bus send error Command cannot be communicated because an error occurred in the SX bus.
A5h SX bus send NAK Command cannot be communicated because NAK occurred while sending data via
the SX bus.
FFh Specification at sending "Operation status" must be set to FF when issuing a request command.
request command
7) Specification of target to connect, connection ID

This item specifies a module as the target of data transmission (the destination for sending a command).
Target module
Connection mode Connection ID (L) Connection ID (H)
of transmission
CPU 0 to CPU 7 7Bh SX bus station No. of destination CPU (FEh to F7h) 00h
P/PE link, FL-net 7Bh SX bus station No. of destination module (F6h to EFh) 00h
8) Command, mode
Command: Major classification code of command
Mode: Detail code of command
For more information on the commands and modes, refer to “Appendix 1-3 Detail Description of Loader Commands."
9) Number of bytes of data part

The number of bytes of a command data part is specified as a four-digit hexadecimal value. Max. 492 bytes = 01ECh. Since a
data part includes information such as a memory type, maximum 486 bytes (234 words) can be actually treated.
App.1-4
Appendix 1-3 Detail Description of Loader Commands

Appendix 1-3-1 Read data
This command is used to read data for the specified number of words from the specified address of the specified data memory.
If the requested number of words to read exceeds the range of the specified memory, the data is read out up to the last address
of the specified memory.
1) Command/mode code
Command: 00h, Mode: 00h
2) Format of the data part of request command and response command
Request data Response data

Memory type Memory type
Memory address (L) Memory address (L)
Memory address (M) Memory address (M)
Memory address (H) Memory address (H)
Number of read words (L) Number of read words (L)
Number of read words (H) Number of read words (H)
Read data
* Set the memory address and number of words of read data in hexadecimal.
3) Layout of read data

Read data is laid out as follows:
MICREX-SX module Personal computer

15 0
12 34 34
56 78 12
78
56
App.1-5
4) Example of data read command
[When D300win is used]
The table below shows the command part for reading two words of data beginning with %MW1.1000 of the standard memory of the
CPU module (CPU station No. 0). (Data in the case of %MW1.1000=WORD#16#1234 and %MW1.1001=WORD#16#5678)
[When Standard loader is used]
The table below shows the command part for reading two words of data beginning with WM1000 of the standard memory of the
CPU module (CPU station No. 0). (Data in the case of WM1000=H1234 and WM1001=H5678.)
Request command Response command

Operation status FF 00
Connection mode 7B 7B
Connection ID (L) FE FE
Connection ID (H) 00 00
Fixed to 11h 11 11
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Command 00 00
Mode 00 00
Fixed to 00h 00 00
Fixed to 01h 01 01
No. of bytes of data part (L) 06 0A
No. of bytes of data part (H) 00 00
Memory type 02 02
Memory address (L) E8 E8
Memory address (M) 03 03
Memory address (H) 00 00
No. of read words (L) 02 02
No. of read words (H) 00 00
– 34
– 12
Read data
– 78
– 56
App.1-6
<Memory type code>
The table below shows the memory type codes for individual MICREX-SX internal memories. (The address expression for
D300win loader/Standard loader)
Target module Memory type Area name Remark

CPU module 02h Standard memory (%MW1.*/WM*)
04h Retain memory (%MW3.*/WL*)
08h System memory (%MW10.*/WSM*)
PE-link module FFh Broadcast area (%MWo.1.*/WMo.*) Note 1
P-link module FFh Broadcast area (%MWo.1.*/WMo.*) Note 2
FL-net module FFh Common memory, etc. (%MWo.1.*/WMo.*)
Note 1: When the broadcast area of a PE-link module is accessed by a command, the address does not begin with 0 (zero).
Refer to the address correspondence table shown below.
Note 2: When the broadcast area of a P-link module is accessed by a command, the high-speed bit area, high-speed word
area, and low-speed word area are not consecutive. Refer to the address correspondence table shown below.
<Address correspondence table for PE-link>
Access from command

Access from application
H M L
%MWo.1.0/WMo.0 00 1E 00
High-speed area 1
| | | |
(high-speed bit area)
%MWo.1.511/WMo.511 00 1F FF
%MWo.1.512/WMo.512 00 20 00
High-speed area 2 | | | |
%MWo.1.8703/WMo.8703 00 3F FF
%MWo.1.8704/WMo.8704 00 40 00
Low-speed area 1 | | | |
%MWo.1.12799/WMo.12799 00 4F FF
%MWo.1.12800/WMo.12800 00 50 00
%MWo.1.25087/WMo.25807 00 7F FF
<Address correspondence table for P-link>
Access from command

Access from application
H M L
%MWo.1.0/WMo.0 00 00 00
High-speed area 1
| | | |
(high-speed bit area)
%MWo.1.511/WMo.511 00 01 FF
%MWo.1.512/WMo.512 00 02 00
High-speed area 2 | | | |
%MWo.1.1663/WMo.1663 00 06 7F
%MWo.1.1664/WMo.1664 00 08 00
%MWo.1.4735/WMo.4735 00 13 FF
%MWo.1.4736/WMo.4736 00 14 00
%MWo.1.7807/WMo.7807 00 1F FF
App.1-7
Appendix 1-3-2 Write data

This command is used to write data for the specified number of words in the area starting from the specified address of the
specified data memory.
Request data Response data

