MELSEC iQ-R Ethernet

User's Manual (Application)

-RJ71EN71
-R00CPU
-R01CPU
-R02CPU
-R04CPU
-R04ENCPU
-R08CPU
-R08ENCPU
-R08PCPU
-R08PSFCPU
-R08SFCPU
-R16CPU
-R16ENCPU
-R16PCPU
-R16PSFCPU
-R16SFCPU
-R32CPU
-R32ENCPU
-R32PCPU
-R32PSFCPU
-R32SFCPU
-R120CPU
-R120ENCPU
-R120PCPU
-R120PSFCPU
-R120SFCPU
SAFETY PRECAUTIONS
(Read these precautions before using this product.)
Before using this product, please read this manual and the relevant manuals carefully and pay full attention to safety to handle
the product correctly.
The precautions given in this manual are concerned with this product only. For the safety precautions of the programmable
controller system, refer to the MELSEC iQ-R Module Configuration Manual.
In this manual, the safety precautions are classified into two levels: " WARNING" and " CAUTION".

Indicates that incorrect handling may cause hazardous conditions, resulting in

WARNING death or severe injury.

Indicates that incorrect handling may cause hazardous conditions, resulting in

CAUTION minor or moderate injury or property damage.

Under some circumstances, failure to observe the precautions given under " CAUTION" may lead to serious
consequences.
Observe the precautions of both levels because they are important for personal and system safety.
Make sure that the end users read this manual and then keep the manual in a safe place for future reference.

1
 [Design Precautions]
WARNING
● Configure safety circuits external to the programmable controller to ensure that the entire system
operates safely even when a fault occurs in the external power supply or the programmable controller.
Failure to do so may result in an accident due to an incorrect output or malfunction.
(1) Emergency stop circuits, protection circuits, and protective interlock circuits for conflicting
operations (such as forward/reverse rotations or upper/lower limit positioning) must be configured
external to the programmable controller.
(2) When the programmable controller detects an abnormal condition, it stops the operation and all
outputs are:
• Turned off if the overcurrent or overvoltage protection of the power supply module is activated.
• Held or turned off according to the parameter setting if the self-diagnostic function of the CPU
module detects an error such as a watchdog timer error.
(3) All outputs may be turned on if an error occurs in a part, such as an I/O control part, where the
CPU module cannot detect any error. To ensure safety operation in such a case, provide a safety
mechanism or a fail-safe circuit external to the programmable controller. For a fail-safe circuit
example, refer to "General Safety Requirements" in the MELSEC iQ-R Module Configuration
Manual.
(4) Outputs may remain on or off due to a failure of a component such as a relay and transistor in an
output circuit. Configure an external circuit for monitoring output signals that could cause a
serious accident.
● In an output circuit, when a load current exceeding the rated current or an overcurrent caused by a
load short-circuit flows for a long time, it may cause smoke and fire. To prevent this, configure an
external safety circuit, such as a fuse.
● Configure a circuit so that the programmable controller is turned on first and then the external power
supply. If the external power supply is turned on first, an accident may occur due to an incorrect output
or malfunction.

2
[Design Precautions]
WARNING
● For the operating status of each station after a communication failure, refer to manuals for the network
used. For the manuals, please consult your local Mitsubishi representative. Incorrect output or
malfunction due to a communication failure may result in an accident.
● When connecting an external device with a CPU module or intelligent function module to modify data
of a running programmable controller, configure an interlock circuit in the program to ensure that the
entire system will always operate safely. For other forms of control (such as program modification,
parameter change, forced output, or operating status change) of a running programmable controller,
read the relevant manuals carefully and ensure that the operation is safe before proceeding. Improper
operation may damage machines or cause accidents.
● Especially, when a remote programmable controller is controlled by an external device, immediate
action cannot be taken if a problem occurs in the programmable controller due to a communication
failure. To prevent this, configure an interlock circuit in the program, and determine corrective actions
to be taken between the external device and CPU module in case of a communication failure.
● Do not write any data to the "system area" and "write-protect area" of the buffer memory in the
module. Also, do not use any "use prohibited" signals as an output signal from the CPU module to
each module. Doing so may cause malfunction of the programmable controller system. For the
"system area", "write-protect area", and the "use prohibited" signals, refer to the user's manual for the
module used. For areas used for safety communications, they are protected from being written by
users, and thus safety communications failure caused by data writing does not occur.
● If a communication cable is disconnected, the network may be unstable, resulting in a communication
failure of multiple stations. Configure an interlock circuit in the program to ensure that the entire
system will always operate safely even if communications fail. Failure to do so may result in an
accident due to an incorrect output or malfunction. When safety communications are used, an
interlock by the safety station interlock function protects the system from an incorrect output or
malfunction.

3
 [Design Precautions]
CAUTION
● Do not install the control lines or communication cables together with the main circuit lines or power
cables. Doing so may result in malfunction due to electromagnetic interference. Keep a distance of
100mm or more between those cables.
● During control of an inductive load such as a lamp, heater, or solenoid valve, a large current
(approximately ten times greater than normal) may flow when the output is turned from off to on.
Therefore, use a module that has a sufficient current rating.
● After the CPU module is powered on or is reset, the time taken to enter the RUN status varies
depending on the system configuration, parameter settings, and/or program size. Design circuits so
that the entire system will always operate safely, regardless of the time.
● Do not power off the programmable controller or reset the CPU module while the settings are being
written. Doing so will make the data in the flash ROM undefined. The values need to be set in the
buffer memory and written to the flash ROM again. Doing so also may cause malfunction or failure of
the module.
● When changing the operating status of the CPU module from external devices (such as the remote
RUN/STOP functions), select "Do Not Open by Program" for "Opening Method" of "Module
Parameter". If "Open by Program" is selected, an execution of the remote STOP function causes the
communication line to close. Consequently, the CPU module cannot reopen the line, and external
devices cannot execute the remote RUN function.

[Security Precautions]
WARNING
● To maintain the security (confidentiality, integrity, and availability) of the programmable controller and
the system against unauthorized access, denial-of-service (DoS) attacks, computer viruses, and other
cyberattacks from external devices via the network, take appropriate measures such as firewalls,
virtual private networks (VPNs), and antivirus solutions.

4
[Installation Precautions]
WARNING
● Shut off the external power supply (all phases) used in the system before mounting or removing the
module. Failure to do so may result in electric shock or cause the module to fail or malfunction.

[Installation Precautions]
CAUTION
● Use the programmable controller in an environment that meets the general specifications in the Safety
Guidelines included with the base unit. Failure to do so may result in electric shock, fire, malfunction,
or damage to or deterioration of the product.
● To mount a module, place the concave part(s) located at the bottom onto the guide(s) of the base unit,
and push in the module until the hook(s) located at the top snaps into place. Incorrect interconnection
may cause malfunction, failure, or drop of the module.
● When using the programmable controller in an environment of frequent vibrations, fix the module with
a screw.
● Tighten the screws within the specified torque range. Undertightening can cause drop of the
component or wire, short circuit, or malfunction. Overtightening can damage the screw and/or module,
resulting in drop, short circuit, or malfunction.
● When using an extension cable, connect it to the extension cable connector of the base unit securely.
Check the connection for looseness. Poor contact may cause malfunction.
● When using an SD memory card, fully insert it into the SD memory card slot. Check that it is inserted
completely. Poor contact may cause malfunction.
● Securely insert an extended SRAM cassette or a battery-less option cassette into the cassette
connector of the CPU module. After insertion, close the cassette cover and check that the cassette is
inserted completely. Poor contact may cause malfunction.
● Do not directly touch any conductive parts and electronic components of the module, SD memory
card, extended SRAM cassette, battery-less option cassette, or connector. Doing so can cause
malfunction or failure of the module.

[Wiring Precautions]
WARNING
● Shut off the external power supply (all phases) used in the system before installation and wiring.
Failure to do so may result in electric shock or cause the module to fail or malfunction.
● After installation and wiring, attach a blank cover module (RG60) to each empty slot and an included
extension connector protective cover to the unused extension cable connector before powering on the
system for operation. Failure to do so may result in electric shock.

5
 [Wiring Precautions]
CAUTION
● Individually ground the FG and LG terminals of the programmable controller with a ground resistance
of 100 ohms or less. Failure to do so may result in electric shock or malfunction.
● Use applicable solderless terminals and tighten them within the specified torque range. If any spade
solderless terminal is used, it may be disconnected when the terminal screw comes loose, resulting in
failure.
● Check the rated voltage and signal layout before wiring to the module, and connect the cables
correctly. Connecting a power supply with a different voltage rating or incorrect wiring may cause fire
or failure.
● Connectors for external devices must be crimped or pressed with the tool specified by the
manufacturer, or must be correctly soldered. Incomplete connections may cause short circuit, fire, or
malfunction.
● Securely connect the connector to the module. Poor contact may cause malfunction.
● Do not install the control lines or communication cables together with the main circuit lines or power
cables. Doing so may result in malfunction due to noise. Keep a distance of 100mm or more between
those cables.
● Place the cables in a duct or clamp them. If not, dangling cables may swing or inadvertently be pulled,
resulting in malfunction or damage to modules or cables.
In addition, the weight of the cables may put stress on modules in an environment of strong vibrations
and shocks.
Do not clamp the extension cables with the jacket stripped. Doing so may change the characteristics
of the cables, resulting in malfunction.
● Check the interface type and correctly connect the cable. Incorrect wiring (connecting the cable to an
incorrect interface) may cause failure of the module and external device.
● Tighten the terminal screws or connector screws within the specified torque range. Undertightening
can cause drop of the screw, short circuit, fire, or malfunction. Overtightening can damage the screw
and/or module, resulting in drop, short circuit, fire, or malfunction.
● When disconnecting the cable from the module, do not pull the cable by the cable part. For the cable
with connector, hold the connector part of the cable. For the cable connected to the terminal block,
loosen the terminal screw. Pulling the cable connected to the module may result in malfunction or
damage to the module or cable.
● Prevent foreign matter such as dust or wire chips from entering the module. Such foreign matter can
cause a fire, failure, or malfunction.
● A protective film is attached to the top of the module to prevent foreign matter, such as wire chips,
from entering the module during wiring. Do not remove the film during wiring. Remove it for heat
dissipation before system operation.
● Programmable controllers must be installed in control panels. Connect the main power supply to the
power supply module in the control panel through a relay terminal block. Wiring and replacement of a
power supply module must be performed by qualified maintenance personnel with knowledge of
protection against electric shock. For wiring, refer to the MELSEC iQ-R Module Configuration Manual.
● For Ethernet cables to be used in the system, select the ones that meet the specifications in the user's
manual for the module used. If not, normal data transmission is not guaranteed.

6
[Startup and Maintenance Precautions]
WARNING
● Do not touch any terminal while power is on. Doing so will cause electric shock or malfunction.
● Correctly connect the battery connector. Do not charge, disassemble, heat, short-circuit, solder, or
throw the battery into the fire. Also, do not expose it to liquid or strong shock. Doing so will cause the
battery to produce heat, explode, ignite, or leak, resulting in injury and fire.
● Shut off the external power supply (all phases) used in the system before cleaning the module or
retightening the terminal screws, connector screws, or module fixing screws. Failure to do so may
result in electric shock.

[Startup and Maintenance Precautions]

CAUTION
● When connecting an external device with a CPU module or intelligent function module to modify data
of a running programmable controller, configure an interlock circuit in the program to ensure that the
entire system will always operate safely. For other forms of control (such as program modification,
parameter change, forced output, or operating status change) of a running programmable controller,
read the relevant manuals carefully and ensure that the operation is safe before proceeding. Improper
operation may damage machines or cause accidents.
● Especially, when a remote programmable controller is controlled by an external device, immediate
action cannot be taken if a problem occurs in the programmable controller due to a communication
failure. To prevent this, configure an interlock circuit in the program, and determine corrective actions
to be taken between the external device and CPU module in case of a communication failure.
● Do not disassemble or modify the modules. Doing so may cause failure, malfunction, injury, or a fire.
● Use any radio communication device such as a cellular phone or PHS (Personal Handy-phone
System) more than 25cm away in all directions from the programmable controller. Failure to do so
may cause malfunction.
● Shut off the external power supply (all phases) used in the system before mounting or removing the
module. Failure to do so may cause the module to fail or malfunction.
● Tighten the screws within the specified torque range. Undertightening can cause drop of the
component or wire, short circuit, or malfunction. Overtightening can damage the screw and/or module,
resulting in drop, short circuit, or malfunction.
● After the first use of the product, do not perform each of the following operations more than 50 times
(IEC 61131-2/JIS B 3502 compliant):
Exceeding the limit may cause malfunction.
• Mounting/removing the module to/from the base unit
• Inserting/removing the extended SRAM cassette or battery-less option cassette to/from the
CPU module
• Mounting/removing the terminal block to/from the module
● After the first use of the product, do not insert/remove the SD memory card to/from the CPU module
more than 500 times. Exceeding the limit may cause malfunction.
● Do not touch the metal terminals on the back side of the SD memory card. Doing so may cause
malfunction or failure of the module.
● Do not touch the integrated circuits on the circuit board of an extended SRAM cassette or a battery-
less option cassette. Doing so may cause malfunction or failure of the module.

7
 [Startup and Maintenance Precautions]
CAUTION
● Do not drop or apply shock to the battery to be installed in the module. Doing so may damage the
battery, causing the battery fluid to leak inside the battery. If the battery is dropped or any shock is
applied to it, dispose of it without using.
● Startup and maintenance of a control panel must be performed by qualified maintenance personnel
with knowledge of protection against electric shock. Lock the control panel so that only qualified
maintenance personnel can operate it.
● Before handling the module, touch a conducting object such as a grounded metal to discharge the
static electricity from the human body. Failure to do so may cause the module to fail or malfunction.

[Operating Precautions]
CAUTION
● When changing data and operating status, and modifying program of the running programmable
controller from an external device such as a personal computer connected to an intelligent function
module, read relevant manuals carefully and ensure the safety before operation. Incorrect change or
modification may cause system malfunction, damage to the machines, or accidents.
● Do not power off the programmable controller or reset the CPU module while the setting values in the
buffer memory are being written to the flash ROM in the module. Doing so will make the data in the
flash ROM undefined. The values need to be set in the buffer memory and written to the flash ROM
again. Doing so can cause malfunction or failure of the module.

[Disposal Precautions]
CAUTION
● When disposing of this product, treat it as industrial waste.
● When disposing of batteries, separate them from other wastes according to the local regulations. For
details on battery regulations in EU member states, refer to the MELSEC iQ-R Module Configuration
Manual.

[Transportation Precautions]
CAUTION
● When transporting lithium batteries, follow the transportation regulations. For details on the regulated
models, refer to the MELSEC iQ-R Module Configuration Manual.
● The halogens (such as fluorine, chlorine, bromine, and iodine), which are contained in a fumigant
used for disinfection and pest control of wood packaging materials, may cause failure of the product.
Prevent the entry of fumigant residues into the product or consider other methods (such as heat
treatment) instead of fumigation. The disinfection and pest control measures must be applied to
unprocessed raw wood.

8
CONDITIONS OF USE FOR THE PRODUCT
(1) Mitsubishi programmable controller ("the PRODUCT") shall be used in conditions;
i) where any problem, fault or failure occurring in the PRODUCT, if any, shall not lead to any major or serious accident;
and
ii) where the backup and fail-safe function are systematically or automatically provided outside of the PRODUCT for the
case of any problem, fault or failure occurring in the PRODUCT.
(2) The PRODUCT has been designed and manufactured for the purpose of being used in general industries.
MITSUBISHI SHALL HAVE NO RESPONSIBILITY OR LIABILITY (INCLUDING, BUT NOT LIMITED TO ANY AND ALL
RESPONSIBILITY OR LIABILITY BASED ON CONTRACT, WARRANTY, TORT, PRODUCT LIABILITY) FOR ANY
INJURY OR DEATH TO PERSONS OR LOSS OR DAMAGE TO PROPERTY CAUSED BY the PRODUCT THAT ARE
OPERATED OR USED IN APPLICATION NOT INTENDED OR EXCLUDED BY INSTRUCTIONS, PRECAUTIONS, OR
WARNING CONTAINED IN MITSUBISHI'S USER, INSTRUCTION AND/OR SAFETY MANUALS, TECHNICAL
BULLETINS AND GUIDELINES FOR the PRODUCT.
("Prohibited Application")
Prohibited Applications include, but not limited to, the use of the PRODUCT in;
• Nuclear Power Plants and any other power plants operated by Power companies, and/or any other cases in which the
public could be affected if any problem or fault occurs in the PRODUCT.
• Railway companies or Public service purposes, and/or any other cases in which establishment of a special quality
assurance system is required by the Purchaser or End User.
• Aircraft or Aerospace, Medical applications, Train equipment, transport equipment such as Elevator and Escalator,
Incineration and Fuel devices, Vehicles, Manned transportation, Equipment for Recreation and Amusement, and
Safety devices, handling of Nuclear or Hazardous Materials or Chemicals, Mining and Drilling, and/or other
applications where there is a significant risk of injury to the public or property.
Notwithstanding the above restrictions, Mitsubishi may in its sole discretion, authorize use of the PRODUCT in one or
more of the Prohibited Applications, provided that the usage of the PRODUCT is limited only for the specific
applications agreed to by Mitsubishi and provided further that no special quality assurance or fail-safe, redundant or
other safety features which exceed the general specifications of the PRODUCTs are required. For details, please
contact the Mitsubishi representative in your region.
(3) Mitsubishi shall have no responsibility or liability for any problems involving programmable controller trouble and system
trouble caused by DoS attacks, unauthorized access, computer viruses, and other cyberattacks.

9
 INTRODUCTION
Thank you for purchasing the Mitsubishi Electric MELSEC iQ-R series programmable controllers.
This manual describes the functions, programming, and troubleshooting of the relevant products listed below.
Before using this product, please read this manual and the relevant manuals carefully and develop familiarity with the
functions and performance of the MELSEC iQ-R series programmable controller to handle the product correctly.
When applying the program examples provided in this manual to an actual system, ensure the applicability and confirm that it
will not cause system control problems.
Please make sure that the end users read this manual.

Relevant products
RJ71EN71, CPU module

Unless otherwise specified, the buffer memory addresses in this manual are for when the P1 connecter of the
RJ71EN71 or RnENCPU is used.
Check the corresponding buffer memory addresses in the list and use the correct addresses when using the
following: ( Page 355 Buffer Memory)
• CPU module (built-in Ethernet port part)
• P2 connector of the RJ71EN71
• RJ71EN71 (network type: Q-compatible Ethernet)

10
CONTENTS
SAFETY PRECAUTIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1
CONDITIONS OF USE FOR THE PRODUCT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
RELEVANT MANUALS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
TERMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
GENERIC TERMS AND ABBREVIATIONS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

CONTENTS
CHAPTER 1 FUNCTIONS 19
1.1 Connection with MELSOFT Product and GOT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Connection via a hub. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Direct connection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.2 SLMP Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Communication structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Data communication procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
List of valid commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Dedicated instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
1.3 Communications Using the Predefined Protocol. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Applicable connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Data communication procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Protocol communication type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Packet elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Execution conditions of predefined protocol communications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Example of predefined protocol communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
1.4 Socket Communications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Setting procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Applicable dedicated instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Applicable connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Communication structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Communications using TCP/IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Communications using UDP/IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Broadcast communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
1.5 Communications Using the Fixed Buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Differences between the "Procedure Exist" and "No Procedure" control methods . . . . . . . . . . . . . . . . . . . . . . . 69
Setting procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Applicable dedicated instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Applicable connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Communication structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Send procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Receive procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Pairing open . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Broadcast communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Data format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Example of communications using the fixed buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
1.6 Communications Using the Random Access Buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Setting procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

11
 Communication structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Procedure for reading from external device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Procedure for writing from external device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Physical address and logical address of random access buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Data Format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Example of communications with random access buffer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
1.7 Communications Using MODBUS/TCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
MODBUS/TCP master function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
MODBUS/TCP slave function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
1.8 Link Dedicated Instruction Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Data communication procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
1.9 File Transfer Function (FTP server) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
Data communication procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Files that can be transferred with FTP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
FTP command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
1.10 File Transfer Function (FTP Client) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Transferable files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Procedure for executing the file transfer function (FTP client) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
1.11 Time Setting Function (SNTP Client) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
1.12 Web Server Function. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
JavaScript objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
CGI object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Error message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
1.13 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
IP filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Remote password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) . . . . . . . . . . . . . . . . . . . . 183
Setting procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Checking the simple CPU communication status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Communication example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part)) . . . . . . . . . . . . . . . . . 216
Setting procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Checking the simple CPU communication status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
1.16 IP Address Change Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
IP address of the Ethernet-equipped module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Usage methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Checking the IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Checking the operating status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
1.17 Redundant System Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
System configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
System switching request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
System switching cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Redundant group setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Communication path bypass function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Both systems identical IP address setting function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

12
 Functions restricted in a redundant system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Setting example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
1.18 Discard received data at CPU STOP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260

CHAPTER 2 PARAMETER SETTINGS 261

2.1 Setting Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
2.2 Basic Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Own Node Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
External Device Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264

CONTENTS
2.3 Application Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Frame Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
Communication Speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
FTP Server Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
FTP Client Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
DNS Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
MODBUS/TCP Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Simple CPU communication setting (RJ71EN71, RnENCPU (network part)) . . . . . . . . . . . . . . . . . . . . . . . . . . 276
Simple CPU communication setting (CPU module (built-in Ethernet port part)) . . . . . . . . . . . . . . . . . . . . . . . . 278
Time Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
Timer Settings for Data Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Gateway Parameter Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Network/Station No. <-> IP information setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
Interrupt Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
IP Packet Transfer Setting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
Network Dynamic Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Module Operation Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Redundant System Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

CHAPTER 3 TROUBLESHOOTING 298

3.1 Checking with LED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298
3.2 Checking the Module Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
Module communication test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
3.3 Checking the Network Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Ethernet diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Simple CPU communication diagnostics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
3.4 Troubleshooting by Symptom . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
3.5 List of Error Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
3.6 List of Parameter Numbers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347
3.7 Event List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
3.8 End Codes Returned to an External Device During Data Communications . . . . . . . . . . . . . . . . . . . . . . . 351

APPENDICES 352
Appendix 1 Module Label . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352
Appendix 2 I/O Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
List of I/O signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
Appendix 3 Buffer Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
List of buffer memory addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
Details of buffer memory addresses (RJ71EN71, RnENCPU (network part)). . . . . . . . . . . . . . . . . . . . . . . . . . 372
Details of buffer memory addresses (CPU module (built-in Ethernet port part)) . . . . . . . . . . . . . . . . . . . . . . . . 389

13
 Appendix 4 Dedicated Instruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396
Open/close processing instructions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396
Instruction for SLMP communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396
Instructions for predefined protocol communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 397
Socket communications instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 397
Instructions for communications using the fixed buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 397
Link dedicated instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
File transfer function instruction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
Other dedicated instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399
Appendix 5 TCP/IP Communications, UDP/IP Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400
TCP/IP communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400
UDP/IP communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
Appendix 6 Communications with Different Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
Appendix 7 Processing Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
Performance list of simple CPU communication function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414
Appendix 8 Mounting the Module with a Remote Head Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415
Restrictions on functions and specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415
Appendix 9 Using the Module in the Redundant System with Redundant Extension Base Unit . . . . . . . . . . . . 416
Restrictions on functions and specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416
Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417
Example of communications using the fixed buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418
Appendix 10Port Numbers Used by Ethernet-equipped Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424
Appendix 11 Operation Image and Data Structure of Predefined Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
Operation image of each communication type of protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
Verification operation of receive packet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430
Example of packet element data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431
Appendix 12Example of External Device Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434
Appendix 13How to Turn Off ERR LED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435
Appendix 14Added and Enhanced Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
RJ71EN71, RnENCPU (network part). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
CPU module (built-in Ethernet port part) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 437

INDEX 439

REVISIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .441
WARRANTY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .443
TRADEMARKS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .444

14
RELEVANT MANUALS
Manual name [manual number] Description Available
form
MELSEC iQ-R Ethernet User's Manual (Application) Functions, parameter settings, programming, troubleshooting, I/O Print book
[SH-081257ENG] (this manual) signals, and buffer memory of Ethernet
e-Manual
PDF
MELSEC iQ-R Module Configuration Manual The combination of the MELSEC iQ-R series modules, common Print book
[SH-081262ENG] information on the installation/wiring in the system, and specifications of
e-Manual
the power supply module, base unit, SD memory card, and battery
PDF
MELSEC iQ-R Ethernet/CC-Link IE User's Manual (Startup) Specifications, procedures before operation, system configuration, wiring, Print book
[SH-081256ENG] and communication examples of Ethernet, CC-Link IE Controller
e-Manual
Network, and CC-Link IE Field Network
PDF
MELSEC iQ-R CPU Module User's Manual (Startup) Performance specifications, procedures before operation, and Print book
[SH-081263ENG] troubleshooting of the CPU module
e-Manual
PDF
MELSEC iQ-R CPU Module User's Manual (Application) Memory, functions, devices, and parameters of the CPU module Print book
[SH-081264ENG]
e-Manual
PDF
MELSEC iQ-R Programming Manual (CPU Module Instructions, Instructions for the CPU module and standard functions/function blocks e-Manual
Standard Functions/Function Blocks) PDF
[SH-081266ENG]
MELSEC iQ-R Programming Manual (Module Dedicated Dedicated instructions for the intelligent function modules e-Manual
Instructions) PDF
[SH-081976ENG]
MELSEC iQ-R Ethernet, CC-Link IE, and MELSECNET/H Function Specifications of the following MELSEC iQ-R series module FBs: e-Manual
Block Reference Ethernet-equipped module FBs, CC-Link IE TSN module FBs, CC-Link IE PDF
[BCN-P5999-0381] Controller Network module FBs, CC-Link IE Field Network module FBs,
and MELSECNET/H network module FBs
GX Works3 Operating Manual System configuration, parameter settings, and online operations of GX e-Manual
[SH-081215ENG] Works3 PDF
MELSEC iQ-R MODBUS and MODBUS/TCP Reference Manual The protocol used for data reading or writing from an external device to e-Manual
[BCN-P5999-1060] the Ethernet-equipped module PDF
SLMP Reference Manual The protocol used to access an SLMP-compatible device from an Print book
[SH-080956ENG] external device (such as a personal computer or HMI (Human Machine e-Manual
Interface)) or an SLMP-compatible module (such as the Ethernet-
PDF
equipped module or modules on CC-Link IE TSN).
iQ Sensor Solution Reference Manual Operation methods of the online functions for iQ Sensor Solution Print book
[SH-081133ENG] e-Manual
PDF

e-Manual refers to the Mitsubishi Electric FA electronic book manuals that can be browsed using a dedicated
tool.
e-Manual has the following features:
• Required information can be cross-searched in multiple manuals.
• Other manuals can be accessed from the links in the manual.
• The hardware specifications of each part can be found from the product figures.
• Pages that users often browse can be bookmarked.
• Sample programs can be copied to an engineering tool.

15
 TERMS
Unless otherwise specified, this manual uses the following terms.
Term Description
ARP Address Resolution Protocol. This protocol is used to obtain the MAC address of Ethernet from an IP address.
Buffer memory Memory in an intelligent function module to store data such as setting values and monitor values. For CPU modules, it
refers to memory to store data such as setting values and monitor values of the Ethernet function, or data used for data
communication of the multiple CPU system function.
Control CPU A CPU module that controls connected I/O modules and intelligent function modules.
The multiple CPU system allows the user to assign the control CPU on a module-by-module basis.
Control system A system that controls a redundant system and performs network communications in a redundant system
Control System IP Address An IP address common to system A and system B in a redundant system. ( Page 245 Both systems identical IP
address setting function)
CPU module (built-in Ethernet A built-in Ethernet port part of a CPU module (CPU part for an RnENCPU).
port part)
Device A memory of a CPU module to store data. Devices such as X, Y, M, D, and others are provided depending on the intended
use.
Engineering tool A tool used for setting up programmable controllers, programming, debugging, and maintenance
Global label A label that is valid for all the program data when multiple program data are created in the project.
There are two types of global label: a module specific label (module label), which is generated automatically by GX
Works3, and an optional label, which can be created for any specified device.
ICMP Internet Control Message Protocol. This protocol is used to exchange messages of errors in an IP network or other
information related to an Ethernet network.
Intelligent function module A module that has functions other than an input or output, such as an A/D converter module and D/A converter module
iQSS iQ Sensor Solution. Cooperation of sensors, programmable controllers, HMI (Human Machine Interface), and engineering
tool to facilitate the start-up or maintenance of sensors. ( iQ Sensor Solution Reference Manual)
MODBUS/TCP A protocol for using MODBUS protocol messages on a TCP/IP network
Module label A label that represents one of memory areas (I/O signals and buffer memory areas) specific to each module in a given
character string.
For the module used, GX Works3 automatically generates this label, which can be used as a global label.
New control system A system that has switched to control system from standby system after system switching in a redundant system.
OPS An operation station using MELSOFT and EZSocket partner products.
Predefined protocol support A function of GX Works3. This function sets protocols appropriate to each external device and reads/writes protocol
function setting data.
Process CPU A CPU module that performs process control and sequence control. Process control function blocks and the online
module change function can be executed.
This module is also used with a redundant function module as a pair and configures a redundant system.
The Process CPU models include the R08PCPU, R16PCPU, R32PCPU, and R120PCPU.
Process CPU (redundant mode) A Process CPU operating in redundant mode.
A redundant system is configured with this CPU module. Process control function blocks and the online module change
function can be used even in this mode.
Redundant function module A module to configure a redundant system by using it in combination with a process CPU (redundant mode).
The SIL2 function module model name is R6RFM.
Redundant system A system consisting of two systems that have same configuration (CPU module, power supply module, network module,
and other modules). Even after an error occurs in one of the two system, the other system takes over the control of the
entire system.
Redundant system with A redundant system that is configured using extension base unit(s)
redundant extension base unit
Relay station A station that relays data link to other station with mounting more than one network modules on one programmable
controller.
RnENCPU (CPU part) A module on the left-hand side of the RnENCPU ( MELSEC iQ-R Ethernet/CC-Link IE User's Manual (Startup))
RnENCPU (network part) A module on the right-hand side of the RnENCPU ( MELSEC iQ-R Ethernet/CC-Link IE User's Manual (Startup))
Routing A process of selecting paths for communication with other networks. There are two types of routing: dynamic routing that
auto-selects the communication routes, and static routing where communication routes are arbitrarily set.
SIL2 Process CPU This module is used with a SIL2 function module as a pair, and performs both standard control and safety control. This
module is also used with a redundant function module as a pair and configures a redundant system.
The SIL2 Process CPU models include the R08PSFCPU, R16PSFCPU, R32PSFCPU, and R120PSFCPU.
SLMP SeamLess Message Protocol. This protocol is used to access an SLMP-compatible device from an external device (such
as a personal computer or HMI (Human Machine Interface)) or an SLMP-compatible module (such as the Ethernet-
equipped module or modules on CC-Link IE TSN).

16
Term Description
Standby system A backup system in a redundant system
Subnet mask A number used to logically divide one network into multiple subnetworks and manage them easily. The following Ethernet
network systems can be configured:
• A small-scale Ethernet network system in which multiple network devices are connected.
• A medium- or large-scale network system in which multiple small-scale network systems are connected via routers or
other network communication devices.
System A A system that is set as system A to distinguish two systems in a redundant system. It is used to distinguish connected two
systems (system A and system B).
System B A system that is set as system B to distinguish two systems in a redundant system. It is used to distinguish connected two
systems (system A and system B).
Transient transmission group Number that is assigned for transient transmission to any given stations.
number By specifying a group of stations as transient transmission target, data can be sent to the stations of the same group
number.

17
 GENERIC TERMS AND ABBREVIATIONS
Unless otherwise specified, this manual uses the following generic terms and abbreviations.
Generic term/abbreviation Description
BUFRCV instruction A generic term for the dedicated instructions GP.BUFRCV and ZP.BUFRCV
BUFRCVS instruction A generic term for the dedicated instructions G.BUFRCVS and Z.BUFRCVS
BUFSND instruction A generic term for the dedicated instructions GP.BUFSND and ZP.BUFSND
CLOSE instruction A generic term for the dedicated instructions GP.CLOSE, ZP.CLOSE, GP.CONCLOSE, and SP.SOCCLOSE
ECPRTCL instruction A generic term for the dedicated instructions GP.ECPRTCL and SP.ECPRTCL
ERRCLEAR instruction A generic term for the dedicated instructions GP.ERRCLEAR and ZP.ERRCLEAR
ERRRD instruction A generic term for the dedicated instructions GP.ERRRD and ZP.ERRRD
Ethernet device A generic term for the devices supporting IP communication (such as a personal computer, a vision sensor, and a bar
code reader)
Ethernet-equipped module A generic term for the following modules:
• RJ71EN71 (when the Ethernet function is used)
• CPU module (when the Ethernet function is used)
MELSECNET/10 An abbreviation for the MELSECNET/10 network system
MELSECNET/H An abbreviation for the MELSECNET/H network system
Network module A generic term for the following modules:
• Ethernet interface module
• A module on CC-Link IE TSN (the RJ71GN11-T2 and a module on a remote station)
• CC-Link IE Controller Network module
• A module on CC-Link IE Field Network (a master/local module, and a module on a remote I/O station, a remote device
station, and an intelligent device station)
• MELSECNET/H network module
• MELSECNET/10 network module
• RnENCPU (network part)
OPEN instruction A generic term for the dedicated instructions GP.OPEN, ZP.OPEN, GP.CONOPEN, and SP.SOCOPEN
Programmable controller CPU A generic term for the R00CPU, R01CPU, R02CPU, R04CPU, R04ENCPU, R08CPU, R08ENCPU, R16CPU,
R16ENCPU, R32CPU, R32ENCPU, R120CPU, R120ENCPU
READ instruction A generic term for the dedicated instructions JP.READ and GP.READ
RECV instruction A generic term for the dedicated instructions JP.RECV and GP.RECV
RECVS instruction A generic term for the dedicated instructions G.RECVS and Z.RECVS
Remote head module An abbreviation for the RJ72GF15-T2 CC-Link IE Field Network remote head module
REQ instruction A generic term for the dedicated instructions J.REQ, JP.REQ, G.REQ, and GP.REQ
RnENCPU A generic term for the R04ENCPU, R08ENCPU, R16ENCPU, R32ENCPU, and R120ENCPU
SEND instruction A generic term for the dedicated instructions JP.SEND and GP.SEND
SOCRCV instruction A generic term for the dedicated instructions GP.SOCRCV and SP.SOCRCV
SOCRCVS instruction A generic term for the dedicated instructions G.SOCRCV and S.SOCRCV
SOCSND instruction A generic term for the dedicated instructions GP.SOCSND and SP.SOCSND
SREAD instruction A generic term for the dedicated instructions JP.SREAD and GP.SREAD
SWRITE instruction A generic term for the dedicated instructions JP.SWRITE and GP.SWRITE
UINI instruction A generic term for the dedicated instructions G.UINI, GP.UINI, Z.UINI, and ZP.UINI
WRITE instruction A generic term for the dedicated instructions JP.WRITE and GP.WRITE
ZNRD instruction A generic term for the dedicated instructions J.ZNRD and JP.ZNRD
ZNWR instruction A generic term for the dedicated instructions J.ZNWR and JP.ZNWR

18
1 FUNCTIONS
1
1.1 Connection with MELSOFT Product and GOT
Programming and monitoring of the programmable controller with the engineering tool, and monitoring and testing of the
programmable controller from the GOT can be performed via Ethernet. This function enables remote operations using
Ethernet's long-distance connection and high-speed communication.
The section describes the methods of connecting the Ethernet-equipped module, MELSOFT product (such as engineering
tool and MX Component), and GOT.
: Connection available, : Connection not available
Connection method Purpose Availability
MELSOFT products GOT
RJ71EN71, CPU module RJ71EN71, CPU module
RnENCPU (built-in RnENCPU (built-in
(network Ethernet port (network Ethernet port
part) part) part) part)
Connection via a hub • To connect to an Ethernet-equipped    
(Connection by specifying the IP module that has no network number
address) and station number
• To connect multiple MELSOFT
products
Connection via a hub • To connect by using network number  *2  *2
(Connection by specifying the network and station number
number and station number) • To connect multiple MELSOFT
products and GOTs
Direct connection • To connect without hub using one    
(Connection without specifying the IP Ethernet cable for one-on-one
address, network number, or station communication with the external
number)*1 device
• To connect to an Ethernet-equipped
module whose IP address in
unknown

*1 This connection method is not available when the RJ71EN71 network type is set to "Q Compatible Ethernet".
*2 Before the connection, check the firmware version of the CPU module. ( Page 436 Added and Enhanced Functions)

For the procedures to connect the Ethernet-equipped module and GOT, refer to the following.
 Manual for the GOT used

If multiple RJ71EN71s with the same network number are installed to one base unit (main base unit or
extension base unit), the Ethernet-equipped module cannot connect to a MELSOFT product or GOT via an
RJ71EN71. When the RJ71EN71 with the same network number as a relay RJ71EN71 is set in a relay
network or target network, the Ethernet-equipped module cannot connect to other stations and other
networks.

1 FUNCTIONS
1.1 Connection with MELSOFT Product and GOT 19
 Connection via a hub

Setting procedure
■Setting in the Ethernet-equipped module side
Set the IP address of the Ethernet-equipped module in "Own Node Settings" under "Basic Settings". ( Page 262 Own
Node Settings)
When connecting by specifying the network number and station number, set the network number and station number in "Own
Node Settings" under "Basic Settings".
Even if "External Device Configuration" is not set under "Basic Settings", the Ethernet-equipped module can be connected to
the MELSOFT product and GOT using the system dedicated connection.*1
*1 When using a TCP/IP connection with the system dedicated connection, up to ((maximum number of connected modules in "External
Device Configuration") - (set number) + 1) modules can be connected.
When using a UDP/IP connection, up to the maximum number of connectable modules can be connected.

When connecting multiple MELSOFT products with TCP/IP, drag "MELSOFT Connection Module" from the
"Module List" to "List of devices" or "Device map area" in "External Device Configuration" under "Basic
Settings". ( Page 264 External Device Configuration)

1 FUNCTIONS
20 1.1 Connection with MELSOFT Product and GOT
■Settings on the engineering tool side
Set in the "Specify Connection Destination Connection" window.
[Online]  [Current Connection Destination] 1

1. Set "PC side I/F" to "Ethernet Board".

2. Double-click "Ethernet Board", and open the "PC side I/
F Detailed Setting of Ethernet Board" window.
3. Set the network number, station number, and protocol of
the personal computer. (Set the network number and
protocol according to the settings for the Ethernet-
equipped module. Set the station number so that it is not
the same as a station number assigned to other
Ethernet devices.)*1

4. Set the "PLC side I/F" to the module to be connected.

1 FUNCTIONS
1.1 Connection with MELSOFT Product and GOT 21
 5. Double-click the icon set in step 4, and open the
detailed setting window.
6. Select "Connection via HUB" for the connection method,
and enter the station number and IP address or host
name for the Ethernet-equipped module. Select
"RJ71EN71" to connect the RnENCPU (network part).

7. Set "Other Station Setting" or "Network Communication

Route" if necessary.
*1 The network number and station number do not need to be set when connecting with the CPU module (built-in Ethernet port part).

1 FUNCTIONS
22 1.1 Connection with MELSOFT Product and GOT
Searching modules on the network
When connecting with a hub, a list of modules that can be searched for will appear by clicking the [Find] button on the detailed
1
setting window.

■Search target modules

• The control CPU of the RJ71EN71 or the CPU module connected to the same hub as the engineering tool
• The control CPU of the RJ71EN71 or the CPU module connected to cascade-connected hub
• The remote head module that controls the RJ71EN71 connected to the same hub as the engineering tool
• The remote head module that controls the RJ71EN71 connected to a cascade-connected hub

• By setting "Do Not Respond to CPU Module Search" in "Security" under "Application Settings" to "Do Not
Respond", the modules will not be listed even if a search is performed.
• Only the MELSEC iQ-R Series Ethernet-equipped modules are searched.
• The RJ71EN71 in which the network type is set to "Q Compatible Ethernet" cannot be searched.

1 FUNCTIONS
1.1 Connection with MELSOFT Product and GOT 23
 ■When module does not appear after search
If a connected Ethernet-equipped module does not appear in the list after searching the modules on the network, check the
following items.
• Search is not performed if it is disabled with the IP filter.
• Modules connected via a router cannot be searched.
• If the module is connected via a wireless LAN, packet loss can prevent the Ethernet communication from stabilizing, and
may inhibit the module search.
• If there are modules with the same IP address in the list, review the IP address parameter settings for the Ethernet-
equipped module.
• If the service processing load of the search-target CPU module is high, it may not be possible to search for the
corresponding module. If the search cannot be performed, increase the response wait time in the search dialog, and
perform the search again.

Precautions
■Remote operation
If remote STOP or remote PAUSE has been executed from the engineering tool to the CPU module on another station when
the CPU module (built-in Ethernet port part) and engineering tool are connected with an Ethernet cable, perform the following
before turning the power off or resetting the CPU module.
• Remote RUN
• Remote RESET

■Functions incompatible with connection via a hub

The following functions cannot be used for connection via a hub. To use the following functions, connect the CPU module
(built-in Ethernet port part) directly or with a USB cable.
• Ethernet Diagnostics
• CC-Link IE Field Diagnostics
• CC-Link IE Control Diagnostics

1 FUNCTIONS
24 1.1 Connection with MELSOFT Product and GOT
■Communications by network number/station number by using the CPU module (built-in
Ethernet port part)
• The UDP/IP protocol is used for the connection and data is always exchanged as binary codes. 1
• When accessing another station, set the network number for the CPU module (built-in Ethernet port part) so that it is unique
among the network numbers of the other network. Also, set the station number that is unique among the station numbers
set for the other modules on the same network.
• When configuring the target station or relay station as a multiple CPU system, ensure that the CPU modules listed below
have the firmware supporting the communications by network number/station number.
• Target station
• CPU modules working as the relay path
• CPU module that controls the Ethernet module working as the relay path

USB
(1)

Ethernet Ethernet
When communicating with CPU module shown as (1), ensure that all CPU modules have the firmware of the version supporting the communications by network
number/station number. Also, set the network number and station number to all CPU modules.

Ethernet module controlled by CPU No.2

USB
(3) (2)

Ethernet Ethernet
When communicating with CPU module shown as (2), ensure also that all CPU modules have the firmware of the version supporting the communications by
network number/station number. Note, however, that the communication is possible even when the network number and station number are not set to CPU
module shown as (3) of the CPU No.2.

1 FUNCTIONS
1.1 Connection with MELSOFT Product and GOT 25
 Direct connection
The Ethernet-equipped module and engineering tool can be directly connected with one Ethernet cable without using a hub.
When direct connection is made, communication is possible without setting the IP address or host name in the "Specify
Connection Destination Connection" window. (Communicate using broadcast communications)

• To prohibit direct connection with the Ethernet, set "Disable" for "Disable Direct Connection with MELSOFT"
in "Security" under the "Application Settings".
• A direct connection is not possible when the RJ71EN71 network type is set to "Q Compatible Ethernet".

Set in the "Specify Connection Destination Connection" window.

[Online]  [Current Connection Destination]

1. Set "PC side I/F" to "Ethernet Board".

2. Double-click "Ethernet Board", and open the "PC side I/
F Detailed Setting of Ethernet Board" window.
3. Set the network number, station number, and protocol of
the personal computer. (Set the network number and
protocol according to the settings for the Ethernet-
equipped module. Set the station number so that it is not
the same as a station number assigned to other
Ethernet devices.)