Memory type Memory type
Memory address (L) Memory address (L)
Memory address (M) Memory address (M)
Memory address (H) Memory address (H)
Number of write words (L) Number of write words (L)
Number of write words (H) Number of write words (H)
Write data
* Set the memory address and number of words of write

Request Response
data in hexadecimal.
command command
3) Layout of write data Operation status FF 00
Write data is laid out as follows: Connection mode 7B 7B
MICREX-SX module Personal computer Connection ID (L) FE FE
15 0 Connection ID (H) 00 00
12 34 34
Fixed to 11h 11 11
56 78 12
Fixed to 00h 00 00
78
Fixed to 00h 00 00
56 Fixed to 00h 00 00
Fixed to 00h 00 00
4) Example of data write command
Fixed to 00h 00 00
[When D300win is used]
The table on the right shows the command part for writing Command 01 01
one word of data in the retain memory %MW3.1 of the Mode 00 00
CPU module (CPU station No. 0).
(Write data: WORD#16#1234) Fixed to 00h 00 00
[When Standard loader is used] Fixed to 01h 01 01

The table on the right shows the command part for writing No. of bytes of data part (L) 08 06
one word of data in the retain memory WL1 of the CPU
module (CPU station No. 0).
(Write data: H1234) Memory type 04 04
Memory address (L) 01 01
Memory address (M) 00 00
Memory address (H) 00 00
No. of write words (L) 01 01
No. of write words (H) 00 00
34 –
Write data
12 –
App.1-8
Appendix 1-3-3 CPU batch start

This command is used to start all the CPUs that exist in a configuration in a batch. Each CPU is cold-started or warm-started,
depending on its condition. If a CPU is already started up, or if the key switch is set at "RUN" position, the CPU does not perform
processing for startup, which, however, does not result in an error, and a response is returned normally.
None
3) Batch start command
The table below shows the command part for batch start:

Fixed to 11h 11 11
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Command 04 04
Mode 00 00
Fixed to 00h 00 00
Fixed to 01h 01 01
No. of bytes of data part (L) 00 00
App.1-9
Appendix 1-3-4 CPU batch initialize and start

This command is used to initialize and start all the CPUs that exist in a configuration in a batch. Each CPU is cold-started.
If a CPU is already started up, or if the key switch is set at "RUN" position, the CPU does not perform processing for initialization
and startup, which, however, does not result in an error, and a response is returned normally.
None
3) Batch initialize and start command
The table below shows the command part for batch initialize and start.

Fixed to 11h 11 11
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Command 04 04
Mode 01 01
Fixed to 00h 00 00
Fixed to 01h 01 01
App.1-10
Appendix 1-3-5 CPU batch stop

This command is used to stop all the CPUs that exist in a configuration in a batch.
If a CPU is already stopped, or if the key switch is set at "RUN" position, the CPU does not perform processing for stop, which,
however, does not result in an error, and a response is returned normally.
None
3) Batch stop command
The table below shows the command part for batch stop.

Fixed to 11h 11 11
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Command 04 04
Mode 02 02
Fixed to 00h 00 00
Fixed to 01h 01 01
App.1-11
Appendix 1-3-6 CPU batch reset

This command is used to reset all the CPUs that exist in a configuration in a batch.
This command is executed independent of the setting of the key switch of the CPU.
None
3) Batch reset command
The table below shows the command part for batch reset.

Fixed to 11h 11 11
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Command 04 04
Mode 03 03
Fixed to 00h 00 00
Fixed to 01h 01 01
App.1-12
Appendix 1-3-7 CPU individual start

This command is used to start an arbitrary CPU existing in a configuration by specifying it. The CPU may be cold-started or
warm-started, depending on its condition. An error occurs if the CPU is already started. A target CPU is specified by a connection
mode and connection ID.
None
3) Example of individual start command
The table below shows the command part for individual start (when CPU1 of a multi-CPU system is started):

Fixed to 11h 11 11
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Command 04 04
Mode 04 04
Fixed to 00h 00 00
Fixed to 01h 01 01
App.1-13
Appendix 1-3-8 CPU individual initialize and start

This command is used to initialize and start an arbitrary CPU existing in a configuration by specifying it. The CPU is cold-started.
An error occurs if the CPU is already started or if the key switch is set at "RUN" or "STOP" position. A target CPU is specified by
a connection mode and connection ID.
None
3) Example of individual initialize and start command
The table below shows the command part for individual initialize and start. (when CPU1 of a multi-CPU system is initialized and
started):

Fixed to 11h 11 11
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Command 04 04
Mode 05 05
Fixed to 00h 00 00
Fixed to 01h 01 01
App.1-14
Appendix 1-3-9 CPU individual stop

This command is used to stop an arbitrary CPU existing in a configuration by specifying it. An error occurs if the CPU is already
stopped or if the key switch is set at "RUN" or "STOP" position. A target CPU is specified by a connection mode and connection
ID.
None
3) Example of individual stop command
The table below shows the command part for individual stop. (when CPU1 of a multi-CPU system is stopped):

Fixed to 11h 11 11
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Command 04 04
Mode 06 06
Fixed to 00h 00 00
Fixed to 01h 01 01
App.1-15
Appendix 1-3-10 CPU individual reset

This command is used to reset an arbitrary CPU existing in a configuration by specifying it. An error occurs if the key switch is
set at "RUN" or "STOP" position. A target CPU is specified by a connection mode and connection ID.
None
3) Example of individual reset command
The table below shows the command part for individual reset. (when CPU1 of a multi-CPU system is reset)

Fixed to 11h 11 11
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Fixed to 00h 00 00
Command 04 04
Mode 07 07
Fixed to 00h 00 00
Fixed to 01h 01 01
App.1-16
Appendix 2-1 Overview of Mail Function

The mail function enables you to send a mail from the PLC. A file in a user ROM inserted in the CPU module can be attached.
V**10 or later versions of SPH2000 and all versions of other CPU modules support the mail function. For SX-Programmer
Expert (D300win), V3.4.4.0 or later versions support it.
To use the mail function, you need to uncheck "Mail isn't used" in the system definition and set MAIL_SEND FB by a program.
<Items requiring special attention>

1) You cannot use the mail function together with the redundant function. Since the mail function belongs to the built-in Ethernet,
it is also impossible to use the redundant function with the mail function using an Ethernet module (Type: NP1L-ET1).
2) If you insert a user ROM where a program using a MAIL_SEND FB is stored in a CPU that does not support the mail function
and then download the program to the CPU, note that the CPU will stop with a fatal fault. (The same fault occurs when
downloading the program by SX control utility. Such programs are locked in order not to be downloaded by the load function
of the loader.) Under this condition, the loader may be disconnected.
If the loader is disconnected, turn off the power of the PLC, remove the user ROM, set the key switch to the "STOP" position,
and then turn on the power again. After connecting the loader, set the key switch to the "TERM" position, and then initialize
the resource and download a program.
3) Do not activate multiple MAIL_SEND FBs simultaneously. If multiple MAIL_SEND FBs exist in a program, be sure to activate
the next FB after operation of the preceding FB is completed.
The following figure shows an example of a system configuration when using the mail function.
System configuration when using mail function (example)
Internet service
provider
Proxy Server DNS Server DNS Server SMTP/POP

(Primary) (Secondary) Server
Ethernet
App.2-1
Appendix 2-2 Mail Specifications

The table below shows the mail specifications of the CPU module.
Item Specification
Data transfer method Message + attached file (File in user ROM attached as it is)
No. of attached files 0 or 1
File type No restriction (including *.CSV and *.TXT)
Attached file
File format MIME format, Version 1.0
File division transmission Not supported
SMTP
Transmission system SMTP-AUTH (PLAIN/LOGIN/CRAM-MD5 are supported)
*POP Before SMTP is not supported.
DNS setting 2 (preferred, alternate)

Encryption Not supported
Compression Not supported
Send Supported
Mail send/receive
Receive Not supported
Title 7 bits
Encode Body ISO-2022-JP 7 bits
Attached file Base64
Title 0 to 255 characters
Data size Body 0 to 2047 characters
Attached file Max. 1M bytes (1024 x 1024 = 1048576 bytes)
<Description of terminology>
SMTP (Simple Mail Transfer Protocol):
This is one of the protocols used to send emails.
SMTP-AUTH (SMTP Authentication):
This is a transmission system where the SMTP server performs authentication by itself and mail sending is allowed only
when the authentication is successful. (User ID and password are required.) Examples of user authentication systems are
PLAIN/LOGIN/CRAM-MD5.
"POP Before SMTP" is another system for mail server authentication, which, however, is not supported by the CPU module.
DNS (Domain Name System):
This is a method of converting a domain name into an IP address.
POP Before SMTP:
This is a method of authenticating a sender using POP authentication before a mail is sent. (User ID is required.)
MIME (Multipurpose Mail Extensions):
This is a method of attaching a file to a mail.
Base64:
This is a replacement method used to send attached binary data as text data in a message.
App.2-2
<Additional notes>
1) To use SMTP-AUTH, you need to set the SMTP port No., user ID, and password that are notified by the provider or system
administrator.
2) For SMTP authentication, either authentication system of CRAM-MD5, LOGIN or PLAIN is performed according to the one
attached to a response from the SMTP server to an arbitrary command issue.
If multiple authentication systems are received from the SMTP server, authentication is tried in order of CRAM-MD5, LOGIN,
and PLAIN to select a matching system to use.
Contact the provider or system administrator for which authentication system is supported by the SMTP server to be used.
3) The built-in Ethernet has no function of automatically obtaining an IP address. You need to assign a fixed IP address using
a router, for example.
App.2-3
Appendix 2-3 Programming for Sending Mails

Appendix 2-3-1 Setting System Definition
To use the mail function, set the following items in the system definition.
• Local station IP address
• Local station mail address
• DNS server IP address, SMTP server address (domain name or IP address)
• User ID, password (only when authentication by the mail server is required by SMTP-AUTH)
* When setting or changing the system definition, be sure to download the system definition and reset the CPU (or turn on and
off the power.)
<Setting procedure>
Open the "Module properties" dialog box of the CPU module, click "Parameter," and then click the "IP-address/Gateway
setting" tab. The following screen opens.
Set the IP address and subnet mask. If necessary, also set the default gateway IP-address.
To specify an SMTP server address as a domain name, set the IP address of the DNS server.
Uncheck "Mail isn't used," and then click the "Mail Setting" button.
* The factory default setting is as follows:

IP address: 192.168.0.1
Subnet mask: 255.255.255.0
Default gateway IP-address: 0.0.0.0 (blank)
DNS server address (Preferred) and (Alternate): 0.0.0.0 (DNS server is disabled.) (blank)
Mail isn't used: Checked
App.2-4
The "Mail setting" dialog box opens. Click the "Base Setting" tab and set the mail address (local station mail address) and
SMTP server address.
1) Mail address: Max. 127 characters

2) SMTP server (Transmission): Max. 127 characters when specified as a domain name.
SMTP server can also be specified as an IP address. In this case, you do not need to set the DNS server address.