4. Set the "PLC side I/F" to the module to be connected.

1 FUNCTIONS
26 1.1 Connection with MELSOFT Product and GOT
 5. Double-click the icon set in step 4, and open the
detailed setting window.
6. Select "Ethernet Port Direct Connection" for the 1
connection method.

When connecting directly with the CPU module (built-in Ethernet port part), setting is also possible by clicking
the [CPU Module Direct Coupled Setting] button of the "Specify Connection Destination Connection" window.

Precautions
■Connection with LAN line
Do not connect with a LAN line and set direct connection. Data will be sent to all external devices on the LAN line, so this
setting will cause the line load to increase and will affect communication with other external devices.

■Connections that are not direct connections

• Do not use a configuration in which the Ethernet-equipped module and external device are connected with a hub. A direct
connection is not established when the devices are connected with a hub.
• When creating a network connection on the personal computer side, communication with a direct connection is not possible
if two or more Ethernet ports are set to "Enable". Review the personal computer settings so that only the Ethernet port for
the direct connection is set to "Enable", and the other Ethernet ports are set to "Disable".

■Settings incompatible with direct connection

When using the RJ71EN71 or the RnENCPU (network part), a direct connection cannot be established if the following setting
is made in the "Specify Connection Destination Connection" window of the engineering tool.
• When "Other Station (Co-existence Network)" is selected for "Other Station Setting"
• When "Other Station (Single Network)" is selected for "Other Station Setting", and "Other station in the same loop or access
to multilevel system" is selected in the "Network Communication Route Detailed Setting of Ethernet" window

■Functions incompatible with direct connection

The following functions cannot be used when the RJ71EN71 or the RnENCPU (network part) is directly connected. To use the
following functions, connect the CPU module (built-in Ethernet port part) directly or connect the CPU module with a USB
cable.
• CC-Link IE Field Diagnostics
• CC-Link IE Control Diagnostics

1 FUNCTIONS
1.1 Connection with MELSOFT Product and GOT 27
 ■Conditions that cannot communicate with direct connection
Communication with a direct connection may be disabled if the following conditions apply. If connection is not possible, review
the settings for the Ethernet-equipped module and personal computer.
• When all bits of the IP address for the Ethernet-equipped module that correspond with the 0 section of the subnet mask for
the personal computer are on or off

Ex.
IP address for the Ethernet-equipped module: 64.64.255.255
IP address for the personal computer: 64.64.1.1
Subnet mask for the personal computer: 255.255.0.0
• When all bits of the IP address for the Ethernet-equipped module that correspond with the host address of each class in the
IP address for the personal computer are on or off

Ex.
IP address for the personal computer: 192.168.0.1  192.x.x.x., class C and the host address is the fourth octet.
Subnet mask for the personal computer: 255.0.0.0
IP address for the Ethernet-equipped module: 64.64.255.255  each bit turns on because of the fourth octet is 255

The IP address for each class are as follow.

• Class A: 0.x.x.x to 127.x.x.x
• Class B: 128.x.x.x to 191.x.x.x
• Class C: 192.x.x.x to 223.x.x.x
The host address for each class is the 0 section shown below.
• Class A: 255.0.0.0
• Class B: 255.255.0.0
• Class C: 255.255.255.0

1 FUNCTIONS
28 1.1 Connection with MELSOFT Product and GOT
1.2 SLMP Communications
SLMP communications are available among devices that can receive/send messages with the SLMP control procedure.
1
The Ethernet-equipped module processes and transfers data following instructions (command) from the external device, so
the programmable controller only needs the open/close processing and does not require a program for data communication.
For SLMP communications, refer to the following.
 SLMP Reference Manual

Applications
This section describes the applications of SLMP communications.

Data read/write
Data read/write can be executed for the following data. With this, the external device can monitor the operation of the
Ethernet-equipped module, analyze data, and control production.
• Device or global label of the CPU module connected with the RJ71EN71 (When the Ethernet function of the RJ71EN71 or
the RnENCPU (network part) is used)
• Device or global label of the CPU module (When the Ethernet function of the CPU module (CPU part for the RnENCPU) is
used)
• Buffer memory of the intelligent function module

File read/write
Files such as parameter files stored in a CPU module can be read/written. Files in a CPU module can be managed on an
external device.

Remote control of a CPU module

A CPU module can be remotely controlled from the external device using remote operations.

Remote password lock/unlock

The remote password can be locked and unlocked from the external device.

Access to the programmable controller on another station via other network

In systems with CC-Link IE Controller Network, CC-Link IE Field Network, MELSECNET/H, MELSECNET/10 or Ethernet, the
programmable controller on another station can be accessed from the external device via the network. However, when
connecting the external device to the CPU module (built-in Ethernet port part), other stations cannot be accessed via network
such as CC-Link IE Controller Network and CC-Link IE Field Network.

Accessing to another station via the port 1 and port 2 of the RJ71EN71 is possible for the module with the
firmware version of "18" or later.

1 FUNCTIONS
1.2 SLMP Communications 29
 Communication structure
When a message is sent from the external device to the Ethernet-equipped module using the SLMP message format, the
Ethernet-equipped module executes a processing corresponding to the received message. During communication, the
Ethernet-equipped module functions as a server and the external device (terminals such as a personal computer) functions as
the client. The server (Ethernet-equipped module) automatically returns a response message suitable for the request
message received from the client.
(2)
(1)

Request message
Access
Header Subheader Command
destination

Ethernet

Response message

Header Subheader Response data

(1) Server side: Ethernet-equipped module

(2) Client side: External device

Data communication procedures

This section describes the procedures for communicating with SLMP.

1. After the module parameters are set, the system checks that the initial processing of the Ethernet-equipped module has
ended normally. ('Initial status' (Un\G1900024.0): On)
2. Perform the open processing to establish a connection between the Ethernet-equipped module and external device.
( Page 400 TCP/IP Communications, UDP/IP Communications)

3. After the connection is established, the SLMP messages are sent from the external device.

4. Close the connection when communication is finished.

In the following case, the Ethernet-equipped module performs a remote password check when the external
device is accessing the programmable controller. If communication is not possible, unlock the remote
password. ( Page 179 Access permit processing (Unlock processing))
• When remote password is set for the CPU module.
• When connection for exchanging data with external device is set as a remote password check target.

1 FUNCTIONS
30 1.2 SLMP Communications
Setting procedure
Set "External Device Configuration" under "Basic Settings". ( Page 264 External Device Configuration)
1
1. Select "SLMP Connection Module" in "Module List" and drag it to "List of devices" or "Device map area".

2. Set the other items to the connection if required.

Communications using an auto-open UDP port

The auto-open UDP port is used for communication with SLMP.
The auto-open UDP port is a UDP/IP port that automatically opens and closes at the following timing. When this port is used,
communication is enabled when the initial processing is completed. Communication can be performed without a program
regardless of the connection's open status.

■Open/close timing
After the Ethernet-equipped module initial processing completes, the port automatically opens according to the registered
parameter settings. The port automatically closes when the power for the Ethernet-equipped module station turns off or is
reset.

• When the initial processing ends normally, the Ethernet-equipped module enables communications using
an automatic open UDP port. The module waits for a communication request to the Ethernet-equipped
module on the own station. (Automatic open)
• The Ethernet-equipped module accepts and processes requests from anywhere as long as they are
addressed to the Ethernet-equipped module itself.
• If a communication request is received from an external device, the corresponding port number is occupied
until that processing ends. Even if another communication request is accepted during this time, the
communication processing will be waited.

1 FUNCTIONS
1.2 SLMP Communications 31
 List of valid commands
The following table lists the commands that can be executed from the external device to the Ethernet-equipped module.
"" in the "Sub-command" field differs according to the specified device.
For details on each command, refer to the following.
 SLMP Reference Manual
Item Command Sub Description
Type Operation command

Device Read 0401 001 Reads value from the bit devices (consecutive device No.) in one-point units.
000 • Reads values from the bit device (consecutive device No.) in 16-point units.
• Reads value from the word devices (consecutive device No.) in one-word units.
003 Reads value from the bit devices (consecutive device No.) in one-point units.
002 • Reads values from the bit device (consecutive device No.) in 16-point units.
• Reads value from the word devices (consecutive device No.) in one-word units.
Write 1401 001 Writes value to the bit devices (consecutive device No.) in one-point units.
000 • Writes value to the bit devices (consecutive device No.) in 16-point units.
• Writes value to the word devices (consecutive device No.) in one-word units.
003 Writes value to the bit devices (consecutive device No.) in one-point units.
002 • Writes value to the bit devices (consecutive device No.) in 16-point units.
• Writes value to the word devices (consecutive device No.) in one-word units.
Read Random 0403 000 Specifies the device number and reads value from the word devices in one-word
units or two-word units. This can be specified with inconsecutive device No.
002 Specifies the device number and reads value from the word devices in one-word
units or two-word units. This can be specified with inconsecutive device No.
Write Random 1402 001 Specifies the device No. to bit device in one-point units and writes value. This can be
specified with inconsecutive device No.
000 • Specifies the device No. to bit device in 16-point units and writes value. This can
be specified with inconsecutive device No.
• Specifies the device No. to word device in one-word units or two-word units and
writes value. This can be specified with inconsecutive device No.
003 Specifies the device No. to bit device in one-point units and writes value. This can be
specified with inconsecutive device No.
002 • Specifies the device No. to bit device in 16-point units and writes value. This can
be specified with inconsecutive device No.
• Specifies the device No. to word device in one-word units or two-word units and
writes value. This can be specified with inconsecutive device No.
Entry Monitor 0801 000 Registers the device to be read by Execute Monitor (command: 0802).
Device
002
Execute Monitor 0802 0000 Reads the value of device registered by Entry Monitor Device (command: 0801).
Read Block 0406 000 Reads data by treating n points of word devices or bit devices (one point is
equivalent to 16 bits) as one block and specifying multiple blocks. This can be
002
specified with inconsecutive device No.
Write Block 1406 000 Writes data by treating n points of word devices or bit devices (one point is
equivalent to 16 bits) as one block and specifying multiple blocks. This can be
002
specified with inconsecutive device No.
Label Array Label Read 041A 0000 Reads data from array type labels or labels whose structure members are the array.
Array Label Write 141A 0000 Writes data to array type labels or labels whose and structure members are the
array.
Read Random 041C 0000 Specifies labels and reads the data.
Write Random 141B 0000 Specifies labels and writes data.
Memory Read 0613 0000 Reads the buffer memory data of own station (SLMP-compatible device).
Write 1613 0000 Writes the data in the buffer memory of own station (SLMP-compatible device).
Extend Unit Read 0601 0000 Reads the data in the buffer memory of intelligent function module.
Write 1601 0000 Writes the data in the buffer memory of intelligent function module.

1 FUNCTIONS
32 1.2 SLMP Communications
Item Command Sub Description
Type Operation command

Remote Control Remote Run 1001 0000 Executes the remote RUN to the access destination module. 1
Remote Stop 1002 0000 Executes the remote STOP to the access destination module.
Remote Pause 1003 0000 Executes the remote PAUSE to the access destination module.
Remote Latch 1005 0000 Executes the Remote Latch Clear to the access destination module.
Clear
Remote Reset 1006 0000 Executes the Remote RESET to the access destination module.
Read Type Name 0101 0000 Reads the model name and model code of the access destination module.
Remote Lock 1631 0000 Specifies the remote password to disable the communication with other devices.
Password (The locked state is activated from the unlocked state.)
Unlock 1630 0000 Specifies the remote password to enable communication with other devices.
(The unlocked state is activated from the locked state.)
File Read Directory/ 1810 0040 Reads file list information.
File
Search Directory/ 1811 0040 Reads the presence of the specified file, file No., and file size.
File
New File 1820 0040 Reserves storage area for the specified file.
Delete File 1822 0040 Deletes a file.
Copy File 1824 0040 Copies the specified file.
Change File 1825 0040 Changes file attributes.
State
Change File Date 1826 0040 Changes the file creation date.
Open File 1827 0040 Locks a file so that the content of the file is not changed by other devices.
Read File 1828 0000 Reads the data of a file.
Write File 1829 0000 Writes the contents in a file.
Close File 182A 0000 Cancels the file lock by open processing.
Self Test 0619 0000 Tests whether the communication with external devices is normally executed or not.

Dedicated instructions
SLMP communications can be executed using the dedicated instructions. ( Page 396 Instruction for SLMP
communications)

1 FUNCTIONS
1.2 SLMP Communications 33
 1.3 Communications Using the Predefined Protocol
Data can be exchanged between the external device (such as measuring instrument and bar code reader) and the CPU
module following the protocol of the device.
Data that varies according to communication session can be handled by incorporating a device or buffer memory into the
communication packet.
Sets the protocol required for communication with the external device using the engineering tool.
The protocol can be set by selecting from the predefined protocol library, or it can be created and edited.

Ò Setting protocols Ó Writing protocols

Protocols can be set easily using the predefined Write the set protocols in the Ethernet-equipped module.
protocol support function of GX Works3.

GX Works3
Sending

External device Ethernet-equipped module Receiving External device

Data can be communicated

Ô Executing protocols with protocols appropriate
to each external device.
Execute protocols by dedicated instructions.
Multiple protocols can be executed by one dedicated instruction.

The number of protocols and packets that can be registered is as follow.

• Protocols: 128 maximum
• Packets: 256 maximum
• Packet data area size: 12288 bytes maximum
When the number of packets reaches the upper limit, protocols cannot be added even if the number of
protocols has not reached the upper limit. If the packet data area size reaches the upper limit, protocols and
packets cannot be added even if the number of protocols and packets has not reached the upper limit.

Applicable connections
The connections No.1 to 16 of the P1 connector can be used for the communications using the predefined protocol.
Communications using the predefined protocol cannot be used with the P2 connector.

1 FUNCTIONS
34 1.3 Communications Using the Predefined Protocol
Data communication procedures
When the predefined protocol support function is used, data can be exchanged with the external device using the following 1
procedure.

1. Select, create or edit the protocol with the predefined protocol support function, and write the protocol setting data. (
Page 35 Creating the protocol setting data)

2. Set the module parameter. ( Page 41 Setting procedure)

3. Write the parameters to the CPU module, and check that initial processing of the Ethernet-equipped module completed
successfully. ('Initial status' (Un\G1900024.0): On)
4. Perform the open processing to establish a connection between the Ethernet-equipped module and external device.
( Page 400 TCP/IP Communications, UDP/IP Communications)

5. Execute the protocol with the ECPRTCL instruction. ( Page 397 Instructions for predefined protocol
communications)

6. Close the connection when communication is finished.

The communication data code is binary code communication regardless of the selected settings.

Creating the protocol setting data

Use the predefined protocol support function to create the protocol setting data.
[Tool]  [Predefined Protocol Support Function]
1. Select the module for which to create the protocol
setting data. Select the following items when using the
RnENCPU.
• CPU part: "Built-in Ethernet CPU"
• Network part: "Ethernet Module"

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 35
 ■Newly creating the protocol setting data
Newly create the protocol setting data.
[File]  [New]

Item Description
Protocol No. Displays the protocol number used with the dedicated instruction in the program.
Manufacturer Displays the name of the manufacturer of the device for which the protocol is being set.
Model Displays the model of the protocol to be set.
Protocol Name Displays the name of the protocol to be set.
Communication Type Displays the communication type of the protocol to be set.
Send only: Sends one send packet once.
Receive only: If there is a matching packet up to 16 registered and received packets, it is received.
Send & receive: After sending one send packet, if there is a matching packet up to 16 registered and received
packets, it is received.
Send/Receive Displays the packet send direction.
: For send
(1) to (16): For receive, the received packet number is displayed in parentheses.
Packet Name Displays the packet name.
Packet Setting Displays the validity of variables in the packet elements and the variable setting state.
If the variable is not set, there are no elements, or there is an element error, the protocol is not written to the Ethernet-
equipped module.
No Variable: When there is no variable in the elements
Variable Set: Only when all variables have been set
Variable Unset: When there is even one unset variable
Element Unset: When there are no elements in an editable protocol
Element error: When elements do not satisfy requirements

1 FUNCTIONS
36 1.3 Communications Using the Predefined Protocol
■Adding protocol
Add protocol.
[Edit]  [Add Protocol] 1

Item Description Setting range

Type Select the type of protocol to be added. • Predefined Protocol Library
• User Protocol Library
• Add New
Protocol No. Select the protocol number to be added. 1 to 128
Manufacturer*1 Set the maker of the protocol to be added. 
Model*1 Set the type of protocol to be added. 
*1
Protocol Name Set the name of the protocol to be added. 

*1 The name can be set only when "Predefined Protocol Library" is selected for "Type".

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 37
 ■Protocol Detailed Setting
Set the protocol send/receive parameters.
"Protocol Setting" window  Select a protocol  [Edit]  [Protocol Detailed Setting]

Item Description
Connected Device Manufacturer Set the protocol maker name.
Information*1
Type Set the protocol device type.
Model Set the protocol model.
Version Set the protocol device version.
Explanation Set a description of the protocol device.
Protocol Setting Protocol No. The protocol number for the selected protocol is displayed.
Information*1
Protocol Name Set the protocol name.
Communication Type Set the protocol communication type.
Receive Setting Receive Wait Time Set the time for wait after the module enters the receive data wait state.
If communication with the external device is disabled because of a disconnection and matching packet
data is not received within the specified time, the module judges that an error has occurred and cancels
the receive data wait state.
Send Setting Standby Time Set the time to wait from when the protocol set for the module enters the execution state to when the
data is actually sent. The time for the external device to enter the receive enable state can be adjusted
with this in respect to the module's send timing.

*1 The setting cannot be changed if the protocol was selected from the predefined protocol library.

Send/receive parameters can be set for multiple protocols by clicking the [Communication Parameter Batch
Setting] button and setting the range of the set protocol numbers, receive settings, and send settings.

1 FUNCTIONS
38 1.3 Communications Using the Predefined Protocol
■Packet setting
Set the configuration of the send/receive packets on the "Packet Setting" window.
"Protocol Setting" window  Packet to be set 1

The above window opens when "Predefined Protocol Library" is selected on the "Add Protocol" window.
When "Add New" or "User Protocol Library" has been selected, configure the packets with the [Change Type] button and [Add
New] button.
For details on the packet elements, refer to the following.
Page 43 Packet elements

■Writing the protocol setting data

Write the protocol setting data to the Ethernet-equipped module.
[Online]  [Write to Module]

Select the module and memory into which the protocol data is to be written, and execute write.
When writing to a CPU module, the protocol setting data is written into the module extension parameters.

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 39
 The following data is not written as the protocol setting data so it will not be displayed even when read.
However, when the protocol is selected from the predefined protocol library, the following can be displayed.
• Manufacturer
• Packet Name
• Protocol Detailed Setting Type, Version, Explanation
• Packet Setting Configuration Element Name

After writing the protocol setting data, the setting data are enabled at the following timing.
• When the system is powered off and on
• When the CPU module is reset
• When the status of the CPU module changed from STOP to RUN state
The predefined protocol settings written in the SD memory card can be transferred to the CPU module memory by using boot
operation. For details on boot operation, refer to the following.
 MELSEC iQ-R CPU Module User's Manual (Application)

■When the protocol setting data are written into multiple target memory
When the protocol setting data are written into multiple target memory, the following operation will take place.
: The protocol setting data are written., : The predefined protocol data are not written.

Target memory Operation

CPU module (built-in SD memory card RJ71EN71,
Ethernet port part) RnENCPU (network
part)
   Operation follows settings in "Module Extended Parameter" under
"Setting of File/Data Use or Not in Memory Card" of the "Memory Card
Parameter" window.
   As soon as the protocol setting data are enabled, the predefined protocol
settings of the RJ71EN71 or the RnENCPU (network part) are
  
overwritten by the predefined protocol settings in the CPU module or SD
memory card.
   Operation follows settings in "Module Extended Parameter" under
"Setting of File/Data Use or Not in Memory Card" of the "Memory Card
Parameter" window.
As soon as the protocol setting data are enabled, the predefined protocol
settings of the RJ71EN71 or the RnENCPU (network part) are
overwritten by the predefined protocol settings in the CPU module or SD
memory card.

By writing the protocol setting data to the CPU built-in memory, the same setting can be used even after
module change.
When capacity of the CPU built-in memory is insufficient, write data to an SD memory card.
Although the protocol setting data can also be written to the intelligent function module, the data must be
written again when the module is changed.

1 FUNCTIONS
40 1.3 Communications Using the Predefined Protocol
Setting procedure
Set "External Device Configuration" under "Basic Settings". ( Page 264 External Device Configuration)
1
1. Select the external device to be connected in "Module List" and drag it to "List of devices" or "Device map area".
External device name Description
UDP Connection Module Select to communicate with the external device using UDP/IP.
Active Connection Module Select to perform the open processing to the external device from the Ethernet-equipped module (Active open)
and communicate using TCP/IP.
Unpassive Connection Module Select to receive the open processing from an unspecified external device (Unpassive open) and communicate
using TCP/IP.
Fullpassive Connection Module Select to receive the open processing from the specified external device (Fullpassive open) and communicate
using TCP/IP.

2. Set "Communication Method" for the external device to "Predefined Protocol".

3. Set the other parameters required for communication in the connection.

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 41
 Protocol communication type
The packets sent to the external device when a processing is executed and the external device's receive packets are
registered in the protocol.
The packet elements set with the predefined protocol support function are the data section of the packets that are actually
sent and received.
This section describes an example of the packet configuration. For details on the packet elements, refer to the following.
Page 425 Operation Image and Data Structure of Predefined Protocol

For TCP/IP
Header Maximum data length: 2046 bytes

Destination Sender's MAC

Type: IP: TCP:
MAC address: address: Data
2 bytes 20 bytes 20 bytes
6 bytes 6 bytes

Ethernet header TCP/IP header

■Precautions for Passive open

• When the CPU module is connected to external device in Passive open state, the IP address of the connected external
device or port number of the external device can be obtained with the SP.SOCCINF instruction. ( Page 397 Instructions
for predefined protocol communications)

For UDP/IP
Header Maximum data length: 2046 bytes

Destination Sender's
Type: IP: UDP:
MAC address: MAC address: Data
2 bytes 20 bytes 8 bytes
6 bytes 6 bytes
Ethernet header UDP/IP header

With the predefined protocol support function, data is exchanged with the external device with the procedures (communication
type) shown below.
For details on the communication type operation, refer to the following.
Page 425 Operation Image and Data Structure of Predefined Protocol
Communication type Description
Send only The send packet is sent once.
Receive only If there is a packet that matches within the maximum of 16 registered receive packets, the packet is received.
Send & receive After sending the send packets, if there are packets that match the up to 16 registered receive packets, the packets are
received.

■Precautions for UDP/IP communications

• Use the SP.SOCCSET instruction to change the external device by the CPU module. ( Page 397 Instructions for
predefined protocol communications)

■Precautions for broadcast communications

• When the CPU module receives data by receiving the broadcast, the IP address of the external device which send data and
port number of the external device can be obtained with the SP.SOCCINF instruction. ( Page 397 Instructions for
predefined protocol communications)

1 FUNCTIONS
42 1.3 Communications Using the Predefined Protocol
Packet elements
The packet is created with a combination of packet elements. 1
Up to 32 elements can be set in one packet. One packet can have a maximum data length of 2046.
This section describes the details of the packet elements.
For examples of the packet element data, refer to the following.
Page 425 Operation Image and Data Structure of Predefined Protocol

Static data

Use when there are specific codes and character strings, such as commands, in the packet.
• When sending: The specified code and character string are sent.
• When receiving: The received data is verified.
Multiple static data elements can be placed anywhere in the data part.
The following table lists the items.
Item Description Remarks
Element Name Set the element name. 
Code Type Select a data type of the setting value. 
ASCII String/ASCII Control Code/HEX
Setting Value Set data within 1 to 50 bytes. Setting example
Code type and setting range are as follows: ASCII string: "ABC"
• ASCII String: 20H to 7EH ASCII control code: STX
• ASCII Control Code: Control code of 00H to 1FH and 7FH HEX: FFFF
• HEX: Hexadecimal data of 00H to FFH

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 43
 Length

The length code is used when there is an element that indicates the data length in the packet.
• When sending: Automatically calculates the data length in the specified range, and adds it to the packet.
• When receiving: From the received data, the data (value) corresponding to the length is verified as the specified range's
data length.
Length elements can be placed anywhere in the data part.
Multiple length elements can be set placed in one packet.
The following table lists the items.
Item Description Remarks
Element Name Set the element name. 
Code Type Select the data length type. 
ASCII Hexadecimal/HEX
Data Length Select the data length on the line. 
The range is 1 to 4 bytes.
Data Flow Forward Direction When sending: Sends the calculated length in order from the This cannot be set if the data
(Upper Byte  Lower Byte) upper byte. length is 1 byte.
When receiving: Receives the data in order from the upper byte.
Reverse Direction When sending: Sends the calculated length in order from the low-
(Lower Byte  Upper Byte) order byte.
When receiving: Receives the data in order from the low-order
byte.
Byte Swap (by Word)*1 When sending: Interchanges the bytes in word units and sends the
calculated length.
When receiving: Interchanges the bytes in word units and receives
the data.
Calculating Start Select the start packet element number for the range to be calculated. 
Range The range is 1 to 32.
End Select the end packet element number for the range to be calculated.
The range is 1 to 32.

*1 This can be selected only when the data length is set to 4 bytes.

1 FUNCTIONS
44 1.3 Communications Using the Predefined Protocol
 • If there are no elements other than length, an element error occurs. (When using length, one or more
elements other than length are required.) 1
• If the calculation result exceeds the number of digits set with "Data Length", the excessive digit value is
discarded (invalidated). For example, if the data length is 2 bytes and the data size calculation results are
"123" bytes, the data length will be "23".
• If there is a non-conversion variable (variable length)/non-verified reception (character length variable) after
the length, and that section is not included in the length calculating range, arrange the static data
immediately after the non-conversion variable/non-verified reception.
• When the code type setting is "ASCII Hexadecimal", a mismatch will occur if a character string other than
"0" to "9", "A" to "F", and "a" to "f" is received.
• Use "0" to "9" or "A" to "F" when converting to ASCII characters during send.
• When arranging multiple length elements, none of the length calculating range may overlap.
• When arranging multiple length elements, the previous length calculating range may not exceed the
arranged length.
• A length element cannot be arranged at the final position of the packet elements.

Non-conversion variable

Use this to send the CPU module device or buffer memory data as part of the send packet, or to store part of the received
packet in the CPU module device or buffer memory.
Multiple non-conversion variable can be arranged in one packet.
The following table lists the items.
Item Description
Element Name Set the element name.
Fixed Length/Variable Fixed Length The data whose length is fixed is sent and received.
Length
Variable Length When sending: The data length is specified at the time of the protocol execution and the data is sent.
When receiving: The data whose length is variable is received.
Data Length/Maximum Set the data length of the send/receive data.
Data Length (For a variable length, set the maximum data length that can be specified for the data length storage area.)
The range is 1 to 2046.
Unit of Stored Data Lower Byte + Upper Byte When sending: Each one word (2 bytes) data in the data storage area is sent in the order of the lower
byte to the upper byte.
When receiving: The receive data is stored to the data storage area in the order of the lower byte to the
upper byte.
Lower Bytes Only When sending: Each lower byte data in the data storage area is sent. The Ethernet-equipped module
ignores the upper byte data.
When receiving: The receive data is stored to each lower byte in the data storage area. The Ethernet-
equipped module stores 00H in the upper byte.

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 45
 Item Description
Byte Swap Disable (Lower  When sending:
Upper)/Enable (Upper  When "Enable (Upper  Lower)" is selected, data in the upper byte and lower byte are swapped by
Lower) one word (2 bytes) and sent. When "Unit of Stored Data" is "Lower Byte + Upper Byte" and "Data
Length" is an odd number of bytes, the upper byte is sent at transmission of the last byte. When "Unit
of Stored Data" is "Lower Bytes Only" and "Data Length" is an odd number of bytes, data without any
byte swap is sent at transmission of the last byte.
When receiving:
When "Enable (Upper  Lower)" is selected, data in the upper byte and lower byte are swapped by
word and sent. When "Unit of Stored Data" is "Lower Byte + Upper Byte" and "Data Length" is an odd
number of bytes, the last byte is stored to the upper byte. When "Unit of Stored Data" is "Lower Bytes
Only" and "Data Length" is an odd number of bytes, the last byte is stored without any byte swap.
Data Storage Area Specify the start device for storing the variable value.
Specification The settable devices are listed below.
Inner user*1*2
• Input (X)
• Output (Y)
• Internal relay (M)
• Latch relay (L)
• Link relay (B)
• Data register (D)
• Link register (W)
File register*2
• File register (R, ZR)
Buffer memory
• G device (G) ('Send/receive area for predefined protocol support function' (Un\G1902000 to Un\G1904047))*3

*1 Do not set local devices.

*2 Set within the device range specified with "Device/Label Memory Area Setting" in "Memory/Device Setting" of "CPU Parameter".
*3 This cannot be set if the target module is a CPU module.

1 FUNCTIONS
46 1.3 Communications Using the Predefined Protocol
The following figures show the configuration of the data storage area.

■When "Fixed Length/Variable Length" is "Fixed Length"

The area after the device number specified on the "Element Setting" window becomes the data storage area. 1
The occupied data storage area differs according to the "Unit of Stored Data".
• When "Lower Byte + Upper Byte" is selected, the same size as the data length is occupied. (However, when the data length
of a send packet is an odd number, the upper byte (lower byte for "Byte Swap") of the end device is not sent. When the data
length of a receive packet is an odd number, the last data is stored with one byte of 00H.)
• When "Lower Bytes Only" is selected, a size double the data length is occupied.

(Word) Specified device

+0
Send
Data storage area
packet

Data storage area

Receive
Data storage area
packet

+n

For send packet: Send data is stored by the program

For receive packet: Receive data is stored by the Ethernet-equipped module

■When "Fixed Length/Variable Length" is "Variable Length"

The area after the device number specified on the "Element Setting" window + 1 becomes the data storage area.
The occupied data storage area differs according to the "Unit of Stored Data".
• When "Lower Byte + Upper Byte" is selected, the same size as the data length + one word (length for the data length
storage area) are occupied. (However, when the data length of a send packet is an odd number, the upper byte (lower byte
for "Byte Swap") of the end device is not sent. When the data length of a receive packet is an odd number, the last data is
stored with one byte of 00H.)
• When "Lower Bytes Only" is selected, a size double the data length + one word (for data length storage area) is occupied.

(Word) Specified device

+0 Data length storage area*1

+1
Send
Data storage area
packet

· Data storage area

Receive
Data storage area
packet

+n

For send packet: Send data is stored by the program

For receive packet: Receive data is stored by the Ethernet-equipped module
*1 The data length unit is byte fixed

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 47
 When "Fixed Length/Variable Length" is "Variable Length" and the configuration is set as follows, an error
occurs:
• An element other than static data is placed behind a non-conversion variable element when non-conversion
variable is out of the length calculating range or when there is no length element (except for when non-
conversion variable is placed at the end of the packet elements).
• Multiple non-conversion variable elements are placed in the length calculating range, while a length element
is not placed.
• A non-conversion variable element is placed before a length element in the length calculating range.

Non-verified reception

Use this when receive data include unnecessary data.

If the receive packet contains non-verified reception, Ethernet-equipped module skims over the specified number of
characters.
Multiple non-verified reception elements can be set in one packet.
The following table lists the items.
Item Description Remarks
Element Name Set the element name. 
Data Length 0 (Number of characters Set when the number of characters that are not verified differs 
variable) between each communication session.
1 to 2046 (number of Set the number of characters that are not verified.
character specification)

When "Data Length" is set to 0, an error will occur if the following layout is used.
• An element other than static data is placed behind a non-verified reception element when non-verified
reception is out of the length calculating range or when there is no length element (except for when non-
verified reception is placed at the end of the packet elements).
• Multiple non-verified reception elements are placed in the length calculating range, while a length element is
not placed.
• A non-verified reception element is placed before a length element in the length calculating range.

1 FUNCTIONS
48 1.3 Communications Using the Predefined Protocol
Execution conditions of predefined protocol communications
The predefined protocol communications can be executed when 'Predefined protocol ready' (Un\G1901002.0) is on. 1
This section describes the operation of 'Predefined protocol ready' (Un\G1901002.0).

When the system is powered on or reset

If protocol setting data is written in, the Ethernet-equipped module checks the protocol setting data when the system is
powered on or reset.
If the protocol setting data is normal, the Ethernet-equipped module turns on 'Predefined protocol ready' (Un\G1901002.0),
and enables execution of the protocol.
'Predefined protocol ready' (Un\G1901002.0) is used as the interlock signal for executing the protocol.
If the protocol setting data is abnormal, 'Predefined protocol ready' (Un\G1901002.0) stays off, and the details of the error are
stored in 'Predefined protocol setting data check area' (Un\G1901020 to Un\G1901047).
If protocol setting data is not written in, the protocol setting data is not checked, and 'Predefined protocol ready'
(Un\G1901002.0) remains off.
Whether the protocol setting data is registered or not can be checked with 'Number of registered predefined protocols'
(Un\G1901024) and 'Predefined protocol registration' (Un\G1901032 to Un\G1901047).

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 49
 ■When protocol setting data is normal
Power on/reset
Normal result

Checking the protocol

Ethernet-equipped module
setting data

Bit 0 turns on when the

check result is normal.

'Predefined protocol ready'

(Un\G1901002.0)

'Predefined protocol setting

The number of registered protocols and information
data check area'
about whether protocols have been registered are stored.
(Un\G1901020 to Un\G1901047)

■When protocol setting data is abnormal

Power on/reset
Abnormal result

Checking the protocol

Ethernet-equipped module
setting data

Bit 0 remains off.

'Predefined protocol ready'

(Un\G1901002.0)

'Predefined protocol setting

data check area' The error details are stored.
(Un\G1901020 to Un\G1901047)

When executing UINI instruction

When the RJ71EN71 network type is set to "Q Compatible Ethernet" and the UINI instruction is executed, the protocol setting
data will not be checked.
Predefined protocol ready maintains the state before the UINI instruction was executed.

1 FUNCTIONS
50 1.3 Communications Using the Predefined Protocol
Example of predefined protocol communications
This section describes an example of predefined protocol communications using UDP/IP. 1
System configuration
Sending side Receiving side
GX Works3
(192.0.1.100) (192.0.1.101)

Ethernet

Parameter settings
Connect the engineering tool to the CPU module and set the parameters.

■Sending side
1. Set the CPU module as follows.
[Project]  [New]

2. Click the [Setting Change] button in the following window and set the item to use module labels.

3. Click the [OK] button to add the module labels of the CPU module.

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 51
 4. Set the RJ71EN71 as follows.
[Navigation window]  [Parameter]  [Module Information]  Right-click  [Add New Module]

5. Click the [OK] button to add the module labels of the RJ71EN71.

6. Set the items in "Basic Settings" as follows.

[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings]

1 FUNCTIONS
52 1.3 Communications Using the Predefined Protocol
7. Set the network configuration as follows.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings]  [External Device Configuration] 1

8. Start the predefined protocol support function.

[Tool]  [Predefined Protocol Support Function]

9. Select "Ethernet Module" for "Module Type" and click the [OK] button.

10. Newly create the protocol setting.

[File]  [New]

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 53
 11. Set the protocol as follows.
[Edit]  [Add Protocol]

12. Set each packet as follows.

"Protocol Setting" window  Packet to be set
• Request

1 FUNCTIONS
54 1.3 Communications Using the Predefined Protocol
• Normal response

• Error response

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 55
 13. Write the protocol setting data to the CPU module.
[Online]  [Write to Module]

14. Write the set parameters to the CPU module. Then reset the CPU module or power off and on the system.
[Online]  [Write to PLC]

In this example, default values were used for parameters that are not shown above. For the parameter setting,
refer to the chapter explaining the parameters in this manual. ( Page 261 PARAMETER SETTINGS)

■Receiving side
1. Set the CPU module and add the module labels of the CPU module. The setting method of the CPU module and addition
method of the module label are the same as those of when setting the sending side. ( Page 51 Sending side)

2. Set the RJ71EN71 and add the module labels of the RJ71EN71. The setting method of the RJ71EN71 and addition
method of the module label are the same as those of when setting the sending side. ( Page 51 Sending side)
3. Set the items in "Basic Settings" as follows.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings]

1 FUNCTIONS
56 1.3 Communications Using the Predefined Protocol
4. Set the network configuration as follows.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings]  [External Device Configuration] 1

5. Write the set parameters to the CPU module. Then reset the CPU module or power off and on the system.
[Online]  [Write to PLC]

In this example, default values were used for parameters that are not shown above. For the parameter setting,
refer to the chapter explaining the parameters in this manual. ( Page 261 PARAMETER SETTINGS)

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 57
 Program examples
Classification Label name Description Device
Module label EN71_EE_1.bnCompletion_ConnectionOpen_D[1] Open completion signal (connection No.1) U0\G1900000.0
EN71_EE_1.uCompletion_EthernetInitialized_D.0 Initial status U0\G1900024.0
EN71_EE_1.bReady_PredefinedProtocol_D Predefined protocol ready U0\G1901002.0
Label to be defined Define global labels as shown below:

1 FUNCTIONS
58 1.3 Communications Using the Predefined Protocol
 1

(0) When 'bStart' (M0) is turned on, the protocol is executed by the dedicated instruction GP.ECPRTCL, and D100 to D109 of the receiving side CPU module
is read and stored in D14 to D23 of the sending side CPU module.
'bComp_OK' (M10) is turned on when the protocol completed successfully.

D0 to D8 stores the following as a protocol setting data.

Device Element name Setting Description
number value
D0 Serial No.  The number increases one by one each time the 'bStart' (M0) is turned on.
D1 Network No. 0H Because the access destination is the connected station (own station), 0H is stored as the request
destination network number.
D2 Station No. FFH Because the access destination is the connected station (own station), FFH is stored as the
request destination station number.
D3 Requested module I/O 3FFH Because the access destination is the receiving side CPU module (control CPU of the receiving
No. side RJ71EN71), 3FFH is stored.
D4 Monitoring timer 10H The monitoring timer is set to 4 seconds. (Unit: 250ms)
D5 to D6 Head device No. 100 To read D100 to D109, start device number is set to 100.
D7 Device code A8H To read D100 to D109, device code is set to A8H.
D8 Number of device points 10 To read 10 points from D100 to D109, number of device points is set to 10.

In this program example, a receiving side program is not required.

1 FUNCTIONS
1.3 Communications Using the Predefined Protocol 59
 1.4 Socket Communications
Using dedicated instructions, arbitrary data can be exchanged with an external device connected by Ethernet over TCP/IP or
UDP/IP. ( Page 397 Socket communications instructions)
Use this for bidirectional communication one-on-one with an external device.
Ethernet

Receive or
broadcast receive External device

Ethernet-equipped module
Send

Broadcast send External device

Broadcast send

External device

For examples of socket communications, refer to the following.

 MELSEC iQ-R Ethernet/CC-Link IE User's Manual (Startup)

Precautions
Socket communications cannot be used when the RJ71EN71 network type is set to "Q Compatible Ethernet".

Setting procedure
Set "External Device Configuration" under "Basic Settings". ( Page 264 External Device Configuration)

1. Select the external device to be connected in "Module List" and drag it to "List of devices" or "Device map area".
External device name Description
UDP Connection Module Select to communicate with the external device using UDP/IP.
Active Connection Module Select to perform the open processing to the external device from the Ethernet-equipped module (Active open)
and communicate using TCP/IP.
Unpassive Connection Module Select to receive the open processing from an unspecified external device (Unpassive open) and communicate
using TCP/IP.
Fullpassive Connection Module Select to receive the open processing from the specified external device (Fullpassive open) and communicate
using TCP/IP.

2. Set "Communication Method" for the external device to "Socket Communication".

3. Set the other parameters required for communication in the connection.

1 FUNCTIONS
60 1.4 Socket Communications
Applicable dedicated instructions
For the dedicated instructions used for socket communications, refer to the following. 1
• Page 396 Open/close processing instructions
• Page 397 Socket communications instructions

Applicable connections
The following connections can be used for data exchange with socket communications.
Module Usable connections
RJ71EN71 P1 connector Connection No.17 to 64
P2 connector Connection No.1 to 64
RnENCPU (network part) P1 connector Connection No.17 to 64
CPU module (built-in Ethernet port part) Connection No.1 to 16

1 FUNCTIONS
1.4 Socket Communications 61
 Communication structure
With socket communications, port numbers that identify the communication are used to enable multiple communication
sessions with the external device. These are used for both TCP/IP and UDP/IP.
For send: Specify send source Ethernet-equipped module's port number and the send destination external device's port
number.
For receive: Specify the Ethernet-equipped module's port number, and read the data sent to that port.

Ethernet-equipped module
(IP address: xx.xx.xx.xx) Ethernet

(1)
External device 1
(IP address: yy.yy.yy.yy)
Port No.A (2) Port No.L

(3)
External device 2
(IP address: zz.zz.zz.zz)
Port No.B (3) Port No.M

(4)
External device 3
(IP address: ww.ww.ww.ww)
Port No.C (5) Port No.N

(1) Sending UDP data from Ethernet-equipped module's port number A to external device 1's port number L
(2) Sending UDP data from external device 1's port number L to Ethernet-equipped module's port number A
(3) Sending data with TCP/IP connection
(4) Sending UDP data from Ethernet-equipped module's port number C to external device 3's port number N
(5) Sending UDP data from external device 3's port number N to Ethernet-equipped module's port number C

1 FUNCTIONS
62 1.4 Socket Communications
Communications using TCP/IP
TCP/IP protocol establishes a connection between the external device's port number for reliable data exchange. 1
Check the following items before performing socket communications using TCP/IP.
• IP addresses and port numbers on external device side
• IP addresses and port numbers on the Ethernet-equipped module side
• Which side, the external device side or Ethernet-equipped module side, will open a connection (Active open or Passive
open)

TCP/IP connection operation

TCP/IP connection includes Active open and Passive open.
First, the side with the TCP/IP connection executes Passive open with the specified port number
The side with TCP/IP connection specifies the port number waiting in the Passive open side, and executes Active open.
This enables the TCP/IP connection, the connection is established, and data can be exchanged.
For details on Active open and Passive open, refer to the following.
( Page 400 TCP/IP communications)

The Active open and Passive open expression may differ according to the external device.
• Active open: TCP/IP connection side, client side, connect side, and others
• Passive open: TCP/IP connection wait side, server side, listen side, and others

■Active open
The following figure shows the flow of data exchange using Active open.

Start ⋅⋅⋅ Specify the port number of the external device waiting for
TCP connection and open a connection by Active open.

Open processing

YES
Was data transfer (Completed, or disconnected by the external device.)
completed?

NO

Send by the SOCSND instruction, or receive by Close processing

the SOCRCV or SOCRCVS instruction.

End

■Passive open
The following figure shows the flow of data exchange using Passive open.

Start ⋅⋅⋅ Waiting for TCP connection in Passive open state.

NO
Send or receive?

YES

Send by the SOCSND instruction, or receive by

the SOCRCV or SOCRCVS instruction.