Mail address: "0" (blank)
SMTP server: "0" (blank)
App.2-5
Next, click the "Detail" tab and set the server port number and, if necessary, the user ID and password for SMTP
authentication.
1) Server port number: Set the port No. of the SMTP server. The setting range is from 1 to 65535.
The default value "25" is normally used.
To perform SMTP-AUTH authentication, use the port No. (normally 587) notified by the provider or system administrator.
The set No. is the actual port No. However, the following numbers are not available.
• 20 and 21 (used by FTP)
• Self port standard No. + 251 and self port standard No. + 253 (used for loader command communication)
Since the default of the self port standard No. is 256, the actual port Nos. are as follows:
256 + 251 = 507 and 256 + 253 = 509
2) Use SMTP Auth: Check this checkbox to perform authentication by SMTP-AUTH. In this case, be sure to set the ID and
password, which is described in the next paragraph.
3) User ID, Password: Set the user ID (max. 63 characters) and password (max. 63 characters) for SMTP authentication.

Server port number: "25"
Use SMTP Auth: Not checked
User ID: "0" (blank)
Password: "0" (blank)
App.2-6
<Relation between SMTP server and DNS server>
When sending mails (MAIL_SEND FB is activated), the PLC connects to (communicates with) the SMTP server. Specify the
SMTP server name as an IP address or domain name. (IP address setting is preferred.)
1) When the SMTP server is specified as an IP address, the PLC connects to this IP address. (The DNS server setting is
ignored.)
1) When the SMTP server is specified as a domain name (IP address setting of the DNS server is required), the PLC makes
inquiry to the DNS server (in order of “Preferred” and “Alternate”) to obtain an SMTP server IP address that corresponds to
the domain name of the SMTP server.
Inquiry to DNS
about SMTP server IP address
Response about IP address

from SMTP server
* When the SMTP server is specified as a domain name, the PLC makes inquiry to the DNS preferred server first. If the DNS
preferred server fails to return a response, the PLC makes inquiry to the DNS alternate server after approximately 30 seconds.
If the DNS alternate server also fails to return a response, the MAIL_SEND FB ends abnormally after another approximately
30 seconds (Status: 195, Substatus: 22).
App.2-7
Appendix 2-3-2 Creating a program

The MAIL_SEND FB is used to send a mail from a PLC. A file can be attached (one desired file in a user ROM). One or more
destinations can be designated.
However, be sure not to activate multiple MAIL_SEND FBs simultaneously. When there are various patterns of destination, title,
and message, it is recommended to use one MAIL_SEND FB and change the input contents of the FB before activating it by an
application.
If multiple FBs are activated simultaneously, the operation becomes as follows.
• When 16 or less MAIL_SEND FBs including FBs related to FTP or SNTP (*) are activated simultaneously:
The first activated MAIL_SEND instruction is executed normally.
The second or later instructions end abnormally (Status: 195, Substatus: 9).
• When 17 or more MAIL_SEND FBs including FBs related to FTP or SNTP (*) are activated simultaneously:
The first activated MAIL_SEND instruction is executed normally.
The 16th or earlier instructions end abnormally (Status: 195, Substatus: 9).
The 16th or earlier instructions end abnormally (Status: 201, Substatus: 0).
* FTP-related FBs: FTP_OPEN, FTP_PUT, FTP_GET, FTP_CREATE_DIR, and FTP_DELETE_FILE
SNTP-related FBs: SNTP_CLIENT
(1) FB format
MAIL_SEND_
Data type Data type
MAIL_SEND
BOOL REQ DONE BOOL
UINT MODE STATUS INT
SUB_STATUS UDINT
TO:ARRAY[1..N]OF WORD; SEND_TO SEND_TO TO
SUBJ:ARRAY[1..N]OF WORD; SUBJECT SUBJECT SUBJ
MSG:ARRAY[1..N]OF WORD; MESSAGE MESSAGE MSG

FILE:ARRAY[1..N]OF WORD; FILE_NAME FILE_NAME FILE
UDINT SIZE LOG_SIZE UDINT
LOG:ARRAY[1..N]OF WORD; LOG_DATA LOG_DATA LOG
App.2-8
Terminal function Terminal name Applicable I/O Description

name (parameter) data type
Mail send request REQ BOOL IN A mail is sent to the destination at the rising edge of
this signal (0 to 1).
Transmission MODULE_NO UINT IN Specifies the SX bus station No. of the transmission
source module No. source module. When sending a mail from CPU0,
set this terminal to UINT#254.
Mode MODE UINT IN Fixed to zero.

Destination SEND_TO WORD-type array IN-OUT Specify a destination address.
(Note 2) To designate multiple addresses, separate them
by a comma (,).
A maximum 2047 characters in total of addresses
and commas can be set.
Subject SUBJECT WORD-type array IN-OUT Enter a subject.