1 FUNCTIONS
1.4 Socket Communications 63
 Precautions for TCP/IP communications
■Conditions for closing
In addition to when close is requested from the external device, the TCP/IP communications processing will be closed in the
following cases if 'Open completion signal' (Un\G1900000 to Un\G1900007) turns off.
• When alive check function times out
• When forced close is received from external device

■TCP/IP connection elements

The TCP/IP connection is managed with the following four elements. Only one connection containing the same four elements
can be created at one time. To use multiple TCP/IP connections simultaneously, ensure that one of the four elements is
different.
• IP address of the Ethernet-equipped module side
• Port number of the Ethernet-equipped module side
• IP address of the external device side
• Port number of the external device side

■Reconnecting with same connection

After closing the connection during TCP/IP communications, wait at least 500ms before reconnecting to a connection with the
same external device (IP address), own station port number, and external device port number.
If a wait interval cannot be provided before reconnecting, changing the own station port number on the Active open side and
connecting is recommended.

1 FUNCTIONS
64 1.4 Socket Communications
■Checking the receive data length
There is no concept of delimiting the communication data during communication with TCP/IP. Thus, the continuously sent
data may be merged on the received side, or the data sent in a group may be split on the receive side. If necessary, the 1
receiving side must check the receive data length and perform the processing.
If the data length is determined when receiving with the Ethernet-equipped module side, using the fixed-length mode is
recommended.
When receiving on the external device side, check the receive data length and perform the processing as shown below.

Receive processing on the external device side

Received message, receive processing

NO
Is TCP connection open?

Receive the rest of the message. TCP connection is closed.

YES

Received data within NO

the time specified by the monitoring
timer value?
YES

Check the received data size.

NO
Sufficient receive data size?

YES

Processing for the received message

Was the entire received message NO

processed?

YES

End Error handling

■Precautions for Active open

Use 'Open completion signal' (Un\G1900000 to Un\G1900007) and 'Open request signal' (Un\G1900008 to Un\G1900015) in
the program to create an interlock circuit. The on/off timing for the open completion signal and open request signal is shown
below.
<When disconnected by the Ethernet-equipped module>
'Open completion signal' ON TCP disconnection completed upon response from the external device
(Un\G1900000 to Un\G1900007) OFF

'Open request signal' ON

TCP disconnection request from the Ethernet-equipped module
(Un\G1900008 to Un\G1900015) OFF

OPEN instruction CLOSE instruction

<When disconnected by the external device>

⋅⋅⋅ TCP disconnection request from the external device

⋅⋅⋅ TCP disconnection completed upon response from the Ethernet-equipped module

CLOSE instruction

1 FUNCTIONS
1.4 Socket Communications 65
 ■Precautions for Passive open
• Use 'Open completion signal' (Un\G1900000 to Un\G1900007) and 'Open request signal' (Un\G1900008 to Un\G1900015)
in the program to create an interlock circuit. The on/off timing for the open completion signal and open request signal is
shown below.

TCP disconnection completed by the external device

'Open completion signal' ON

(Un\G1900000 to Un\G1900007) OFF

'Open request signal' ON

(Un\G1900008 to Un\G1900015) OFF

TCP connection completed by the external device Always on

• When the CPU module is connected to the external device with Passive open, the connected external device's IP address
or the external device's port number can be retrieved with the SP.SOCCINF instruction.
• With TCP/IP, one external device is connected to with one connection. To connect with multiple external devices with the
same own station port number, provide a connection for each external device. If more external devices than the prepared
number of connections are connected, the connection will be disconnected immediately.
• Connect from the external device after the Ethernet-equipped module enters the open standby state. The TCP/IP
connection request received from the external device between the time from CPU startup completion to open wait state
causes an error, and force close connection is returned to the external device. In this case, wait for the Ethernet-equipped
module to enter the open wait state and then retry from the external device.
• Do not execute the GP.CONCLOSE instruction or SP.SOCCLOSE instruction in the program. If the GP.CONCLOSE
instruction or SP.SOCCLOSE instruction is executed, the open completion signal and open request signal for the
corresponding connection will turn off. The close processing will be executed and send/receive will be disabled. To re-open
a closed connection, execute the GP.CONOPEN instruction or SP.SOCOPEN instruction.

Communications using UDP/IP

Communication with UDP/IP uses a simple protocol without order control or re-send control.
Check the following items before performing socket communications using UDP/IP.
• IP addresses and port numbers on external device side
• IP addresses and port numbers on the Ethernet-equipped module side

Precautions for UDP/IP communications

• Loss of data, data arrival order interchange, and others could be occur. Consider using TCP/IP if there are problems.
• Even if the communication line between the CPU module and external device is not connected because of a connected
cable disconnection and others, the data send processing may end normally. Thus, providing a communication procedure
and sending/receiving data is recommended.
• Use the SP.SOCCSET instruction to change the external device with the CPU module.
• 'Open completion signal' (Un\G1900000 to Un\G1900007) and 'Open request signal' (Un\G1900008 to Un\G1900015) for
the connection set to UDP/IP is always on.
• Do not execute the GP.CONCLOSE instruction or SP.SOCCLOSE instruction in the program. If the GP.CONCLOSE
instruction or SP.SOCCLOSE instruction is executed, the open completion signal and open request signal for the
corresponding connection will turn off. The close processing will be executed and send/receive will be disabled. To re-open
a closed connection, execute the GP.CONOPEN instruction or SP.SOCOPEN instruction.
• Even if 'Open completion signal' (Un\G1900000 to Un\G1900007) is turned on, data sending may fail. If data sending fails,
send the data again.

1 FUNCTIONS
66 1.4 Socket Communications
Broadcast communications
Broadcast communications is a communication method that does not specify the external device. Data is exchanged between 1
all Ethernet-equipped module stations and external devices on the same Ethernet to which the Ethernet-equipped modules
are connected.
Item Description
Broadcast sending The same data is sent to all Ethernet devices on the same Ethernet.
Broadcast receiving The data sent with broadcast send is received.

Setting procedure
Set "External Device Configuration" under "Basic Settings". ( Page 264 External Device Configuration)

1. Select "UDP Connection Module" in "Module List" and drag it to "List of devices" or "Device map area".

2. Set "Communication Method" for the external device to "Broadcast Send" or "Broadcast Receive".

3. Set the other parameters required for communication in the connection.

Precautions
• Decide the dedicated port number for broadcast communication in the system, and use that number.
• Access via a router is not permitted when using broadcast send.
• The external device connected on the same Ethernet must carry out a read/discard processing if the message received
with broadcast receiving is not required.
• When the CPU module receives the data with broadcast receiving, the IP address of the sending external device and the
external device's port number can be retried with the SP.SOCCINF instruction.

1 FUNCTIONS
1.4 Socket Communications 67
 Precautions
This section describes the precautions for exchanging data with socket communications.

Port number
Port numbers 1 to 1023 are typically reserved port numbers (WELL KNOWN PORT NUMBERS) and 61440 to 65534 are
used by other communication functions, so 1024 to 4999 or 5010 to 61439 should be used for the own station port numbers.
5000 to 5009 are used by the system and must not be specified. ( Page 424 Port Numbers Used by Ethernet-equipped
Module)
When using the file transfer function (FTP server), do not specify 20 or 21 for socket communications. When using the time
setting function (SNTP client), do not specify 123 for socket communications.

Reading received data

If 'Socket/fixed buffer reception status signal' (Un\G1900016 to Un\G1900023) is on, read the received data. The
communication could be affected if large amounts of data are not read out for a while.

Accessing a file during communication

The CPU module prioritizes the file access processing over the Ethernet communication processing. Thus, if the file is
accessed with FTP, the engineering tool, and so on, during socket communications, the socket communications processing
could be delayed.
To access a file while monitoring the response time with the external device with socket communications, add the time
required for accessing the file to the monitoring time.

Module FB and dedicated instruction

• When performing the open processing using the module FB or dedicated instruction, start sending and receiving data after
the module FB or dedicated instruction is completed.
• Multiple module FBs or dedicated instructions to one connection cannot be simultaneously executed. When multiple
module FBs or dedicated instructions are simultaneously executed, no operation is performed for the module FB or
dedicated instruction executed later. Execute again after the module FB or dedicated instruction in execution is completed.

1 FUNCTIONS
68 1.4 Socket Communications
1.5 Communications Using the Fixed Buffer
Communications using the fixed buffer uses TCP/IP and UDP/IP to send and receive arbitrary data with the external device
1
connected to the Ethernet with dedicated instructions in the same manner as exchanging data with socket communications.
Exchanges arbitrary data between the CPU module and external device using the fixed buffer of the RJ71EN71 and the
RnENCPU (network part).
The following table lists the differences with socket communications are given below.
Item Differences
Socket communications Communications using the fixed buffer
Connection send/receive Send/receive is possible with one connection Specify send or receive for one connection
(Two connections are required for send and
receive)

Precautions
The CPU module (CPU part for the RnENCPU) cannot exchange data with the fixed buffer.

Differences between the "Procedure Exist" and "No Procedure"

control methods
"Procedure Exist" and "No Procedure" control methods can be used for fixed buffer communication. The following table lists
the differences between "Procedure Exist" and "No Procedure".
Item Differences
Procedure Exist No Procedure
Message format Data is sent and received with the predetermined Data is sent and received according to the external
data format. device's message format.
Response for received data A response is sent for the received data. No response is sent for the received data.
Data Code Data can be exchanged with binary code or ASCII Data is exchanged only with binary codes.
code.
Data length specified with dedicated instructions Specify with a number of words. Specify with a number of bytes.
Amount of application data per data exchange Maximum 5113 words (binary code) Maximum 10238 bytes
session*1 Maximum 2556 words (ASCII code)

*1 The following value is used if the RJ71EN71 network type is set to "Q Compatible Ethernet".
Procedure Exist: Maximum 1017 words (binary code), maximum 508 words (ASCII code)
No Procedure: Maximum 2046 bytes

Setting procedure
Set "External Device Configuration" under "Basic Settings". ( Page 264 External Device Configuration)

1. Select the external device to be connected in "Module List" and drag it to "List of devices" or "Device map area".
External device name Description
UDP Connection Module Select to communicate with the external device using UDP/IP.
Active Connection Module Select to perform the open processing to the external device from the Ethernet-equipped module (Active open)
and communicate using TCP/IP.
Unpassive Connection Module Select to receive the open processing from an unspecified external device (Unpassive open) and communicate
using TCP/IP.
Fullpassive Connection Module Select to receive the open processing from the specified external device (Fullpassive open) and communicate
using TCP/IP.

2. Set "Communication Method" for the external device to "Fixed Buffer (Procedure Exist)" or "Fixed Buffer (No
Procedure)".

3. Set the "Fixed Buffer Send/Receive Setting".

4. Set the other parameters required for communication in the connection.

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 69
 Applicable dedicated instructions
For the dedicated instructions used for communications using the fixed buffer, refer to the following.
• Page 396 Open/close processing instructions
• Page 397 Instructions for communications using the fixed buffer
GP.CONOPEN and GP.CONCLOSE of the open/close processing instructions are not available when "Q Compatible
Ethernet" is set to network type.

Applicable connections
The connections No.1 to 16 of the P1 connector can be used for the communications using the fixed buffer.
Communications using the fixed buffer cannot be used with the P2 connector.

Communication structure
This section describes the mechanism of communication with fixed buffer communication.

Data flow
Dedicated instructions are used to send and receive data in fixed buffer communication ( Page 70 Applicable dedicated
instructions)
With "Procedure Exist", the CPU module and external device exchange data one-on-one. A handshake is established with the
external device when sending data form the CPU module and receiving data from the external device.
With "No Procedure", data is sent from the CPU module and received from the external device without a procedure.
RJ71EN71
Fixed buffer

BUFSND instruction No.1

No.2
No.3
BUFRCV instruction No.4
CPU module

External device
No.16

1 FUNCTIONS
70 1.5 Communications Using the Fixed Buffer
External devices capable of data exchange
Data can be exchanged with the following external devices.
1
• Devices in Ethernet to which the RJ71EN71 is connected
• Devices in Ethernet to which the RnENCPU (network part) is connected
• Device connected via router
As the following figure shows, the external device for communication and the working application (for send/receive and
"Procedure Exist"/"No Procedure") are set in "External Device Configuration" under "Basic Settings" using each fixed buffer
(No.1 to No.16) to fix the external device for each buffer.

Fixed buffer No.1 For sending data to the external device 1

Fixed buffer No.2 For receiving data from the external device 1
External device 1
Fixed buffer No.3 For receiving data from the external device 8

External device 8

Fixed buffer No.16 For sending data to the external device 28

External device 28

Pay attention to the following when changing the external device.

• During TCP/IP communications, the external device can be changed only when a connection is not established with the
external device (when the open completion signal is off).
• During UDP/IP communications, the external device can be changed regardless of the connection status with the external
device.
• When changing the external device, do not use the pairing open or alive check function.

Processing during data send/receive

■During data send
When the BUFSND instruction is executed, the RJ71EN71 and the RnENCPU (network part) send data from the
corresponding fixed buffer to the external device set in the specified connection.

■During data reception

If the data is being received from an external device set in the specified connection, the RJ71EN71 and the RnENCPU
(network part) process the reception.
If data is being received from an external device that is not set in the specified connection, the RJ71EN71 and the RnENCPU
(network part) will ignore the received data.

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 71
 Send procedure
The following figure shows the processing when sending data from the RJ71EN71 or the RnENCPU (network part) to the
external device.

Procedure exists
The following figure shows the send processing for the fixed buffer No.1 area corresponding to the connection No.1.
Initial processing Open processing Sending data Receiving a response

Ò
'Initial status' (Un\G1900024.0)

'Open completion signal Ó

(connection No.1)'
(Un\G1900000.0)

BUFSND instruction
Ô

BUFSND instruction completion ×

device 1 scan

BUFSND instruction completion

device +1

Sending data ACK

(TCP only)
ACK
Response (TCP only)
Õ Ö
 Normal completion of the initial processing is checked. ('Initial status' (Un\G1900024.0): On)
 A connection is established between the external device and the RJ71EN71 or the RnENCPU (network part), and normal completion of the connection No.1
open processing is checked. ( Page 400 TCP/IP Communications, UDP/IP Communications)
 The BUFSND instruction is executed. (Sends data)
 The data length amount of send data in the fixed buffer No.1 area is sent to the external device.
 When the external device receives the data from the RJ71EN71 or the RnENCPU (network part), returns a response to the RJ71EN71 or the RnENCPU
(network part).
 When a response is received from the external device, the RJ71EN71 or the RnENCPU (network part) finishes data send. If the response is not returned
within the response monitor timer value, a data send error occurs.*1 If the data send completes abnormally, execute the BUFSND instruction again and start
the send processing.
*1 Adjust the monitor timer value with the parameters. ( Page 281 Timer Settings for Data Communication)

• The details of the open setting are enabled at the rising edge of the RJ71EN71 and the RnENCPU (network
part) open completion signal.
• Send the next data (command) after the data exchange has been completed for the previous data
(command) send.
• When sending or receiving data to multiple external devices, the data can be sent sequentially. However, to
avoid communication trouble, it is recommended to switch the external device and send/receive the data.
When using a connection opened with UDP/IP, the setting value in the communication address setting area
can be changed before sending or receiving to switch the external device.

1 FUNCTIONS
72 1.5 Communications Using the Fixed Buffer
No procedure
The following figure shows the send processing for the fixed buffer No.1 area corresponding to the connection No.1.
1
Initial processing Open processing Sending data

Ò
'Initial status' (Un\G1900024.0)

'Open completion signal Ó

(connection No.1)'
(Un\G1900000.0)

BUFSND instruction Ô

BUFSND instruction completion Ö

device 1 scan

BUFSND instruction completion

device +1

ACK
Sending data (TCP only)
Õ
 Normal completion of the initial processing is checked. ('Initial status' (Un\G1900024.0): On)
 A connection is established between the external device and the RJ71EN71 or the RnENCPU (network part), and normal completion of the connection No.1
open processing is checked. ( Page 400 TCP/IP Communications, UDP/IP Communications)
 The BUFSND instruction is executed. (Sends data)
 The data length amount of send data in the fixed buffer No.1 area is sent to the external device.
 When a response is received from the external device, the RJ71EN71 or the RnENCPU (network part) finishes data send. If the data send completes
abnormally, execute the BUFSND instruction again and start the send processing.

During UDP/IP communications, if the internal processing of the RJ71EN71 and the RnENCPU (network part)
completed normally, the data send processing may end normally even if the communication line between the
CPU module and external device is disconnected because of a connection cable disconnection or other
causes. Thus, providing a communication procedure and sending/receiving data is recommended.

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 73
 Receive procedure
The following figure shows the processing for the RJ71EN71 or the RnENCPU (network part) to receive data from the external
device. The following receive methods can be used.
• Receiving with main program (BUFRCV instruction)
• Receiving with interrupt program (BUFRCVS instruction)

Receiving with main program (procedure exists)

The following figure shows the receive processing for the fixed buffer No.1 area corresponding to the connection No.1.
Initial processing Open processing Receiving data Sending a response

Ò
'Initial status' (Un\G1900024.0)

'Open completion signal Ó

(connection No.1)'
(Un\G1900000.0)

BUFRCV instruction
Õ

BUFRCV instruction completion ×

device 1 scan

BUFRCV instruction completion

device +1
'Socket/fixed buffer reception
status signal (connection No.1)'
(Un\G1900016.0)

Receiving data ACK

(TCP only)
ACK
Response (TCP only)
Ô Ö
 Normal completion of the initial processing is checked. ('Initial status' (Un\G1900024.0): On)
 A connection is established between the external device and the RJ71EN71 or the RnENCPU (network part), and normal completion of the connection No.1
open processing is checked. ( Page 400 TCP/IP Communications, UDP/IP Communications)
 Data is received from the external device. ('Socket/fixed buffer reception status signal (connection No.1)' (Un\G1900016.0): On)
 The BUFRCV instruction is executed, and the receive data length and receive data are read from the fixed buffer No.1. ('Socket/fixed buffer reception status
signal (connection No.1)' (Un\G1900016.0): Off)
 When reading of the receive data length and receive data is completed, a response is returned to the external device.
 The receive processing ends. If the data reception completes abnormally, execute the BUFRCV instruction again and start the receive processing.

• The details of the open setting are enabled at the rising edge of the RJ71EN71 and the RnENCPU (network
part) open completion signal.
• Execute the BUFRCV instruction when the socket/fixed buffer reception status signal changes from OFF to
ON.
• The socket/fixed buffer reception status signal does not turn on when abnormal data is received. In addition,
data is not stored in the fixed buffer No.1 area.

1 FUNCTIONS
74 1.5 Communications Using the Fixed Buffer
Receiving with main program (no procedure)
The following figure shows the receive processing for the fixed buffer No.1 area corresponding to the connection No.1.
1
Initial processing Open processing Receiving data

Ò
'Initial status' (Un\G1900024.0)

'Open completion signal Ó

(connection No.1)'
(Un\G1900000.0)

BUFRCV instruction Õ

BUFRCV instruction completion Ö

device 1 scan
BUFRCV instruction completion
device +1
'Socket/fixed buffer reception
status signal (connection No.1)'
(Un\G1900016.0)

ACK
Receiving data (TCP only)
Ô
 Normal completion of the initial processing is checked. ('Initial status' (Un\G1900024.0): On)
 A connection is established between the external device and the RJ71EN71 or the RnENCPU (network part), and normal completion of the connection No.1
open processing is checked. ( Page 400 TCP/IP Communications, UDP/IP Communications)
 Data is received from the external device. ('Socket/fixed buffer reception status signal (connection No.1)' (Un\G1900016.0): On)
 The BUFRCV instruction is executed, and the receive data length and receive data are read from the fixed buffer No.1. ('Socket/fixed buffer reception status
signal (connection No.1)' (Un\G1900016.0): Off)
 The receive processing ends. If the data reception completes abnormally, execute the BUFRCV instruction again and start the receive processing.

• The details of the open setting are enabled at the rising edge of the RJ71EN71 and the RnENCPU (network
part) open completion signal.
• Execute the BUFRCV instruction when the socket/fixed buffer reception status signal changes from OFF to
ON.
• The socket/fixed buffer reception status signal does not turn on when abnormal data is received. In addition,
data is not stored in the fixed buffer No.1 area.

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 75
 Reception with interrupt program (procedure exists)
Use the BUFRCVS instruction for receiving data with the interrupt program. The interrupt program is started when data is
received from the external device. It enables the reading of receive data to the CPU module.
The interrupt settings are required to use the interrupt program. ( Page 293 Interrupt Settings)
The following figure shows the receive processing for the fixed buffer No.2 area corresponding to the connection No.2.
Initial processing Open processing Receiving data Sending a response

Ò
'Initial status' (Un\G1900024.0)

'Open completion signal Ó

(connection No.2)'
(Un\G1900000.1)

BUFRCVS instruction Õ

×
In interrupt processing

Receiving data ACK

(TCP only)
ACK
Response (TCP only)
Ô Ö

Cycle Cycle

END END
Program Scan processing Scan Interrupt processing Scan processing

 Normal completion of the initial processing is checked. ('Initial status' (Un\G1900024.0): On)
 A connection is established between the external device and the RJ71EN71 or the RnENCPU (network part), and normal completion of the connection No.2
open processing is checked. ( Page 400 TCP/IP Communications, UDP/IP Communications)
 The CPU module is requested to start the interrupt program, and data is received from the external device. ('Socket/fixed buffer reception status signal
(connection No.2)' (Un\G1900016.1): On)
 The interrupt program starts. The BUFRCVS instruction is executed, and the receive data length and receive data are read from the fixed buffer No.2.
('Socket/fixed buffer reception status signal (connection No.2)' (Un\G1900016.1): Off)
 When reading of the receive data length and receive data is completed, a response is returned to the external device.*1
 Execution of the interrupt program ends, and execution of the main program resumes.
*1 A response is not returned when the execution completes abnormally.

1 FUNCTIONS
76 1.5 Communications Using the Fixed Buffer
Reception with interrupt program (no procedure)
Use the BUFRCVS instruction for receiving data with the interrupt program. The interrupt program is started when data is
1
received from the external device. It enables the reading of receive data to the CPU module.
The interrupt settings are required to use the interrupt program. ( Page 293 Interrupt Settings)
The following figure shows the receive processing for the fixed buffer No.2 area corresponding to the connection No.2.
Initial processing Open processing Receiving data

Ò
'Initial status' (Un\G1900024.0)

'Open completion signal Ó

(connection No.2)'
(Un\G1900000.1)

BUFRCVS instruction Õ

Ö
In interrupt processing

Receiving data ACK

(TCP only)

Cycle Cycle

END END
Program Scan processing Scan Interrupt processing Scan processing

 Normal completion of the initial processing is checked. ('Initial status' (Un\G1900024.0): On)
 A connection is established between the external device and the RJ71EN71 or the RnENCPU (network part), and normal completion of the connection No.2
open processing is checked. ( Page 400 TCP/IP Communications, UDP/IP Communications)
 The CPU module is requested to start the interrupt program, and data is received from the external device. ('Socket/fixed buffer reception status signal
(connection No.2)' (Un\G1900016.1): On)
 The interrupt program starts. The BUFRCVS instruction is executed, and the receive data length and receive data are read from the fixed buffer No.2.
('Socket/fixed buffer reception status signal (connection No.2)' (Un\G1900016.1): Off)
 Execution of the interrupt program ends, and execution of the main program resumes.

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 77
 Pairing open
Pairing open is an opening method that pairs a fixed buffer communication reception connection and send connection, and
establishes a connection using one port each from the own station and external device.
When pairing open is specified, data can be exchanged with two connections using an open processing for one port.
(TCP/IP or UDP/IP
RJ71EN71 or RnENCPU (network part) communications)
Send data
Connection No.1 Fixed buffer (for receiving) Port External device
Receive data
Connection No.2 Fixed buffer (for sending)

Setting procedure
Set "External Device Configuration" under "Basic Settings". ( Page 264 External Device Configuration)

1. Select the external device to be connected in "Module List" and drag it to "List of devices" or "Device map area".

2. Set "Communication Method" for the external device.

3. Set the "Fixed Buffer Send/Receive Setting" with the external device to "Pairing (Receive)".*1

4. Set the other parameters required for communication in the connection.

5. Select the same external device as step 1 from the "Module List", and drag to the next connection number of the external
device set in step 1.
6. Set "Communication Method" for the external device to the same as the external device set in step 1.

7. Set the "Fixed Buffer Send/Receive Setting" with the external device to "Pairing (Send)".

8. Set the other parameters to the same values as the external device set in Step (1).
*1 Set "Pairing (Receive)" to connection No.1 to 7, or No.9 to 15.

• Only the external devices in the Ethernet to which the RJ71EN71 or the RnENCPU (network part) is
connected and devices connected via a router can communicate data with pairing open.
• The open/close processing for the next connection (send connection) is executed automatically using the
open/close processing on the receive connection side set to pairing open.

1 FUNCTIONS
78 1.5 Communications Using the Fixed Buffer
Broadcast communications
Broadcast communications is a communication method that does not specify the external device. Data is exchanged between 1
all Ethernet-equipped module stations and external devices on the same Ethernet to which the Ethernet-equipped modules
are connected.
Item Description
Broadcast sending The same data is sent to all Ethernet devices on the same Ethernet.
Broadcast receiving The data sent with broadcast send is received.

Setting procedure
Set "External Device Configuration" under "Basic Settings". ( Page 264 External Device Configuration)

1. Select "UDP Connection Module" in "Module List" and drag it to "List of devices" or "Device map area".

2. Set "Communication Method" for the external device to "Broadcast Send" or "Broadcast Receive".

3. Set the other parameters required for communication in the connection.

Precautions
• Decide the dedicated port number for broadcast communication in the system, and use that number.
• Access via a router is not permitted when using broadcast send.
• The external device connected on the same Ethernet must carry out a read/discard processing if the message received
with broadcast receiving is not required.

Precautions
This section describes the precautions for communications using the fixed buffer.

Precautions for UDP/IP communications

Even if 'Open completion signal' (Un\G1900000 to Un\G1900007) is turned on, data sending may fail. If data sending fails,
send the data again.

Module FB and dedicated instruction

• When performing the open processing using the module FB or dedicated instruction, start sending and receiving data after
the module FB or dedicated instruction is completed.
• Multiple module FBs or dedicated instructions to one connection cannot be simultaneously executed. When multiple
module FBs or dedicated instructions are simultaneously executed, no operation is performed for the module FB or
dedicated instruction executed later. Execute again after the module FB or dedicated instruction in execution is completed.

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 79
 Data format
This section describes the data format used during communications using the fixed buffer.
The communication data is configured of the header and application data.

Header
The header is for TCP/IP or UDP/IP. The RJ71EN71 or the RnENCPU (network part) automatically adds and deletes the
header, the setting is not required.
The contents of the header are shown below.
• TCP/IP

Ethernet (14 bytes) IP (20 bytes) TCP (20 bytes)

• UDP/IP

Ethernet (14 bytes) IP (20 bytes) UDP (8 bytes)

Application data
If the communication procedure is "Fixed Buffer (No Procedure)", the application data expresses the following data code with
binary codes. Data is exchanged with binary codes regardless of the communication data code setting.

Text (command)

Maximum of 10238 bytes

1 FUNCTIONS
80 1.5 Communications Using the Fixed Buffer
 With nonprocedural, the subheader and data length added for procedural are not used, so the data is all
handled as valid text. The RJ71EN71 and the RnENCPU (network part) turn on the fixed buffer reception 1
status signal after storing the size of the received message (packet) in the receive data length storage area.
Providing a check procedure including the data length, data type code, and so on, in the message's
application data is recommended so that the application data's byte size and data type can be seen on the
receiving side.

The following figure shows the configuration of the application data when the communication procedure is set to "Fixed Buffer
(Procedure Exist)".

■Format
• When exchanging data with binary codes
Application data area
(command message)

Maximum of
2 bytes 2 bytes 5113 words

Data length Text

Communication Subheader
setting (command)
request source
L H L H

Communication
request destination Subheader End code

1 byte 1 byte

Application data area

(Response)

• When exchanging data with ASCII codes

Application data area
(command message)

Maximum of
4 bytes 4 bytes 5112 words

Data length Text

Communication Subheader
setting (command)
request source
H - - L H - - L

Communication
request destination Subheader End code

H L H L

2 byte 2 byte

Application data area

(Response)

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 81
 ■Subheader
The RJ71EN71 or the RnENCPU (network part) automatically adds and deletes the subheader, the setting is not required.
Data Format Command (external device  RJ71EN71 or Response (RJ71EN71 or RnENCPU (network
RnENCPU (network part)) part)  external device)
Binary code b7 ⋅⋅⋅ b0 b7 ⋅⋅⋅ b0
0 1 1 0 0 0 0 0 1 1 1 0 0 0 0 0

60H 00H E0H

Subheader Subheader

ASCII code b7 ⋅⋅⋅ b0 b7 ⋅⋅⋅ b0

0 1 1 0 0 0 0 0 1 1 1 0 0 0 0 0
"6" 6H "0" 0H "E" EH "0" 0H

36H 30H 30H 30H 45H 30H

Subheader Subheader

■Data length setting

Shows the amount of data in the text (command) section.
• When exchanging data with binary codes: Maximum 5113 words
• When exchanging data with ASCII codes Maximum 2556 words

1 FUNCTIONS
82 1.5 Communications Using the Fixed Buffer
■Text (command)
Shows the format of the command/response.
• When exchanging data with binary codes 1
Command format

Maximum of 5113 words

60H 00H (L) (H) (L) (H) (L) (H) (L) (H) ⋅⋅⋅ (L) (H)

Subheader
Data specifying/
storing device for sending/
receiving instructions

Data length
n
setting

n+1 (H) (L)

n+2 (H) (L)

Send/
receive data n+3 (H) (L)
⋅⋅⋅

n+setting data length (H) (L)

1 word (2 bytes)

• When exchanging data with ASCII codes

Command format

Maximum of 5112 words

36H 30H 30H 30H (H) ⋅⋅⋅ (L) (H) ⋅⋅⋅ (L) (H) ⋅⋅⋅ (L) ⋅⋅⋅ (H) ⋅⋅⋅ (L)

Subheader
Data specifying/
storing device for sending/
receiving instructions
ASCII-binary conversion
Data length
n
setting

n+1 (H) (L)

n+2 (H) (L)

Send/
receive data
⋅⋅⋅

n+setting data length (H) (L)

Maximum of 2556 words
1 word (2 bytes)

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 83
 ■End code
The error code is stored in the end command added to the response. ( Page 351 End Codes Returned to an External
Device During Data Communications)
The end code is also stored in the BUFSND instruction and BUFRCV instruction completion status area (inside control data).
The following cases may apply if an error code for communications using the SLMP or random access buffer is stored even
when executing communications using the fixed buffer.
Description Remedy method
The data length specified in the application data section of the message sent Specify the actual data size in the text section as the data length in the
from the external device to the RJ71EN71 or the RnENCPU (network part) application data section. (Refer to the following descriptions.)
differs from the actual data size in the text section.
The subheader of the message sent from the external device to the Review the subheader specified in the application data section.
RJ71EN71 or the RnENCPU (network part) is incorrect.

The communication data may be split and exchanged due to buffer limitations to the own station or external station. The data
that is split and received is restored (reassembled) by the RJ71EN71 or the RnENCPU (network part) and exchanged. (The
received data is restored (reassembled) based on the data length in the communication data.) The RJ71EN71 and the
RnENCPU (network part) processing that take place when the data in the communication data is incorrect are shown below.
Communication Description
Method
Fixed Buffer When data length specified immediately after subheader < text data volume
(Procedure Exist), • The data immediately after the text corresponding to the data length specified immediately after the subheader is handled as the
Random Access second message.
Buffer • The start of each statement becomes the subheader, so the RJ71EN71 and the RnENCPU (network part) execute a processing
corresponding to the subheader code.
• If the subheader is not a code supported by the RJ71EN71 and the RnENCPU (network part), an abnormal completion response is
sent to the external device.

Data sent from the external device Data processed by the RJ71EN71 or the RnENCPU (network part)
(1st data) (2nd data)

Subheader Subheader

This section is processed as a subheader.

In the above case, the code processed as the subheader with the uppermost bit set as 1 is returned as the response.
For example, if the command's subheader section is 65H, the response's subheader is E5H.
When data length specified immediately after subheader > text data volume
The RJ71EN71 and the RnENCPU (network part) wait to receive the insufficient remaining data.
If the remaining data is received within the response monitor timer value, the RJ71EN71 and the RnENCPU (network part) execute a
processing corresponding to the subheader code.
If the remaining data is not received within the response monitor timer value, the RJ71EN71 and the RnENCPU (network part) execute
the following processing.
• The ABORT(RST) instruction is sent to the external device, and the line is closed.
• The error code is stored in 'Connection status storage area' (Un\G100 to Un\G163).
Fixed Buffer (No During nonprocedural, there is no message data length, so the received data is stored as is into the receive buffer area. Providing a
Procedure) check procedure including the data length, data type code, and so on, in the message's application data is recommended so that the
application data's byte size and data type can be seen on the receiving side.

1 FUNCTIONS
84 1.5 Communications Using the Fixed Buffer
Example of communications using the fixed buffer
This section describes the socket communications examples using Active open of TCP/IP communications. 1
System configuration
Sending side Receiving side
GX Works3
(192.0.1.100) (192.0.1.101)

Ethernet

Parameter settings
Connect the engineering tool to the CPU module and set the parameters.

■Sending side
1. Set the CPU module as follows.
[Project]  [New]

2. Click the [Setting Change] button in the following window and set the item to use module labels.

3. Click the [OK] button to add the module labels of the CPU module.

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 85
 4. Set the RJ71EN71 as follows.
[Navigation window]  [Parameter]  [Module Information]  Right-click  [Add New Module]

5. Click the [OK] button to add the module labels of the RJ71EN71.

6. Set the items in "Basic Settings" as follows.

[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings]

1 FUNCTIONS
86 1.5 Communications Using the Fixed Buffer
7. Set the network configuration as follows.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings]  [External Device Configuration] 1

8. Write the set parameters to the CPU module. Then reset the CPU module or power off and on the system.
[Online]  [Write to PLC]

In this example, default values were used for parameters that are not shown above. For the parameter setting,
refer to the chapter explaining the parameters in this manual. ( Page 261 PARAMETER SETTINGS)

■Receiving side
1. Set the CPU module and add the module labels of the CPU module. The setting method of the CPU module and addition
method of the module label are the same as those of when setting the sending side. ( Page 85 Sending side)
2. Set the RJ71EN71 and add the module labels of the RJ71EN71. The setting method of the RJ71EN71 and addition
method of the module label are the same as those of when setting the sending side. ( Page 85 Sending side)
3. Set the items in "Basic Settings" as follows.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings]

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 87
 4. Set the network configuration as follows.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings]  [External Device Configuration]

5. Write the set parameters to the CPU module. Then reset the CPU module or power off and on the system.
[Online]  [Write to PLC]

In this example, default values were used for parameters that are not shown above. For the parameter setting,
refer to the chapter explaining the parameters in this manual. ( Page 261 PARAMETER SETTINGS)

1 FUNCTIONS
88 1.5 Communications Using the Fixed Buffer
Program example (sending side)
■Labels 1
Classification Label name Description Device
Module label RCPU.stSM.bAlways_ON Always on SM400
EN71_EE_1.stPort1.uStatus_HUB_Connection_D.0 Connection status U0\G5192.0
EN71_EE_1.bnCompletion_ConnectionOpen[1] Open completion signal (connection No.1) U0\G1900000.0
EN71_EE_1.bnStatus_ConnectionOpenExecution[1] Open request signal (connection No.1) U0\G1900008.0
EN71_EE_1.uCompletion_EthernetInitialized.0 Initial status U0\G1900024.0
Label to be defined Define global labels as shown below:

■FBs
The following shows FBs to be used in the program example.
• M_RJ71EN71_EE_Refresh_Data
• M_RJ71EN71_EE_ConnectionOpen
• M_RJ71EN71_EE_Send_Socket
• M_RJ71EN71_EE_ConnectionClose

■Program

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 89
 1 FUNCTIONS
90 1.5 Communications Using the Fixed Buffer
 1

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 91
 (0) The refresh processing of the module label is performed. (The processing is required for when using the module function block.)
When the refresh processing is completed, 'bRunRefresh' (M0) is turned on.
(56) When 'bStartOpen' (M1) is turned on, the open processing of connection No.1 is performed.
When the open processing is completed successfully, 'bOpen_OK' (M3) is turned on.
(252) When 'bStartSend' (M5) is turned on, the send data is stored and sent to the receiving side.
When the data send is completed successfully, 'bSend_OK' (M7) is turned on.
(341) When 'bStartClose' (M13) is turned on, the close processing of connection No.1 is performed.
When the close processing is completed successfully, 'bClose_OK' (M15) is turned on.

1 FUNCTIONS
92 1.5 Communications Using the Fixed Buffer
Program example (receiving side)
■Labels 1
Classification Label name Description Device
Module label RCPU.stSM.bAlways_ON Always on SM400
EN71_EE_1.bnCompletion_ConnectionOpen[1] Open completion signal (connection No.1) U0\G1900000.0
EN71_EE_1.bnCompletion_ReceiveSocket_FixedBuffer[1] Socket/fixed buffer reception status signal U0\G1900016.0
(connection No.1)
EN71_EE_1.uCompletion_EthernetInitialized.0 Initial status U0\G1900024.0
Label to be defined Define global labels as shown below:

■FBs
The following shows FBs to be used in the program example.
• M_RJ71EN71_EE_Refresh_Data
• M_RJ71EN71_EE_Recv_Socket

■Program

1 FUNCTIONS
1.5 Communications Using the Fixed Buffer 93
 (0) The refresh processing of the module label is performed. (The processing is required for when using the module function block.)
When the refresh processing is completed, 'bRunRefresh' (M0) is turned on.
(98) When 'bStartRecv' (M9) is turned on, the data sent from the sending side is received and stored in 'uRecvData' (D2000).
(The device range in which data is stored varies depending on the data length of the received data.)
When the data receive is completed successfully, 'bRecv_OK' (M11) is turned on.

• Secure sufficient device areas according to the maximum length of data sent from the send source to
prevent the device areas used for other purposes from being overwritten by the receive data.
• When the data receive is consecutively executed, turn on pbi_bReadTiming (read timing) as shown in the
above program.
• To receive data at shorter intervals than the scan time of the CPU module, add the normally closed contact
of 'bRecv_OK' (M11) and 'bRecv_NG' (M12) to the execution conditions of FB for receiving as shown in the
above program. When there is no normally closed contact of 'bRecv_OK' (M11) and 'bRecv_NG' (M12),
'bStartRecvFB' (M17) is not turned off and on and the FB for receiving may not be executed.

1 FUNCTIONS
94 1.5 Communications Using the Fixed Buffer
1.6 Communications Using the Random Access
Buffer 1
With communications using the random access buffer, data can be freely read and written between any external device
(excluding Ethernet-equipped module) and the RJ71EN71 or the RnENCPU (network part). The external device does not
need to be fixed. The random access buffer is used as the common buffer area for external devices connected to the
Ethernet.
RJ71EN71 or RnENCPU
(network part)

External Writing Writing External

device device

Reading Random Reading

access
Writing buffer Writing

External External
device Reading Reading device

Writing Reading

External
device

Precautions
The CPU module (CPU part for the RnENCPU) cannot exchange data with the random access buffer.

Setting procedure
Set "External Device Configuration" under "Basic Settings". ( Page 264 External Device Configuration)

1. Select the external device to be connected in "Module List" and drag it to "List of devices" or "Device map area".
External device name Description
UDP Connection Module Select to communicate with the external device using UDP/IP.
Active Connection Module Select to perform the open processing to the external device from the Ethernet-equipped module (Active open)
and communicate using TCP/IP.
Unpassive Connection Module Select to receive the open processing from an unspecified external device (Unpassive open) and communicate
using TCP/IP.
Fullpassive Connection Module Select to receive the open processing from the specified external device (Fullpassive open) and communicate
using TCP/IP.

2. Set "Communication Method" for external device to "Random Access Buffer".

3. Set the IP address of the external device.

4. Set the other parameters required for communication in the connection. ( Page 264 External Device Configuration)

1 FUNCTIONS
1.6 Communications Using the Random Access Buffer 95
 Communication structure
This section describes the mechanism of communications using the random access buffer.

Data flow
The following figure shows the flow of data communications using the random access buffer.
A dedicated packet is used to exchange data between the external device and the RJ71EN71 or the RnENCPU (network
part).
A program is used to access the random access buffer from the CPU module.

The process is executed asynchronously with the program, so if synchronization is required, use socket
communications or communications using the fixed buffer.

External devices capable of data exchange

Data can be exchanged with the following external devices.
• Devices in Ethernet to which the RJ71EN71 is connected
• Devices in Ethernet to which the RnENCPU (network part) is connected
• Device connected via router

Procedure for reading from external device

The following figure shows the processing when sending data from the RJ71EN71 or the RnENCPU (network part) in
response to a read request from the external device.

RJ71EN71 or RnENCPU
CPU module (network part) 4 Read request (command)

Random access ACK (TCP only)

buffer
3 Writing using the TO
instruction 5 Response/data read
External device
ACK (TCP only)
 After the module parameters are set, check that the initial processing of the RJ71EN71 or the RnENCPU (network part) has completed normally. ('Initial
status' (Un\G1900024.0): On)
 The open processing is executed to establish a connection between the RJ71EN71 or the RnENCPU (network part) and external device. ( Page 400
TCP/IP Communications, UDP/IP Communications)
 The program writes the data into the random access buffer of the RJ71EN71 or the RnENCPU (network part).
 The read request is sent from the external device to the RJ71EN71 or the RnENCPU (network part) asynchronously from the above processing. (RJ71EN71
or RnENCPU (network part) side: Receives command)
 When the read request is received from the external device, the RJ71EN71 or the RnENCPU (network part) send the data written into the random access
buffer to the external device. (RJ71EN71 or RnENCPU (network part) side: Sends response)
 The connection is closed when communication is finished.

1 FUNCTIONS
96 1.6 Communications Using the Random Access Buffer
Procedure for writing from external device
The following shows the procedure when writing data from the external device to the random access buffer of the RJ71EN71 1
or the RnENCPU (network part).

1. After the module parameters are set, check that the initial processing of the RJ71EN71 or the RnENCPU (network part)
has completed normally. ('Initial status' (Un\G1900024.0): On)

2. The open processing is executed to establish a connection between the RJ71EN71 or the RnENCPU (network part) and
external device. ( Page 400 TCP/IP Communications, UDP/IP Communications)
3. Data is written from the external device to the random access buffer of the RJ71EN71 or the RnENCPU (network part).
(RJ71EN71 or RnENCPU (network part) side: Receives command)

4. The RJ71EN71 or the RnENCPU (network part) execute the write processing requested by the external device, and
returns the write results to the external device that sent the write request. (RJ71EN71 or RnENCPU (network part) side:
Sends response)
5. The data written in the random access buffer is read asynchronously from the above the processing by the program.

6. Close the connection when communication is finished.

1 FUNCTIONS
1.6 Communications Using the Random Access Buffer 97
 Physical address and logical address of random access buffer
This section describes the start address of the random access buffer of the RJ71EN71 or the RnENCPU (network part)
specified in the command.
The address specified for the random access buffer differs from the address specified by the external device and the address
specified with the FROM/TO instruction.
• Physical address: Address specified with program's FROM/TO instruction
• Logical address: Address specified by external device in start address item of command
Physical address Buffer memory areas Logical address

20000 0

Random access
buffer

26143 6143

Precautions
The following section lists the precautions for communications using the random access buffer.

Precautions for programming

■Initial processing and open processing completion
The initial processing and connection open processing must be completed.

■Send request from CPU module

Send cannot be requested from the CPU module. Completion of sending to CPU module is not checked. If the data send/
receive must be synchronized between the CPU module and external device, use fixed buffer communication.

■Random access buffer address

The address specified by the external device is different from the address specified with the FROM/TO instruction. For details,
refer to the following.
( Page 98 Physical address and logical address of random access buffer)

Data Format
The communication data is configured of the header and application data.

Header
The header is for TCP/IP or UDP/IP. The RJ71EN71 or the RnENCPU (network part) automatically adds and deletes the
header, the setting is not required.

■Details of header section size

The details of the header section data format and size are shown below.
• TCP/IP

Ethernet (14 bytes) IP (20 bytes) TCP (20 bytes)

• UDP/IP

Ethernet (14 bytes) IP (20 bytes) UDP (8 bytes)

1 FUNCTIONS
98 1.6 Communications Using the Random Access Buffer
Application data
The application data expresses the following data code as binary code or ASCII code. Switch between the binary code and
1
ASCII code with "Own Node Settings" under "Basic Settings". ( Page 262 Own Node Settings)

■Format
• When exchanging data with binary codes
Application data area
(command message)

Maximum of
2 bytes 2 bytes 2 bytes 1017 words

Text
Data length (command)
Communication Subheader Start address
setting (none at read
request source request)
H 00H L H L H
Text
Communication
(response)
request destination Subheader End code (none at write
request)

1 byte 1 byte Maximum of

1017 words

Application data area

(Response)

• When exchanging data with ASCII codes

Application data area
(command message)

Maximum of
4 bytes 4 bytes 4 bytes 1016 words

Text
Data length (command)
Communication Subheader Start address
setting (none at read
request source request)
H L 30H 30H H - - L H - - L
Text
Communication
(response)
request destination Subheader End code (none at write
H L H L request)

2 byte 2 byte Maximum of

1016 words

Application data area

(Response)

■Subheader
The RJ71EN71 or the RnENCPU (network part) automatically adds and deletes the subheader, the setting is not required.
b7 b6 b5 b4 b3 b2 b1 b0
0 1 1 0 0 0 0 1 00H

Only for command (not for response)

Command/response type
(When communications are performed using the random access
buffer, this format is used.)
For data read: 61H
For data write: 62H

Command/response flag
For command: 0
For response: 1

1 FUNCTIONS
1.6 Communications Using the Random Access Buffer 99
 • During read
Data format Command (external device  RJ71EN71 or Response (RJ71EN71 or RnENCPU (network
RnENCPU (network part)) part)  external device)
Binary code b7 ⋅⋅⋅ b0 b7 ⋅⋅⋅ b0
0 1 1 0 0 0 0 1 1 1 1 0 0 0 0 1

61H 00H E1H

Subheader Subheader

ASCII code b7 ⋅⋅⋅ b0 b7 ⋅⋅⋅ b0

0 1 1 0 0 0 0 1 1 1 1 0 0 0 0 1
"6" 6H "1" 1H "E" EH "1" 1H

36H 31H 30H 30H 45H 31H

Subheader Subheader

1 FUNCTIONS
100 1.6 Communications Using the Random Access Buffer
■Start Address
The start address of the random access buffer range where data read/write is executed is expressed as a logical address.
( Page 98 Physical address and logical address of random access buffer) 1
• When exchanging data with binary codes
Specify the head address with a binary value.

L H

2 bytes

• When exchanging data with ASCII codes

Specify the ASCII code for expressing the start address as a hexadecimal.

H − − L

4 bytes

■Data length setting

Express the number of read/write data words with the random access buffer range.
• When exchanging data with binary codes
Specify the number of words as a binary value. (Maximum 1017 words)

L H

2 bytes

• When exchanging data with ASCII codes

Specify the ASCII code when expressing the number of words as a hexadecimal. (Maximum 508 words)

H − − L

4 bytes

1 FUNCTIONS
1.6 Communications Using the Random Access Buffer 101
 ■Text
• When exchanging data with binary codes
Data length (maximum of 1017 words)

(L) (H) (L) (H) (L) (H) (L) (H)

Random access
buffer
Specified n (H) (L)
address

n+1 (H) (L)

n+2 (H) (L)

n + set number of
(H) (L)
words to be read

1 word (2 bytes)

• When exchanging data with ASCII codes

Data length × 2 (maximum of 1016 words)

(H) to (L) (H) to (L) (H) to (L)

ASCII-binary conversion

Random access
buffer
Specified
n (H) (L)
address

n+1 (H) (L)

n + set number of
words to be read (H) (L)
(Maximum of 508 words)

Ex.

(H) (L)

n 12H 34H

n+1 56H 78H

31H 32H 33H 34H 35H 36H 37H 38H

(H) to (L) (H) to (L)

■End code
The error code is stored in the end command added to the response. ( Page 351 End Codes Returned to an External
Device During Data Communications)

1 FUNCTIONS
102 1.6 Communications Using the Random Access Buffer
Example of command/response format
The following section shows an example of the command and response format.
1
■Writing to buffer with write request from external device
• When exchanging data with binary codes
Command format (external device  RJ71EN71)

Subheader Start address Data length Text (10 words)

(L) (H) (L) (H) (L) (H) (L) (H) (L) (H) (L) (H)

62H 00H 00H 00H 0AH 00H 34H 12H 78H 56H BCH 9AH BCH 9AH

Random access buffer

Physical address (H) (L) Logical address

20000 12H 34H 0

20001 56H 78H 1

20002 9AH BCH 2

20009 9AH BCH 9

(10 words)

26143 6143

Response format (RJ71EN71  external device)

Subheader End code

E2H 00H

1 FUNCTIONS
1.6 Communications Using the Random Access Buffer 103
 • When exchanging data with ASCII codes
Command format (external device  RJ71EN71)

Subheader Start address Data length

(H) - - (L) (H) - - (L)

36H 32H 30H 30H 00H 00H 00H 00H 00H 00H 00H 41H

Text (20 words)

(H) - - (L) (H) - - (L) (H) - - (L) (H) - - (L)

31H 32H 33H 34H 35H 36H 37H 38H 39H 41H 42H 43H 39H 41H 42H 43H

ASCII-binary conversion

Random access buffer

Physical address (H) (L) Logical address

20000 12H 34H 0

20001 56H 78H 1

20002 9AH BCH 2

20009 9AH BCH 9

(10 words)

26143 6143

Response format (RJ71EN71  external device)

Subheader End code

45H 32H 30H 30H

1 FUNCTIONS
104 1.6 Communications Using the Random Access Buffer
■Reading from buffer with read request from external device
• When exchanging data with binary codes
Command format (external device  RJ71EN71) 1
Subheader Start address Data length
(L) (H) (L) (H)

61H 00H 14H 00H 0AH 00H

Response format (RJ71EN71  external device)

Subheader End code Text (10 words)

(L) (H) (L) (H) (L) (H) (L) (H)

E1H 00H 34H 12H 78H 56H BCH 9AH BCH 9AH

Random access buffer

Physical address (H) (L) Logical address

20000 0

20020 12H 34H 20

20021 56H 78H 21

20022 9AH BCH 22

20029 9AH BCH 29

(10 words)

26143 6143

1 FUNCTIONS
1.6 Communications Using the Random Access Buffer 105
 • When exchanging data with ASCII codes
Command format (external device  RJ71EN71)

Subheader Start address Data length

(H) - - (L) (H) - - (L)

36H 31H 30H 30H 00H 00H 31H 34H 00H 00H 00H 41H

Response format (RJ71EN71  external device)

Subheader End code

45H 31H 30H 30H

Text (20 words)

(H) - - (L) (H) - - (L) (H) - - (L) (H) - - (L)

31 H 32H 33H 34H 35H 36H 37H 38H 39H 41H 42H 43H 39H 41H 42H 43H

ASCII-binary conversion

Random access buffer

Physical address (H) (L) Logical address

20000 0

20020 12H 34H 20

20021 56H 78H 21

20022 9AH BCH 22

20029 9AH BCH 29

(10 words)

26143 6143

1 FUNCTIONS
106 1.6 Communications Using the Random Access Buffer
Example of communications with random access buffer
The following figure shows an example of the write operation from the external device. 1
External device
CPU module RJ71EN71
Random access buffer
Device memory
D10000 21710

Ô
Data received Data received

21719
D10009 21720 1 1
Ó

Program for receive processing

Ó Ò Receive completion flag

 The receive completion flag is set at the end of the received data.
 The receive completion flag is monitored.
 When the receive completion flag turns on, the data is transferred from the random access buffer to the CPU module.

1 FUNCTIONS
1.6 Communications Using the Random Access Buffer 107
 1.7 Communications Using MODBUS/TCP
MODBUS protocol messages are sent/received via the TCP/IP network.
For communications using MODBUS/TCP, refer to the following.
 MELSEC iQ-R MODBUS and MODBUS/TCP Reference Manual

MODBUS/TCP master function

A module communicates with a MODBUS/TCP slave device as a master station using one of the following functions.
Function Description Available module Reference source
Communications using the Executes the protocol using the • CPU module (built-in Ethernet port part) Page 34 Communications Using the
predefined protocol dedicated instructions when a • RJ71EN71, RnENCPU (network part) Predefined Protocol
MODBUS/TCP is selected from the
predefined protocol library.
Simple CPU Issues a request message for reading/ RJ71EN71, RnENCPU (network part) Page 183 Simple CPU Communication
communication function writing to a MODBUS/TCP slave Function (RJ71EN71, RnENCPU
device automatically. (Network Part))

(1) (3) (2)

(4)
Ethernet

(1) CPU module (built-in Ethernet port part), RJ71EN71, RnENCPU (network part)
(2) MODBUS/TCP slave device
(3) Request message
(4) Response message

MODBUS/TCP slave function

A module communicates with a MODBUS/TCP master device as a slave station using the automatic operations described in
the following pages.
• Page 109 Automatic response to MODBUS/TCP master device
• Page 110 Automatic conversion from MODBUS device
(1) (3) (2)

(4)
Ethernet

(1) MODBUS/TCP master device

(2) RJ71EN71 or RnENCPU (network part)
(3) Request message
(4) Response message

• Before using this function, check the firmware version of the module. ( Page 436 Added and Enhanced
Functions)
• This function is not available when the network type is set to "Q Compatible Ethernet" for the RJ71EN71.

1 FUNCTIONS
108 1.7 Communications Using MODBUS/TCP
Automatic response to MODBUS/TCP master device
When receiving a request message from the MODBUS/TCP master device, the RJ71EN71 or RnENCPU (network part)
1
automatically executes a necessary processing depending on the function code and sends a response message to the
MODBUS/TCP master device.
No program is required because the function of automatic conversion from MODBUS device is used. ( Page 110
Automatic conversion from MODBUS device)
MODBUS/
CPU module RJ71EN71 TCP master device

Ò
Request message (function code)

Device memory Ô

Õ Response message

 A request message is received.

 The function code is checked.
 The requested processing is executed.
 The response message is sent.

This section lists the function codes (MODBUS standard functions) that can be executed from the MODBUS/TCP master
device to the RJ71EN71 and RnENCPU (network part). ( MELSEC iQ-R MODBUS and MODBUS/TCP Reference
Manual)
Function code (FC) Sub-code (SC) Function name
01H  Read coil
02H  Read input
03H  Read holding register
04H  Read input register
05H  Write single coil
06H  Write single register
0FH  Write multiple coils
10H  Write multiple register
14H 06H Read extended file register
15H 06H Write extended file register
16H  Mask-write holding register
17H  Read/write multiple register

■Setting procedure
Set the automatic response function in "External Device Configuration" under "Basic Settings". ( Page 264 External
Device Configuration)
1. Select "MODBUS/TCP Connection Module" in "Module List", and drag it to "List of devices" or "Device map area".

2. Set "Port No." and "Existence Confirmation".

When multiple devices are set in "MODBUS/TCP Connection Module", set the same value to "Port No." of all devices.

3. Select [Close with Reflecting the Setting] to finish the external device configuration settings.

■Open/close timing
After the initial processing of the RJ71EN71 and RnENCPU (network part) completes, the port automatically opens according
to the parameter settings. The port automatically closes when the station on which the RJ71EN71 and RnENCPU (network
part) are mounted is turned off or reset.

1 FUNCTIONS
1.7 Communications Using MODBUS/TCP 109
 ■Precautions
When a dedicated instruction and the automatic communication function are simultaneously used with the QJ71MT91 set as
the MODBUS/TCP master device, set two devices to "MODBUS/TCP Connection Module" in "External Device Configuration".
For dedicated instructions and the automatic communication function of the QJ71MT91, refer to the following.
 MODBUS/TCP Interface Module User's Manual

Automatic conversion from MODBUS device

This function automatically converts the access to the MODBUS devices of the RJ71EN71 and RnENCPU (network part) into
the access to the devices of the CPU module.
Use the MODBUS device assignment parameters to create the association between the MODBUS devices and the device
memory areas of the CPU module.
This allows the RJ71EN71 and RnENCPU (network part) to convert the access to the MODBUS device specified in the
request message from the MODBUS/TCP master device into the access to the corresponding device of the CPU module.
MODBUS/
CPU module RJ71EN71 TCP master device

MODBUS device assignment parameter

Device memory
Device memory MODBUS device

D299 400499
D300 1234H D300 400500 (1)
D301 400501

(2)

(1) Request message (request for reading the value in holding register 400500)
(2) Response message (response with the value in holding register 400500 (1234H))

■Setting procedure
Set the assignment to the MODBUS devices in "MODBUS/TCP Settings" under "Application Settings". ( Page 274
MODBUS/TCP Settings)

1 FUNCTIONS
110 1.7 Communications Using MODBUS/TCP
■MODBUS device assignment parameters
The parameters are used to associate the MODBUS devices with the device memory areas of the CPU module. Using the
parameters enables direct access from a MODBUS/TCP master device to the device memory areas of the CPU module. 1
MODBUS device assignment
CPU module device memory MODBUS device
parameter setting example

Internal relay (M) Coil

M0 000001
3500 Coil assignment 1
M1201 003500 Device code M(0090H)
3500 Head device number 1201
M4700 004000 Head coil number 0
Assignment points 3500

M8191
8192
Coil assignment 2
Output (Y)
Y0 Device code Y(009DH)
Head device number 0
012191 Head coil number 3999
Assignment points 8192
8192

Coil assignment 3
Y1FFF Device code L(0092H)
Head device number 0
Latch relay (L) 5
L0 5 Head coil number 64999
L4 065000 Assignment points 5
065004
065536

L8191

Special register (SD) Holding register

SD0 400001
2048 1000 Holding register assignment 1
401000
SD2047 Device code SD(00A9H)
402000 Head device number 0
Data register (D) Head holding register number 1999
D0 2048 Assignment points
1000 2048
404047
D999

Holding register assignment 2

D6000 Device code D(00A8H)

430000 Head device number 0

6288 Head holding register number 0
Assignment points 1000
6288
D12287
436287
Holding register assignment 3
Device code D(00A8H)
Head device number 6000
Head holding register number 29999
Assignment points 6288

465536

1 FUNCTIONS
1.7 Communications Using MODBUS/TCP 111
 ■MODBUS devices
The following table lists the MODBUS devices supported by the RJ71EN71 and RnENCPU (network part).
MODBUS device type Unit Read/write Number of access MODBUS device No.
points
Coil Bit Read/write 65536 points 1 to 65536
Input Bit Read 65536 points 100001 to 165536
Input register Word Read 65536 points 300001 to 365536
Holding register Word Read/write 65536 points 400001 to 465536
Extended file register Word Read/write*1 10027008 points File number: 0 to 1002*2*3
Device number: 600000 to 609999

*1 For the CPU module, read-only memory cannot be set in the file register.
*2 The maximum values of the number of access points and the file number for the extended file register depend on the size of the file
register (ZR) set in the CPU module. ( Page 112 MODBUS extended file register assignment)
*3 The number of access points for the extended file register is the maximum size that can be set in the CPU module (when the R120CPU
+ NZ2MC-16MBS are mounted).

■MODBUS extended file register assignment

The assignment of the MODBUS extended file register to the CPU module is fixed to the file register (ZR).
The following shows the assignment to the file register of the CPU module. (The number of points for the file register shows
the maximum size that can be set in the CPU module (when the R120CPU + NZ2MC-16MBS are mounted)).
CPU module MODBUS
file register (ZR) extended file register

ZR0 600000
10000 File number 0
ZR9999 609999
ZR10000 600000
10000 File number 1
ZR19999 609999
ZR20000 600000
10000 File number 2
ZR29999 609999
ZR30000

ZR10019999
ZR10020000 600000
7008 File number 1002
ZR10027007 607007

The size of the MODBUS extended file register depends on the size of the file register (ZR) set in the CPU module.
For details, refer to the following.
 MELSEC iQ-R CPU Module User's Manual (Application)

1 FUNCTIONS
112 1.7 Communications Using MODBUS/TCP
■Applicable devices
The following table lists the devices of the CPU module that can be set in the MODBUS devices.
Device name Symbol MODBUS device (: Can be assigned, : Cannot be assigned) 1
Coil Input Input register Holding Extended file
register register
Special relay SM   *1 *1 
Special register SD     
Input X   *1 *1 
Output Y   *1 *1 
Internal relay M   *1 *1 
Latch relay L   *1 *1 
Annunciator F   *1 *1 
Edge relay V   *1 *1 
Link relay B   *1 *1 
Data register D     
Link register W     
Timer (contact) TS   *1 *1 
Timer (coil) TC   *1 *1 
Timer (current value) TN     
Long timer (current value) LTN   *4 *4 
Retentive timer (contact) STS   *1 *1 
Retentive timer (coil) STC   *1 *1 
Retentive timer (current value) STN     
Long retentive timer (current value) LSTN   *4 *4 
Counter (contact) CS   *1 *1 
Counter (coil) CC   *1 *1 
Counter (current value) CN     
Long counter (contact) LCS   *1 *1 
Long counter (coil) LCC   *1 *1 
Long counter (current value) LCN   *2 *2 
*1 *1
Link special relay SB     
Link special register SW     
*5 *1 *1
Step relay S     
Direct input DX   *1 *1 
Direct output DY   *1 *1 
Index register Z     
Long index register LZ   *2 *2 
File register R     
ZR     *3
Refresh data register RD     
*6
Buffer memory H     

*1 When setting a bit type device to the input register or output register, set it so that the number of assigned points will be a multiple of 16.
Otherwise, an error occurs in the engineering tool.
*2 The long counter (current value) and the long index register use two points of MODBUS devices.
*3 The assignment of the extended file register is fixed to the file register (ZR).
*4 The long timer (current value) and long retentive timer (current value) use four points of MODBUS devices. ( Page 114 Long timer
and long retentive timer)
*5 The step relay is read-only. An attempt of writing will cause an error.
*6 When the buffer memory is used, use H (hexadecimal constant) as the device symbol and set the address in hexadecimal notation. The
setting range is 1D5000H to 1D6FFFH. ( Page 388 User setting area for MODBUS/TCP function (Un\G1921024 to Un\G1929215))

1 FUNCTIONS
1.7 Communications Using MODBUS/TCP 113
 ■Long timer and long retentive timer
Note that the following items cannot be set for reading the long timer and long retentive timer.
• Long timer (contact)
• Long timer (coil)
• Long retentive timer (contact)
• Long retentive timer (coil)
When, however, the current value of the long timer or long retentive timer is set in units of four words, the contact and coil will
be read simultaneously.
Response data Description
1st word The current value is stored.
2nd word
3rd word • b0: The value of the coil is stored.
• b1: The value of the contact is stored.
• b2 to b15: Used by the system.
4th word Used by the system.

As shown above, the long timer and long retentive timer use the data configuration of four words per device. Consequently,
specify the number of device points for a request data in units of four points.
Note that the write of long timer and long retentive timer cannot be set.

1 FUNCTIONS
114 1.7 Communications Using MODBUS/TCP
■Default assignment parameters
The MODBUS device assignment parameters include default assignment parameters as initial values.
The following diagram shows the MODBUS device assignment using the default assignment parameters. 1
Coil Input Input register Holding register
(000001 to 065536) (100001 to 165536) (300001 to 365536) (400001 to 465536)
000001 100001 300001 400001

Y
8192 (0 to 1FFF) 8192 X
(0 to 1FFF)
D
Coil assignment 1 008192 Input assignment 1 108192
12288 (0 to 12287)
008193

M
8192 (0 to 8191)
Holding register assignment 1 412288
Coil assignment 2 016384
(Empty)
(Empty)
SM 020481
2048 (0 to 2047)
Coil assignment 3 022528
022529 SD 420481
2048 (0 to 2047)
Holding register assignment 2 422528
8192 L
(0 to 8191) 422529
RJ71EN71
Coil assignment 4 030720 user free area
4096 H
030721 (1D5000 to 1D5FFF)
Holding register assignment 3 426624
8192 B
(0 to 1FFF) (Empty)

Coil assignment 5 038912 430721

F 038913
2048 (0 to 2047) W
8192 (0 to 1FFF)
Coil assignment 6 040960 (Empty)
SB 040961 (Empty) Holding register assignment 4 438912
2048 (0 to 7FF)
Coil assignment 7 043008
(Empty)
V 043009
2048 (0 to 2047) SW 440961
Coil assignment 8 045056 2048 (0 to 7FF)
Holding register assignment 5 443008
(Empty)

TC 053249
1024 (0 to 1023)
Coil assignment 10 054272 (Empty)

(Empty)
TS 055297
1024 (0 to 1023) TN 453249
Coil assignment 11 056320 1024 (0 to 1023)
Holding register assignment 6 454272
(Empty)
CC 061441
512 (0 to 511) (Empty)
Coil assignment 14 061952
(Empty)
CS 063489 CN 461441
512 (0 to 511)
512 (0 to 511) Holding register assignment 8 461952
Coil assignment 15 064000
(Empty) (Empty)
065536 165536 365536 465536

• In the MODBUS device assignment parameters, start MODBUS device number is last five digits of the
setting target MODBUS device number - 1.
• The default values set for the MODBUS device assignment parameters cannot be used for creating a
project for the engineering tool using the remote head module. Clear the values first before starting the
setting.

1 FUNCTIONS
1.7 Communications Using MODBUS/TCP 115
 1.8 Link Dedicated Instruction Communication
The RJ71EN71 or the RnENCPU (network part) execute the transient transmission to the programmable controller of the
other station on the same Ethernet using the link dedicated instructions. ( Page 398 Link dedicated instructions)
A station on a network other than Ethernet can be accessed. ( Page 407 Communications with Different Networks)

Precautions
The CPU module (CPU part for the RnENCPU) cannot exchange data with the link dedicated instruction.

Data communication procedures

This section describes the procedure for communication with link-dedicated instructions.

1. After setting the module parameters, check that the initial processing of the own station, relay stations, and the
RJ71EN71 and RnENCPU (network part) of access stations have completed successfully. ('Initial status'
(Un\G1900024.0): On)

2. Data is exchanged with link dedicated instructions. ( Page 398 Link dedicated instructions)

Communication with the link dedicated instructions uses the MELSOFT transmission port (UDP/IP), so the
open/close processing is not required.

Setting procedure
1. Set the network number and station number in "Own Node Settings" under "Basic Settings". ( Page 263 Details of
items)
2. Set the send destination station information in "Network/Station number <-> IP Related information setting" under
"Application Settings". ( Page 286 Network/Station No. <-> IP information setting)*1
*1 This setting is not required when the target station is specified with an IP address using control data of the control data of READ
instruction, SREAD instruction, WRITE instruction, or SWRITE instruction.

1 FUNCTIONS
116 1.8 Link Dedicated Instruction Communication
1.9 File Transfer Function (FTP server)
The server function of FTP (File Transfer Protocol) used to transfer files with the external device is supported. The external
1
device with FTP client function can easily and directly access files in the CPU module.
The following operations can be executed on the CPU module files from the external device with FTP client function.

Ethernet-equipped module (FTP server) External device (FTP client)

Parameters
Programs Storage files
Data
Read
Write
Ethernet

• Reading of file from CPU module (download)

• Writing of file to CPU module (upload)
• Browsing of file names in CPU module

When using the file transfer function (FTP server) with multi-CPU system configuration, the following CPU
module is accessed immediately after logging in. To change the access destination CPU module, execute the
cpuchg command.
• Control CPU (when the RJ71EN71 is connected)
• CPU module connected with Ethernet cable (when CPU module is connected)

1 FUNCTIONS
1.9 File Transfer Function (FTP server) 117
 Data communication procedures
The following section describes the settings for FTP communication.

Setting in the Ethernet-equipped module side

To use the file transfer function (FTP server), set "Use" for "FTP Server" in "FTP Server Settings" under "Application Settings".
For details on other setting items, refer to the following.
Page 272 FTP Server Settings

1 FUNCTIONS
118 1.9 File Transfer Function (FTP server)
Operations on external device (FTP client) side
This section describes the procedures and required processes on the external device side for using the Ethernet-equipped
1
module's file transfer function (FTP server). The FTP commands and input format used for the operation are shown in the
explanation. ("" means to input CR, Enter or the Return key.)

Start

Start the FTP client. (ftp q)

Login to the Ethernet-equipped module (open "Ethernet-equipped module's IP address" q)

Is the FTP NO
communication port subject
to remote password
check?
YES
(quote password-unlock
Unlock the remote password.
"remote password" q)

Is file transfer YES

completed?
NO
NO Is the high-speed
Write files YES write mode enabled?
to the FTP server?
YES
NO
NO Are contents in
No file conversion is notified. (binary q) No file conversion is notified. (binary q) the program cache memory
changed?

(dir q YES
Check the file list. NO (quote pm-write
or ls q) Enable the high-speed Transfer files to the program memory.
write mode? q)
NO Does the read YES
target file exist? NO Is the FTP
(quote communication port subject
Enable the high-speed
fastmode to remote password
YES write mode. check?
onq)
YES
NO Is file
password set for the Check the file list. (dir q or
(quote password-lock
target file? ls q) Lock the remote password.
q)
YES
(quote passwd-rd NO Does the write
Enter a file password. Disconnect from
"read password" q) target file exist? (bye q)
the Ethernet-equipped module.
YES
Read the file. (get "file name" q)
End
NO
Can it be overwritten?

YES

NO Is file
password set for the
target file?
YES
(quote passwd-wr
Enter a file password.
"write password" q)
(delete "file name" q or
Delete or rename the file. rename "current file name"
"new file name" q)

Write the file. (put "file name" q)

1 FUNCTIONS
1.9 File Transfer Function (FTP server) 119
 Logging into Ethernet-equipped module
This section describes the steps from starting FTP and logging into the Ethernet-equipped module.

Ex.
Start FTP from the Microsoft Windows command prompt.

Ò
Ó

Ô
Õ

 FTP start (FTP )

 Connect with FTP server (open Ethernet-equipped module IP address )
 Specify login name (login name )
 Specify password (password )

Use the login name and password that are set in "FTP Server Settings" under "Application Settings". When the Ethernet-
equipped module (FTP server) receives the login name and password from the external device (FTP client), it checks that the
login name and password are correct.
If the login name and password are correct, transfer of the files to the Ethernet-equipped module is permitted. If incorrect, file
transfer is not permitted.

Locking and unlocking the remote password

If the FTP communication port is specified as a remote password check target with the remote password setting, unlock the
remote password with the following command. (quote password-unlock remote password ) When finished, lock the
remote password with the following command. (quote password-lock )

If the FTP communication port is specified as a remote password check target, some commands cannot be
used until the remote password is unlocked.
For details on the commands that can be used in the locked state, and those that can only be used in the
unlock state, refer to the following.
( Page 121 FTP command list)

Inputting the file password

If a file password is set for the target file, the file password must be input with the following command before the file can be
accessed.
• Write password (quote passwd-wr write password )
• Read password (quote passwd-rd read password )

Files that can be transferred with FTP

For the files that can be transferred (read, write, deleted) with the file transfer function (FTP server), refer to the file operation
available which is described in the following manual.
 MELSEC iQ-R CPU Module User's Manual (Application)

1 FUNCTIONS
120 1.9 File Transfer Function (FTP server)
FTP command
1
FTP command list
The FTP client side commands supported by the Ethernet-equipped module are shown below.
: Executable*1, : Not executable*2
Command Function CPU module status Remote password
STOP RUN Unlocked*4 Locked*4
*3 *3
Enable Disable
binary*5 Notifies that the file will be transferred without conversion.     
bye Closes and ends the connection with the FTP server.     
close Closes the connection with the FTP server.     
*6
delete Deletes the CPU module file.     
dir Displays the CPU module file information.     
get Reads a file from the CPU module.     
ls Displays the CPU module file name.     
mdelete Deletes the CPU module file.  *6   
mdir Stores the CPU module file information in the file.     
mget Reads a file from the CPU module.     
mls Reads a file from the CPU module.     
mput Writes the file to the CPU module.     
open Connects to the FTP server.     
put Writes the file to the CPU module.     
pwd Displays the current directory of the CPU module.     
quit Closes and ends the connection with the FTP server.     
quote Sends the FTP server's subcommand.*7     
rename Changes the CPU module file name.     
user Inputs the user name and password for the Ethernet-equipped     
module.

*1 The command may not be executed depending on the file type. ( Page 120 Files that can be transferred with FTP)
*2 If executed, the process completes abnormally.
*3 Shows the "Allow Online Change" setting in "FTP Server Settings" under "Application Settings". If an illegal command is executed while
write is prohibited during RUN, the process completes abnormally.
*4 Shows whether the command can be executed when the FTP communication port is specified as a remote password check target port
with the Ethernet-equipped module mounted station's remote password setting. For details on the remote password, refer to the
following.
( Page 177 Remote password)
*5 The Ethernet-equipped module is set to transfer the file automatically without conversion. (Binary code fixed)
Therefore, the file is transferred with binary code regardless of the "Communication Data Code" setting in "Own Node Settings" under
"Basic Settings".
*6 The parameter file and program file cannot be deleted when the CPU module is in the RUN state.
*7 Only the subcommands dedicated for the Ethernet-equipped module can be used. For the subcommands can be used, refer to the
following.
( Page 122 Subcommands usable with quote command)

1 FUNCTIONS
1.9 File Transfer Function (FTP server) 121
 ■Subcommands usable with quote command
This section describes the Ethernet-equipped module dedicated commands added to the quote command and used.
When executing this command from the FTP client, input the subcommand after the quote command.
("" means to input CR, Enter or the Return key.)

Ex.
Executing the STOP command
Input the following at the command prompt.
quote stop 
The following table lists the subcommands can be used.
: Executable, : Not executable*1
Command Function CPU module status Remote password
STOP RUN Unlocked Locked
Write Write
enable prohibit
change Shows or changes the CPU module file attributes.     
cpuchg*2 Specifies the access destination CPU module when using a     
multi-CPU system configuration.
fastmode*5 Enables or disables the high-speed write mode for the CPU     
module, or displays its status.
passwd-rd Sets, shows or clears the file password (read password).     
passwd-wr Sets, shows, or clears the file password (write password).     
password-lock Changes the remote password from the unlock state to the     *4
lock state.
password-unlock Changes the remote password from the lock state to the     
unlock state.
path-delimiter*5 Changes the directory delimiter of the file path of the CPU     
module from "\" to "/".*6
path-delimiter Turn off file setting changing for the file path name when a     
off*5 file is specified by the path-delimiter.*6
path-delimiter Displays the setting status of the file path name when a file is     
status*5 specified.*6
status Displays the CPU module operation information.     
run Sets the CPU module to the RUN state. *3    
stop Sets the CPU module to the STOP state.     
pm-write Writes the program memory.     

*1 If executed, the process completes abnormally.

*2 This subcommand cannot be used when the connection destination is a CPU module.
*3 This subcommand is invalid when the RUN/STOP/RESET switch of the CPU module is set to STOP.
*4 Even if the subcommand is executed, the remote password remains locked with no error occurred.
*5 This subcommand can be used only when the connection destination is a programmable controller CPU. Before using this
subcommand, check the versions of the CPU module used. ( Page 436 Added and Enhanced Functions)
*6 For function details, refer to the following.
Page 124 FTP server function file path name switching

1 FUNCTIONS
122 1.9 File Transfer Function (FTP server)
Specifying an FTP command
This section describes the method of specifying the files specified with the FTP command on the FTP client (external device
1
side) supported by the Ethernet-equipped module.
With the CPU module, the drive name and file name are distinguished when specifying the file.
When specifying a file with FTP, specify the target file with the following arrangement.*1
Item Description
Specification format [Drive name:\]Folder name*2\File name.Extension
Example 3:\MAINSEQ1.QDR (other than drive 2)
2:\LOGGING\LOG01\00000001\LOG01_00000001.CSV (drive 2)
Specification details Refer to the following.
Page 123 Drive name (drive No.),Page 123 Folder name, file name, and extension

*1 The default directory delimiter is "\". To change the directory delimiter to "/", refer to the following.
Page 124 FTP server function file path name switching
*2 The file name can be specified only when specifying a file stored in drive 2.

The section enclosed in square brackets [ ] in the specification format can be omitted.

■Drive name (drive No.)

Specify the drive name of the target memory for transferring the file.
For the correspondence of the target memory and drive names, refer to the following.
 MELSEC iQ-R CPU Module User's Manual (Application)
Omitting the drive name is the same as specifying the program memory (drive 4). If, however, FTP server function file path
name switching is enabled, the setting is valid. ( Page 124 FTP server function file path name switching)

■Folder name, file name, and extension

• Specify the folder name and file name according to the rules provided in the following.
 MELSEC iQ-R CPU Module User's Manual (Application)
• The name determined for the CPU module is assigned for the extension.
• When using an FTP command that can be used for multiple files, specify the file name and extension with the wild card "*"
or "?". (Depending on the FTP client, there may be additional restrictions to the characters that can be used for the file
name.)
*: All files with the arbitrary character string (including none) are targeted from the position specified with "*".
?: All files with the arbitrary character string (excluding none) are targeted from the position specified with "?". ("?" can be used multiple times.)

1 FUNCTIONS
1.9 File Transfer Function (FTP server) 123
 FTP server function file path name switching
The directory delimiter of the file path specified using the FTP command is changed from "\" to "/" in the CPU module (built-in
Ethernet port part).
In addition, the omission of the drive number in the file path name can be set.
Change procedure Description
Using the special relay/special register Changing the special relay SM1512 (FTP server function file path name switching setting Enable) changes
the directory delimiter.
This method is used when FTP clients use only Linux OS and "/" is to be set for the directory delimiter.
Using the FTP command Specifying the subcommand (path-delimiter) for the quote command changes the directory delimiter of the
file path name of the CPU module.
This method is used when FTP clients use Windows OS or Linux OS and the directory delimiter is to be
changed every time the server is accessed by the client.

The following table lists how to specify CPU module files after changing the directory delimiter to "/".
Item Description
Specification format [Drive name:/]File name.Extension
Example 3:/MAINSEQ1.QDR

• After the directory delimiter is changed to "/", directory delimiter commands including "\" can be received by the CPU
module. However, the directory delimiter that is sent from the CPU module is "/".
• When changing the directory delimiter again, the contents set later are valid.
• When executing the FTP command to specify a file path name using an FTP client with Linux OS, the same folder
configuration must be used for the CPU module and the personal computer.

Only the programmable controller CPU can be used for the function. Before using this function, check the
version of the CPU module used. Page 436 Added and Enhanced Functions

■Using the special relay/special register

• Turning the SM1512 (FTP server function file path name switching setting Enable) off and on changes the directory
delimiter of the CPU module file path name "/". Storing the setting value in the SD1512 (FTP server function file path name
switching setting) enables omission of the drive number in the file path name.
• While the SM1512 is on, the directory delimiter change is valid. Turning off the SM1512 clears the change and returns the
directory delimiter from "/" to "\".
• When an improper value is set, the SM1513 (FTP server function file path name switching setting error) is turned on and
the error cause is stored in the SD1513 (FTP server function file path name switching setting error cause). When there is no
error in the setting value, the SM1513 is turned off.
• The current setting status is stored in the SD1514 (FTP server function file path name switching setting status) When the
SM1512 is off, 0 is stored in the SD1514.
Special relay Name
SM1512 FTP server function file path name switching setting Enable
SM1513 FTP server function file path name switching setting error

Special register Name

SD1512 FTP server function file path name switching setting
SD1513 FTP server function file path name switching setting error cause
SD1514 FTP server function file path name switching setting status

For details on the special relay/register, refer to the following.

 MELSEC iQ-R CPU Module User's Manual (Application)

Do not turn the SM1512 off and on or on and off while the FTP command is executing. Doing so may cause
malfunction.

1 FUNCTIONS
124 1.9 File Transfer Function (FTP server)
■Using the FTP command
• When executing the quote command with a subcommand of the path-delimiter [mode], the directory delimiter of the CPU
module file path name is changed from "\" to "/". Inputting the setting value to [mode] enables omission of the drive number 1
in the file path.
• Executing the path-delimiter off command clears the setting.
• Executing the path-delimiter status command enables the current settings to be checked.
FTP command Function
(Sub command of the quote
command)
path-delimiter Changes the setting of the file path name when a file is specified.
(After executing the command, the SM1512 is turned on and the current setting value is stored in the SD1514.)
path-delimiter off Turns off file setting changing for the file path name when a file is specified.
path-delimiter status Displays the setting status of the file path name when a file is specified.

For details on the quote command, refer to the following.

Page 129 Ethernet-equipped module dedicated subcommand

The current settings can be checked using the SM1512 (FTP server function file path name switching setting
Enable) and the SD1514 (FTP server function file path name switching setting status).

1 FUNCTIONS
1.9 File Transfer Function (FTP server) 125
 Details of FTP command
This section describes the FTP commands on the FTP client side supported by the Ethernet-equipped module, and the
methods of using those commands.

• Note that depending on the client side FTP application, some of the FTP commands may not operate as
described in this manual. Refer to the manual for the FTP client, and check the functions, operation
methods, and so on.
• The specification format and result of the command may differ depending on the FTP client used.
• The section enclosed in square brackets [ ] in the specification format can be omitted.

■FTP server support command

Command name Description
binary Function Notifies the FTP server that the file will be transferred without conversion. The return code and kanji codes are
also not converted.
These settings are automatically applied to the Ethernet-equipped module.
Specification format binary (abbreviated: bin)
bye Function Closes the connection with the FTP and quits the FTP.
Specification format bye
Same function quit
close Function Closes the connection with the FTP server.
Specification format close
delete Function Deletes files stored in the CPU module.
Specification format delete "file path name"
Example When deleting files stored in the SD memory card
delete 2:\MAINSEQ1.PRG
Similar command mdelete
dir Function Displays the file name, date of creation and volume of files stored in the CPU module.
Specification format dir [drive name:\]
Example When displaying the detailed information of files stored in the data memory
dir 4:\
Similar command ls
get Function Reads a file from the CPU module.
Specification format get "source file path name" [destination file path name]
Example 1 When reading files stored in the SD memory card and store with same file name
get 2:\MAINSEQ1.PRG
Example 2 When reading files stored in the SD memory card and store with different file name
get 2:\SEQ1BAK.PRG SEQ\SEQ10LD.PRG
Caution • If the destination file path name (FTP client side) is not specified, the file is stored in the FTP client side with
the same file name as the source file name (CPU module side).
• The transfer destination is in the currently connected directly when FTP is started and connected.
• When the command is executed in an FTP client with Linux OS, the drive number in the source file path name
must be omitted. Set the drive number in the file path name to be omitted in advance using the FTP server
function file path name switching, and specify as follows. ( Page 124 FTP server function file path name
switching)
Example: "get /SEQ10LD.PRG"
ls Function Displays the names of files stored in the CPU module.
Specification format ls [drive name:\]
Example When displaying the detailed information of files stored in the data memory
ls 4:\
Similar command dir
Caution When the command is executed in an FTP client with Linux OS, the results are the same as the dir command.
(The mls command corresponds to the ls command for an FTP client with Windows OS.)

1 FUNCTIONS
126 1.9 File Transfer Function (FTP server)
Command name Description
mdelete Function Deletes files stored in the CPU module.

Specification format
When deleting multiple files, specify the file name and extension in the file path name with wild cards (*, ?).
mdelete "file path name" (abbreviated: mdel)
1
Example When deleting all files with "CSV" extension from files stored in SD memory card
mdelete 2:\*.CSV
Caution When the command is executed in an FTP client with Linux OS, omit the drive number in the file path name and
add "/" to the beginning of the file path name. Set the drive number in the file path name to be omitted in advance
using the FTP server function file path name switching, and specify as follows. ( Page 124 FTP server
function file path name switching)
Example: "mdelete /*.csv"
Similar command delete
mdir Function Stores the detailed information (file name, date of creation, volume) of the file stored in the CPU module in the
FTP client side file as log data.
Specification format mdir "source drive name":\"destination file path name"
Example When storing the detailed information of file stored in data memory into 20120702.LOG file
mdir 4:\20120702.LOG
Caution • Always specify "\" immediately after the source drive name.
• Always specify the source drive name when specifying the destination file path name (FTP client side).
• If the destination file path name is not specified, the file is stored with the file name determined by the FTP
client's FTP application.
• The transfer destination is in the currently connected directly when FTP is started and connected.
Similar command mls
mget Function Reads a file from the CPU module.
When reading multiple files, specify the file name and extension in the file path name with wild cards (*, ?).
When reading multiple files, receive is confirmed before transferring each file.
Specification format mget "file path name"
Example When reading all files with "CSV" extension from files stored in SD memory card
mget 2:\*.CSV
Caution • The read file is stored with the same file name in the FTP client side. The storage destination is in the current
connection directory when the FTP is started and connected.
• When the command is executed in an FTP client with Linux OS, omit the drive number in the file path name
and add "/" to the first of the file path name. Set the drive number in the file path name to be omitted in advance
using the FTP server function file path name switching, and specify as follows. ( Page 124 FTP server
function file path name switching)
Example: "mget /*.csv"
mls Function Stores the file name of the file stored in the CPU module in the FTP client side file as log data.
Specification format mls "source drive name":\"destination file path name"
Example When storing the file name of file stored in SD memory card into 20120702.LOG file
mls 2:\20120702.LOG
Caution • Always specify "\" immediately after the source drive name.
• Always specify the source drive name when specifying the destination file path name (FTP client side).
• If the destination file path name is not specified, the file is stored with the file name determined by the FTP
client's FTP application.
• The transfer destination is in the currently connected directly when FTP is started and connected.
Similar command mdir
mput Function Writes the file to the CPU module.
When writing multiple files, specify the file name and extension in the file path name with wild cards (*, ?).
When writing multiple files, send is confirmed before transferring each file.
Specification format mput "source file path name"
Example When writing all files with "PRG" extension
mput*.PRG
Caution • The storage destination file name is the same as the FTP client side.
• The transmission destination is the data memory (drive 4 "4:\"). When the file path name is changed using the
FTP server function file path name switching, the setting is valid. ( Page 124 FTP server function file path
name switching)

1 FUNCTIONS
1.9 File Transfer Function (FTP server) 127
 Command name Description
open Function Specifies the host name or IP address and port number on the FTP server side, and connects with the FTP
server.
Specification format open "host name" [port number]
open "IP address" [port number]
• Host name: Host name set with Microsoft Windows hosts file
• IP address: IP address of the Ethernet-equipped module side
• Port number: Port number to be used (If omitted, port number 21 is used for operation)
Example 1 When specifying the host name and connecting to the FTP server
open HOST
Example 2 When specifying the IP address and connecting to the FTP server
open 192.0.1.254
Caution The IP address can be specified to create a connection when starting the FTP.
put Function Writes the file to the CPU module.
Specification format put "source file path name" [destination file path name]
Example 1 When writing the param.PRM file to the SD memory card with the same file name
put param.PRM 2:\param.PRM
Example 2 When writing the param.PRM file to the SD memory card with a different file name
put param.PRM 2:\param1.PRM
Caution • If the directory is not specified with the source file path name (FTP client side), the file in the current connection
directory when the FTP server is started and connected is written.
• If the destination file path name (FTP server side) is not specified, the file is transferred to the data memory
(drive 4 "4:\").
pwd Function Displays current directory name of the CPU module.
Specification format pwd
Caution "\" is displayed as the pwd command execution results.
quit Function Closes the connection with the FTP and quits the FTP.
Specification format quit
Similar command bye
quote Function Sends the FTP server's subcommand (Ethernet-equipped module dedicated subcommand).
Specification format quote
Example quote password-lock
Caution Only the Ethernet-equipped module dedicated subcommand can be specified. Refer to the following.
( Page 129 Ethernet-equipped module dedicated subcommand)
rename Function Changes the CPU module file name.
Specification format rename "old file path name" "new file path name"
(abbreviated: ren)
Example When changing the name of a file stored in the SD memory card
rename 2:\param.PRM 2:\param1.PRM
Caution The following response code appears when the file is successfully renamed.
350 Need more info.
250 Rename successful.
user Function Inputs the user name and password for the connected FTP server.
Specification format user "user name" [FTP password]
• User name: Login name set with Ethernet-equipped module parameters
• FTP password: FTP password set with Ethernet-equipped module parameters
Example 1 When specifying the user name
user RJ71EN71
Example 2 When specifying the user name and password
user RJ71EN71 RJ71EN71

1 FUNCTIONS
128 1.9 File Transfer Function (FTP server)
■Ethernet-equipped module dedicated subcommand
This section describes the Ethernet-equipped module dedicated subcommands that are added to the FTP command's quote
command and sent. 1
Command name Description
change Function Shows or changes the attributes of files stored in the CPU module.
Specification format When displaying the file attributes
1 quote change file path name
One of the following is displayed as the execution results when the process ends normally.
• When specified file is read-only: -----R
• When specified file is writable and readable: -----W
Specification format When changing the file attributes
2 quote change "file path name" "attribute"
Specify the attributes with one of the following methods.
• When changing to a read-only file: r
• When changing to a writable and readable file: w
Example 1 When displaying the attributes of files stored in the SD memory card
quote change 2:\PRG1.PRG
Example 2 When changing the attributes of files stored in the SD memory card
quote change 2:\PRG1.PRG r
cpuchg Function Specifies the access destination CPU module when using a multi-CPU system configuration.
This may also display the current access destination CPU module.
Specification format quote cpuchg [access destination CPU module]
Access destination CPU module: Specify the CPU module from which files are to be accessed.
Shows the method for specifying the access destination CPU module.
• No input: Checks the current access destination CPU module.
• controlPLC: Specifies the control CPU as the access destination CPU module.
• no1: Specifies the CPU No.1 as the access destination CPU module.
• no2: Specifies the CPU No.2 as the access destination CPU module.
• no3: Specifies the CPU No.3 as the access destination CPU module.
• no4: Specifies the CPU No.4 as the access destination CPU module.
The execution results when the access is completed normally are shown in the following manner.
• When setting access destination CPU module: 200 Command Okey
• When displaying access destination CPU module: 200 Target cpu is "access destination CPU module".
The following appears if the specified access destination CPU module is not found.
• 557 Cpu not found
Example 1 When specifying control CPU as access destination CPU module
quote cpuchg controlPLC
Example 2 When displaying the currently set access destination CPU module
quote cpuchg
Caution The access destination CPU module after logging into the RJ71EN71 with the open/user command is the
RJ71EN71 control CPU.