(Note 3) A maximum of 255 characters can be set.
Body MESSAGE WORD-type array IN-OUT Enter a mail body.
(Note 4) A maximum 2047 characters can be set.
Attached file path FILE_NAME WORD-type array IN-OUT Enter a path (folder) name and file name of an attached
name (Note 5) file.
A maximum of 255 characters can be set.
The maximum size of an attached file is 1MB.
Size SIZE UDINT IN Specifies the array size of log data (LOG_DATA).
Log data LOG_DATA WORD-type array IN-OUT This is an array for storing logs when sending a mail.
or DINT-type array,
WORD
(Note 6)
Mail send end DONE BOOL OUT Turns ON for one scan when the sending is completed
normally.
Mail send error ERROR BOOL OUT Turns ON for one scan when the sending ends
abnormally.
Error status STATUS INT OUT Outputs an error code.
Substatus SUB_STATUS UDINT OUT Outputs the detail code of the error status.
(This terminal is enabled when the sending ends
abnormally and outputs zero when completed normally.)
Log buffer size LOG_SIZE UDINT OUT Outputs the number of words of output data of the log
buffer.
Note 1: Connect a WORD-type array to "SEND_TO/SUBJECT/MESSAGE/FILE_NAME/LOG_DATA" and specify them as a

ASCII code. (For LOG_DATA, a WORD-type variable or DINT-type array can also be set.) These variables must be
assigned to the local variable.
When setting "SEND_TO/SUBJECT/MESSAGE/FILE_NAME" terminals, set data "00h" after the last data. Data after
the data "00h" are ignored. If the STR_TO_SJ instruction is used, 00h is automatically added after the last data of a
WORD-type array.
Do not change “SEND_TO/SUBJECT/MESSAGE/FILE_NAME” during FB processing. Otherwise, the send data is not
guaranteed.
Note 2: About the “SEND_TO” terminal
If no character is entered in SEND_TO (destination), an error occurs
Note 3: About the “SUBJECT” terminal
SUBJECT (subject) is optional. (However, be sure to connect a WORD-type array variable.) In this case, set “0000h” at
the top of the WORD array. It is treated as “no subject” and only a line feed code is sent. However, on the reception
side, “no subject” is added depending on the mail software.
If a line feed code is entered in the middle of SUBJECT, characters just before the line feed code and the line feed
code are sent.
App.2-9
Note 4: About the "MESSAGE" terminal
MESSAGE (message) is optional. (However be sure to connect a WORD-type array variable.) In this case, set "0000h"
at the top of the WORD array. It is treated as "no message" and only a line feed code is sent.
If line feed codes are entered in the middle of MESSAGE, they are also sent as data.
Note 5: About the "FILE_NAME" terminal
FILE_NAME (attached file name) is optional. (However be sure to connect a WORD-type array variable.) In this case,
set “0000h” at the top of the WORD array. It is treated as “no attached file.”
Note 6: About the “LOG_DATA” terminal
To store send data as a log, connect an array. When storing logs in a user ROM by using the F_APPEND FB, connect a
DINT-type array. When logs are not necessary, connect a WORD-type variable (array is also connectable) and set “SIZE”
to 0 (zero).
< Formula for calculating array size>

The size required for an array can be calculated as follows:
Supposing the total number of bytes of characters is “L,”
Array size = (L + 1) ÷ 2
* The number of bytes of characters is calculated as 1 character = 1 byte.

If indivisible, round up digits after the decimal point.

1) A mail is sent at the rising edge of “REQ.”
2) When the mail is sent to the SMTP server normally, “DONE” is set ON for one scan. (This only indicates that the mail has
been sent to the SMTP server. Whether or not the mail has reached the final destination is not confirmed.)
If the mail is not sent to the SMTP server normally, “ERROR” is set ON for one scan, and the corresponding error code is
outputted to “STATUS” and the corresponding detail code to “SUB_STATUS.” (Zero is outputted when the mail is sent
normally.)
If an additional “REQ” instruction is set ON before “DONE” or “ERROR” is set ON, it is ignored.
3) Data that has been sent to the SMTP server is outputted to “LOG_DATA” as a send log. If an error occurs while sending a
mail to the SMTP server, data sent before the error occurs is outputted to “LOG_DATA.”
Since all the contents of the mail are outputted to “LOG_DATA,” an array of sufficient size must be prepared.
“LOG_DATA” is updated to (overwritten by) the latest information at the timing when “DONE” or “ERROR” is set ON. Store
the old logs by an application program as needed.
Note 1: Do not activate multiple MAIL_SEND FBs simultaneously. If the program contains multiple MAIL_SEND FBs, activate
the next FB after the operation of the previous FB is completed.
Other FBs including FTP or SNTP are available even when a MAIL_SEND FB is activated.
Note 2: Sending is not completed within one scan. It may take several seconds depending on the size of an attached file or
whether the destination SMTP server is on the same network. It may also take approximately one second for the sending
to end abnormally due to an error in the DNS server or SMTP server.
To monitor time to complete instruction execution by an application, perform an experiment with the actual device to
measure communication time before determining the monitoring time.
Note 3: The MAIL_SEND FB checks completion of an instruction for every instruction execution. When the MAIL_SEND FB is
used in an interruption or periodic task, note that neither the bit for normal end nor bit for abnormal end is not set ON
even after communication ends. Either of the bits is set ON when the next task is executed. It is recommended to use
the MAIL_SEND FB in the default task
Note 4: The number of characters that can be treated in a row and operation when the number of characters in a row exceeds
the limit vary depending on the SMTP server (specifications on the SMTP server side). Therefore, if a long message
without line feed codes is entered in “MESSAGE (message),” the transmission destination may not be able to receive it
correctly. It is recommended to use line feed codes properly.
Note 5: The send date and time displayed on the transmission destination is the time of the PLC internal calendar that is
automatically set for the mail header. Set the PLC internal calendar correctly and adjust the time using the “SMTP server
function,” for example.
App.2-10
<Example of a log>
The following shows an example of a log file that is written to a user ROM using the F_APPEND FB and opened in a text editor
such as the notepad.
Example)
Send Time:2007/06/05 10:20:30
From:[email protected]
To:[email protected],[email protected]
Subject:Error contents
Message:Nonfatal fault = 100
File:Error100.csv
<Formula for calculating log size>