1 FUNCTIONS
1.9 File Transfer Function (FTP server) 129
 Command name Description
fastmode Function Enables the high-speed write mode.
Since both of the following processing are not performed in high-speed write mode, the program (.PRG) and FB
file (.PFB) can be transferred to the "$MELPRJ$" folder at high speed.
• To create a temporary file (FTP_I***_#.TMP)
• To automatically transfer files that have been written in the program cache memory to the program memory.
Specification format quote fastmode [mode]
Mode: Specify whether to enable or disable the high-speed write mode.
• on: Enabled
• off: Disabled
One of the following is displayed as the execution results when the process ends normally.
• When the status of high-speed write mode is switched to on (enabled): 200 Command successful
• When the status of high-speed write mode is switched to off (disabled): 200 Command successful
• If status is displayed when high-speed write mode is enabled: 200 Fastmode is ON
• If status is displayed when high-speed write mode is disabled: 200 Fastmode is OFF
Example 1 When enabling the high-speed write mode
quote fastmode on
Example 2 When disabling the high-speed write mode
quote fastmode off
Example 3 When displaying status of the high-speed write mode
quote fastmode
Caution • The high-speed write mode is disabled when logging into the CPU module.
• In high-speed write mode, files are not automatically transferred when contents in the program cache memory
are changed with the file write command (put, mput), file delete command (delete, mdelete), or file rename
command (rename). Therefore, execute the file transfer command (to program memory) (quote pm-write) after
changing the contents. If the CPU module is reset without executing the file transfer command (to program
memory) after the changing, incorrect program files remain in the program memory. In this case, delete the
incorrect program files with the file delete command (delete, mdelete) and transfer files again.
passwd-rd Function Sets the read password (file password) registered as the file transfer target file to the Ethernet-equipped module.
Shows/clears the read password set in FTP.
Use this command only when a read password is registered for the file transfer target file. The CPU module
checks the password when accessing the specified file.
Specification format quote passwd-rd [read password]
The following appears as the execution results when the command ends normally.
• When setting a read password: 200 Command successful
• When displaying the read password: 200 Read-password is "read password"
• When clearing the read password: 200 Command successful
• When displaying the state with a read password not set: 200 Read-password is not set.
Example 1 When specifying the read password (ABCD1234@efgh)
quote passwd-rd ABCD1234@efgh
Example 2 When displaying the read password currently set in FTP
quote passwd-rd
Example 3 When clearing the read password currently set in FTP
quote passwd-rd c, or quote passwd-rd C
Caution • One read password can be set for the FTP of the Ethernet-equipped module. When the file transfer target file
changes and when a read password is registered for the change destination file, reset the read password for
the target file.
• The read password is initialized (cleared) when logging into the Ethernet-equipped module.

1 FUNCTIONS
130 1.9 File Transfer Function (FTP server)
Command name Description
passwd-wr Function Sets the write password (file password) registered in the file transfer target file to the Ethernet-equipped module.
Shows/clears the write password set in FTP.
Use this command only when a write password is registered for the file transfer target file. The CPU module 1
checks the password when accessing the specified file.
Specification format quote passwd-wr [write password]
The following appears as the execution results when the command ends normally.
• When setting the write password: 200 Command successful
• When displaying the write password: 200 Write-password is "Write password"
• When clearing the write password: 200 Command successful
• When displaying the state with the write password not set: 200 Write-password is not set.
Example 1 When specifying the write password (ABCD1234@efgh)
quote passwd-wr ABCD1234@efgh
Example 2 When displaying the write password currently set in the FTP
quote passwd-wr
Example 3 When clearing the write password currently set in the FTP
quote passwd-wr c, or quote passwd-wr C
Caution • One write password can be set for the FTP of the Ethernet-equipped module. When the file transfer target file
changes and when a write password is registered for the change destination file, reset the write password for
the target file.
• The write password is initialized (cleared) when logging into the Ethernet-equipped module.
password-unlock Function Specifies the remote password set for the CPU module and unlocks the password.
This command is used when FTP communication port is specified as a remote password check target port.
Specification format quote password-unlock [remote password]
• Remote password: Specifies the remote password set in the CPU module parameters.
The following appears as the execution results when the command ends normally.
200 Command Okey
The following appears when the remote password does not match.
556 Password Error
The following appears if another command is requested before the remote password is unlocked.
555 Password Locked
Example When specifying a remote password (123456)
quote password-unlock 123456
Caution • If the FTP communication port is specified as a remote password check target port when logging in, the
password will be locked.
• The CPU module files can be accessed by executing this command and unlocking before starting the various
FTP operation.
• If the FTP communication port is not specified as a remote password check target port, the processing will
complete normally when the remote password is unlocked.
password-lock Function Locks the remote password function set for the CPU module.
This command is executed when the FTP communication port is specified as a remote password check target
port.
Specification format quote password-lock
The following appears as the execution results when the command ends normally.
200 Command Okey
Example When locking the remote password
quote password-lock

1 FUNCTIONS
1.9 File Transfer Function (FTP server) 131
 Command name Description
path-delimiter Function Changes the directory delimiter of the file path name when a file is specified.
Also, the drive number can be omitted depending on the mode specification.
Specification format quote path-delimiter [mode]
Mode: Specify one of the following 4 digit hexadecimal number.

0 0 0/2/3/4 0/2

0000 or blank:"/" is set for the directory delimiter of the file path name. (When the FTP clients use Linux OS and
other OS)
0022: When "/" is set for the directory delimiter of the file path name and the file path is specified from the FTP
client, the drive number can be omitted. When the drive number is omitted, Drive 2 (SD memory card) is
used.
0032: When "/" is set for the directory delimiter of the file path name and the file path is specified from the FTP
client, the drive number can be omitted. When the drive number is omitted, Drive 3 (device/label memory)
is used.
0042: When "/" is set for the directory delimiter of the file path name and the file path is specified from the FTP
client, the drive number can be omitted. When the drive number is omitted, Drive 4 (data memory) is used.
When drive number omission is set and the CPU module receives the command with the specified drive number,
the specified drive number in the received command is prioritized.
The following appears as the execution results when the command ends normally.
200 path-delimiter is ON [mode]
The following appears when the mode setting value is out of range.
504 Parameter not accepted, not implemented.
To clear the setting, use the path-delimiter off command.
Example 1 When "/" is set for the directory delimiter
quote path-delimiter 0000
Example 2 When "/" is set for the directory delimiter and the drive number in the file path name is omitted
quote path-delimiter 0022: Drive 2
quote path-delimiter 0032: Drive 3
quote path-delimiter 0042: Drive 4
path-delimiter off Function Clears the setting change of the file path name by the path-delimiter.
Specification format quote path-delimiter off
The following appears.
200 path-delimiter is OFF
path-delimiter status Function Displays the setting status of the file path name when a file is specified.
Specification format quote path-delimiter status
The following appears as the execution results when the command ends normally.
• When ON is set: 200 path-delimiter is ON (mode)
• When OFF is set: 200 path-delimiter is OFF
Caution The 4 digit hexadecimal number is displayed as the setting value for "ON (mode)" when ON is set.
run Function Sets the CPU module to the RUN state (remote RUN). Clearing of the device memory can be specified when
entering the RUN state.
Specification format quote run [mode [clear mode]]
Mode: Specify whether to forcibly execute remote RUN
• 0: Normal RUN (default)
• 1: Forced RUN
Clear mode: Specify to clear (initialize) CPU module device memory at start of operation during remote RUN
• 0: Do not clear device (default)
• 1: Clear other than latch area
• 2: Clear all including latch range
The following message appears as the execution results when the process ends normally.
200 Command successful
Example 1 When executing the remote RUN with normal RUN and do not clear device memory specified
quote run
Example 2 When executing the remote RUN with forced RUN and do not clear device memory specified
quote run 1
Example 3 When executing the remote RUN with forced RUN and clear other than latch area memory specified
quote run 11
Caution • Forced RUN is used only when remote RUN of the CPU module is not possible due to trouble in the device
that remote STOPPED the CPU module, and the CPU needs to be forcibly remote RUN with another device.
With normal RUN, a module that is in the STOP/PAUSE state executed by another device cannot be set to the
RUN state.
• Specify clearing of the device memory by the clear mode at the start of operation according to the system
specifications. After the specified clear is executed, the CPU module will RUN according to the device's default
settings.

1 FUNCTIONS
132 1.9 File Transfer Function (FTP server)
Command name Description
status Function Displays the CPU module operation information.

Specification format
This command is used to check the operation information when transferring files.
quote status
1
One of the following is displayed as the execution results when the process ends normally.
When CPU module is in RUN state: "RUN"
When CPU module is in STOP state: "STOP"
When CPU module is in PAUSE state: "PAUSE"
stop Function Set the CPU module to the STOP state (remote STOP).
Specification format quote stop
The following message appears as the execution results when the process ends normally.
200 Command successful
Caution Write to the program memory after setting the CPU module to the STOP state with this command.
pm-write Function Transfers the files written in the program cache memory to the program memory so that the files are held even at
power-off.
Specification format quote pm-write
The following message appears as the execution results when the process ends normally.
200 Command successful
Caution • The MELSEC iQ-R series CPU module automatically transfers the files to program memory after writing them
in the program cache memory. Therefore, the files are held at power-off without using this command. If this
command is used in the FTP client program, the program does not need be modified when replacing the
MELSEC-Q series.
• Set the CPU module to the STOP state before writing.

1 FUNCTIONS
1.9 File Transfer Function (FTP server) 133
 Precautions

Precautions for designing system

Design the system (such as configuration of interlock circuits in the program) so that the entire system always functions
properly during file transfer to the operating system and during status control of the programmable controller.

FTP client
• The FTP command specifications may differ from this manual depending on the FTP client. In this case, refer to the manual
for the FTP client and check the functions and operation methods.
• FTP operations are not possible from Microsoft Internet Explorer. If attempted, Internet Explorer will issue an error.
• Specify the IP address for the FTP command without zero fill. (Do not set "1" as "001".)

Processing on CPU module side

• Only the drive of the CPU module on the own station can access files.
• Do not power off or reset it, or insert/eject the SD memory card during file access. The file could be damaged if these are
attempted.
• Do not manipulate the files from a peripheral, such as an engineering tool, while accessing the files. (This also applies to
online operations such as writing during RUN as the files are manipulated.) If the file is manipulated from another device
during the file transfer function (FTP server) operation, the peripheral may issue an error. If the processing has been halted
due to an error, re-execute the processing before quitting the FTP function.

Communication processing
• If a timeout error occurs during file transfer, the TCP/IP connection will be closed. Log into the Ethernet-equipped module
with the FTP client again before resuming file transfer.
• The existence of the external device is checked with the FTP connection.
• The file transfer processing time will differ according to the Ethernet line's load rate (line congestion), the number of
connections being used simultaneously (other connection's communication processing), and system configuration
(distance between FTP server and FTP client, method of accessing CPU module).
• Only one external device (FTP client) can log into the Ethernet-equipped module at one time. If a connection is attempted
from another FTP client in the login state, an error will occur without establishing the connection.
• If another communication function (MELSOFT connection or SLMP) is simultaneously executed with UDP/IP during file
transfer with FTP, an error such as timeout may occur. Either communicate after the file is transferred, or communicate with
TCP/IP.

1 FUNCTIONS
134 1.9 File Transfer Function (FTP server)
Writing files
• An existing file cannot be overwritten. Delete or rename an existing file with the file delete command (delete, mdelete) or
1
the file rename command (rename) before writing files.
• A read-only file or a file locked by the function except for FTP cannot be written. If attempted, a write error occurs.
• A file cannot be transferred when the SD memory card used is protected. If attempted, a write error occurs.
• A temporary file (FTP_I***_#.TMP) is automatically created at a file writing. (*** is first three digits of start I/O number, and #
is the hardware port number to which FTP client is connected.) The file is renamed the write target file name when a writing
is completed, however, the temporary file may remain if the system is powered off or the CPU module is reset during a file
writing. In this case, delete the temporary file with the file delete command (delete, mdelete).
• In high-speed write mode, a temporary file is not created at a file writing. Therefore, if the system is powered off or the CPU
module is reset during a file writing, a file in the middle of the writing remains. In this case, delete this file with the file delete
command (delete, mdelete) and write a file again.
• When the file register is set as a refresh device, do not perform any writing or deletion to the corresponding drive.
• When writing a large file to the SD memory card, set the CPU module to STOP. If writing is performed in the RUN state, a
communication error may occur.
• The number of files that can be written into the specified drive is maximum [maximum number of files that can be written] -
1 file. For details on the maximum number of files that can be written to the CPU module, refer to the following.
 MELSEC iQ-R CPU Module User's Manual (Startup)

Deleting files
• Decide the timing for deleting the files for the entire system including the CPU module and engineering tool.
• Files with read-only attributes and files that are locked by a function other than FTP cannot be deleted. An error will occur if
attempted.
• The file cannot be deleted if the SD memory card is protected. An error will occur if attempted.

FTP password
The FTP password can be reset with the following procedure when it is lost.

1. Read the parameters from the CPU module with the engineering tool.

2. Click the [Restore the Default Settings] button in "Application Settings" to return all "Application Settings" to the default
values.
3. Set the "FTP Server Settings" and "Application Settings" again.
4. Write the set parameters to the CPU module.

5. Enable the parameters by powering off and on or resetting the CPU module.

When the FTP password is lost, all items set in "Application Settings" must be reset in addition to the "FTP
Server Settings".

1 FUNCTIONS
1.9 File Transfer Function (FTP server) 135
 Setting a firewall on the FTP client side
If the FTP communication is blocked by a firewall on the FTP client side, data cannot be exchanged from the FTP server.
Check the firewall settings, enable FTP communication and then access the FTP server.

Monitoring timer
When operation of files such as program (.PRG) and FB file (.PFB) is performed in a CPU module with a large program
capacity, a timeout may occur due to long processing time on the CPU module. If a timeout occurs, increase the response
monitoring timer value. ( Page 273 Response Monitoring Timer)

Execution of the file transfer function (FTP server) during execution of another function
For some file transfer functions (FTP server), there are some functions that cannot be simultaneously executed. Check that
the function that cannot be simultaneously executed is not being executed and then execute the file transfer function (FTP
server).
File transfer function (FTP server) Functions that cannot be simultaneously executed
File transfer function (FTP server) of the • Writing a file (put, mput, pm-write) • CPU module data backup/restoration function
RJ71EN71 and RnENCPU (network part) • Deleting a file (delete, mdelete) • iQ Sensor Solution data backup/restoration function
• Changing a file name (rename)
• Changing a file attribute (change)
File transfer function (FTP server) of the CPU module (built-in Ethernet port part)

1 FUNCTIONS
136 1.9 File Transfer Function (FTP server)
1.10 File Transfer Function (FTP Client)
The CPU module becomes an FTP client and can execute file transfer with the FTP server connected to Ethernet using the
1
file transfer function instruction.*1

File transfer function instruction

SP.FTPPUT

SP.FTPGET

·
END

External device (FTP server)

CPU module (FTP client)

Retrieving a specified file

SP.FTPGET instruction Ethernet

SP.FTPPUT instruction Sending a specified file

*1 To execute this function, an FTP server is required. For details on an FTP server, refer to the manual for the server used.

When the data logging function is used, a data logging file can be transferred to the FTP server by using the
data logging file transfer function. ( MELSEC iQ-R CPU Module User's Manual (Application))

Before executing the function, check the versions of the CPU module and engineering tool used. ( Page
436 Added and Enhanced Functions)

File transfer specifications

The following table summarizes the file transfer specifications of the file transfer function (FTP client).
Item Description
FTP server whose operation has been checked by Mitsubishi MicrosoftInternet Information Services(IIS)
Target OS:
• MicrosoftWindows10
• MicrosoftWindows8.1
• MicrosoftWindows8
• MicrosoftWindows7
Number of connectable FTP servers 1
FTP transfer mode Binary mode

1 FUNCTIONS
1.10 File Transfer Function (FTP Client) 137
 Transferable files
The following table lists the files that can be transferred using the file transfer function (FTP client).
: Transferable, : Not transferable
File type CPU built-in memory SD memory File name and
Program Device/label Data memory card extension
memory memory
Drive 0 Drive 3 Drive 4 Drive 2
Program     ANY_STRING.PRG
FB file     ANY_STRING.PFB
CPU parameter     CPU.PRM
System parameter     SYSTEM.PRM
Module parameter     UNIT.PRM
Module extension parameter     • UEXmmmnn.PRM
• UEXmmm00.PPR
Module-specific backup parameter     UBPmmmnn.BPR
Memory card parameter     MEMCARD.PRM
Device comment     ANY_STRING.DCM
Device initial value     ANY_STRING.DID
Global label setting file     GLBLINF.IFG
Initial label value Initial global label     GLBLINF.LID
file value file
Initial local label     PROGRAM_NAME.LID
value file
File register  *1*2   ANY_STRING.QDR
Event history     • EVENT.LOG
• EVEN2.LOG
Device data storage file   *2  DEVSTORE.QST
General-purpose data   *3 *3 ANY_STRING.ANY_STRING
Data logging Common setting     LOGCOM.LCS
setting file file
Individual setting     LOGnn.LIS
file
Memory dump setting file     MEMDUMP.DPS
Remote password     00000001.SYP
Abnormal database check file     ErrorDB.txt
System file for backing up CPU     $BKUP_CPU_INF.BSC
module data
Backup data file for backing up CPU     BKUP_CPU.BKD
module data
Device/label data file for backing up     BKUP_CPU_DEVLAB.BKD
CPU module data
System file for the backup/restoration     $BKUP_UNIT_INF.BSI
function for the iQ Sensor Solution
Backup data file for the backup/     Depends on a connected
restoration function for the iQ Sensor device.QBR
Solution
ODBC server setting file     netserver.cfg
Database path file     dbmaintainpath.txt

*1 The file can be transferred only from the FTP client to the FTP server. (Only the SP.FTPPUT instruction can be executed.)
*2 When the SP.FTPPUT instruction is executed with bit 2 (Transfer completion file delete setting) of (s1)+0 set to 1 (Delete), the file cannot
be transferred.
*3 The file that has more than one period cannot be transferred. The file that has one period or no period (only file name) can be
transferred.

1 FUNCTIONS
138 1.10 File Transfer Function (FTP Client)
Procedure for executing the file transfer function (FTP client)
To execute the file transfer function (FTP client), set an FTP client and an FTP server in parameters, and execute a file 1
transfer function instruction.
Follow the procedures described below.

Setting an FTP server

1. Set the login name, password, and home directory for the FTP client to the FTP server. In addition, give users a right to
access (read/write) files. ( Manual for the server used)

Setting an FTP client

1. Set the IP address of the CPU module (built-in Ethernet port part) to be used as an FTP client. ( Page 262 Own
Node Settings)
[Navigation window]  [Parameter]  Target module  [Module Parameter]  [Basic Settings]  [Own Node Settings]
 [IP Address]
For the Process CPU (redundant mode), set the IP addresses of system A/system B because communications are performed
using the IP addresses. Set the IP address of system B by the following procedure. ( Page 295 Redundant System
Settings)
[Navigation window]  [Parameter]  Target module  [Module Parameter]  [Application Settings]  [Redundant
System Settings]  [System B IP Address]

2. Set "Use" for "To Use or Not to Use FTP Client Settings" in "FTP Client Settings" under "Application Settings".
For details on other setting items in "FTP Client Settings", refer to the following.
Page 273 FTP Client Settings
3. Set "Use" for "To Use or Not to Use DNS Server Settings" in "DNS Settings" under "Application Settings" as needed.
For details on other setting items in "DNS Settings", refer to the following.
Page 273 DNS Settings
4. Set a timer for the file transfer function (FTP client) in "Timer Settings for Data Communication" under "Application
Settings" as needed. ( Page 281 Timer Settings for Data Communication)
Item Setting
Timeout period • TCP Resend Timer
• TCP ULP Timer
Alive check interval and count • Destination Alive Check Start Interval Timer
• Destination Alive Check Interval Timer
• Destination Alive Check Resend Count

1 FUNCTIONS
1.10 File Transfer Function (FTP Client) 139
 Executing a file transfer function instruction
Use the dedicated instructions to execute the file transfer function (FTP client). ( Page 398 File transfer function
instruction)

■Precautions
• To retrieve the file register file from the FTP server, execute the put command of the FTP server function while the CPU
module is in a STOP state.
• To send/retrieve files stored in the CPU built-in memory, such as a sequence program file, to/from the FTP server, execute
the CPU module data backup/restoration function together with the instruction. ( MELSEC iQ-R CPU Module User's
Manual (Application))
File transfer function Procedure
Sending files to the FTP server (1) Back up transfer target files stored in memory areas to the SD memory card.
(2) Execute the SP.FTPPUT instruction.
Retrieving files from the FTP server (1) Execute the SP.FTPGET instruction.
(2) Restore the retrieved files from the SD memory card to memory areas.

Checking the file transfer function (FTP client) status

The status of the function can be checked with "Status of Each Connection" on the "Ethernet Diagnostics" window. ( Page
306 Status of Each Connection)

1 FUNCTIONS
140 1.10 File Transfer Function (FTP Client)
Precautions
1
Connection with the FTP server
If a response to an alive check request is not returned from the FTP server, the CPU module (FTP client) determines that the
FTP server is not alive and disconnects the connection.
The connection may also be disconnected if the FTP server does not support the TCP KeepAlive function (response to a
KeepAlive ACK message).

Communication error when retrieving transfer files

If a large capacity file is retrieved by execution of the SP.FTPGET instruction, a communication error may occur due to an
increase of the transfer processing load. When transferring a large capacity file, extend a connection time (timeout period) in
parameters for the FTP server so that no communication error occurs.

Execution of the SD memory card forced disable function

If the SD memory card forced disable function is executed, use of the SD memory card is disabled in the middle of the transfer
processing, causing an immediate stop of the processing. Check that the transfer processing has been completed, and
execute the function.

Execution of a file transfer function instruction during execution of another function

A file transfer function instruction cannot be executed during execution of the following functions. Check that the following
function is not being executed, and then execute the instruction.
• CPU module data backup/restoration function
• iQ Sensor Solution data backup/restoration function

File operation from the external device during file transfer

Do not manipulate the files from an external device, such as an engineering tool, while transferring the files.
If the file is manipulated from another device while transferring the files, the external device may issue an error. If the
processing has been halted due to an error, re-execute the processing after the file transfer operation.

Communication processing
If another communication function (MELSOFT connection or SLMP) is simultaneously executed with UDP/IP during file
transfer with FTP, an error such as timeout may occur. Either communicate after the file is transferred, or communicate with
TCP/IP.

Deleting unnecessary files

If a cable is disconnected, system is powered off, or the CPU module is reset during the file transfer, delete unnecessary files
(such as a temporary file and undefined files) in the FTP server. Then, transfer files again.

1 FUNCTIONS
1.10 File Transfer Function (FTP Client) 141
 When the process CPU (redundant mode) is used
■System switching during the file transfer
• When the system switching occurs during the file transfer by an engineering tool, the system switching instructions, or the
system switching request from the network module, the system will be switched after completed the processing.
• When the system switching occurs because of power-off, reset, hardware failure, or stop error during the file transfer, the
connections between the FTP server and old control system cannot be disconnected properly. In this case,
communications may not be performed with the new control system until disconnection of the old control system is
recognized due to FTP server timeout. To reconnect with the FTP server, keep an attempt to execute until the connection
with the FTP server becomes open. In addition, delete unnecessary files on the FTP server when the files are generated.
The files are not remain in the FTP server since the FTP connection are not connected even when the system switching is
executed other than during the file transfer.

■SP.FTPPUT instruction immediately after system switching

When the SP.FTPPUT instruction is executed immediately after the system switching, execute the instruction with transfer
files existing (such as generated files) in the new control system.

1 FUNCTIONS
142 1.10 File Transfer Function (FTP Client)
1.11 Time Setting Function (SNTP Client)
Time information is collected from the time information server (SNTP server) connected on the LAN at the specified timing,
1
and the CPU module's time is automatically set.

Time query
LAN

Setting server time in the CPU module

Ethernet-equipped module

Ethernet

Personal computer

This setting is not available when the RJ71EN71 network type is set to "Q Compatible Ethernet".

An SNTP server (time information server) must be provided on the LAN line to use this function.

Time setting execution timing

Time setting is executed in the following timing.
• At powering off and on resetting the CPU module
• At each set time (execution at set cycle interval)
• At set time (execution at set time)
• At programmed arbitrary timing*1
*1 The time is set when 'Time setting function (SNTP client) execution' (Un\G11009.0) is turned on.

When setting the time at the CPU module power on or reset, check the hub or external device connection
before setting.

Setting procedure
Set with "Time Setting (SNTP client)" under "Application Settings". ( Page 280 Time Setting)

Confirming the execution results

The time setting execution results can be checked with the following module label.
• 'Operation result' (Un\G11000)
• 'Execution time' (Un\G11001 to Un\G11007)
• 'Required response time' (Un\G11008)

1 FUNCTIONS
1.11 Time Setting Function (SNTP Client) 143
 Precautions
■Time to be set
The time to be set in the CPU module is the time which is obtained by adjusting the time information (UTC) retrieved from the
SNTP server (time information server) based on the time zone set in "Clock Related Setting" under "Operation Related
Setting" of "CPU Parameter".

■Communication timeout
If a response is not received from the SNTP server (time information sever) 20 seconds after the time setting is executed, the
communication times out. An error does not occur when the communication times out. Instead, the timeout occurrence
appears in the event history.

■Delay by communication time

The time set in the CPU module may be delayed by the time required to communicate with the SNTP server's personal
computer. To reduce this delay, specify an SNTP server personal computer on the network that is as close to the Ethernet-
equipped module as possible.

■When using multi-CPU system configuration

Execute the time setting only for the CPU No.1. Even if the time is set for a CPU module other than the CPU No.1, the clock
data for the CPU No.1 is set automatically.

■Setting the execution time

The execution time can be set in the range of 1980 to 2079.

1 FUNCTIONS
144 1.11 Time Setting Function (SNTP Client)
1.12 Web Server Function
The Web server function can read/write device data from/to the CPU module by using a Web browser. The device data can be
1
read/written from/to the CPU module by using a general-purpose Web browser of an Ethernet-connected personal computer
and also by using a general-purpose Web browser of a tablet or smartphone via Ethernet. An original Web page can be
created by users and displayed as well.

Ethernet

For the specifications, parameter settings, procedures before operation, system configuration, functions, and troubleshooting
of the Web server function, refer to the following.
 MELSEC iQ-R/MELSEC iQ-F Web Server Function Guide Book
This manual describes the JavaScript objects and CGI objects that can be used in the user Web page.

Incorporate measures other than this function if the programmable controller system's safety must be
maintained against illegal access from an external device. Mitsubishi shall not be held liable for any system
problems that may occur from illegal access. The user authentication of the Web server function is one
method of preventing illegal access (such as program or data destruction) from an external device. It does not
completely prevent illegal access.
Examples of measures for illegal access are given below.
• Install a firewall
• Install a personal computer as a relay station, and control the relay of send/receive data with an application
program
• Install an external device for which the access rights can be controlled as a relay station (Contact the
network provider or equipment dealer for details on the external devices for which access rights can be
controlled.)

1 FUNCTIONS
1.12 Web Server Function 145
 JavaScript objects
JavaScript objects in the library of user Web pages enable device data to be read or written easily on the user Web page. The
following table lists the objects in the JavaScript object library for the user Web page (RUserWebLib.js).
Object name (function Description Reference
name)
Data block Displays the specified device data in a table format. Page 149 Data block (WSDatblk)
(WSDatblk)
Level display Displays what percentage the device value accounts for of the whole (the range Page 151 Level display (WSLevel)
(WSLevel) between the upper and lower limit values).
Figure display Displays the specified figure when the device value reaches the set value. Page 153 Figure display (WSFigure)
(WSFigure)
Image display Displays the specified image file when the device value reaches the set value. Page 155 Image display (WSPicture)
(WSPicture)
Historical graph Displays the device data in a time-series line graph. Page 156 Historical graph display
(WSHstgrp) (WSHstgrp)
Write button Writes the specified value to the specified device. Page 158 Write button (WSWtrBtn)
(WSWtrBtn)
Logoff button Performs the logoff operation. Page 159 Logoff button (WSLogoutBtn)
(WSLogoutBtn)

Common information on JavaScript objects

■Style sheet
Descriptions for the styles such as character size, color, line color, the background color of the user Web page can be omitted.
If descriptions are omitted or incorrect, the following default display according to the style sheet (UserWebStyle.css) is
applied.
Item Default
Character color Black
Background color White
Line color Black
Fill color of level display Blue
Graph line color Blue
Character size 20
Button character color According to the setting of the Web browser
Button background color According to the setting of the Web browser
Button line color According to the setting of the Web browser

The character font differs depending on the terminal used to display the user Web page.

When editing the style sheet in the library of the user Web page, do not change the class names in the style
sheet. In addition, do not define the style classes with the same name.

1 FUNCTIONS
146 1.12 Web Server Function
■Parameter settings of JavaScript objects
• When an optional parameter setting is omitted, the object will be displayed as default. Also, when the optional parameter
setting is abnormal, the object will be displayed as default. 1
• Set parameters using the specified data formats. A parameter error occurs if a parameter is set in the data format other
than the specified one (for example, when a character string such as '1' is set in the parameter that should be a numeric
value).
• If the X- and Y- coordinates are omitted, the object will be placed at the upper left end (coordinates 0, 0).
• For an RGB value specified for parameters or HTML specifications such as a color name, the range check is not
performed. The operation for an abnormal setting differs depending on the browser.
• When specifying a device name which includes \, such as Un\G and Jn\X, repeat \ as Un\\G and Jn\\X. (\ is an escape
sequence.)
• The following table lists formats and positional notations available for the devices which can be set for JavaScript objects.
: Can be set, : Cannot be set
Classification Type Device name 16-bit signed 32-bit signed Single-precision Bit
16-bit unsigned 32-bit unsigned real number
Double-precision
real number
User device Bit Input (X)    
Output (Y)    
Internal relay (M)    
Latch relay (L)    
Link relay (B)    
Annunciator (F)    
Link special relay (SB)    
Edge relay (V)    
Step relay (S)    
Bit/word Timer (T) : Unsigned decimal/   
hexadecimal
Retentive timer (ST) : Unsigned decimal/   
hexadecimal
Bit/double word Long timer (LT)  : Unsigned decimal/  
hexadecimal
Long retentive timer  : Unsigned decimal/  
(LST) hexadecimal
Bit/word Counter (C) : Unsigned decimal/   
hexadecimal
Bit/double word Long counter (LC)  : Unsigned decimal/  
hexadecimal
Word Data register (D) : Decimal/hexadecimal : Decimal/hexadecimal : Decimal 
Link register (W) : Decimal/hexadecimal : Decimal/hexadecimal : Decimal 
Link special register : Decimal/hexadecimal : Decimal/hexadecimal : Decimal 
(SW)
Bit Direct access input (DX)    
Direct access output    
(DY)
System device Bit Special relay (SM)    
Word Special register (SD) : Decimal/hexadecimal : Decimal/hexadecimal : Decimal 
Index register Word Index register (Z) : Decimal/hexadecimal : Decimal/hexadecimal : Decimal 
Double word Long index register (LZ)  : Decimal/hexadecimal : Decimal for single- 
precision real number
File register Word File register (R) : Decimal/hexadecimal : Decimal/hexadecimal : Decimal 
File register (ZR) : Decimal/hexadecimal : Decimal/hexadecimal : Decimal 
Refresh data Word Refresh data register : Decimal/hexadecimal : Decimal/hexadecimal : Decimal 
register (RD)
Other devices  SFC block device (BL)    
 SFC step device (BLn\S)    

1 FUNCTIONS
1.12 Web Server Function 147
 ■Refreshing cycle
Set the refreshing cycle of the user Web page to the variable updateInterval in HTML. This refreshing cycle applies to all the
objects in the user Web page. When the variable updateInterval is not described in HTML or it is out of range between 5 and
120, 5-second interval (default) applies to the operation.

Ex.
When refreshing the user Web page in 10-second interval
<script>
var updateInterval = 10;
</script>

■Message display language

Set the message display language to the variable dspLanguage in HTML. The following table lists the settings of the variable
dspLanguage and message display languages.
dspLanguage Message display language
No description English
ja-JP Japanese
en-US English
zh-CN Chinese (Simplified)
Other than the above (out of range) English

■Available files
The following files are available in the user Web page.
File Extension MIME type
HTML .html text/html
.htm text/htm
JavaScript .js text/javascript
CSS .css text/css
GIF image .gif image/gif
PNG image .png image/png
JPG/JPEG image .jpg(.jpeg) image/jpeg

1 FUNCTIONS
148 1.12 Web Server Function
Data block (WSDatblk)
This object displays the specified device data in a table format. The current values of the devices are displayed as center
1
aligned and updated in the fixed interval.
• direction = 0 (Vertical)
Window

dev[0] devNamCol dev[5] devValCol

yPos

xPos
devValHeight

blkSize = 5

lnCol

devNamHeight

dev[4] devNamBkCol dev[9] devValBkCol

devNamWidth devValWidth

• direction = 1 (Horizontal)

blkSize = 5

Set dev[n] for the devices to be displayed. (n: 0 to 31)

: Required, : Optional
Parameter Item Description Requirement
dev[0].dsp Device display name 1 A name to be displayed with the data block *1
dev[0].name Device name 1 Device type + device number 
dev[0].base The positional notation of the K: Decimal 
device 1 H: Hexadecimal
B: Binary
dev[0].format The data format of the device 1 0: 16-bit signed 
1: 16-bit unsigned
2: 32-bit signed
3: 32-bit unsigned
4: Single-precision real number
5: Double-precision real number
6: Bit

dev[31].dsp Device display name 32 A name to be displayed with the data block 
dev[31].name Device name 32 Device type + device number 
dev[31].base The positional notation of the K: Decimal 
device 32 H: Hexadecimal
B: Binary

1 FUNCTIONS
1.12 Web Server Function 149
 Parameter Item Description Requirement
dev[31].format The data format of the device 32 0: 16-bit signed 
1: 16-bit unsigned
2: 32-bit signed
3: 32-bit unsigned
4: Single-precision real number
5: Double-precision real number
6: Bit
direction Display direction 0: Vertical 
1: Horizontal (If omitted, it is 0.)
blkSize Block size 1 to 32 
(The number of lines is displayed when the display direction is set
to vertical, and the number of columns is displayed when the
display direction is set to horizontal.)
devNamDisp Device name display 0: Not display 
1: Display (If omitted, it is 1.)
devNamCol Character color of device name The RGB value or color name 
devNamBkCol Background color of device name Example: #FF0000 (RGB value) or red (color name)

devNamWidth Cell width of device name Positive real numbers (unit: px) *1
(For the horizontal display direction, the setting value of the cell
devNamHeight Cell height of device name
width of device value takes priority, and for the vertical display
direction, the setting value of the cell height of device value does.)
devValCol Character color of device value The RGB value or color name 
devValBkCol Background color of device value
devValWidth Cell width of device value Positive real numbers (unit: px) 
devValHeight Cell height of device value
InCol Line color The RGB value or color name 
xPos X-coordinate The horizontal coordinate of the data block at the upper left end 
(unit: px)
yPos Y-coordinate The vertical coordinate of the data block at the upper left end (unit: 
px)

*1 When the device name is not displayed (devNamDisp = 0), no error occurs without this setting.

■Precautions
• Write all the necessary parameters. If the necessary parameters are not written or the setting value is out of range, an error
occurs.
• If the data format is the single-precision real number or double-precision real number, the positional notation will be the
decimal.

1 FUNCTIONS
150 1.12 Web Server Function
Level display (WSLevel)
This object displays the current value of the specified device as a level for the range between the upper and lower limit values.
1
The displayed color can be changed when the current value is above or below the specified value. The current values of the
devices are updated in the fixed interval.
• direction = 0 (Vertical)
Window

yPos
levWidth
upperVal Current value > upperAlmVal Current value < lowerAlmVal

xPos

upperAlmVal upperCol

bkCol

levLength
almLnCol

levCol

lowerAlmVal

lowerCol

lowerVal
devValHeight devValCol

devValWidth devValBkCol

• direction = 1 (Horizontal)
levLength

levWidth

devValHeight

devValWidth

: Required, : Optional
Parameter Item Description Requirement
devName Device name Device type + device number 
direction Level direction 0: Vertical 
1: Horizontal (If omitted, it is 0.)
upperVal Upper limit value A numeric value (decimal) within the range of the specified data 
format.
lowerVal Lower limit value
upperAlmVal Upper limit of alarm value
lowerAlmVal Lower limit of alarm value
dspAlmLn Display of alarm value line 0: Not display 
dspVal Display of current value 1: Display (If omitted, it is 1.)

valFormat Data format 0: 16-bit signed 

1: 16-bit unsigned (If omitted, it is 0.)
2: 32-bit signed
3: 32-bit unsigned
4: Single-precision real number
5: Double-precision real number
levCol Level display color The RGB value or color name 

1 FUNCTIONS
1.12 Web Server Function 151
 Parameter Item Description Requirement
upperCol Display color when the current The RGB value or color name 
value is above the upper limit of (If omitted, it is the
alarm value. same as the level
display color.)
lowerCol Display color when the current
value is below the lower limit of
alarm value.
bkCol Background color The RGB value or color name 
almLnCol Line color of alarm value 
levLength Level length Positive real numbers (unit: px) 
levWidth Level width
xPos X-coordinate The horizontal coordinate of the level display at the upper left end 
(unit: px)
yPos Y-coordinate The vertical coordinate of the level display at the upper left end 
(unit: px)
devValWidth Cell width of current value Positive real numbers (unit: px) 
devValHeight Cell height of current value
devValCol Character color of current value The RGB value or color name 
devValBkCol Background color of current value

■Precautions
Write all the necessary parameters. If the necessary parameters are not written or the setting value is out of range, an error
occurs.

1 FUNCTIONS
152 1.12 Web Server Function
Figure display (WSFigure)
When the device value is within the specified range, a figure is displayed in the specified color. The device value is monitored
1
in the fixed interval.
• figType = 'Oval' (oval)
Window

yPos
figWidth defCol range[n].high ≥ Current value ≥ range[n].low

xPos
figHeight

range[n].col

• figType = 'Rect' (rectangle)

Window

yPos
figWidth defCol

xPos
figHeight

• figType = 'Tri' (triangle)

When a negative value is set for the figure height (figHeight), the downward triangle is displayed.
Window

yPos
figWidth defCol

xPos
figHeight

Set range[n] for the range of the display color to be displayed. (n: 0 to 4)
: Required, : Optional
Parameter Item Description Requirement
devName Device name Device type + device number 
devFormat The data format of the device 0: 16-bit signed 
1: 16-bit unsigned
2: 32-bit signed
3: 32-bit unsigned
4: Single-precision real number
5: Double-precision real number
6: Bit
figType Figure type Oval: Oval (When specifying a circle, set the figure height = width.) 
Rect: Rectangle (When specifying a square, set the figure height =
width.)
Tri: Triangle
figHeight Figure height Real numbers (unit: px) 
When a negative value is set, the value is treated as an absolute
figWidth Figure width
value.
defCol Default display color The RGB value or color name 
(This item is displayed when the device value is out of the setting
range.)
rangeNum Number of setting ranges 1 to 5 
range[0].low Lower limit of setting range 1 A numeric value (decimal) within the range of the specified data 
range[0].high Upper limit of setting range 1 format.

range[0].col Display color when device value The RGB value or color name 
is within setting range 1

1 FUNCTIONS
1.12 Web Server Function 153
 Parameter Item Description Requirement
range[1].low Lower limit of setting range 2 A numeric value (decimal) within the range of the specified data 
format.
range[1].high Upper limit of setting range 2
range[1].col Display color when device value The RGB value or color name 
is within setting range 2

range[4].low Lower limit of setting range 5 A numeric value (decimal) within the range of the specified data 
format.
range[4].high Upper limit of setting range 5
range[4].col Display color when device value The RGB value or color name 
is within setting range 5
xPos X-coordinate The horizontal coordinate of the figure display at the upper left end 
(unit: px)
yPos Y-coordinate The vertical coordinate of the figure display at the upper left end
(unit: px)

■Precautions
• Write all the necessary parameters. If the necessary parameters are not written or the setting value is out of range, an error
occurs.
• If the setting ranges overlap, the figure with the lower number of the setting range is displayed. For example, when the
device value is in both of the setting range 1 and 2, the figure of the setting range 1 is displayed.

1 FUNCTIONS
154 1.12 Web Server Function
Image display (WSPicture)
When the device value is within the specified range, the specified image file can be displayed. The device value is monitored
1
in the fixed interval.
Window

yPos defPicture
pictWidth range[n].high ≥ Current value ≥ range[n].low

STOP RUN
xPos
pictHeight

range[n].picture

Set range[n] for the range in which the image is to be displayed. (n: 0 to 4)
: Required, : Optional
Parameter Item Description Requirement
devName Device name Device type + device number 
devFormat The data format of the device 0: 16-bit signed 
1: 16-bit unsigned
2: 32-bit signed
3: 32-bit unsigned
4: Single-precision real number
5: Double-precision real number
6: Bit
pictHeight Display range height of image file Real numbers (unit: px) 
pictWidth Display range width of image file When a negative value is set, the value is treated as an absolute
value.
defPicture Name of image file to be Extension: .jpg, .jpeg, .gif, .png 
displayed as default (This item is displayed when the device value is out of the setting
range.)
rangeNum Number of setting ranges 1 to 5 
range[0].low Lower limit of setting range 1 A numeric value (decimal) within the range of the specified data 
format.
range[0].high Upper limit of setting range 1
range[0].picture Name of image file displayed Extension: .jpg, .jpeg, .gif, .png 
when device value is within
setting range 1
range[1].low Lower limit of setting range 2 A numeric value (decimal) within the range of the specified data 
format.
range[1].high Upper limit of setting range 2
range[1].picture Name of image file displayed Extension: .jpg, .jpeg, .gif, .png 
when device value is within
setting range 2

range[4].low Lower limit of setting range 5 A numeric value (decimal) within the range of the specified data 
format.
range[4].high Upper limit of setting range 5
range[4].picture Name of image file displayed Extension: .jpg, .jpeg, .gif, .png 
when device value is within
setting range 5
xPos X-coordinate The horizontal coordinate of the figure display range at the upper 
left end (unit: px)
yPos Y-coordinate The vertical coordinate of the figure display range at the upper left 
end (unit: px)

■Precautions
• Write all the necessary parameters. If the necessary parameters are not written or the setting value is out of range, an error
occurs.
• The total size of the image file on one screen should be 100K bytes or smaller.
• If the setting ranges overlap, the image with the lower number of the setting range is displayed. For example, when the
device value is in both of the setting range 1 and 2, the figure of the setting range 1 is displayed.

1 FUNCTIONS
1.12 Web Server Function 155
 Historical graph display (WSHstgrp)
This object displays the device value in a time-series line graph. The device value is read in every refreshing cycle. After the
number of records is reached, the display shifts to left and old records are deleted.
Window

yPos

xPos upperMargin
upper

grBkCol

grElm[0].lnCol

xLine

lower

lowerMargin dispCol
leftMargin grWidth rightMargin

(2) (1)
pointNum
(1) Refreshing cycle
(2) Data in a refreshing cycle is out of the display range.

Set grElm[n] for the devices to be displayed. (n: 0 to 31)

: Required, : Optional
Parameter Item Description Requirement
grElmNum Number of graph elements 1 to 32 
devFormat The data format of the device 0: 16-bit signed 
1: 16-bit unsigned
2: 32-bit signed
3: 32-bit unsigned
4: Single-precision real number
5: Double-precision real number
6: Bit
grElm[0].devName Device name Device type + device number 
grElm[0].lnCol Graph line color The RGB value or color name 
Example: #FF0000 (RGB value) or red (color name)
grElm[1].devName Device name Device type + device number 
grElm[1].lnCol Graph line color The RGB value or color name 

grElm[31].devName Device name Device type + device number 
grElm[31].lnCol Graph line color The RGB value or color name 
grBkCol Graph background color The RGB value or color name 
dspCol Character color
pointNum Number of records 5 to 100 
upper Upper limit value A numeric value (decimal) within the range of the specified data 
format.
lower Lower limit value
yLine Vertical axis interval (record) 0 to 99 
xLine Number of horizontal axes
grHeight Graph height Positive real numbers (unit: px) 
grWidth Graph width

1 FUNCTIONS
156 1.12 Web Server Function
Parameter Item Description Requirement
xPos X-coordinate The horizontal coordinate of the historical graph display at the 

yPos Y-coordinate
upper left end (unit: px)
The vertical coordinate of the historical graph display at the upper
1
left end (unit: px)
rightMargin Right margin Positive real numbers (unit: px) 
(If omitted, it is 0.)
leftMargin Left margin
upperMargin Upper margin
lowerMargin Lower margin

■Precautions
• Write all the necessary parameters. If the necessary parameters are not written or the setting value is out of range, an error
occurs.
• The numerical value used in the historical graph is fixed to decimal.
• If the communication load is high for a while, the device value may be lost.

1 FUNCTIONS
1.12 Web Server Function 157
 Write button (WSWtrBtn)
This object writes the specified value to the specified device.
Window

yPos wrBtn
btnWidth

xPos
btnHeight

btnTxt

: Required, : Optional
Parameter Item Description Requirement
devName Device name Device type + device number 
devBase Positional notation of device K: Decimal 
H: Hexadecimal
B: Binary
devFormat The data format of the device 0: 16-bit signed 
1: 16-bit unsigned
2: 32-bit signed
3: 32-bit unsigned
4: Single-precision real number
5: Double-precision real number
6: Bit
wrVal Write value The setting range depends on the positional notation and data 
format of the device.
Specify a string for the input value.
Example: wrVal: '1'
wrBtn Write button Class element name 
It is used for the selector of the style sheet.
btnTxt Text displayed on the button Optional 
(If omitted, it is
empty.)
btnWidth Button width Positive real numbers (unit: px) 
btnHeight Button height
wrComfirm Write confirmation message 0: Not display 
1: Display (If omitted, it is 0.)
language Message language 0: Japanese 
1: English (If omitted, it is 1.)
2: Chinese (Simplified)
xPos X-coordinate The horizontal coordinate of the write button at the upper left end 
(unit: px)
yPos Y-coordinate The vertical coordinate of the write button at the upper left end 
(unit: px)

■Precautions
• Write all the necessary parameters. If the necessary parameters are not written or the setting value is out of range, an error
occurs.
• If no parameter is specified for the write button, the default style specified in UserWebStyle.css is applied.

1 FUNCTIONS
158 1.12 Web Server Function
Logoff button (WSLogoutBtn)
This object places the button to log off. When the logoff button is clicked, the user login page (Log-in_User.html) is displayed.
1
Window

logOutBtn
yPos
btnWidth

xPos btnHeight

btnTxt

: Required, : Optional
Parameter Item Description Requirement
logOutBtn Logoff button Class element name of button object 
(It is used for the selector of the style sheet.)
btnTxt Text displayed on the button Optional 
(If omitted, it is
empty.)
btnWidth Button width Positive real numbers (unit: px) 
btnHeight Button height
xPos X-coordinate The horizontal coordinate of the logoff button at the upper left end 
(unit: px)
yPos Y-coordinate The vertical coordinate of the logoff button at the upper left end 
(unit: px)

■Precautions
• Write all the necessary parameters. If the necessary parameters are not written or the setting value is out of range, an error
occurs.
• When using the logoff button, always store the user login page (Log-in_User.html) in the SD memory card.
• If no parameter is specified for the logoff button, the default style specified in UserWebStyle.css is applied.

1 FUNCTIONS
1.12 Web Server Function 159
 CGI object
By using the CGI object, a simple and small file size user Web page can be created.
For an overview of CGI, refer to reference books on the market.
For the user Web page, the following CGI objects dedicated to read/write data from/to devices can be used.
File name Item Description Reference
RdDevRnd.cgi Device read CGI Reads the current value of the specified device. Page 162 Device read CGI
WrDevRnd.cgi Device write CGI Writes the specified value to the specified device. Page 168 Device write CGI

The data acquisition from the Web server or the operation to the Web server is executed by passing it as the CGI request from
the client and returning the execution result as a response to the client.

Data specified for CGI object

The data used in the CGI object are listed below.

■Device name
The following table lists the devices that can be accessed with the device read CGI and device write CGI.
Type Device
Bit device X, Y, M, L, B, F, SB, V, DX, DY, SM, Jn\X, Jn\Y, Jn\B, Jn\SB, BL, BLn\S
Word device T (Current value), ST (Current value), C (Current value), D, W, SW, SD, Jn\W, Jn\SW, Un\G, U3En\G, U3En\HG, Z, R,
ZR, RD
Double-word device LT (Current value), LST (Current value), LC (Current value), LZ

When specifying a device name which includes \, such as Un\G and Jn\X, repeat \ as Un\\G and Jn\\X. (\ is an escape
sequence.)

1 FUNCTIONS
160 1.12 Web Server Function
■Device size
Applicable device size differs depending on the device.
For the notation of the device number, specify decimal or hexadecimal depending on the device. 1
: Available in both device read CGI and device write CGI, : Not available
Device Notation Device size
B: Bit W: Word D: Word Q: Quad word
X Hexadecimal    
Y Hexadecimal    
M Decimal    
L Decimal    
B Hexadecimal    
F Decimal    
SB Hexadecimal    
V Decimal    
DX Hexadecimal    
DY Hexadecimal    
SM Decimal    
Jn\X Hexadecimal    
Jn\Y Hexadecimal    
Jn\B Hexadecimal    
Jn\SB Hexadecimal    
BL Decimal    
BLn\S Decimal    
T (current value) Decimal    
ST (current value) Decimal    
C (current value) Decimal    
D Decimal    
W Hexadecimal    
SW Hexadecimal    
SD Decimal    
Jn\W Hexadecimal    
Jn\SW Hexadecimal    
Un\G Decimal    
U3En\G Decimal    
U3En\HG Decimal    
Z Decimal    
R Decimal    
ZR Decimal    
RD Decimal    
LT (current value) Decimal    
LST (current Decimal    
value)
LC (current value) Decimal    
LZ Decimal    Device read CGI only

■Device value
The notation of the device value used in the CGI object should be as follows:
• The CGI object treats device values are treated as a string type in the hexadecimal notation. When using the decimal
number or real number in the Web page, convert hexadecimal  decimal or real number by using JavaScript.
• Do not start with 0x. Do not perform the 0 interpolation. For example, when reading/writing the value 0x012F, set the string
12F as the device value.
• The case of the hexadecimal alphanumeric character is ignored. For example, the device value can be expressed either as
12F or 12f to read/write the value 0x012F.

1 FUNCTIONS
1.12 Web Server Function 161
 Device read CGI
Reads the current value of the specified device.

■Access method and access information

Item Description
Access method POST
Access destination information (URL) /cgi/RdDevRnd.cgi

■Request specifications
The following table lists the parameters used for the request.
Parameter Data type Description Setting range
name
NUM string Hexadecimal string of the number Set this parameter so that the total number of device points specified to read/write in
of read device points (n: 1 to 20) one Web page is within 32 points.
DEV1 string Device name of the first point Up to 16 alphanumeric characters
(This parameter is not case-sensitive. The indirect specification, bit specification, digit
specification, or index modification cannot be performed.)
Page 160 Device name
TYP1 string Device size of the first point B: Bit
W: Word
D: Double word
Q: Quad word
Page 161 Device size

DEV(n) string Device name of the nth point (n: 1 Up to 16 alphanumeric characters
to 32) (This parameter is not case-sensitive. The indirect specification, bit specification, digit
specification, or index modification cannot be performed.)
TYP(n) string Device size of the nth point B: Bit
W: Word
D: Double word
Q: Quad word

The format of the request data is the query string. Specify DEV(n) and TYP(n) with the serial number. Otherwise, an error
occurs.

Ex.
When reading 10 points of device from D0, M100, , SD0
NUM=A&DEV1=D0&TYP1=D&DEV2=M100&  &DEV10=SD0&TYP10=W

1 FUNCTIONS
162 1.12 Web Server Function
■Response specifications
The following table lists the parameters used for the response.
Parameter Data type Description 1
name
RET string Execution result (hexadecimal string)
0000: Normal
0001: Not logged on
0005: Incorrect request source (Referer)
4005: Number of points over
4030: Incorrect device type
4031: Out of device range
4041: Error due to the specified buffer memory number + specified number of transfer points out of buffer memory range
4043: Error of when the specified module does not exist
4080: CGI parameter error
DATA string Reading value (array)
Hexadecimal string

The format of the response data is JSON.

Ex.
Response data of the device read CGI
{
"RET" : "0",
"DATA" : [
"100",

"FABC"
]
}

The above response is transferred in the following format on a message.

{"RET":"0","DATA":["100",  ,"FABC"]}

When the execution result is abnormal, only RET is transferred.

{"RET":"4031"}

To display the device value in the real number format on the Web page, specify D: Double word for the device
size and execute a request (1). Convert the read data to the real number format by using JavaScript (2).

D0 B36FH

D1 35A5H

(1)

DATA[0] "35a5b36f"

(2)

Single-precision
D0 1.234568E-06
real number

Web page

1 FUNCTIONS
1.12 Web Server Function 163
 ■Application example
An example for reading values by using the device read CGI is shown below.
• Display of HTML

(4) (1) (2) (3)

(1) Set DEV1.
(2) Set TYP1.
(3) Set VAL1.
(4) Click to call the ReadDeviceRandomTbl function of JavaScript. (Set the table ID for the argument.)

• HTML example
<form id="devform" name="readdev" method="post">
<table id="devtbl" class="devtbl" border="1">
<tr>
<th>Device Name</th><th>Data Type</th><th>Value</th>
</tr>
<tbody>
<tr>
<td><input type="text" id="DEV1" name=" DEV1" class="input"value='D10' /></td>
<td><input type="text" id="TYP1" name=" TYP1" class="input"value='32-bit Integer' /></td>
<td><input type="text" id="VAL1" name=" VAL1" class="read-input"/></td>
</tr>
<tr>
<td><input type="text" id="DEV2" name="DEV2" class="input" value='SD0'/ ></td>
<td><input type="text" id="TYP2" name="TPY2" class="input" value='16-bit Integer'/ ></td>
<td><input type="text" id="VAL2" name="VAL2" class="read-input"/></td>
</tr>
<tr>
<td><input type="text" id="DEV3" name="DEV3" class="input"value='M0'/ ></td>
<td><input type="text" id="TYP3" name="TYP3" class="input"value='Bit'/ ></td>
<td><input type="text" id="VAL3" name="VAL3" class="read-input"/></td>
</tr>
</tbody>
</table>
<input type="button" value="Read" class="input" onclick=" ReadDeviceRandomTbl(devtbl)"/>
</form>

1 FUNCTIONS
164 1.12 Web Server Function
• JavaScript example
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<!-- charset setting*Set UTF-8 which is set in the Web server setting -->
1
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
<!-- Set the title name -->
<title>Sample</title>
<link href="./css/UserWebStyle.css" rel="stylesheet" media="all" />
<!-- Library JavaScript reading (change the path depending on the storage position) -->
<script src="./RUserWebLib.js"></script>
<!-- Write the original JavaScript hereinafter -->
<!-- Write the JavaScript of the user here -->
<script>
// The function for a CGI request
function ReadDeviceRandomTbl(devtblid) {
var devtblitem = document.getElementById(devtblid);
var i, devitem, typitem;
var tblrows = devtblitem.rows.length;
var param;

// Number of device points setting

param = "NUM=" + (tblrows - 1) + '&';
for (i = 1; i < tblrows; i++) {
// Parameter setting of the device name
devitem = document.getElementById(devtblitem.rows[i].cells[0].childNodes[0].id);
param += devitem.name + "=" + devitem.value + '&';

// Parameter setting of the device size

typitem = document.getElementById(devtblitem.rows[i].cells[1].childNodes[0].id);
if( "Bit" == typitem.value) {
param += typitem.name + "=" + 'B';
}
else if("16-bit Integer" == typitem.value) {
param += typitem.name + "=" + 'W';
}
else if("32-bit Integer" == typitem.value) {
param += typitem.name + "=" + 'D';
}
else {
param += typitem.name + "=" + 'Q';
}
if( i < (tblrows - 1)) param += '&';
}

// Request to the CGI

xhr = new XMLHttpRequest();
xhr.open('POST', "/cgi/RdDevRnd.cgi", true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
var FUNC = function() { ReadDeviceRandomTbl_Response(xhr, devtblid); }; // Response analysis function setting
xhr.onreadystatechange = FUNC;
xhr.send(param);
}

1 FUNCTIONS
1.12 Web Server Function 165
 // The function for analyzing a response
function ReadDeviceRandomTbl_Response(xhr, devtblid) {
// XMLHttpRequest Client status check
// 0:UNSENT 1:OPENED 2:HEADERS_RECEIVED 3:LOADING 4:DONE
if( 4 != xhr.readyState ) {
// End the processing if the status 4 is other than DONE (operation complete).
return;
}

// HTTP Response code check

if ( 200 != xhr.status ) {
// Display the error dialog box if the response code is other than "200 OK".
alert("HTTP STATUS ERROR=" + xhr.status );
return;
}

var i, dataitem;
var devtblitem = document.getElementById(devtblid);
var tblrows = devtblitem.rows.length; // Obtain the number of the table lines (including the header).
var res = JSON.parse( xhr.response ); // Analysis processing of JSON string

// Judgment from the CGI

if( res.RET != "0000" ) {
// Display the error dialog box if the result is abnormal.
alert("ERROR=" + res.RET);
}
else {
// Reflect the obtained value to the table if the result is normal.
for ( i = 1, m = 0; i < tblrows; i++, m++) {
dataitem = document.getElementById(devtblitem.rows[i].cells[2].childNodes[0].id);
// Set the read result to the value of the table (convert the hexadecimal string to numerical value).
dataitem.value = parseInt(res.DATA[m],16);
}
alert("read complete");
}
}
</script>
</head>

1 FUNCTIONS
166 1.12 Web Server Function
<body>
<form>
<table id="devtbl" class="devtbl" border="1">
<tr>
1
<th>Device Name</th>
<th>Data Type</th>
<th>Value</th>
</tr>
<tbody>
<tr>
<td><input type="text" id="DEV1" name="DEV1" class="input" value="D10"/></td>
<td><input type="text" id="TYP1" name="TYP1" class="input" value="16-bit Integer"/></td>
<td><input type="text" id="DATA1" name="DATA1" class="read-input" ></td>
</tr>
<tr>
<td><input type="text" id="DEV2" name="DEV2" class="input" value="D11"/></td>
<td><input type="text" id="TYP2" name="TYP2" class="input" value="32-bit Integer"/></td>
<td><input type="text" id="DATA2" name="DATA2" class="read-input" /></td>
</tr>
<tr>
<td><input type="text" id="DEV3" name="DEV3" class="input" value="M0"/></td>
<td><input type="text" id="TYP3" name="TYP3" class="input" value="Bit"/></td>
<td><input type="text" id="DATA3" name="DATA3" class="read-input" /></td>
</tr>
</tbody>
</table>
<input type="button" value="Read" class="input" onclick="ReadDeviceRandomTbl('devtbl')"/>
</form>
</body>
</html>

(5)

(5) Display the read result.

In the above example, the request parameter is as follows:

NUM=3&DEV1=D10&TYP1=D&DEV2=SD0&TPY2=W&DEV3=M0&TYP3=B

1 FUNCTIONS
1.12 Web Server Function 167
 Device write CGI
Writes the specified value to the specified device.

■Access method and access information

Item Description
Access method POST
Access destination information (URL) /cgi/WrDev.cgi

■Request specifications
The following table lists the parameters used for the request.
Parameter Data type Description Setting range
name
NUM string Number of write device points (1) Set 1.
(Set this parameter so that the total number of device points specified to read/write
per Web page is within 32 points.)
DEV1 string Device name Up to 16 alphanumeric characters
(This parameter is not case-sensitive. The indirect specification, bit specification, digit
specification, or index modification cannot be performed.)
Page 160 Device name
TYP1 string Device size B: Bit
W: Word
D: Double word
Q: Quad word
Page 161 Device size
DATA1 string Write value Hexadecimal string

The format of the request data is the query string.

Ex.
Writing FFFFH to D0
NUM=1&DEV1=D0&TYP1=W&DATA1=FFFF

When writing the device value which is input to the Web page in the real number format, the input data needs
to be converted to the hexadecimal format by using JavaScript (1). For the device size, D: Double word needs
to be specified and performing a request (2) are required as well.

Single-precision
D0 1.234568E-06
real number

Web page
(1)

DATA1 "35a5b36f"

(2)

D0 B36FH

D1 35A5H

1 FUNCTIONS
168 1.12 Web Server Function
■Response specifications
The following table lists the parameters used for the response.
Parameter Data type Description 1
name
RET string Execution result (hexadecimal string)
0000: Normal
0001: Not logged on
0002: No permission (A user without device write permission executed the CGI.)
0005: Incorrect request source (Referer)
4005: Number of points over
4030: Incorrect device type
4031: Out of device range
4041: Specified buffer memory number + specified number in the transfer points is out of buffer memory range error
4043: Error of when the specified module does not exist
4080: CGI parameter error
4032: Device specification error
DATA string The read value of the target device (array)
Hexadecimal string

The format of the response data is JSON.

Ex.
Response data of the device write CGI
{
"RET" : "0",
"DATA" : [
"100"
]
}

The above response is transferred in the following format on a message.

{"RET":"0","DATA":["100"]}

When the execution result is abnormal, data is not written and only the RET is transferred.
{"RET":"4031"}

1 FUNCTIONS
1.12 Web Server Function 169
 ■Application example
An example for writing a value by using the device write CGI is shown below.
• Display of HTML

(4) (1) (2) (3)

(1) Set DEV1.
(2) Set TYP1.
(3) Set VAL1.
(4) Click it to call the WriteDeviceBlockTbl function of JavaScript. (Set the table ID, the line number where the write starts, and the number of write points 1 for
the arguments.)

• HTML example
<form id="devform" name="readdev" method="post">
<table id="devtbl" class="devtbl" border="1">
<tr>
<th>Device Name</th><th>Data Type</th><th>Value</th>
</tr>
<tbody>
<tr>
<td><input type="text" id="DEV1" name=" DEV1" class="input"value='D10'/ ></td>
<td><input type="text" id="TYP1" name=" TYP1" class="input"value='32-bit Integer'/ ></td>
<td><input type="text" id="DATA1" name=" DATA1" class="input"value='3'/></td>
</tbody>
</table>
<input type="button" value="Write" class="input" onclick=" WriteDeviceBlockTbl(devtbl,1,1)"/>
</form>

1 FUNCTIONS
170 1.12 Web Server Function
• JavaScript example
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<!-- charset setting*Set UTF-8 which is set in the Web server setting -->
1
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
<!-- Set the title name -->
<title>Device write CGI sample</title>
<link href="./css/UserWebStyle.css" rel="stylesheet" media="all" />
<!-- Library JavaScript reading (change the path depending on the storage position) -->
<script src="./RUserWebLib.js"></script>
<!-- Write the original JavaScript hereinafter -->
<!-- Write the JavaScript of the user here -->
<script>
function WriteDeviceBlockTbl(devtblid, row) {
var dataitem;
var xhr;
var devtblitem = document.getElementById(devtblid);
// Number of device points setting (fixed to one point)
var param = 'NUM=1&';
// Parameter setting of the device name
var devitem = document.getElementById(devtblitem.rows[row].cells[0].childNodes[0].id);
param += 'DEV1=' + devitem.value + '&';

// Parameter setting of the device size

var typitem = document.getElementById(devtblitem.rows[row].cells[1].childNodes[0].id);
if( 'Bit' == typitem.value){
param += 'TYP1=' + 'B';
}
else if( '16-bit Integer' == typitem.value) {
param += 'TYP1=' + 'W';
}
else if( '32-bit Integer' == typitem.value) {
param += 'TYP1=' + 'D';
}
else {
param += 'TYP1=' + 'Q';
}
param += '&';

// Parameter setting of the data

var dataitem = document.getElementById(devtblitem.rows[row].cells[2].childNodes[0].id);
param += 'DATA1=' + parseInt(dataitem.value).toString(16)

// Request to the CGI

xhr = new XMLHttpRequest();
xhr.open('POST', "/cgi/WrDev.cgi", true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
var FUNC = function() { WriteDeviceBlockTbl_Response(xhr, typitem, dataitem); }; // Response analysis function setting
xhr.onreadystatechange = FUNC;
xhr.send(param);
}

1 FUNCTIONS
1.12 Web Server Function 171
 // The function for analyzing a response
function WriteDeviceBlockTbl_Response(xhr, typitem, dataitem) {
// XMLHttpRequest Client status check
// 0:UNSENT 1:OPENED 2:HEADERS_RECEIVED 3:LOADING 4:DONE
if( 4 != xhr.readyState ) {
// End the processing if the status 4 is other than DONE (operation complete).
return;
}
// HTTP Response code check
if ( 200 != xhr.status ) {
// Display the error dialog box if the response code is other than "200 OK".
alert("HTTP STATUS ERROR=" + xhr.status );
return;
}

var value;
var res = JSON.parse( xhr.response ); // Analysis processing of JSON string
// Judgment from the CGI
if( res.RET != "0000" ) {
// Display the error dialog box if the result is abnormal.
alert("ERROR=" + res.RET);
}
else {
// Reflect the write result value if the result is normal.
dataitem.value = parseInt(res.DATA[0],16);
alert("write complete");
}
}
</script>
</head>

1 FUNCTIONS
172 1.12 Web Server Function
<body>
<form>
<table id="devtbl" class="devtbl" border="1">
<tr>
1
<th>Device Name</th>
<th>Data Type</th>
<th>Value</th>
</tr>
<tbody>
<tr>
<td><input type="text" id="DEV1" name="DEV1" class="input" value="D10"/></td>
<td><input type="text" id="TYP1" name="TYP1" class="input" value="16-bit Integer"/></td>
<td><input type="text" id="DATA1" name="DATA1" class="input" value="3"/></td>
<td><input type="button" value=" Write" class="input" onclick="WriteDeviceBlockTbl('devtbl',1)"/></td>
</tr>
<tr>
<td><input type="text" id="DEV2" name="DEV2" class="input" value="D11"/></td>
<td><input type="text" id="TYP2" name="TYP2" class="input" value="32-bit Integer"/></td>
<td><input type="text" id="DATA2" name="DATA2" class="input" value="10"/></td>
<td><input type="button" value=" Write" class="input" onclick="WriteDeviceBlockTbl('devtbl',2)"/></td>
</tr>
<tr>
<td><input type="text" id="DEV3" name="DEV3" class="input" value="M0"/></td>
<td><input type="text" id="TYP3" name="TYP3" class="input" value="Bit"/></td>
<td><input type="text" id="DATA3" name="DATA3" class="input" value="1"/></td>
<td><input type="button" value=" Write" class="input" onclick="WriteDeviceBlockTbl('devtbl',3)"/></td>
</tr>
</tbody>
</table>
</form>
</body>
</html>

In the above example, the request parameter is as follows:

NUM=1&DEV1=D10&TYP1=D&DATA1=3

1 FUNCTIONS
1.12 Web Server Function 173
 Error message

Display example of error messages

If an object of the user Web page is used incorrectly, a button to notify the user of an error is displayed at the upper left of the
object when the user Web page is displayed. The error message related to the common processing which is not limited to the
object is displayed at the upper left of the window.

Click the button to display the detailed information of the error.

1 FUNCTIONS
174 1.12 Web Server Function
■List of error messages of the user Web page
The following table lists error messages, causes, and action of the user Web page.
Description Cause Action 1
A required parameter "XXX" has not been set. A required parameter has not been set. Check the contents of the HTML file.
The setting of the parameter "XXX" is incorrect. Parameters are out of the setting range.
Set values of parameters that should be numeric
values are specified with other than numeric
values.
The data format of the device "XXX" is incorrect. Positional notation of the device, data format,
device name
The receive data contains errors. The receive data contains errors. Check that the CPU module and the client terminal
are properly connected and update the Web page.
You were logged off. Log on and try again. The user has been logged off. (Communications Check that the CPU module and the terminal are
are disconnected.) properly connected and log on again.
Specified devices are invalid. The following are the Device names are incorrect. Check parameters of each object to see if any device
possible causes. name is specified incorrectly.
• A device such as pointer and constant
• Unsupported device
Specified device No. is invalid. The following are Device numbers and buffer memory addresses Check parameters of each object to see if any device
the possible causes. are out of range or not numeric values. The number and buffer memory address are specified
• A device over the settable device range of CPU device range is incorrect. incorrectly.
parameter
Specified modules do not exist. Check the The module numbers are incorrect. Check parameters of each object to see if any module
modules. An error has occurred in communications with number is specified incorrectly.
intelligent function modules. Check that there are no power-offs or errors in
extension units.

For details on the other errors, refer to the following.

 MELSEC iQ-R/MELSEC iQ-F Web Server Function Guide Book
 MELSEC iQ-R CPU Module User's Manual (Application)

1 FUNCTIONS
1.12 Web Server Function 175
 1.13 Security
Security depending on the network environment can be structured by restricting access by each communication path to the
CPU module.
For the restriction methods for access, refer to the following.
• Page 176 IP filter
• Page 177 Remote password

IP filter
Identifies the IP address of the access source, and prevents access from an illegal IP address.
The IP address of the external device to be allowed or denied is set in the parameters, and access from external devices is
restricted.
Use of this function is recommended when using in an environment connected to a LAN line.

Ethernet

External device
Access permitted IP address: 192.168.1.2

Ethernet-equipped module

Access permitted External device

IP address: 192.168.1.3

Access prohibited

External device
IP address: 192.168.1.5

• This setting is not available when the RJ71EN71 network type is set to "Q Compatible Ethernet".
• Access cannot be restricted when the network other than Ethernet is set as the communication path.

The IP filter is one method of preventing illegal access (such as program or data destruction) from an external
device. It does not completely prevent illegal access. Incorporate measures other than this function if the
programmable controller system's safety must be maintained against illegal access from an external device.
Mitsubishi shall not be held liable for any system problems that may occur from illegal access.
Examples of measures for illegal access are given below.
• Install a firewall
• Install a personal computer as a relay station, and control the relay of send/receive data with an application
program
• Install an external device for which the access rights can be controlled as a relay station (Contact the
network provider or equipment dealer for details on the external devices for which access rights can be
controlled.)

1 FUNCTIONS
176 1.13 Security
Setting procedure
1. Set the IP address to be allowed or denied in "IP Filter Settings" of "Security" under "Application Settings". ( Page
1
284 IP Filter Settings)
2. Write the module parameters to the CPU module.

3. The IP filter is enabled when the CPU module power is turned off and on or reset.

Even if the connection is established as set with the Ethernet-equipped module's "External Device
Configuration" under "Basic Settings" or the program, access from the external device is either allowed or
denied following "IP Filter Settings" of "Security" under "Application Settings".
Therefore, if the IP address set in the Ethernet-equipped module's "External Device Configuration" under
"Basic Settings" is set to be denied with "IP Filter Settings" of "Security" under "Application Settings", the IP
filter is enabled and communication with the external device is denied.

Precautions
If there is a proxy server in the LAN line, deny the IP address for the proxy server. If the IP address is allowed, it will not be
possible to prevent access from personal computers that access the proxy server.

Remote password
Permits or prohibits access from the external device to the CPU module via the Ethernet-equipped module. This function can
prevent illegal access of the CPU module from a remote location.

The remote password is one method of preventing illegal access (such as program or data destruction) from
an external device. It does not completely prevent illegal access. Incorporate measures other than this
function if the programmable controller system's safety must be maintained against illegal access from an
external device. Mitsubishi shall not be held liable for any system problems that may occur from illegal access.
Examples of measures for illegal access are given below.
• Install a firewall
• Install a personal computer as a relay station, and control the relay of send/receive data with an application
program
• Install an external device for which the access rights can be controlled as a relay station (Contact the
network provider or equipment dealer for details on the external devices for which access rights can be
controlled.)

Number of settable modules

Up to eight modules can be set for remote passwords.
When using the multiple CPU system configuration, up to eight modules can be set for each CPU module.

1 FUNCTIONS
1.13 Security 177
 Setting procedure
Set the remote password as follows.
[Navigation window]  [Parameter]  [Remote Password]
1. Register the remote password on the "Register
Password" window.
[Password] button

2. Select the module for which the remote password is to

be applied, and set the start I/O number. Select the
following items when using the RnENCPU.
• CPU part: "CPU Module (Built-in Ethernet Function)"
• Network part: "CC-Link IE Built-in Ethernet I/F Module"

3. Set the target connection on the "Remote Password

Detail Setting" window.
"Detail Setting" for the target module.

4. Write the remote password to the CPU module.

5. The remote password is enabled when the CPU
module is powered off and on or reset.

1 FUNCTIONS
178 1.13 Security
Access permit/prohibit processing operation
This section describes the processing for permitting or prohibiting access of the CPU module with remote password by the
1
external device.

■Access permit processing (Unlock processing)

The external device trying to communicate unlocks the remote password set for the connected Ethernet-equipped module.
If the password is not unlocked, the Ethernet-equipped module to which the external device is connected prohibits access, so
an error occurs in the external device.
The unlocking method is shown below.
• SLMP dedicated command (Remote Password Unlock)
• Dedicated command (password-unlock) for file transfer function (FTP server)
• Input password from engineering tool

■Access processing
Access to the specified station is possible when the remote password is correctly unlocked. Execute the arbitrary access.

■Access prohibit processing (Lock processing)

When access to the specified station ends, lock the remote password from the external device to disable subsequent access.
The locking method is shown below.
• SLMP dedicated command (Remote Password Lock)
• Dedicated command (password-lock) for file transfer function (FTP server)
• Lock with engineering tool (executed automatically)

Remote password check operation

■Communication that is checked
The Ethernet-equipped module checks the remote password for a communication request made to the own station or other
station received from the external device.
When checking a remote password for modules with multiple connections, the connection for which the remote password is
set.

RJ71EN71

CPU module

Remote password Remote password Path checked using

check a remote password
(Own station)
(2) Path not checked using
(Another station) (3) a remote password

(3)

Engineering tool

CPU module

Remote Remote password

password check

(*1)

Engineering tool
RJ71EN71

*1 The remote password check is set, so the communication request from the external device is not accepted. If the remote password
check is not set, the communication request can be accepted and data can be exchanged from the external device.

1 FUNCTIONS
1.13 Security 179
 ■Accessible station
The station accessible from the external device when a remote password is set for the CPU module and the station that can
unlock/lock the remote password are limited to those in the same network number.
The following figure shows an example of when the remote password is set for multiple stations in the system.

Ex.

Station 1-2 (1)

Station A

CPU
module RJ71EN71

Network No.1 Ethernet

Station 1-1 (1) (2) Station 3-2 (1)

Remote Remote Remote Remote
password password password password
check check
Station B
CPU module RJ71EN71 RJ71EN71 CPU module RJ71EN71
Engineering tool

Ethernet Network No.2 Network No.3 Ethernet

Station 2-1 (1) Station 2-2 (1) (2) Station 3-1 (1)
Remote Remote
password password
CPU CPU
RJ71EN71 check module
RJ71EN71
module

Station C CPU module RJ71EN71 RJ71EN71 Station D

*1 The password can be unlocked and locked by the following external devices.
1-1 station (1): A station only
2-2 station (1): C station only
3-2 station (1): D station only
: Station accessible from external device after remote password is unlocked
: Station accessible from external device even if remote password is not unlocked
: Station that cannot be accessed from external device
External Target programmable controller (request source)
device*2 1-1 station CPU 1-2 station CPU 2-1 station CPU 2-2 station CPU 3-1 station CPU 3-2 station CPU
(Request
source)
A station      
B station      
C station      
D station      

*2 The A station accesses the  station after the remote password for 1-1 station (1) is unlocked and access the  station if the
communication line is open.
The B station accesses the  station if the communication line is open.
The C station accesses the  station after the remote password for 2-2 station (1) is unlocked and access the  station if the
communication line is open.
The D station accesses the  station after the remote password for 3-2 station (1) is unlocked and access the  station if the
communication line is open.

1 FUNCTIONS
180 1.13 Security
Precautions
The following section lists the precautions for using remote password.
1
■Set connection
Set the remote password for the connection used to exchange data with an external device that can execute the unlock/lock
processing.

■When remote password is set for UDP/IP connection

• Determine the external device to communicate with and exchange the data. (With UDP/IP, after the remote password is
unlocked data can be exchanged with devices other than the unlocked external device too. Determine the communication
device before starting use.)
• Always lock the remote password after data communication is finished. (If the remote password is not locked, the unlocked
state is held until timeout occurs.)
• Set "UDP" for "Existence Confirmation" of the target connection in "External Device Configuration" under "Basic Settings".
Set as small a value as possible for the "Destination Alive Check Start Interval Timer" and "Destination Alive Check Interval
Timer" in "Timer Settings for Data Communication" under "Application Settings".

■TCP/IP close processing

If the TCP/IP is closed before the TCP/IP is locked, the CPU module will automatically start the lock processing.

■Remote password valid range

The remote password is valid only for access from the Ethernet-equipped module for which the parameters are set. When
using multiple CPU modules in a multi-CPU system, set a remote password for each CPU module for requiring a remote
password.

A
B Ethernet
C
Enable/ D
Disable

Remote password
check
No remote password
parameter
Remote password
parameter

The remote password is checked when accessing with path A or B.

The remote password is not checked when accessing with path C or D.

■Connection for nonprocedural fixed buffer communication

The remote password is not checked during communication for nonprocedural fixed buffer communication, so do not set the
remote password check.

■Accessing another station's programmable controller

When the external device is accessing another station's programmable controller via the Ethernet-equipped module, it may
not be possible to access the programmable controller if a remote password is set for the CPU module at the relay station or
access station.

1 FUNCTIONS
1.13 Security 181
 ■When the CPU module is used as a relay station for the connection between the MELSOFT
product and GOT
A remote password is enabled when the following items are set in "System Connection" in "Remote Password Detail Setting".
"PLC side I/F Detailed Setting of PLC Module" of "Current "System Connection" of "Remote Password Detail Setting"
Connection Destination"
Ethernet port direct connection MELSOFT direct connection
Connection via a hub MELSOFT transmission port (UDP/IP)

The following figure shows the availability of the access when a remote password is set for a relay station (CPU module).
Target device

(1) (2) (3) (4) (5)

Ethernet Ethernet Ethernet

When a remote password is set for (1), the target device becomes accessible after the remote password is unlocked.
When remote passwords are set for (2) to (5), the target device is accessible even when the remote passwords are not unlocked.

1 FUNCTIONS
182 1.13 Security
1.14 Simple CPU Communication Function (RJ71EN71,
RnENCPU (Network Part)) 1
This function allows data communications between specified devices at the specified timing just by making simple settings of
the RJ71EN71 and RnENCPU (network part) from an engineering tool. Send/receive is performed with a specified
communication destination on a one-to-one basis.
Ethernet

MELSEC iQ-R

RJ71EN71

MELSEC-Q

MELSEC-L

MELSEC iQ-F

MELSEC iQ-L

MELSEC-F

SLMP

MODBUS/TCP

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 183
 Communication destination Type Description
MELSEC iQ-R series CPU module, Ethernet module Page 186 Module type
MELSEC-Q series CPU module, Ethernet module
MELSEC-L series CPU module, Ethernet module
MELSEC iQ-F series CPU module
MELSEC iQ-L series CPU module
MELSEC-A/AnS series Ethernet module
MELSEC-F series Ethernet block/adapter
Programmable controllers of other companies
SLMP-compatible device QnA-compatible 3E frame
MODBUS/TCP slave device

Access via routers is also available. For the access, set the subnet mask and default gateway. ( Page 262
Own Node Settings)

Before using the simple CPU communication function, check the versions of the module and engineering tool
used. ( Page 215 Restrictions applicable depending on versions)

1 FUNCTIONS
184 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
Setting procedure
The following section describes the settings for using this function. 1
1. Set "Enable" for "To Use or Not to Use Simple PLC Communication Setting" in "Simple PLC Communication Setting"
under "Application Settings".
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Application Settings]  [Simple PLC Communication Setting]
2. Double-click "<Detailed Setting>" of the "Simple PLC Communication Setting" to display the following window. (
Page 276 Simple CPU communication setting (RJ71EN71, RnENCPU (network part)))

3. After setting the items, write the module parameters to the CPU module of the own station, and reset or power off and on
the CPU module to start the simple CPU communication.

When "On Request" is set to the communication setting, refer to the following.
Page 201 Operations when the communication setting is "On Request"

Communication Pattern
Select the communication pattern from the following items.
Setting item Description
Read Read the data of the specified destination device (transmission source) to the specified device of the own station
(transmission destination).
Write Write the data of the specified device of the own station (transmission source) to the specified destination device
(transmission destination).

Communication Setting: Execution Interval

Select the communication timing from the following items.
Setting item Description Setting range
Fixed Interval  Data are communicated between the devices at a specified 
execution interval.
Execution Interval (ms) Execution interval is set. 1ms to 65535ms (in increments of
1ms)
On Request Data are communicated between the devices upon request only. 

• Actual time of execution interval may be longer than the value of the setting because the time is affected by
the specified communication destinations or Ethernet line congestion. For the preventive measures, refer to
the following.
Page 325 When the simple CPU communication function is used
• If latency time is set, data communication is started after the latency time has passed. ( Page 204
Latency Time)

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 185
 Communication Destination (IP Address)
Click "Destination" to open the "Communication Destination Setting" window and specify the communication destination. Up
to 64 communication destinations can be registered.