The log size is the total of the following items. The log buffer capacity (array size of LOG_DATA) must be more than the log size.
If the actual log size exceeds the log buffer capacity, the exceeding data is discarded.
Item Formula (byte)

Indication in log
Date and time Send time: 10 + 19 + 2 (line feed code)
Sender From: 5 + Local station mail address (max. 127) + 2 (line feed code)
Destination To: 3 + Destination mail address (max. 255) + 2 (line feed code)
Subject Subject: 8 + Subject (max. 255) + 2 (line feed code)
Message Message: 8 + Message (max. 2047) + 2 (line feed code)
Attached file File: 5 + Name of attached folder/file (max. 255) + 2 (line feed code)
The number of bytes of characters is calculated as 1 character = 1 byte.

Max. size of log data = 1505 words (3009 bytes; One byte is used for boundary adjustment.)
<Operation of a log>
In SIZE, specify the same number as the log buffer capacity (array size of LOG_DATA).
If SIZE is greater than the log buffer capacity, another memory is rewritten.
If SIZE is smaller than the log buffer capacity and the actual log exceeds SIZE, output to the log is limited to the number of
words specified in SIZE.
If an error occurs while sending a mail to the SMTP server, data sent before the error occurs is outputted to the log. For example,
if an error occurs while sending “destination (To),” data up to “sender (From)” are valid. Data after it are not stored.
In addition, if an error occurs before connecting to the SMTP server (e.g. parameter error), no data is stored in a log. If neither
“Subject (subject),” “mail body (message),” nor “Attached file (File)” is entered, each title and line feed codes are stored.
App.2-11
(4) Status list
Error Error Description Cause Sub status

code code
65 File path name error The specified file or folder does not exist. 13
66 File access error An error occurred while a file in the user ROM was being accessed. 18
177 Parameter error A value out of the The number of characters of the destination address 32
specified range was characters exceeds the limit (max. 255 characters).
entered.
The number of characters of the subject characters 33
exceeds the limit (max. 255 characters).
The number of characters of the message exceeds 34

the limit (max. 2047 characters).
The number of characters of the path name of the 35

attached file exceeds the limit (max. 255 characters).
A number other than the local station No. (254 for 36

CPU0) is specified for MODULE_NO.
A value other than 0 (zero) is specified for MODE. 37
No character is specified for the destination. 38
Address range error of the destination, subject, 0

message, file path name, or log buffer variable
(The range is exceeded or the variable is assigned
to the global memory.)
195 SMTP communication Communication with An error occurred on the network during command 20 (Note 1)
error the NTP server was communication.
failed.
Acquisition of the internal work memory was failed. 11 (Note 2)
Data connection was failed. 9 (Note 3)
A timeout occurred. (30 seconds or more have 10
passed.)
SMTP authentication Authentication of the SMTP server was failed. User ID or password is wrong. 60 (Note 4)
error
DNS communication Communication with the DNS server was failed. 22 (Note 5)
error
Attached file size error The size of an attached file exceeds the limit (max. 1MB). 50
System definition error Mail setting is not performed in the system definition. 51 (Note 6)
201 Resource full Acquisition of the internal memory was failed when the FB is executed. 0 (Note 7)
App.2-12
Note 1: Even if the specified destination address does not exist, the sending may be completed normally depending on the
SMTP server. (specifications on the SMTP server.)
Example 1: A mail with only one destination address was sent. However, the address does not exist actually.
Example 2: A mail with multiple destination addresses was sent. However, one of them does not exist.
Note 2: This error occurs when the internal memory (different from the user memory) shared in the CPU module is insufficient.
This error usually does not occur, however, if it occurs, contact Fuji Electric.
Note 3: The following factors can be considered.

• The setting of SMTP server IP address is wrong.
• The SMTP server is specified as a domain name, however, the DNS server is not set.
• The CPU is set to redundant mode.
Note 4: "Use SMTP Auth” is selected, however, the SMTP server supports none of the following SMTP-AUTH authentication
methods: PLAIN, LOGIN, or CRAM-MD5, or authentication of the SMTP server is nor required.
Note 5: No response has been returned from the DNS server (preferred/alternate) for 60 seconds.
Note 6: The following factors can be considered.