In the engineering tool, up to 512 communication destinations can be set. Note that the settable number is
different.
Devices having different settings in any of the items below are counted as different communication
destination.
• Module type
• IP address
• UDP/TCP
• Port No.
• Own station port number
• Option (hexadecimal)

■Module type
Select the module type of the communication destination.
Module type Communication destination Communication specification
MELSEC iQ-R (Built-in Ethernet) RnCPU, RnENCPU*1, RnPCPU, RnSFCPU, RnPSFCPU MELSOFT connection (protocol: UDP)
MELSEC-Q (Built-in Ethernet) Built-in Ethernet port QCPU
MELSEC-L (Built-in Ethernet) Built-in Ethernet port LCPU
MELSEC iQ-F (Built-in Ethernet) FX5U CPU module, FX5UC CPU module MELSOFT connection (protocol: TCP)
MELSEC iQ-L (Built-in Ethernet) LnHCPU MELSOFT connection (protocol: UDP)
MELSEC iQ-R (Ethernet Module) RnENCPU*2, RJ71EN71
MELSEC-Q (Ethernet Module) QJ71E71-100
MELSEC-L (Ethernet Module) LJ71E71-100
MELSEC-A/AnS (Ethernet Module) AJ71E71N3-T, AJ71QE71N3-T, A1SJ71E71N3-T, A1SJ71QE71N3-T MC protocol (A-compatible 1E frame)
MELSEC-FX3 (Ethernet Block/Adapter) FX3U-ENET-ADP, FX3U-ENET-L
SLMP Corresponding Device (QnA • SLMP-compatible device (No serial number) SLMP (MC protocol QnA-compatible 3E
Compatible 3E Frame) • MC protocol 3E frame-compatible device frame)
• Read (0401H)
• Write (1401H)
OMRON (CS/CJ series) Supported model for SYSMAC CS/CJ series FINS
KEYENCE (KV series) Supported model for KV series SLMP (MC protocol QnA-compatible 3E
frame)
Panasonic (FP2SH series) Supported model for FP2 series MEWTOCOL
Panasonic (FP7 series) Supported model for FP7 series MEWTOCOL7
YASKAWA MP3000 series Supported model for MP3000 series Extended MEMOBUS
YASKAWA MP2000 series Supported model for MP2000 series
Yokogawa FA-M3 series Supported model for FA-M3 series Personal computer link
MODBUS/TCP-compatible device MODBUS/TCP slave device MODBUS/TCP
SIEMENS S7 series Supported model for S7 series S7 Communication
Fuji Electric MICREX-SX series • Supported model for MICREX-SX (CPU module) series Loader command
• Supported model for MICREX-SX (Ethernet module) series
JTEKT TOYOPUC series • Supported model for TOYOPUC PC10 (CPU module) series Computer link
• Supported model for TOYOPUC Plus (CPU module) series
• Supported model for TOYOPUC Plus (Ethernet module) series

*1 When the RnENCPU is used for the connection to the Ethernet port of the CPU part
*2 When the RnENCPU is used for the connection to the Ethernet port of the network part

1 FUNCTIONS
186 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
■IP address, UDP/TCP, port number
Set the IP address of the communication destination, communication protocol, port number, and own port number.
Module type Setting range 1
IP address UDP/TCP Port No. Own station port
number
MELSEC iQ-R (Built-in Ethernet) 0.0.0.1 to UDP Cannot be set. 1 to 4999, 5010 to 65534
223.255.255.254
MELSEC-Q (Built-in Ethernet) UDP
MELSEC-L (Built-in Ethernet) UDP
MELSEC iQ-F (Built-in Ethernet) TCP
MELSEC iQ-L (Built-in Ethernet) UDP
MELSEC iQ-R (Ethernet Module) UDP
MELSEC-Q (Ethernet Module) UDP
MELSEC-L (Ethernet Module) UDP
MELSEC-A/AnS (Ethernet Module) UDP, TCP 256 to 65534
MELSEC-FX3 (Ethernet Block/Adapter) UDP, TCP 1025 to 5548, 5552 to
65534
SLMP Corresponding Device (QnA UDP, TCP 1 to 65534
Compatible 3E Frame)
OMRON (CS/CJ series) UDP
KEYENCE (KV series) UDP, TCP
Panasonic (FP2SH series) UDP, TCP
Panasonic (FP7 series) UDP, TCP
YASKAWA MP3000 series UDP, TCP
YASKAWA MP2000 series UDP, TCP
Yokogawa FA-M3 series UDP, TCP
MODBUS/TCP-compatible device TCP
SIEMENS S7 series TCP 102
Fuji Electric MICREX-SX series TCP 251 to 65531
JTEKT TOYOPUC series TCP 1025 to 65535

• When a multiple CPU system is configured, specify the IP address of the CPU module to which the Ethernet
cable is connected.
• Port numbers 1 to 1023 are typically reserved port numbers (WELL KNOWN PORT NUMBERS) and 61440
to 65534 are used by other communication functions, so it is recommended to use 1024 to 4999 or 5010 to
61439 for the own station port numbers.
• If the communication destination is Mitsubishi Electric programmable controllers (except MELSEC-A/AnS
and MELSEC-FX3), the number between 61696 and 65534 is dynamically used for the own station port
number. Consequently, do not specify the number between 61696 and 65534 for the own station port
number in the OPEN instruction and the GP.CONOPEN instruction. Otherwise, the instruction may not be
completed properly.
• When specifying the same communication destination in multiple settings, set different own station port
numbers.

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 187
 ■Option (hexadecimal)
Set the option setting value of the communication destination.
Module type Setting range
MELSEC iQ-R (Built-in Ethernet) Cannot be set.
MELSEC-Q (Built-in Ethernet)
MELSEC-L (Built-in Ethernet)
MELSEC iQ-F (Built-in Ethernet)
MELSEC iQ-L (Built-in Ethernet)
MELSEC iQ-R (Ethernet Module)
MELSEC-Q (Ethernet Module)
MELSEC-L (Ethernet Module)
MELSEC-A/AnS (Ethernet Module)
MELSEC-FX3 (Ethernet Block/Adapter)
SLMP Corresponding Device (QnA
Compatible 3E Frame)
OMRON (CS/CJ series)
KEYENCE (KV series)
Panasonic (FP2SH series)
Panasonic (FP7 series)
YASKAWA MP3000 series
YASKAWA MP2000 series
Yokogawa FA-M3 series
MODBUS/TCP-compatible device Set the setting value for the module ID of the MODBUS application header.
■When communicating with a MODBUS/TCP-compatible device
00H or FFH
■When communicating with a MODBUS RTU/ASC-compatible device via a gateway device
• 00H (broadcast)
• 01H to F7H (station number of a MODBUS RTU/ASC-compatible device)
SIEMENS S7 series Cannot be set.
Fuji Electric MICREX-SX series
JTEKT TOYOPUC series

Precautions
The following are the precautions when 00H (broadcast) is set for communication with a MODBUS RTU/ASC-compatible
device via a gateway device.
• Since the slave station does not response, a timeout error (CFB0H) occurs. Do not specify the read.
• Do not specify both a bit device and a word device in one setting value. Specify only one of them.
• When setting multiple devices, set a different own station port number.
For the communication time-out period, communication retry count, and monitoring time at error, set as follows. When setting
the following values, the second communication is executed after Communication Time-out Period, and the communication of
a third or later is executed at the cycle of Communication Time-out Period  2.
• Communication Retry Count = 0
• Communication Time-out Period = Monitoring Time At Error

1 FUNCTIONS
188 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
Setting for communication destination
The settings differ depending on the communication destination.
1
Specify the protocol and own station port number for each setting to be the same as those set in the simple CPU
communication settings.
Communication destination Necessary setting
MELSEC iQ-R (Built-in Ethernet)*1 Since the MELSOFT connection is used for communications, no setting is required.
MELSEC-Q (Built-in Ethernet) Set the following items (for the number of devices) in the "Open Setting" window.
• Protocol: "UDP"
MELSEC-L (Built-in Ethernet)
• Open System: "MELSOFT Connection"
MELSEC iQ-F (Built-in Ethernet)*2 Since the MELSOFT connection is used for communications, no setting is required.
MELSEC iQ-L (Built-in Ethernet)
MELSEC iQ-R (Ethernet Module)*1
MELSEC-Q (Ethernet Module) Set the network number and station number.
MELSEC-L (Ethernet Module)
MELSEC-A/AnS (Ethernet Module) ■Programming tool
Create an initial processing program, and set the following items.
• IP address and port number
• Communication method (UDP/TCP)
• Bit 15 and Bits 0 to 7 of Area for communication instruction during stop (Un\G496) (Turn on the bits corresponding
to the connection numbers to be used.)*3
■DIP switch on the front of the module
Set the following items.
• SW2 (data code setting): Off
• SW7 (CPU communication timing setting): On*4
MELSEC-FX3 (Ethernet Block/Adapter) Set "Communication Data Code" of "Ethernet Port" to "Binary Code".
Set the following items (for the number of devices) in the "Open Setting" window.
• Protocol: "UDP or "TCP"
• Open system: "MC protocol"
• IP address, port number: Settings made for the own station (RJ71EN71 or RnENCPU)
SLMP Corresponding Device (QnA Configure the settings so that the SLMP (QnA-compatible 3E frame of the MC protocol) can be used on the SLMP-
Compatible 3E Frame) compatible device side. ( Manual for the device used)
Set the communication data code to binary.
OMRON (CS/CJ series) Refer to the manual for the programmable controller of other manufacturer to be used.
KEYENCE (KV series)
Panasonic (FP2SH series)
Panasonic (FP7 series)
YASKAWA MP3000 series
YASKAWA MP2000 series
Yokogawa FA-M3 series
MODBUS/TCP-compatible device Set the MODBUS/TCP as a slave station. ( Manual for the device used)
SIEMENS S7 series Refer to the manual for the programmable controller of other manufacturer to be used.
Fuji Electric MICREX-SX series
JTEKT TOYOPUC series

*1 Up to 64 devices can be connected to each port of the CPU module (built-in Ethernet port part) or the Ethernet module.
*2 Up to nine devices can be connected.
*3 Set this item to execute this function while the communication destination CPU module is in the STOP state or stop error state.
*4 Turn on this switch to execute this function while the communication destination CPU module is in the RUN state.

Target PLC No.

When the communication destination is one of the following modules and a multiple CPU system is used, specify the "Target
PLC No." of the communication destination.
• MELSEC iQ-R (built-in Ethernet): RnCPU, RnENCPU, RnPCPU, RnSFCPU
• MELSEC-Q (built-in Ethernet): QnUDE(H)CPU, QnUDVCPU, QnUDPVCPU ( QCPU User's Manual (Multiple CPU
System))
When the communication destination is Yokogawa FA-M3 series and "Not Specified" is set to "Target PLC No.", the CPU No.1
is automatically regarded as the target. (When the firmware version of the RJ71EN71 and the RnENCPU (network part) is
"42" or later)

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 189
 Devices that can be specified
The devices that can be specified as transmission source and transmission destination vary depending on the communication
destination. Bit device and word device can be set together for each setting number.
For devices that can be specified, the size of a device is specified in units of 16 points for a bit device and one point for a word
device. Use 0 or multiples of 16 to specify the device number of a bit device.

• The maximum number of points per setting is 1024 words (bit device 8192 points maximum, word device
512 points maximum).
• Set the devices within the device range specified with the parameter of the CPU module.

■Devices that can be specified on the own station

The maximum number of points when the NZ2MC-16MBS is connected to the R120CPU. The number of points differs
depending on the CPU module used, whether to use or not an extended SRAM cassette, or the type of the extended SRAM
cassette.
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 2FFFH 
Y 0H to 2FFFH 
M 0 to 161882111 A local device cannot be specified.
L 0 to 32767 
B 0H to 9A61FFFH 
SB 0H to 9A61FFFH 
SM 0 to 4095 
Word device D 0 to 10117631 A local device cannot be specified.
W 0H to 9A61FFH 
SW 0H to 9A61FFFH 
SD 0 to 4095 
R 0 to 32767 Data is read or written following the file register settings of the communication
destination.
ZR 0 to 10027007 Data is read or written following the file register settings of the communication
destination.
RD 0 to 1048575 
G PORT1: 722500 to Buffer memory for the RJ71EN71 and RnENCPU (network part).
788035 A G device is expressed as Un\G. The search for the device requires the search string
PORT2: 2722500 to to be prefixed by Un\G. When the search for a G device is attempted while the
2788035 RJ71EN71 and RnENCPU (network part) are not mounted, U0\G is prefixed for the
search. (An error for unmounted module is not detected.)

1 FUNCTIONS
190 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
■When the communication destination is the MELSEC iQ-R (built-in Ethernet) or MELSEC iQ-R
(Ethernet module)
The maximum number of points when the NZ2MC-16MBS is connected to the R120CPU. The number of points differs 1
depending on the CPU module used, whether to use or not an extended SRAM cassette, or the type of the extended SRAM
cassette.
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 2FFFH 
Y 0H to 2FFFH 
M 0 to 161882111 A local device cannot be specified.
L 0 to 32767 
B 0H to 9A61FFFH 
SB 0H to 9A61FFFH 
SM 0 to 4095 
Word device D 0 to 10117631 A local device cannot be specified.
W 0H to 9A61FFH 
SW 0H to 9A61FFH 
SD 0 to 4095 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.
ZR 0 to 10027007 Data is read or written following the file register settings of the communication destination.
RD 0 to 1048575 

■When the communication destination is the MELSEC-Q (built-in Ethernet) or MELSEC-Q

(Ethernet module)
The maximum number of points when the Q4MCA-8MBS is connected to the Q26UDVCPU. The number of points differs
depending on the CPU module used, whether to use or not an extended SRAM cassette, or the type of the extended SRAM
cassette.
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 1FFFH 
Y 0H to 1FFFH 
M 0 to 61439 
L 0 to 32767 
B 0H to EFFFH 
SB 0H to 7FFFH 
SM 0 to 2047 
Word device D 0 to 4910079 The maximum number of points when D (extended data register) or W (extended link
register) is set.
W 0H to 4AEBFFH The maximum number of points when D (extended data register) or W (extended link
register) is set.
SW 0H to 7FFFH 
SD 0 to 2047 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.
ZR 0 to 4849663 Data is read or written following the file register settings of the communication destination.

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 191
 ■When the communication destination is the MELSEC-L (built-in Ethernet) or MELSEC-L
(Ethernet module)
The following table lists the maximum number of points for the L26CPU. The number of points varies depending on the CPU
module used.
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 1FFFH 
Y 0H to 1FFFH 
M 0 to 61439 
L 0 to 32767 
B 0H to EFFFH 
SB 0H to 7FFFH 
SM 0 to 2047 
Word device D 0 to 421887 The maximum number of points when D (extended data register) or W (extended link
register) is set.
W 0H to 66FFFH The maximum number of points when D (extended data register) or W (extended link
register) is set.
SW 0H to 6FFFH 
SD 0 to 2047 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.
ZR 0 to 393215 Data is read or written following the file register settings of the communication destination.

■When the communication destination is the MELSEC iQ-F (built-in Ethernet)

Type Applicable device
Symbol Range Remarks
Bit device X 0 to 1777 Octal notation is used.
Y 0 to 1777 Octal notation is used.
M 0 to 32767 A local device cannot be specified.
L 0 to 32767 
B 0H to 7FFFH 
SB 0H to 7FFFH 
SM 0 to 9999 
Word device D 0 to 7999 A local device cannot be specified.
W 0H to 7FFFH 
SW 0H to 7FFFH 
SD 0 to 11999 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.

1 FUNCTIONS
192 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
■When the communication destination is the MELSEC iQ-L (built-in Ethernet)
The maximum number of points when the L16HCPU is connected. The number of points varies depending on the CPU
module used. 1
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 2FFFH 
Y 0H to 2FFFH 
M 0 to 14065663 A local device cannot be specified.
L 0 to 32767 
B 0H to D69FFFH 
SB 0H to D69FFFH 
SM 0 to 4095 
Word device D 0 to 879103 A local device cannot be specified.
W 0H to D69FFH 
SW 0H to D69FFH 
SD 0 to 4095 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.
ZR 0 to 819199 Data is read or written following the file register settings of the communication destination.
RD 0 to 1048575 

■When the communication destination is the MELSEC A/AnS (Ethernet module)

The maximum number of points for the A4UCPU. The number of points varies depending on the CPU module used. (
MELSEC Communication Protocol Reference Manual)
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 7FFH 
Y 0H to 7FFH 
M 0 to 8191, 9000 to 9255 To specify 9000 to 9255 with "Communication Pattern" set to "Write", refer to the manual of
the CPU module used.
To specify 9000 to 9255, use 9000 + a multiple of 16.
B 0H to FFFH 
Word device D 0 to 6143, 9000 to 9255 To specify 9000 to 9255 with "Communication Pattern" set to "Write", refer to the manual of
the CPU module used.
W 0H to FFFH 
R 0 to 8191 
Rn 10000 to 488191 Upper two digits are 1 to 48 (block No.), and lower four digits are 0 to 8191.
The range of 8192 to 9999 must not be specified.
The usable range varies depending on the CPU module used and parameter settings. (
User's manual of the CPU module used)

■When the communication destination is the MELSEC-FX3 (Ethernet block/adapter)

Type Applicable device
Symbol Range Remarks
Bit device X 0 to 377 Octal notation is used.
Y 0 to 377 Octal notation is used.
M 0 to 7679, 8000 to 8511 To specify 8000 to 8511 with "Communication Pattern" set to "Write", refer to the manual of
the CPU module used.
Word device D 0 to 8511 To specify 8000 to 8511 with "Communication Pattern" set to "Write", refer to the manual of
the CPU module used.
R 0 to 32767 

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 193
 ■When the communication destination is an SLMP-compatible device (QnA-compatible 3E
frame)
Applicable devices differ depending on the device. For applicable devices, refer to the manual for the device used.
The device types that can be set are X, Y, M, L, B, SB, SM, D, W, SW, SD, R, and ZR. The accessible device range of the
communication destination is the range which can be specified with the subcommand (0000) of the SLMP (QnA-compatible
3E frame of the MC protocol).

The following SLMP commands are sent to the external device.

• When "Read" is set to "Communication Pattern"

Subheader Request Request Request Request Request Monitoring Command Subcommand Device Start device No. Number of
destination destination destination destination data length timer code device points
network station No. module I/O multidrop
No. No. station No.
50H 00H 00H FFH FFH 03H 00H 0CH 00H 00H 00H 01H 04H 00H 00H

• When "Write" is set to "Communication Pattern"

Subheader Request Request Request Request Request Monitoring Command Subcommand Device Start device No. Number of Write data
destination destination destination destination data length timer code device points
network station No. module I/O multidrop
No. No. station No.
50H 00H 00H FFH FFH 03H 00H 00H 00H 01H 14H 00H 00H

■When the communication destination is OMRON (CS/CJ series)

Type Applicable device
Symbol Range Remarks
Bit device .. 0 to 6143 Channel I/O
(The device is AR 0 to 447 The setting is available only when "Read" is set to "Communication Pattern".
displayed in units of
words. One point AR 448 to 959 
corresponds to one HR 0 to 511 
word.)
WR 0 to 511 
Word device DM 0 to 32767 
TIM 0 to 4095 
CNT 0 to 4095 
DR 0 to 15 
TK 0 to 31 The setting is available only when "Read" is set to "Communication Pattern".
EM 0 to 32767 
EMn_ 0 to 32767 "n" represents 0H to FH or 10H to 18H. (25 devices in total)

• In the address table on the communication destination side, set the IP address and node address to be
assigned to the RJ71EN71 or RnENCPU (network part). (Specify "1" for the node address.)
• When using the RJ71EN71 in a redundant system, set the control system IP address to the "Redundant
System Settings" under "Application Settings" on the own station and the communication destination.

1 FUNCTIONS
194 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
■When the communication destination is KEYENCE (KV series)
The format of devices other than B device consists of the last two digits of bit specification and the upper digits of word
specification. 1
Type Applicable device
Symbol Range Remarks
Bit device R 0 to 199915 Specify 00 in the last two digits for the start.
(The device is
B 0H to 7FFFH Specify 0 or a multiple of 16 for the start.
displayed in units of
bits. One point MR 0 to 399915 Specify 00 in the last two digits for the start.
corresponds to one bit.) LR 0 to 99915 Specify 00 in the last two digits for the start.
CR 0 to 7915 Specify 00 in the last two digits for the start.
T 0 to 3999 
C 0 to 3999 
Word device CM 0 to 5999 
DM 0 to 65534 
EM 0 to 65534 
FM 0 to 32767 
ZF 0 to 524287 
W 0H to 7FFFH 
T 0 to 3999 
C 0 to 3999 

■When the communication destination is Panasonic (FP2SH series)

Type Applicable device
Symbol Range Remarks
Bit device WX 0 to 511 The setting is available only when "Read" is set to "Communication Pattern".
(The device is WY 0 to 511 
displayed in units of
words. One point WR 0 to 886 
corresponds to one WL 0 to 639 
word.)
Word device LD 0 to 8447 
DT 0 to 10239 
FL 0 to 32764 

Setting item of communication destination: Set the MEWTOCOL station number. At this time, set 1 to the
external device side (FP2) and 2 to the own station side.

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 195
 ■When the communication destination is Panasonic (FP7 series)
Type Applicable device
Symbol Range Remarks
Bit device WX 0 to 511 
(The device is WY 0 to 511 
displayed in units of
words. One point WR 0 to 2047 
corresponds to one WL 0 to 1023 
word.)
_WX 001000000 to The upper three digits of the device number show the program block number, and the
468000511 lower six digits show the device number.
_WY 001000000 to The upper three digits of the device number show the program block number, and the
468000511 lower six digits show the device number.
_WR 001000000 to The upper three digits of the device number show the program block number, and the
468002047 lower six digits show the device number.
_WL 001000000 to The upper three digits of the device number show the program block number, and the
468001023 lower six digits show the device number.
Word device LD 0 to 16383 
DT 0 to 999423 
_LD 001000000 to The upper three digits of the device number show the program block number, and the
468016383 lower six digits show the device number.
_DT 001000000 to The upper three digits of the device number show the program block number, and the
468065534 lower six digits show the device number.

■When the communication destination is YASKAWA MP3000 series

Type Applicable device
Symbol Range Remarks
Bit device IB 0H to 21FFFH The setting is available only when "Read" is set to "Communication Pattern".
(The device is OB 0H to 21FFFH 
displayed in units of
words. One point MB 0 to 1048575 
corresponds to one GB 0 to 2097151 
word.)
SB 0 to 65534 
Word device IW 0H to 21FFFH The setting is available only when "Read" is set to "Communication Pattern".
OW 0H to 21FFFH 
MW 0 to 1048575 
GW 0 to 2097151 
SW 0 to 65534 

■When the communication destination is YASKAWA MP2000 series

Type Applicable device
Symbol Range Remarks
Bit device IB 0H to 7FFFH The setting is available only when "Read" is set to "Communication Pattern".
(The device is
MB 0 to 65534 
displayed in units of
words. One point
corresponds to one
word.)
Word device IW 0H to 7FFFH The setting is available only when "Read" is set to "Communication Pattern".
MW 0 to 65534 

1 FUNCTIONS
196 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
■When the communication destination is Yokogawa FA-M3 series
Type Applicable device
Symbol Range Remarks 1
Bit device X 201 to 71664 The setting is available only when "Read" is set to "Communication Pattern".
(The device is The setting range of the last two digits is 01 to 64. (Only 01, 17, 33, or 49 can be set as the
displayed in units of start device. Only 16, 32, 48, or 64 can be set as the end device.)
words. One point
Y 201 to 71664 The setting range of the last two digits is 01 to 64. (Only 01, 17, 33, or 49 can be set as the
corresponds to one
start device. Only 16, 32, 48, or 64 can be set as the end device.)
word.)
I 1 to 165535 Use 1 or a multiple of 16 +1 to set the start device.
E 1 to 4096
L 1 to 78192
M 1 to 9984
Word device D 1 to 65535 
R 1 to 4096 
V 1 to 256 
B 1 to 262144 
W 1 to 78192 
Z 1 to 1024 
TP 1 to 3072 
CP 1 to 3072 
TS 1 to 3072 
CS 1 to 3072 
TI 1 to 3072 
CI 1 to 3072 

■When the communication destination is a MODBUS/TCP-compatible device

Applicable devices and the number of writable/readable points differ depending on the device. For applicable devices and the
number of writable/readable points, refer to the manual for the device used.
The device types that can be set are Coil, Input, Input Register, and Holding Register.
Type Applicable device
Maximum Maximum Remarks
number of number of
write points read points
Coil 1968 2000 
Input  2000 Setting is possible only when the "Communication Pattern" is "Read".
Input Register  125 Setting is possible only when the "Communication Pattern" is "Read".
Holding Register 123 125 

Specify the value obtained by subtracting 1 from the MODBUS device number.

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 197
 ■When the communication destination is SIEMENS S7 series
Type Applicable device
Symbol Range Remarks
Bit device I 0 to 255 Start digit: An even number must be specified.
(The device is Q 0 to 255
Last digit: An odd number must be specified.
displayed in units of
words. One point M 0 to 255
corresponds to 8
points.)
Word device DB 001000 to 255511 Upper 3 digits: Block No., Lower 3 digits: Address range
An even number must be specified to the start of the lower 3 digits and an odd number
must be specified to the last of the lower 3 digits. (The size for 1 point is 1 byte. Two points
are required to set for word device.)

Access is executed in units of words. The upper byte and lower byte of reading/writing value may be
interchanged depending on the setting in the communication destination.

■Fuji Electric MICREX-SX series

Type Applicable device
Symbol Range Remarks
Bit device MX1 0000000 to 1703935 
(The device is MX3 000000 to 262143 
displayed in units of
words. One point MX10 0000 to 1023 
corresponds to 16
points.)
Word device MW1 0000000 to 1703935 
MW3 000000 to 262143 
MW10 0000 to 1023 

1 FUNCTIONS
198 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
■JTEKT TOYOPUC series
Type Applicable device
Symbol Range Remarks 1
Bit device X 10000H to 3007FH Upper 1 digit: Program No., Lower 4 digits: Address range
(The device is Y 10000H to 3007FH
The following lists the communicable address range of lower 4 digits.
displayed in units of • M (internal relay): 0000 to 007FH, 0100 to 017FH
words. One point M 10000H to 3017FH • L (link relay): 0000 to 007FH, 0100 to 02FFH
corresponds to 16 K 10000H to 3002FH • V (special relay): 0000 to 000FH, 0100 to 017FH
points.)
L 10000H to 302FFH
V 10000H to 3017FH
EX 00000H to 0007FH 
EY 00000H to 0007FH 
EM 00000H to 001FFH 
EK 00000H to 000FFH 
EL 00000H to 001FFH 
EV 00000H to 000FFH 
GX 00000H to 00FFFH 
GY 00000H to 00FFFH 
GM 00000H to 00FFFH 
Word device D 10000H to 32FFFH Upper 1 digit: Program No., Lower 4 digits: Address range
The following lists the communicable address range of lower 4 digits.
R 10000H to 307FFH
• S (special register): 0000 to 03FFH, 1000 to 13FFH
S 10000H to 313FFH • N (present value register): 0000 to 01FFH, 1000 to 17FFH
N 10000H to 317FFH
U 10000H to 1FFFFH 
ES 00000H to 007FFH 
EN 00000H to 007FFH 
H 00000H to 007FFH 
EB 00000H to 3FFFFH 
FR 00000H to 1FFFFH 

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 199
 Operation during the simple CPU communication
■Operation of the own station
Since the own station operates without depending on the operating status of the CPU module, the simple CPU
communication is performed even when the CPU module is in the STOP state because of stop error. When an initial
communication error occurs, communications of the corresponding setting numbers are stopped and ones of the setting
numbers, where no error occurs will operate.
If the communication destination sends a response, data is transferred to the system area for the simple CPU communication.
Data inconsistency will not occur in one setting since processing is executed for each setting.

■Operation of the communication destination

The operation differs depending on the communication destination.
Communication destination Data operation in one setting
MELSEC iQ-R (Built-in Ethernet) Since the data in one setting is communicated at the same timing, data inconsistency will not occur.
MELSEC-Q (Built-in Ethernet)
MELSEC-L (Built-in Ethernet)
MELSEC iQ-F (Built-in Ethernet)
MELSEC iQ-L (Built-in Ethernet)
MELSEC iQ-R (Ethernet Module)
MELSEC-Q (Ethernet Module) The data specified with a bit device or a word device in one setting is communicated at the same timing.
However, if both a bit device and a word device are set for the same setting number, the data of each
MELSEC-L (Ethernet Module)
device may be communicated at different timing.
MELSEC-A/AnS (Ethernet Module) When the data size in one setting is as follows, data inconsistency will not occur.
• Read: Bit device 2048 points or less, word device 256 points or less
• Write: Bit device 640 points or less, word device 256 points or less
MELSEC-FX3 (Ethernet Block/Adapter) When the data size in one setting is as follows, data inconsistency will not occur.
• Read: Bit device 512 points or less, word device 64 points or less
• Write: Bit device 160 points or less, word device 64 points or less
SLMP Corresponding Device (QnA Compatible 3E Depends on the communication destination.
Frame)
OMRON (CS/CJ series)
KEYENCE (KV series)
Panasonic (FP2SH series)
Panasonic (FP7 series)
YASKAWA MP3000 series
YASKAWA MP2000 series
Yokogawa FA-M3 series
MODBUS/TCP-compatible device
SIEMENS S7 series
Fuji Electric MICREX-SX series
JTEKT TOYOPUC series

1 FUNCTIONS
200 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
Operations when the communication setting is "On Request"
■How to start communications 1
Power off and on the system or reset the CPU module first. Turn off and on the buffer memory area of Request to start
communication at request, and communications start.

Once the CPU module is reset, the system starts the preparation processing. The preparation processing
checks the parameter settings (own station port numbers). If an error occurs, data will not be communicated.
In this case, the buffer memory area of Simple CPU communication status stores AH (Communications
impossible).

■Each status after communications start

The following table lists the buffer memory areas that stores each status of communications from its start to completion.
Status Item Address Buffer memory status
During the latency time*1 Simple CPU communication status for each Un\G721936 to Un\G721999 1H: Preparing
setting number Un\G1247460 to Un\G1247907
After a lapse of the latency time Preparation completion for each setting Un\G721912 to Un\G721915 On: Ready
number Un\G1247412 to Un\G1247439
Simple CPU communication status for each Un\G721936 to Un\G721999 2H: Waiting for the request
setting number Un\G1247460 to Un\G1247907
Request to start communication Simple CPU communication status for each Un\G721936 to Un\G721999 3H: Communicating
at request issued setting number Un\G1247460 to Un\G1247907
Execution status flag for each setting Un\G721908 to Un\G721911 On: Communicating
number Un\G1247384 to Un\G1247411
Data communication Execution status flag for each setting Un\G721908 to Un\G721911 Off: Communication stop
completed*2 number Un\G1247384 to Un\G1247411

*1 During the latency time, another start request (turning off and on the buffer memory area of Request to start communication at request)
is ignored.
*2 After the data communications has been completed, 2H (Waiting for the request) is stored in the buffer memory area of Simple CPU
communication status by turning off and on the buffer memory area of Request to start communication at request, and one session
completes.

Once a start request of On Request communications is detected, another start request (turning off and on the
buffer memory area of Request to start communication at request) from a program is ignored until the buffer
memory area of Execution status flag turns off (Communication stop). (This symptom is not treated as an
error.)

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 201
 ■Behavior on errors
After data is sent to the communication destination, if no response is received from the communication destination or an error
occurs (or an error response is received), the system makes retries until the timeout time.
During retries, the buffer memory area of Simple CPU communication status stores 5H (Retry being executed).
The system retries the operation for the number of times specified in the parameter plus one additional time.

■Behavior when an abnormal state is detected

If an error response is received after the retries, an abnormal state is detected and the buffer memory area of Simple CPU
communication error code stores error codes.
In an abnormal state, the buffer memory area of Execution status flag turns off (Communication stop). By programmatically
turning on and off the buffer memory area of Request to start communication at request, 2H (Waiting for the request) is stored
in the buffer memory area of Simple CPU communication status.

• While the communications of one setting number is in an abnormal state, the value in the buffer memory
areas of Simple CPU communication status for other setting numbers, in which the same communication
destination is set, remains unchanged (2H (Waiting for the request)).
• If no response is received from the communication destination, the buffer memory area of Simple CPU
communication error code stores error codes.
• If an error response is received from the communication destination, the buffer memory area of Simple CPU
communication error code stores error codes and the buffer memory area of Abnormal response code
stores abnormal response codes. (The abnormal response code here indicates any codes received from
the destination device.)

1 FUNCTIONS
202 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
■Timing chart
• Operation of on-request communications of setting No.65 (Normal)
Communication
request turns on.
Communication
request turns off.
Communication
request turns on.
Communication
request turns off.
1
Power on or clear reset. Communications Response Communications Communications Response Communications
start. receive stop. start. receive stop.
Time
Initial
processing
Waiting
time to start
communications

(1) (2) (1) (2)

'Request to start communication at request for ON
each setting number' (Un\G1247300.0) OFF

'Request to stop fixed interval communication ON

for each setting number' (Un\G1247328.0) OFF
ON
'Request to restart fixed interval communication OFF
for each setting number' (Un\G1247356.0) (3) (4) (3) (4)

'Execution status flag for each setting number' ON

OFF
(Un\G1247384.0)
'Preparation completion for each setting ON
number' (Un\G1247412.0) OFF

'Simple CPU communication status for each

setting number' (Un\G1247460) 0 1 2 3 2 3 2

'Simple CPU communication error code for each

setting number' (Un\G1247908) 0

'Abnormal response code for each setting

number' (Un\G1248356) 0

'Execution interval (current value) for each

setting number' (Un\G1248804) 0

(1) The buffer memory area is turned on by the program.

(2) The buffer memory area is turned off by the program.
(3) The buffer memory area is turned on by the system.
(4) The buffer memory area is turned off by the system.

• Operation of on-request communications of setting No.65 (Abnormal state)

Communication Communication
request turns on. request turns on.
Power on or clear reset. Communications Data 1st 2nd Communications Data
start. send retry retry Error detection start. send
Time
Initial
processing
Waiting
time to start Communication Communication Communication
communications timeout time timeout time timeout time

(1) (2) (1)

'Request to start communication at request for ON
each setting number' (Un\G1247300.0) OFF

'Request to stop fixed interval communication ON

for each setting number' (Un\G1247328.0) OFF
ON
'Request to restart fixed interval communication OFF
for each setting number' (Un\G1247356.0) (3) (4) (3)

'Execution status flag for each setting number' ON

OFF
(Un\G1247384.0) (3)
'Preparation completion for each setting ON
number' (Un\G1247412.0) OFF

'Simple CPU communication status for each

setting number' (Un\G1247460) 0 1 2 3 5 2 3

'Simple CPU communication error code for each

setting number' (Un\G1247908) 0 Error code 0

'Abnormal response code for each setting

0 Abnormal response 0
number' (Un\G1248356)

'Execution interval (current value) for each

setting number' (Un\G1248804) 0

(1) The buffer memory area is turned on by the program.

(2) The buffer memory area is turned off by the program.
(3) The buffer memory area is turned on by the system.
(4) The buffer memory area is turned off by the system.

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 203
 Communication Time-out Period/Communication Retry Count/Monitoring Time At Error
When the communication destination does not respond or returns an error response, the communication will be retried
(resent) after the time-out period has passed.
At this time, after communications are performed for the communication retry count + 1 times, the fixed interval
communication is performed during the monitoring time at error. If the communication destination responds after these
communications, the communications at the execution interval specified with the parameters are restarted.

Ex.
Error detection timing when 2 is set for the communication retry count

Communication Communication Communication

error at the error at the error at the
previous time previous time previous time

Retry of Retry of
communication, communication,
Interval first time second time

Communication

Communication
Communication

Communication

Communication

Communication
Error detection

Communication Communication Communication Monitoring time Monitoring time

timeout time timeout time timeout time at error at error

The error is detected if the communication destination does not respond or communications fail by when the
following time has passed: (communication retry count + 1)  communication time-out period

Latency Time
By setting the latency time, the start timing in the communications can be switched in the following cases.
• To prevent an error due to the overlap of the start timing in the communications
• To start communications after the communication destination is ready for the communications
During the latency time, "Preparing" is indicated in the communication status.

Communications at a specified execution interval (when "Fixed" is set for the communication setting) is
ignored during the latency time.

1 FUNCTIONS
204 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
Checking the simple CPU communication status
The simple CPU communication status can be checked with the buffer memory or diagnostic functions. 1
Checking with the buffer memory
The simple CPU communication status can be checked with the storage status of the corresponding setting number in the
following buffer memory areas.
Item Address Remarks
Request to start communication at request Un\G721896 to Un\G721899 • Setting No.1: Un\G721896.0
Un\G1247300 to Un\G1247327 
• Setting No.64: Un\G721899.F
• Setting No.65: Un\G1247300.0

• Setting No.512: Un\G1247327.F
Request to stop fixed interval communication Un\G721900 to Un\G721903 • Setting No.1: Un\G721900.0
Un\G1247328 to Un\G1247355 
• Setting No.64: Un\G721903.F
• Setting No.65: Un\G1247328.0

• Setting No.512: Un\G1247355.F
Request to restart fixed interval communication Un\G721904 to Un\G721907 • Setting No.1: Un\G721904.0
Un\G1247356 to Un\G1247383 
• Setting No.64: Un\G721907.F
• Setting No.65: Un\G1247356.0

• Setting No.512: Un\G1247383.F
Execution status flag Un\G721908 to Un\G721911 • Setting No.1: Un\G721908.0
Un\G1247384 to Un\G1247411 
• Setting No.64: Un\G721911.F
• Setting No.65: Un\G1247384.0

• Setting No.512: Un\G1247411.F
Ready Un\G721912 to Un\G721915 • Setting No.1: Un\G721912.0
Un\G1247412 to Un\G1247439 
• Setting No.64: Un\G721915.F
• Setting No.65: Un\G1247412.0

• Setting No.512: Un\G1247439.F
Simple CPU communication 0H: Unset Un\G721936 to Un\G721999 • Setting No.1: Un\G721936
status Un\G1247460 to Un\G1247907 
1H: Preparing
• Setting No.64: Un\G721999
2H: Waiting for the request • Setting No.65: Un\G1247460
3H: Communicating 
• Setting No.512: Un\G1247907
4H: Communication stop
5H: Retry being executed
6H: Monitoring at error
AH: Communications
impossible
Simple CPU communication error code Un\G722000 to Un\G722063 • Setting No.1: Un\G722000
Un\G1247908 to Un\G1248355 
• Setting No.64: Un\G722063
• Setting No.65: Un\G1247908

• Setting No.512: Un\G1248355
Abnormal response code Un\G722064 to Un\G722127 • Setting No.1: Un\G722064
Un\G1248356 to Un\G1248803 
• Setting No.64: Un\G722127
• Setting No.65: Un\G1248356

• Setting No.512: Un\G1248803

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 205
 Item Address Remarks
Execution interval (current value) Un\G722128 to Un\G722191 • Setting No.1: Un\G722128
Un\G1248804 to Un\G1249251 
• Setting No.64: Un\G722191
• Setting No.65: Un\G1248804

• Setting No.512: Un\G1249251

For details on the values to be stored in the buffer memory, refer to the following.
Page 383 Simple CPU communication area

■Communication stop/restart request

When 'Simple CPU communication status for each setting number' (Un\G721936 to Un\G721999, Un\G1247460 to
Un\G1247907) stores any of the following values, communications can be stopped by turning off and on 'Request to stop fixed
interval communication for each setting number' (Un\G721900 to Un\G721903, Un\G1247328 to Un\G1247355). (If the value
is other than the following, the stop request is invalid.)
• 3H: Communicating
• 5H: Retry being executed
• 6H: Monitoring

When 'Request to stop fixed interval communication for each setting number' (Un\G721900 to Un\G721903,
Un\G1247328 to Un\G1247355) is turned off and on, the communications will stop at the timing of sending
data in the next execution interval.
Therefore, if the communication destination does not respond with the stop request accepted, the
communications will stop after the communication time-out period has passed. When the retry is being
executed, the communications will stop after the communication time-out period has passed without
depending on the retry count.

When 'Simple CPU communication status for each setting number' (Un\G721936 to Un\G721999, Un\G1247460 to
Un\G1247907) is in the "4H: Communication stop" state, communications can be restarted by turning off and on 'Request to
restart fixed interval communication for each setting number' (Un\G721904 to Un\G721907, Un\G1247356 to Un\G1247383).
(If the status is other than "4H: Communication stop", the restart request is invalid.)
When the communication setting is "On Request" or no setting is configured, no operation is performed by turning off and on
'Request to restart fixed interval communication for each setting number' (Un\G721904 to Un\G721907, Un\G1247356 to
Un\G1247383) and 'Request to stop fixed interval communication for each setting number' (Un\G721900 to Un\G721903,
Un\G1247328 to Un\G1247355). Therefore, the buffer memory areas will remain on without being turned on and off by the
system.

1 FUNCTIONS
206 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
Ex.
The operation at communication stop/restart request for the setting No.1
Stop request Communication stop Restart request Communication restart 1
(1)
(2)
'Request to stop fixed interval
communication for each setting number' ON
(Un\G721900.0) OFF
(1)
(2)
'Request to restart fixed interval
communication for each setting number' ON
(Un\G721904.0) OFF

'Execution status flag for each setting ON

number' (Un\G721908.0) OFF

'Simple CPU communication status for each

setting number' (Un\G721936) 3 4 3

'Execution interval (current value) for each

(3) 0 (3)
setting number' (Un\G722128)

(1) The buffer memory area is turned on by the program.

(2) The buffer memory area is turned off by the system.
(3) The current value is stored.

Checking with "simple CPU communication diagnostics"

The communication status of the simple CPU communication function can be checked with "Simple CPU Communication
Diagnostics".
For details, refer to the following.
Page 312 Simple CPU communication diagnostics

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 207
 Communication example
In this example, B0 to B1FFF of own station are transferred to M0 to M8191 of the communication destination using the
simple CPU communication function. Also, W0 to W1FF of own station are transferred to D0 to D511 of the communication
destination.

System configuration
(1) (2)

Ethernet
(1) Own station (transfer source): RJ71EN71 (IP address: 192.168.3.40)
(2) Communication destination (transfer destination): RJ71EN71 (IP address: 192.168.3.50)

Device assignment
The following figure shows the assignment of devices that communicates data in the simple CPU communication.
Own station (transfer source) Communication destination (transfer destination)

R04CPU RJ71EN71 RJ71EN71 R04CPU

B0 M0

· ·

B1FFF M8191

W0 D0
W1FF D511

Parameter settings
Connect the engineering tool to the CPU module and set the parameters.

■Settings for the transfer source

1. Set the CPU module as follows.
[Project]  [New]

1 FUNCTIONS
208 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
2. Click the [Setting Change] button and set to use module labels.

3. Click the [OK] button to add the module labels of the CPU module.
1

4. Set the RJ71EN71 as follows.

[Navigation window]  [Parameter]  [Module Information]  Right-click  [Add New Module]

5. Click the [OK] button to add the module labels of the RJ71EN71.

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 209
 6. Set the items in "Basic Settings" as follows.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71(E+E)]  [Port 1 Module Parameter
(Ethernet)]  [Basic Settings]  [Own Node Settings]

7. Set the items in "Application Settings" as follows.

[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71(E+E)]  [Port 1 Module Parameter
(Ethernet)]  [Application Settings]  [Simple PLC Communication Setting]

8. Set the items in "Simple PLC Communication Setting" as follows.

[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71(E+E)]  [Port 1 Module Parameter
(Ethernet)]  [Application Settings]  [Simple PLC Communication Setting]  [Detailed Setting]

9. Write the set parameters to the CPU module. Then reset the CPU module or power off and on the system.
[Online]  [Write to PLC]

In this example, default values were used for parameters that are not shown above. For the parameter setting,
refer to the chapter explaining the parameters in this manual. ( Page 261 PARAMETER SETTINGS)

1 FUNCTIONS
210 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
■Settings for the transfer destination
1. Set the CPU module and the RJ71EN71. Steps to take are similar to those for the transfer source, except no setting for
module labels is required. ( Page 208 Settings for the transfer source) 1
2. Set the items in "Basic Settings" as follows.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71(E+E)]  [Port 1 Module Parameter
(Ethernet)]  [Basic Settings]  [Own Node Settings]

3. Write the set parameters to the CPU module. Then reset the CPU module or power off and on the system.
[Online]  [Write to PLC]

In this example, default values were used for parameters that are not shown above. For the parameter setting,
refer to the chapter explaining the parameters in this manual. ( Page 261 PARAMETER SETTINGS)

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 211
 Program examples
Write the following program to the transfer source CPU module.
In this example, ABCDH is stored in a bit device and 5555H is stored in a word device, and transfer them.
Classification Label name Description Device
Module label EN71_EE_1.stPort1.bnSts_Start_Request_D[1] Request to start communication at request of Simple Un\G721896.0
CPU communication setting No.1
EN71_EE_1.stPort1.bnSts_Status_Flag_D[1] Execution flag of Simple CPU communication Un\G721908.0
setting No.1
EN71_EE_1.stPort1.bnReady_D[1] Preparation completion flag of Simple CPU Un\G721912.0
communication setting No.1
EN71_EE_1.stPort1.wnStatus_SimplePLC_D[1] Communication status storage location of Simple Un\G721936
CPU communication setting No.1
EN71_EE_1.stPort1.wnErrorCode_SimplePLC_D[1] Error code storage location of Simple CPU Un\G722000
communication setting No.1
Label to be defined Define global labels as shown below:

(0) Turn on 'Request execution device of the simple CPU communication setting No.1' (M0) and store the transfer data ABCDH to 512 points of data from
bSendData (K4B0), and the transfer data (5555H) to 512 points of data from wSendData (W0).
Turn on 'Request to start communication at request of Simple CPU communication setting No.1' (Un\G721896.0) when 'Communication status storage
location of Simple CPU communication setting No.1' (Un\G721936) is 2H.
(23)Start counting 'Number of successful communications' (C0) when communications start successfully.
Store an error code in 'Simple CPU communication setting No.1 error code' (D1000) when the abnormal state is detected.