• The mail setting is not performed in the system definition. The system definition is not yet downloaded to the CPU.
The CPU is not yet reset after the system definition is downloaded.
• “Use SMTP Auth” is selected, however, no user ID and password is set.
• The system definition with mail setting is downloaded to a model that has no built-in Ethernet (NP1PM-48R).
Note 7: This error occurs 17 or more MAIL_SEND FBs (including FBs related to FTP or SNTP) are simultaneously activated.
App.2-13
Appendix 2-4 Sample Program

Appendix 2-4-1 Mail sending (no log)
<Array declaration>
<Variable declaration>
<Program>
<Description of the program>

This program converts the destination, subject, and message into word-type arrays and passes them to the MAIL_SEND FB.
Since no file is attached, the first word of the array to which FILE_NAME is connected must be set to 0 (zero).
Since the log is not used, set SIZE to 0 and connect a word-type variable to LOG_DATA.
The MAIL_SEND FB is activated at the rising edge of a “mail send request” variable and the mail is sent to the SMTP server.
When the MAIL_SEND FB is completed normally, “Normal end” is set ON for one scan. To confirm that “Normal end” is set ON,
a set coil is used.
App.2-14
Appendix 2-4-2 Mail sending (with attached file and log)

<Preparation of user ROM>
You need to format a user ROM in advance using the memory card utility function in D300win so that the PLC can use it. When
the PLC is powered on and off with a user ROM inserted, the program memory in the PLC is overwritten with the contents of the
user ROM. Since there is no program in a user ROM formatted by D300, the program in the PLC will be lost. Therefore, be sure
to download a program to the user ROM.
Next, create an attached file and a folder for log files in the user ROM, and then store the attached file in the attached file folder.
<Procedure>
1) Connect the user ROM to your personal computer via a commercially available PC card adapter or card reader/writer.
2) In the "Extras" menu, click "Memory Card Utility," and then click "User ROM." In the "User ROM" screen, click the
"Maintenance" tab. Select the drive where the user ROM is connected for the drive and "FAT" for the file system, and then
format the user ROM.
* Be careful not to format the hard disk of your personal computer by mistake.
3) Select the "Download" tab to download the project.
4) Open the folders in the user ROM in Explorer and create a folder for attached files and a folder for logs as shown below.
(Match the folder names with the program.) Then, put the attached file in the folder for attached files.
App.2-15
<Registering user ROM card expansion FB in the library>
In this sample program, contents of the logs in the user ROM are stored using the _F_APPEND FB that is one of the User ROM
card expansion FBs. (Since a log is outputted as an ASCII code, there is no need to use an FB related to CSV file writing). To
use this FB, you need to register the user ROM card expansion FB in the library.
<Procedure>
Start the installation CD of D300win, and then select “CSV interface FB setup” to install the library to your personal computer.
Next, start D300win and register “FileCsvInterface” in the library.
<Array declaration>
<Variable declaration>
App.2-16
<Program>
<Description of the program>

This program converts the destination, subject, message, and attached file into word-type arrays and passes them to the
MAIL_SEND FB.
The MAIL_SEND FB is activated at the rising edge of the “mail send request” variable to send the mail and attached file (a file
named “DATA01.TXT” in a folder named “MailSend_Folder” in the user ROM) to the SMTP server.
When the MAIL_SEND FB is completed normally, “DONE” is set ON for one scan. To confirm that “DONE” is set ON, a set coil
is used. Set the “mail send request” variable OFF.
The log is saved as “LOG01.TXT” in a folder named “MailLog_Folder” in the user ROM by the _F_APPEND FB (_F_APPEND
can store data up to 1000 words for one instruction).
When _F_APPEND is completed normally, "Log normal end" is set ON for one scan. To confirm that “Normal end” is set ON, a
set coil is used.
Set the “Normal end reset” variable ON to reset “Normal end”.
Set the “Log normal end reset” variable ON to reset “Log normal end”.
App.2-17
Appendix 2-5 Mail Function Execution Time

<Effects on program execution time>
Effects of the MAIL_SEND FB on program execution time vary depending on the operation status of the FB and the status of the
CPU internal memory.
The table below shows the values when the FB operates at the highest speed.
Operation status Processing speed

When there is no send request Approx. 1µs
When send request is being activated Approx. 15µs
During send processing Approx. 1µs
When sending is completed Approx. 5µs
* The MAIL_SEND FB does not end within one scan.
<Time required to send a mail>

Time required to send a mail is affected by the following factors: the number of characters of a subject and message, the size of
an attached file, whether or not SMTP authentication is performed, the response time of the SMTP server, and the status of the
network.
The table below shows reference values obtained under a condition that the mail function is executed at a relatively high speed.
For the time, an actual measurement values required from setting ON of the mail send request (REQ) to normal completion of
the mail sending (DONE) are shown.
Item Condition
Bus tact 1ms
• In-house LAN server
SMTP server
• No SMTP authentication
Subject None (0 character) 255 characters
Message None (0 character) 2047 characters
Attached file None (0 byte)) 1M byte
Measurement value Approx. 0.25s Approx. 65s
App.2-18
Appendix 3 Notes on Module Replacement
Appendix 3-1 Aging Time

Some Ethernet devices (hub, router, and opposite device) store the MAC address of a communication partner once
communication starts. (Each Ethernet device has a different MAC addresses, which is like a serial number.)
If a device (hub or router) that has such a specification is connected between the CPU module and the opposite device, or the
opposite device has such a specification, communication may be failed when the CPU module is replaced (MAC address is
changed) after starting normal operation.
The reason is that the Ethernet device (or a hub or router connected in-between) stores the MAC address of the communication
partner (learning function). Since it is held for a certain period of time even after the communication partner stops communication
or does not exist, communication with a different MAC address is failed. This period is referred to as “Aging Time.”
This condition occurs when Ethernet built-in CPU is in passive open mode (Unpassive/Fullpassive) in TCP/IP communication or
communication begins with receiving operation in UDP/IP communication. In these cases, the communication partner performs
sending (or opening) operation first. Therefore, if the CPU module is replaced and the MAC address is changed, communication
is failed.
When Ethernet built-in CPU is in active open mode in TCP/IP communication or communication begins with receiving operation
in UDP/IP communication, the local station performs sending (or opening) operation first to rewrite the MAC address that is
stored in the communication partner. Therefore, communication can be performed.
The above condition where communication is failed is reset after “Aging Time” passes or when the power of the opposite device (or
a hub or router connected in-between) is turned ON and OFF.
<FYI>
The aging time of the Ethernet built-in CPU is one minute (fixed). For information on the aging time of the opposite device,
contact the maker. The aging time of hubs is commonly set to approximately 5 minutes.
App.3-1
Appendix 4 Receive Data Packet Merging Phenomenon
Appendix 4-1 Receive Data Packet Merging Phenomenon

<Overview>
When data is received via Ethernet, the send data length of an external device may not match the receive data length of the
PLC depending on the usage.
This phenomenon occurs only in “General Purpose Communication mode”, not in “Fixed Buffer Communication mode” or
“Loader Command mode.”
How the phenomenon occurs and how to handle it are the same as those in Ethernet modules. For more information, refer to
user’s manual “Ethernet Interface Module (FEH259).”
App.4-1
Appendix 5 IP Address Setting
Appendix 5-1 IP Address Setting

<Overview>
To use Ethernet, set the IP address of the local station. The default is “192.268.0.1.”
When adding Ethernet to a system that has already been operating such as an in-house LAN, you need to consult the network
administrator to assign an IP address.
When Ethernet is used in a close network where a PLC or POD is connected via a hub, the user can set an desired IP address.
In this case, 192.168.0.o (o = 1 to 254) is commonly used. Set the IP addresses so as not to overlap between devices.
In the case of TCP/IP communication, there are available and unavailable addresses.
The available addresses are as follows:
1.*.*.* to 126.*.*.* (IP address called class A)
However, it is not possible to set all the asterisks to 0 or 255.
For UDP/IP communication, an IP address where all the asterisks are set to 255 is reserved for broadcast.
128.1.*.* to 191.254.*.* (IP address called class B)

However, it is not possible to set all the asterisks to 0 or 255.
For UDP/IP communication, an IP address where all the asterisks are set to 255 is reserved for broadcast.
192.0.1.* to 223.255.254.* (IP address called class C)

However, it is not possible to set the asterisk to 0 or 255.
For UDP/IP communication, an IP address where the asterisk is set to 255 is reserved for broadcast.
Addresses other than the above are not available in TCP/IP communication.
<FYI>
224.0.0.0 to 239.255.255.255 (IP called class D)
IP address for IP multicast in UDP/IP communication
240.0.0.0 to 255.255.255.255 (IP called class E)

IP address reserved for an experiment on IP
Do not use this IP address.
App.5-1
Fuji Electric Co., Ltd.
Gate City Ohsaki, East Tower,
11-2, Osaki 1-chome, Shinagawa-ku, Tokyo 141-0032, Japan
E-mail: [email protected]
URL: https://www.fujielectric.com/
Materials covered in this document are subject to revision due to the modification of the product.

FEH193 All Zrqs1kruxr

Uploaded by

Document Informationclick to expand document information

Document Informationclick to expand document information

Copyright:

Available Formats

FEH193 All Zrqs1kruxr

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

FEH193 All Zrqs1kruxr

Uploaded by

Copyright:

Available Formats

series

SPH Series CPU Module with Built-In Ethernet

Title Manual No. Contents

<Related manuals for SX-Programmer Expert (300win)>

Title Manual No. Contents

<Related manuals for SX-Programmer Standard>

Title Manual No. Contents

* This manual is available for both D300win and Standard loader.

Even some items indicated by "Caution" may result in a serious accident.

Printed on * Manual No. Revision contents

Jan. 2006 FEH193 First edition

Sep. 2023 FEH193e • Name of this manual was changed.

Section 3 Mounting Modules

Section 4 Communication Procedures

Section 5 SNTP Client and FTP Client Communication

Section 6 Ethernet Communication Information

Appendix 1 Loader Command

Appendix 2 Mail Function

Appendix 3 Notes on Module Replacement

Appendix 4 Receive Data Packet Merging Phenomenon

Appendix 5 IP Address Setting

1-1 Overview of Ethernet Communication using a CPU with Built-In Ethernet

Ethernet node of another company

Programming loader for SX

Ethernet built in CPU Ethernet interface module

<Supported versions of programming loader>

Supported loader version

<General notes on Ethernet>

* Ethernet is a registered trademark of U.S. based Xerox Corp.

2-1 Transmission Specifications

Performs communication between SX_CPU and other nodes, using TCP/IP or

* Ethernet transmission frame

Destination Source MAC ...

6 bytes 6 bytes 2 bytes ... ...

2-1-2 Communication ports of module

Communication No. of Connection

(2) Control of communication ports

2-2 Communication Functions

2-2-1 General Purpose Communication mode

<Features of General Purpose Communication mode>

Send data PLC from other

2-2-2 Fixed Buffer Communication mode

<Features of Fixed Buffer Communication mode>

MICREX-SX Ethernet built in CPU

Dedicated buffer 1 Dedicated buffer 8

Send Receive Send Receive

2-2-3 Loader Command Communication mode

Communication mode General purpose

<Features of Loader Command Communication mode>

Depending on the application Communi- Communi-

Data read: R_READ FB

2-2-4 FTP server mode

* Number of FTP server control connections: 4

(1) FTP access control command

Command Description Support Note

USER NAME Authentication username

PASSWORD Authentication password

ACCOUNT Account information