1 FUNCTIONS
212 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
Precautions
This section provides precautions for the simple CPU communication function. 1
Incomplete data reception and timeout
Because the load of Ethernet communication becomes heavy during the simple CPU communication, if the other
communication (MELSOFT connection or SLMP) is simultaneously performed by using UDP, the data reception of UDP may
not be completed, resulting in a timeout error. Therefore, to perform other communications during the simple CPU
communication, the communication using TCP is recommended.

Execution interval setting

The execution interval of the simple CPU communication function and the period of time until the completion of
communications will differ according to the Ethernet line's load rate, operating status of other communications (such as
MELSOFT connection, SLMP communication, and socket communication function), scan time of the communication
destination, and system configuration. Thus, the set execution interval or time required for completing the communications
may be increased.

■Cause of increased execution interval of the simple PLC communication

• The scan time of the control CPU module of the RJ71EN71 where the simple CPU communication function is set is long.
• The RJ71EN71 where the simple CPU communication function is set is communicating by using a function other than the
simple CPU communication function, and the processing of the communication by using a function other than the simple
CPU communication function takes time.
• The load on the Ethernet line is high.
• The number of settings in "Simple PLC Communication Setting" under "Application Settings" is large.
• Response from the communication destination is delayed.
• More than one RJ71EN71 where the simple CPU communication function is set is mounted on a base unit (main base unit
or extension base unit).
To perform communications at the set execution interval, set a sufficient execution interval. If checking the execution interval
is required, perform actual communications and check it with the "Simple PLC Communication Diagnostics" window.

Duplication of own station port numbers

The simple CPU communication cannot be performed in the following cases.
• The own station port number set in the simple CPU communication and the own station port number of the CPU module set
in the external device configuration are the same.
• The own station port number set in the simple CPU communication and the one set in another function such as the socket
communication are the same. ('Simple CPU communication status for each setting number' (Un\G721936 to Un\G721999)
is "AH: Communications impossible".)
Set a unique own station port number. For the setting numbers other than the one in which a communication error occurs,
communications are performed after the preparation processing is completed normally.

IP address and module type of communication destination

Check the IP address and module type of the communication destination before setting the parameters. The simple CPU
communication is not performed when the communication destination does not exist (an incorrect IP address is specified) or
when the preparation processing is not completed. ('Simple CPU communication status for each setting number'
(Un\G721936 to Un\G721999) is AH: Communications impossible.) )

Communication destination device

Check the type and range of the device to be read or written in the communication destination.
Especially, when "Write" is set to "Communication Pattern", the control data of the communication destination may be
overwritten, resulting in malfunction.

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 213
 Security
The simple CPU communication is not performed when a remote password is set for the communication destination. Clear the
remote password.
If the IP filter has been set in the communication destination, check the setting and correct it if necessary.
If any security function specific to the communication destination (programmable controller products manufactured by other
companies), clear the function.

When using the file register (R, ZR)

When using the file register (R, ZR) for the device on the own station, always assign the device within the setting range. If the
devices are not assigned, an error occurs (error code: 4031), and the simple CPU communication of the setting number which
exceeds the setting range cannot be performed.

Setting of the network and station numbers

When the communication destination is the MELSEC iQ-R (Ethernet module), MELSEC-Q (Ethernet module), or MELSEC-L
(Ethernet module), the network number and station number should be set in the own node settings of the Ethernet
parameters.

Usable connections
Up to 64 connections can be used in the simple CPU communication settings. If, however, connection has been used for other
functions, the maximum number of connections is the difference calculated by subtracting the number of connections used for
other function from 64.

Measures against errors occurring during communications

When an error occurs during writing communications, data writing may not be completed properly. Check the error details,
take appropriate measures, and restart communications.

1 FUNCTIONS
214 1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part))
Restrictions applicable depending on versions
The simple CPU communication function is available for the RJ71EN71 or RnENCPU (network part) whose firmware version
1
is "35" or later and that uses the engineering tool of software version of 1.050C or later.
The terms of "Fixed Interval" and "On Request" in the list are used for the communication setting in "Simple PLC
Communication Setting" under "Application Settings".
Engineering tool RJ71EN71 or RnENCPU (network part)
Firmware version of Firmware version of Firmware version of Firmware version of
"35" to "38" "39" to "41" "42" to "46" "47" or later
Software version of 1.050C • Number of settable modules: 1 to 64
• Communication setting: "Fixed Interval" only
• Communication destination: MELSEC iQ-R (built-in Ethernet), MELSEC-Q (built-in Ethernet), MELSEC-L (built-
in Ethernet), MELSEC iQ-F (built-in Ethernet), MELSEC iQ-R (Ethernet module), MELSEC-Q (Ethernet module),
MELSEC-L (Ethernet module), SLMP-compatible device (QnA-compatible 3E frame), OMRON (CS/CJ series),
KEYENCE (KV series), Panasonic (FP2SH series), Panasonic (FP7 series), YASKAWA MP3000 series,
YASKAWA MP2000 series, Yokogawa FA-M3 series, MODBUS/TCP-compatible device
• Option setting: Cannot be set (The setting value is regarded as 0.)*4
Software Setting No. Same as the engineering • Number of settable modules: 1 to 512
version of 1 to 64 tool of software version of • Communication setting: "Fixed Interval" or "On Request"
1.052E or later 1.050C*1*2 • Communication destination: MELSEC-A/AnS (Ethernet module) and MELSEC-FX3
(Ethernet block/adapter) are added to the communication destination that uses the
Setting No. 
engineering tool of software version of 1.050C.
65 to 512 (Simple CPU
• Option setting: Cannot be set (The setting value is regarded as 0.)*4
communication
impossible)*3
Software Setting No. Same as the engineering Same as the engineering • Communication destination: MELSEC iQ-L (built-in
version of 1 to 64 tool of software version of tool of software version of Ethernet), SIEMENS S7 series, Fuji Electric MICREX-
1.060N or later 1.050C*1*2 1.052E or later SX series, and JTEKT TOYOPUC series are added to
the communication destination that uses the
Setting No. 
engineering tool of software version of 1.052E.
65 to 512 (Simple CPU
• Redundant system
communication
• Option setting: Cannot be set (The setting value is
impossible)*3
regarded as 0.)*4
Software Setting No. • Same as the • Same as the • Communication The option setting is
version of 1 to 64 engineering tool of engineering tool of destination: MELSEC available for a MODBUS/
1.065T or later software version of software version of iQ-L (built-in Ethernet), TCP-compatible device.
1.050C*1*2 1.052E or later SIEMENS S7 series,
• The setting value is not • The setting value is not Fuji Electric MICREX-
reflected even if an reflected even if an SX series, and JTEKT
option is set. The setting option is set. The setting TOYOPUC series are
value is regarded as 0. value is regarded as 0. added to the
Setting No.  communication
65 to 512 (Simple CPU destination that uses the
engineering tool of
communication
impossible)*3 software version of
1.052E.
• Redundant system
• The setting value is not
reflected even if an
option is set. The setting
value is regarded as 0.

*1 The simple CPU communication of the setting number with "On Request" set to the communication setting is not executed and a simple
CPU communication error (error code: CFBFH) occurs.
*2 When a duplicate port number is set to the own stations, a duplication error of own port number (error code: CFB2H) occurs.
The simple CPU communication of the setting number with an unsupported communication destination is not executed, and a simple
CPU communication error (CFB0H or CFBFH) occurs.
*3 Setting No.65 to 512 are prohibited to use. Using the numbers can cause malfunction of the module. To use setting No.65 to 512, use
RJ71EN71 or RnENCPU (network part) with the firmware version of "39" or later.
*4 Firmware version of "47" or later only

When setting No.65 to 512 is used on the RJ71EN71 or RnENCPU (network part) with the firmware version of
"35" to "38", data of G device (buffer memory area) may be overwritten. To use setting No.65 to 512, use
RJ71EN71 or RnENCPU (network part) with the firmware version of "39" or later.

1 FUNCTIONS
1.14 Simple CPU Communication Function (RJ71EN71, RnENCPU (Network Part)) 215
 1.15 Simple CPU Communication Function (CPU
Module (Built-in Ethernet Port Part))
This function allows data communications between specified devices at the specified timing just by making simple settings of
the CPU module (built-in Ethernet port part) from an engineering tool. Send/receive is performed with a specified
communication destination on a one-to-one basis.

Ethernet
MELSEC iQ-R

RCPU

MELSEC-Q

Hub
MELSEC-L

MELSEC iQ-F

MELSEC iQ-L

MELSEC-A/AnS / MELSEC-F

SLMP

Communication destination Type Description

MELSEC iQ-R series CPU module (built-in Ethernet) Page 218 Module type
MELSEC-Q series CPU module (built-in Ethernet), Ethernet module
MELSEC-L series CPU module (built-in Ethernet), Ethernet module
MELSEC iQ-F series CPU module (built-in Ethernet)
MELSEC iQ-L series CPU module (built-in Ethernet)
MELSEC-A/AnS series Ethernet module
MELSEC-F series Ethernet block/adapter
SLMP-compatible device QnA-compatible 3E frame

Access via routers is also available. For the access, set the subnet mask and default gateway. ( Page 262
Own Node Settings)

When using the simple CPU communication function, check the versions of the CPU module and engineering
tool used. ( Page 436 Added and Enhanced Functions)

1 FUNCTIONS
216 1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part))
Setting procedure
The following section describes the settings for using this function. 1
1. Set "Enable" for "To Use or Not to Use Simple PLC Communication Setting" in "Simple PLC Communication Setting"
under "Application Settings".
[Navigation window]  [Parameter]  Target module  [Module Parameter] [Application Settings]  [Simple PLC
Communication Setting]
2. Double-click "<Detailed Setting>" of the "Simple PLC Communication Setting" to display the following window. (
Page 278 Simple CPU communication setting (CPU module (built-in Ethernet port part)))

3. After setting the items, write the module parameters to the CPU module on the own station, and reset or power off and on
the CPU module to start the simple CPU communication.

Communication Pattern
Select the communication pattern from the following items.
Setting item Description
Read Read the data of the specified destination device (transmission source) to the specified device of the own station
(transmission destination).
Write Write the data of the specified device of the own station (transmission source) to the specified destination device
(transmission destination).

Communication Setting: Execution Interval

Select the communication timing from the following items.
Setting item Description Setting range
Fixed interval (Fixed)  Data are communicated between the devices at a specified 
execution interval.
Execution Interval (ms) Execution interval is set. 10ms to 65535ms (in increments
of 1ms)

• Actual time of execution interval may be longer than the value of the setting because the time is affected by
the specified communication destinations or Ethernet line congestion. For the preventive measures, refer to
the following.
Page 325 When the simple CPU communication function is used
• If latency time is set, data communication is started after the latency time has passed. ( Page 225
Latency Time)

1 FUNCTIONS
1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part)) 217
 Communication Destination (IP Address)
Click "Destination" to open the "Communication Destination Setting" window and specify the communication destination. Up
to 64 communication destinations can be registered.

■Module type
Select the module type of the communication destination from the following list.
Module type Communication destination Communication specification
*1
MELSEC iQ-R (Built-in Ethernet) RnCPU, RnENCPU , RnPCPU, RnSFCPU, RnPSFCPU MELSOFT connection (protocol: UDP)
MELSEC-Q (Built-in Ethernet) Built-in Ethernet port QCPU
MELSEC-L (Built-in Ethernet) Built-in Ethernet port LCPU
MELSEC iQ-F (Built-in Ethernet) FX5U CPU module*2, FX5UC CPU module*2
MELSEC iQ-L (Built-in Ethernet) LnHCPU
MELSEC-Q (Ethernet Module) QJ71E71-100
MELSEC-L (Ethernet Module) LJ71E71-100
MELSEC-A/AnS (Ethernet Module) AJ71E71N3-T, A1SJ71E71N3-T MC protocol (A-compatible 1E frame)
MELSEC-FX3 (Ethernet Block/Adapter) FX3U-ENET-ADP, FX3U-ENET-L
SLMP Corresponding Device (QnA • SLMP-compatible device (No serial number) SLMP (MC protocol QnA-compatible 3E
Compatible 3E Frame) • MC protocol 3E frame-compatible device frame)
Read (0401H)
Write (1401H)

*1 When the RnENCPU is used for the connection to the Ethernet port of the CPU part
*2 The device can be used when the firmware version of "1.110" or later is used.

■IP address, TCP/UDP, port number, and own station port number
Set the IP address of the communication destination, communication protocol, port number, and own port number.
Module type Setting range
IP address TCP/UDP Port No. Own station port
number
MELSEC iQ-R (Built-in Ethernet) 0.0.0.1 to UDP Cannot be set. Cannot be set.
223.255.255.254
MELSEC iQ-L (Built-in Ethernet)
MELSEC iQ-F (Built-in Ethernet)
MELSEC-Q (Built-in Ethernet)
MELSEC-L (Built-in Ethernet)
MELSEC-Q (Ethernet Module)
MELSEC-L (Ethernet Module)
MELSEC-A/AnS (Ethernet Module) 256 to 65534 1 to 4999, 5010 to 65534
MELSEC-FX3 (Ethernet Block/Adapter) 1025 to 5548, 5552 to
65534
SLMP Corresponding Device (QnA 1 to 4999, 5010 to 65534
Compatible 3E Frame)

• When a multiple CPU system is configured, specify the IP address of the CPU module to which the Ethernet
cable is connected.
• In communications where the communication destination other than MELSEC-A/AnS, MELSEC-FX3, and
SLMP Corresponding Device is set, port numbers 61696 to 65534 are dynamically used for the own station
port numbers. Therefore, when using the simple CPU communication function, do not set 61696 to 65534 to
the own station port numbers for establishing a connection instruction (SP.SOCOPEN) of the socket
communication function. If set, the instruction may not be completed properly.
• Port numbers 1 to 1023 are typically reserved port numbers (WELL KNOWN PORT NUMBERS) and 61440
to 65534 are used by other communication functions, so 1024 to 4999 or 5010 to 61439 should be used for
the own station port numbers.
• When specifying the same communication destination in multiple settings, set different own station port
numbers.

1 FUNCTIONS
218 1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part))
Setting for communication destination
The settings differ depending on the communication destination.
1
Communication destination Necessary setting
MELSEC iQ-R (Built-in Ethernet) Communication uses the auto-open UDP port, so the setting is not required.
MELSEC-Q (Built-in Ethernet) Set the following items (for the number of devices) in the "Open Setting" window.
• Protocol: "UDP"
MELSEC-L (Built-in Ethernet)
• Open System: "MELSOFT Connection"
MELSEC iQ-F (Built-in Ethernet) Communication uses the auto-open UDP port, so the setting is not required.
MELSEC iQ-L (Built-in Ethernet)
MELSEC-Q (Ethernet Module) Set the network number and station number.
MELSEC-L (Ethernet Module)
MELSEC-A/AnS (Ethernet Module) ■Programming tool
Create an initial processing program, and set the following items.
• IP address and port number
• Communication method: "UDP"
• Bit 15 and Bits 0 to 7 of Area for communication instruction during stop (Un\G496) (Turn on the bits corresponding
to the connection numbers to be used.)*1
For the initial processing program, refer to the following.
 For A Ethernet Interface Module User's Manual
■DIP switch on the front of the module
Set the following items.
• SW2 (data code setting): Off
• SW7 (CPU communication timing setting): On*2
MELSEC-FX3 (Ethernet Block/Adapter) Set "Communication Data Code" of "Ethernet Port" to "Binary Code".
Set the following items (for the number of devices) in the "Open Setting" window.
• Protocol: "UDP"
• Open system: "MC protocol"
SLMP Corresponding Device (QnA Configure the settings so that the SLMP (QnA-compatible 3E frame of the MC protocol) can be used on the SLMP-
Compatible 3E Frame) compatible device side. ( Manual for the device used)
Set the communication data code to binary.
Set the protocol to UDP.

*1 Set this item to execute this function while the communication destination CPU module is in the STOP state or stop error state.
*2 Turn on this switch to execute this function while the communication destination CPU module is in the RUN state.

Target PLC No.

When the communication destination is one of the following modules and a multiple CPU system is used, specify the "Target
PLC No." of the communication destination.
• MELSEC iQ-R (built-in Ethernet): RnCPU, RnENCPU, RnPCPU, RnSFCPU
• MELSEC-Q (built-in Ethernet): QnUDE(H)CPU, QnUDVCPU, QnUDPVCPU ( QCPU User's Manual (Multiple CPU
System))

1 FUNCTIONS
1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part)) 219
 Devices that can be specified
The devices that can be specified as transmission source and transmission destination vary depending on the communication
destination. Bit device and word device can be set together for each setting number.
For devices that can be specified, the size of a device is specified in units of 16 points for a bit device and one point for a word
device. Use 0 or multiples of 16 to specify the device number of a bit device.

• Set the number of device points to the total number of setting No.1 to 64 (8192 words maximum).
• The maximum number of points per setting is 512 words (bit device 8192 points maximum, word device 512
points maximum).

■Devices that can be specified on the own station

The maximum number of points when the NZ2MC-16MBS is connected to the R120CPU. The number of points differs
depending on the CPU module used, whether to use or not an extended SRAM cassette, or the type of the extended SRAM
cassette.
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 2FFFH 
Y 0H to 2FFFH 
M 0 to 161882111 A local device cannot be specified.
L 0 to 32767 
B 0H to 9A61FFFH 
SB 0H to 9A61FFFH 
SM 0 to 4095 
Word device D 0 to 10117631 A local device cannot be specified.
W 0H to 9A61FFH 
SW 0H to 9A61FFFH 
SD 0 to 4095 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.
ZR 0 to 10027007 Data is read or written following the file register settings of the communication destination.
RD 0 to 1048575 

■When the communication destination is the MELSEC iQ-R (built-in Ethernet)

The maximum number of points when the NZ2MC-16MBS is connected to the R120CPU. The number of points differs
depending on the CPU module used, whether to use or not an extended SRAM cassette, or the type of the extended SRAM
cassette.
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 2FFFH 
Y 0H to 2FFFH 
M 0 to 161882111 A local device cannot be specified.
L 0 to 32767 
B 0H to 9A61FFFH 
SB 0H to 9A61FFFH 
SM 0 to 4095 
Word device D 0 to 10117631 A local device cannot be specified.
W 0H to 9A61FFH 
SW 0H to 9A61FFFH 
SD 0 to 4095 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.
ZR 0 to 10027007 Data is read or written following the file register settings of the communication destination.
RD 0 to 1048575 

1 FUNCTIONS
220 1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part))
■When the communication destination is the MELSEC-Q (built-in Ethernet) or MELSEC-Q
(Ethernet module)
The maximum number of points when the Q4MCA-8MBS is connected to the Q26UDVCPU. The number of points differs 1
depending on the CPU module used, whether to use or not an extended SRAM cassette, or the type of the extended SRAM
cassette.
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 1FFFH 
Y 0H to 1FFFH 
M 0 to 61439 
L 0 to 32767 
B 0H to EFFFH 
SB 0H to 7FFFH 
SM 0 to 2047 
Word device D 0 to 4910079 The maximum number of points when D (extended data register) or W (extended link
register) is set.
W 0H to 4AEBFFH The maximum number of points when D (extended data register) or W (extended link
register) is set.
SW 0H to 7FFFH 
SD 0 to 2047 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.
ZR 0 to 4849663 Data is read or written following the file register settings of the communication destination.

■When the communication destination is the MELSEC-L (built-in Ethernet) or MELSEC-L

(Ethernet module)
The following table lists the maximum number of points for the L26CPU. The number of points varies depending on the CPU
module used.
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 1FFFH 
Y 0H to 1FFFH 
M 0 to 61439 
L 0 to 32767 
B 0H to EFFFH 
SB 0H to 7FFFH 
SM 0 to 2047 
Word device D 0 to 421887 The maximum number of points when D (extended data register) or W (extended link
register) is set.
W 0H to 66FFFH The maximum number of points when D (extended data register) or W (extended link
register) is set.
SW 0H to 6FFFH 
SD 0 to 2047 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.
ZR 0 to 393215 Data is read or written following the file register settings of the communication destination.

1 FUNCTIONS
1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part)) 221
 ■When the communication destination is the MELSEC iQ-F (built-in Ethernet)
Type Applicable device
Symbol Range Remarks
Bit device X 0 to 1777 Octal notation is used.
Y 0 to 1777 Octal notation is used.
M 0 to 32767 A local device cannot be specified.
L 0 to 32767 
B 0H to 7FFFH 
SB 0H to 7FFFH 
SM 0 to 9999 
Word device D 0 to 7999 A local device cannot be specified.
W 0H to 7FFFH 
SW 0H to 7FFFH 
SD 0 to 11999 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.

■When the communication destination is the MELSEC iQ-L (built-in Ethernet)

The maximum number of points when the L16HCPU is connected. The number of points varies depending on the CPU
module used.
Type Applicable device
Symbol Range Remarks
Bit device X 0H to 2FFFH 
Y 0H to 2FFFH 
M 0 to 14065663 A local device cannot be specified.
L 0 to 32767 
B 0H to D69FFFH 
SB 0H to D69FFFH 
SM 0 to 4095 
Word device D 0 to 879103 A local device cannot be specified.
W 0H to D69FFH 
SW 0H to D69FFH 
SD 0 to 4095 
R 0 to 32767 Data is read or written following the file register settings of the communication destination.
ZR 0 to 819199 Data is read or written following the file register settings of the communication destination.
RD 0 to 1048575 

■When the communication destination is the MELSEC A/AnS (Ethernet module)

The maximum number of points for the A4UCPU. The number of points varies depending on the CPU module used. (
MELSEC Communication Protocol Reference Manual)
Type Applicable device
Symbol Range Remarks
Bit device X 0 to 7FFh 
Y 0 to 7FFh 
M 0 to 8191, 9000 to 9255 To specify 9000 to 9255 with "Communication Pattern" set to "Write", refer to the manual of
the CPU module used.
To specify 9000 to 9255, use 9000 + a multiple of 16.
B 0 to FFFh 
Word device D 0 to 6143, 9000 to 9255 To specify 9000 to 9255 with "Communication Pattern" set to "Write", refer to the manual of
the CPU module used.
W 0 to FFFh 
R 0 to 8191 

1 FUNCTIONS
222 1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part))
■When the communication destination is the MELSEC-FX3 (Ethernet block/adapter)
Type Applicable device
Symbol Range Remarks 1
Bit device X 0 to 377 Octal notation is used.
Y 0 to 377 Octal notation is used.
M 0 to 7679, 8000 to 8511 To specify 8000 to 8511 with "Communication Pattern" set to "Write", refer to the manual of
the CPU module used.
Word device D 0 to 8511 To specify 8000 to 8511 with "Communication Pattern" set to "Write", refer to the manual of
the CPU module used.
R 0 to 32767 

■When the communication destination is an SLMP-compatible device (QnA-compatible 3E

frame)
Applicable devices differ depending on the device. For applicable devices, refer to the manual for the device used.
The device types that can be set are X, Y, M, L, B, SB, SM, D, W, SW, SD, R, and ZR. The accessible device range of the
communication destination is the range which can be specified with the subcommands 001 and 000 of the SLMP (QnA-
compatible 3E frame of the MC protocol).

1 FUNCTIONS
1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part)) 223
 Operation during the simple CPU communication
■Operation of the own station
Since the own station operates without depending on the operating status of the CPU module, the simple CPU
communication is performed even when the CPU module is in the STOP state because of stop error. When an initial
communication error occurs, communications of the corresponding setting numbers are stopped and ones of the setting
numbers, where no error occurs will operate.
If the communication destination responds at the timing of the END processing of the CPU module, data is transferred to the
system area for the simple CPU communication. For devices other than the SLMP-compatible device (QnA-compatible 3E
frame), data inconsistency will not occur in one setting since processing is executed by one setting unit.

■Operation of the communication destination

The operation differs depending on the communication destination.
Communication destination Data operation in one setting
MELSEC iQ-R (Built-in Ethernet) Since the data in one setting is communicated at the same timing, data inconsistency will not occur.
MELSEC-Q (Built-in Ethernet)
MELSEC-L (Built-in Ethernet)
MELSEC iQ-F (Built-in Ethernet)
MELSEC iQ-L (Built-in Ethernet)
MELSEC-Q (Ethernet Module) The data specified with a bit device or a word device in one setting is communicated at the same timing.
However, if both a bit device and a word device are set for the same setting number, the data of each device may be
MELSEC-L (Ethernet Module)
communicated at different timing.
MELSEC-A/AnS (Ethernet Module) When the data size in one setting is as follows, data inconsistency will not occur.
• When "Write" is set to "Communication Pattern": Bit device of 640 points or less, word device of 256 points or less
• When "Read" is set to "Communication Pattern": Bit device of 2048 points or less, word device of 256 points or
less
MELSEC-FX3 (Ethernet Block/Adapter) When the data size in one setting is as follows, data inconsistency will not occur.
• When "Write" is set to "Communication Pattern": Bit device of 160 points or less, word device of 64 points or less
• When "Read" is set to "Communication Pattern": Bit device of 512 points or less, word device of 64 points or less
SLMP Corresponding Device (QnA The data specified with a bit device or a word device in one setting is communicated at the same timing.
Compatible 3E Frame) However, if both a bit device and a word device are set for the same setting number, the data of each device may be
communicated at different timing.
The order of a word device and a bit device for read/write is as follows:
• When "Write" is set to "Communication Pattern": Word device  Bit device
• When "Read" is set to "Communication Pattern": Bit device  Word device

1 FUNCTIONS
224 1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part))
Communication Time-out Period/Communication Retry Count/Monitoring Time At Error
When the communication destination does not respond or returns an error response, the communication will be retried
1
(resent) after the time-out period has passed.
At this time, after communications are performed for the communication retry count + 1 times, the fixed interval
communication is performed during the monitoring time at error. If the communication destination responds after these
communications, the communications at the execution interval specified with the parameters are restarted.

Ex.
Error detection timing when 2 is set for the communication retry count

Communication Communication Communication

error at the error at the error at the
previous time previous time previous time

Retry of Retry of
communication, communication,
Interval first time second time

Communication

Communication
Communication

Communication

Communication

Communication
Error detection

Communication Communication Communication Monitoring time Monitoring time

timeout time timeout time timeout time at error at error

The error is detected if the communication destination does not respond or communications fail by when the
following time has passed: (communication retry count + 1)  communication time-out period

Latency Time
By setting the latency time, the start timing in the communications can be switched in the following cases.
• To prevent an error due to the overlap of the start timing in the communications
• To start communications after the communication destination is ready for the communications
During the latency time, "Preparing" is indicated in the communication status.

Communications at a specified execution interval (when "Fixed" is set for the communication setting) is
ignored during the latency time.

Initial Communication Setting

The operation can be set when the communication destination does not respond (including that the communication
destination has the different IP address or is not started) at the initial communication.
By using this setting, communications can be started at the timing when the external device is connected or powered on after
starting simple CPU communications even if the external device is not connected or powered off at starting the simple CPU
communications.

To use the setting, check the versions of the CPU module and engineering tool used. ( Page 436 Added
and Enhanced Functions)

1 FUNCTIONS
1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part)) 225
 Checking the simple CPU communication status
The simple CPU communication status can be checked with the buffer memory or diagnostic functions.

Checking with the buffer memory

The simple CPU communication status can be checked with the storage status of the corresponding setting number in the
following CPU buffer memory areas.
Item Address Remarks
Execution status flag U3En\G1102 to 1105 1102.0: Setting No.1 to 1105.F: Setting No.64
Ready U3En\G1106 to 1109 1106.0: Setting No.1 to 1109.F: Setting No.64
Simple CPU communication 0H: Unset U3En\G1130 to 1193 1130: Setting No.1 to 1193: Setting No.64
status
1H: Preparing
3H: Communicating
4H: Communication stop
5H: Retry being executed
6H: Monitoring
AH: Communications
impossible
Simple CPU communication error code U3En\G1194 to 1257 1194: Setting No.1 to 1257: Setting No.64
Execution interval (current value) U3En\G1258 to 1321 1258: Setting No.1 to 1321: Setting No.64
Abnormal response code U3En\G1322 to 1385 1322: Setting No.1 to 1385: Setting No.64

For details on the values to be stored in the CPU buffer memory, refer to the following.
Page 363 CPU module (built-in Ethernet port part)

When the "MELSEC-A/AnS (Ethernet Module)" or "MELSEC-FX3 (Ethernet Block/Adapter)" is set to the
communication destination, if an error response is received from the communication destination, the buffer
memory area of Simple CPU communication error code stores the error code, CFB4H, and the buffer memory
area of Abnormal response code stores the codes returned from the external device.

■Communication stop/restart request

When the simple CPU communication status of the corresponding setting number in the CPU buffer memory is either of the
following, communications can be stopped by turning off and on the stop request of the corresponding setting number. (If the
status is other than the following, the stop request is invalid.)
• 3H: Communicating
• 5H: Retry being executed
• 6H: Monitoring

When the stop request is turned off and on, the communications will stop at the timing of sending data in the
next execution interval.
Therefore, if the communication destination does not respond with the stop request accepted, the
communications will stop after the communication time-out period has passed. When the retry is being
executed, the communications will stop after the communication time-out period has passed without
depending on the retry count.

When the simple CPU communication status of the corresponding setting number in the CPU buffer memory is "4H:
Communication stop", communications can be restarted by turning off and on the CPU buffer memory of the corresponding
setting number. (If the status is other than "4H: Communication stop", the restart request is invalid.)

1 FUNCTIONS
226 1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part))
Ex.
The operation at communication stop/restart request for the setting No.1

END 0 END 0
1
Stop Communication Restart Communication
request stop request restart

On by the program Off by the system

Regular communication
stop request ON
(Un\G1094.0) OFF
On by the program
Off by the system
Regular communication
restart request ON
(Un\G1098.0) OFF

Execution status flag ON

(Un\G1102.0) OFF

Simple CPU
communication status 3H 4H 3H
(Un\G1130)

Execution interval
(current value) (Current value) 0 (Current value)
(Un\G1258)

Checking with "simple CPU communication diagnostics"

The communication status of the simple CPU communication function can be checked with "Simple CPU Communication
Diagnostics".
For details, refer to the following.
Page 312 Simple CPU communication diagnostics

1 FUNCTIONS
1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part)) 227
 Precautions
This section provides precautions for the simple CPU communication function.

Incomplete data reception and timeout

Because the load of Ethernet communication becomes heavy during the simple CPU communication, if the other
communication (MELSOFT connection or SLMP) is simultaneously performed by using UDP, the data reception of UDP may
not be completed, resulting in a timeout error. Therefore, to perform other communications during the simple CPU
communication, the communication using TCP is recommended.

Execution interval setting

The execution interval of the simple CPU communication function will differ according to the Ethernet line's load rate,
operating status of other communications (such as MELSOFT connection, SLMP communication, socket communication
function, CC-Link IE Field Network Basic), scan time of the communication destination, and system configuration. Thus, the
set execution interval or time required for completing the communications may be increased.
To perform communications at the set execution interval, set a sufficient execution interval. If checking the execution interval
is required, perform actual communications and check it with the "Simple PLC Communication Diagnostics" window.

Duplication of own station port numbers

The simple CPU communication cannot be performed in the following cases.
• The own station port number set in the simple CPU communication and the own station port number of the CPU module set
in the external device configuration are the same.
• The own station port number set in the simple CPU communication and the one set in another function such as the socket
communication are the same.
Set different own station port numbers. For the setting numbers other than the one in which a communication error occurs,
communications are performed after the preparation processing is completed normally.

Module type and IP address of communication destination

Check the module type and IP address of the communication destination before setting the parameters. The simple CPU
communication is not performed when the preparation processing is not completed because the communication destination
does not exist or an incorrect module type or IP address is specified.

Communication destination device

Check the type and range of the device to be read or written in the communication destination.
Especially, when "Write" is set to "Communication Pattern", the control data of the communication destination may be
overwritten, resulting in malfunction.

1 FUNCTIONS
228 1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part))
Remote password
The simple CPU communication is not performed when a remote password is set for the communication destination. Clear the
1
remote password.

File register (R, ZR)

When using the file register (R, ZR) for the device on the own station, always assign the device within the setting range. The
simple CPU communication of the setting number which exceeds the setting range due to a stop error of the own station
cannot be performed.
When a stop error occurs, communications of the setting number other than the one which exceeds the setting range continue
operating.

Special relay (SM) and special register (SD)

Do not write any data to the special relay (SM) and the special register (SD) that are set on the system side. Doing so may
cause a system failure or communication failure.

When the communication destination in a redundant system

In this case, use "Control System IP Address" of "Redundant System Settings" for the Process CPU (redundant mode) side,
and set the control IP address on the "Communication Destination Setting" window in the simple CPU communication.

1 FUNCTIONS
1.15 Simple CPU Communication Function (CPU Module (Built-in Ethernet Port Part)) 229
 1.16 IP Address Change Function
This function can change the IP address of the Ethernet-equipped module or other item without changing the parameter
settings.

Ex.
Case of the CPU module (built-in Ethernet port part)

Ó Store the IP address of the special register (SD) to the

IP address storage area (system memory)
by turning the special relay (SM) on.
IP address storage
Special register (SD) area (system memory)
Ò Store the IP address in the special register SD1518 Network No. Network No.
(SD) by the device write operation. SD1519 Station No. Station No.

SD1520
IP address IP address
SD1521

SD1522
Subnet Subnet
mask Write mask
SD1523 pattern execution pattern
(SM1520
SD1524
Default Default
ON)
gateway gateway
Bus SD1525 IP address IP address
connection

GOT Ô Power off and on Õ Operate with the IP address stored

or reset the CPU in the IP address storage area
module. (system memory).

• When this function is used in the CPU module (built-in Ethernet port part), it can be used also by
manipulating the special relay and special register values from the GOT. Refer to the list of special relay and
special register in the following manual for details on the special relay and special register.
 MELSEC iQ-R CPU Module User's Manual (Application)
• When this function is used in the RJ71EN71 or RnENCPU (network part), it can be used also by
manipulating the buffer memory values from the GOT. ( Page 355 Buffer Memory)

• When this function is used in the RJ71EN71 or RnENCPU (network part), check the firmware version of the
module. The network number and station number of the CPU module (built-in Ethernet port part) can be
changed in the CPU module with the firmware version supporting communications by network number/
station number. ( Page 436 Added and Enhanced Functions)
• The IP address change function is not available when "Q Compatible Ethernet" is selected for the network
type in the RJ71EN71.

1 FUNCTIONS
230 1.16 IP Address Change Function
IP address of the Ethernet-equipped module
The value set with the module parameters during initial processing is set as the IP address of the Ethernet-equipped module. 1
When this function is used, the IP address set during initial processing is the value stored in the IP address storage area
instead of the value set in the parameters.

Ex.
Case of the CPU module (built-in Ethernet port part)
[When using parameters]

Parameter file
CPU module
Module parameter
IP address 192.168.3.39 IP address 192.168.3.39
Subnet mask pattern 255.255.255.0 Subnet mask pattern 255.255.255.0
Default gateway IP address 192.168.3.254 Default gateway IP address 192.168.3.254
Network No. 3 Network No. 3
Station No. 39 Station No. 39

The IP address in the parameter file is set.

[When using the IP address change function] Parameter file

Module parameter
IP address 192.168.3.39
CPU module
Subnet mask pattern 255.255.255.0
IP address 192.168.3.40 Default gateway IP address 192.168.3.254
Subnet mask pattern 255.255.255.0 Network No. 3
Default gateway IP address 192.168.3.254 39
Station No.
Network No. 5
Station No. 20
IP address storage area (system memory)
IP address 192.168.3.40
The IP address in the IP address
storage area (system memory) is set. Subnet mask pattern 255.255.255.0
Default gateway IP address 192.168.3.254
Network No. 5
Station No. 20

Writing and clearing the IP address

■Case of the CPU module (built-in Ethernet port part)
The IP address value is written into the IP address storage area (system memory). The write and clear operations are
performed with the special relay and special register.
IP address storage area
Special register (system memory)
SD1518 Network No. Network No.
SD1519 Station No. Station No.
SD1520
IP address IP address
SD1521
SD1522 Subnet mask Subnet mask
SD1523 pattern pattern
Write execution
SD1524 Default gateway (SM1520 ON) Default gateway
SD1525 IP address IP address

1 FUNCTIONS
1.16 IP Address Change Function 231
 ■Case of the RJ71EN71 or RnENCPU (network part)
The IP address value is written into the IP address storage area (flash ROM). The write and clear operations are performed
with the buffer memory.
IP address storage area
Buffer memory (flash ROM)
Un\G11700 IP address IP address
Un\G11701
Un\G11702 Subnet mask Subnet mask pattern
Un\G11703
Un\G11704 Default gateway Write execution Default gateway
Un\G11705 (Un\G11709.0 ON) IP address
Un\G11706 Network No. Network No.
Un\G11707 Station No. Station No.
Transient transmission Transient transmission
Un\G11708 group No. group No.

1 FUNCTIONS
232 1.16 IP Address Change Function
Usage methods
1
Write operation
■Case of the CPU module (built-in Ethernet port part)
Follow the steps below.

1. Store the value to be changed in 'IP address setting' (SD1518 to SD1525).

2. Turn off and on 'IP address storage area write request' (SM1520).
3. Check the write results with the following special relay and special register.
Device At normal completion At abnormal completion
'IP address storage area write request' (SM1520) Off Off
'IP address storage area write error' (SM1521) Off On
'IP address storage area writing error cause'  Stores the cause of the error
(SD1526)

4. Power off and on or set the CPU module.

5. If the IP address stored in the IP address storage area (system memory) is a valid value, the stored IP address is set as
the IP address of the CPU module (built-in Ethernet port part). (If the value is invalid or not set, the value set in the
module parameters is set as the IP address of the CPU module (built-in Ethernet port part).)

6. Check the IP address with the buffer memory. ( Page 363 CPU module (built-in Ethernet port part))

■Case of the RJ71EN71 or RnENCPU (network part)

Follow the steps below.

1. Store the values to be changed in 'IP address setting' (Un\G11700 to Un\G11705) and 'Communications by Network No./
Station No.' (Un\G11706 to Un\G11708).
2. Turn off and on 'IP address storage area write request' (Un\G11709.0).

3. Check the write results with the following buffer memory areas.
Buffer memory At normal completion At abnormal completion
'IP address storage area write request' (Un\G11709.0) Off Off
'IP address storage area write error' (Un\G11710.0) Off On
'IP address storage area writing error cause' (Un\G11711)  Stores the cause of the error

4. Power off and on or set the CPU module.

5. If the IP address stored in the IP address storage area (flash ROM) is a valid value, the stored IP address is set as the IP
address of the RJ71EN71 or the RnENCPU (network part). (If the value is invalid or not set, the value set in the module
parameters is set as the IP address of the RJ71EN71 or the RnENCPU (network part).)
6. Check the IP address with the buffer memory. ( Page 355 RJ71EN71, RnENCPU (network part))

1 FUNCTIONS
1.16 IP Address Change Function 233
 ■Operation of the special relay and special register, or of the buffer memory
The following section shows the operation of the special relay and special register or of the buffer memory when writing to the
IP address storage area.
• Operation at normal completion

The system is powered

off when writing was
Write start Write completed
completed.

Write request ON
(SM1520) OFF
(Un\G11709.0)

Write error ON
(SM1521) OFF
(Un\G11710.0)

Write error cause

(SD1526) 0
(Un\G11711)

• Operation at abnormal completion

Write start Write failed Write start Write completed

Write request ON
(SM1520) OFF
(Un\G11709.0)

The system is powered

Write error ON
on when writing was
(SM1521) OFF
(Un\G11710.0) failed. The system is powered
off when writing starts.
Write error cause
(SD1526) Error cause 0
(Un\G11711)

■Cause of error at abnormal completion

• If the data is not written correctly into the IP address storage area (system memory) in the CPU module (built-in Ethernet
port part), the cause of the error is stored in 'IP address storage area writing error cause' (SD1526).
Stored value Cause of error
100H The value for 'IP address setting' (SD1518 to SD1525) exceeds the setting
range.
200H An error occurred during write.
300H Writing cannot be performed since the following functions are being executed.
• CPU module data backup/restoration function
400H Writing was started during the clear processing.

• If the data is not written correctly into the IP address storage area (flash ROM) in the RJ71EN71 or the RnENCPU (network
part), the cause of the error is stored in 'IP address storage area writing error cause' (Un\G11711).
Stored value Cause of error
100H The value for 'IP address' (Un\G11700 to Un\G11701) exceeds the setting
range.
101H The value for 'Default gateway' (Un\G11704 to Un\G11705) exceeds the
setting range.
102H The network address of 'Default gateway' (Un\G11704 to Un\G11705) or of the
gateway IP address is different from that of the IP address of the own node.
103H The value for 'Network number' (Un\G11706) exceeds the setting range.
104H The value for 'Station number' (Un\G11707) exceeds the setting range.
105H The value for 'Transient transmission group number' (Un\G11708) exceeds
the setting range.
106H The port 1 and port 2 IP addresses written in the IP address storage area are
the same.
107H The port 1 and port 2 network numbers or station numbers written in the IP
address storage area are the same.
200H An error occurred during write.
400H Writing was started during the clear processing.

1 FUNCTIONS
234 1.16 IP Address Change Function
Clearing operation
■Case of the CPU module (built-in Ethernet port part) 1
Execute clearing by turning off and on 'IP address storage area clear request' (SM1522).

1. Turn on 'IP address storage area clear request' (SM1522).

2. Check the write results with the following special relay and special register.
Device At normal completion At abnormal completion
'IP address storage area clear request' (SM1522) Off Off
'IP address storage area clear error' (SM1523) Off On
'IP address storage area clear error cause'  Stores the cause of the error
(SD1527)

3. Power off and on or set the CPU module.

4. Check the IP address with the buffer memory. ( Page 363 CPU module (built-in Ethernet port part))

■Case of the RJ71EN71 or RnENCPU (network part)

Execute clearing by turning off and on 'IP address storage area clear request' (Un\G11712.0).

1. Turn on 'IP address storage area clear request' (Un\G11712.0).

2. Check the write results with the following buffer memory areas.
Buffer memory At normal completion At abnormal completion
'IP address storage area clear request' (Un\G11712.0) Off Off
'IP address storage area clear error' (Un\G11713.0) Off On
'IP address storage area clear error cause' (Un\G11714)  Stores the cause of the error

3. Power off and on or set the CPU module.

4. Check the IP address with the buffer memory. ( Page 355 RJ71EN71, RnENCPU (network part))

■Operation of the special relay and special register, or of the buffer memory
The following section shows the operation of the special relay and special register or of the buffer memory when clearing the
IP address storage area.
• Operation at normal completion
The system is powered
off when clearing was
Clear start Clear completed
completed.

Clear request ON
(SM1522) OFF
(Un\G11712.0)

Clear error ON
(SM1523) OFF
(Un\G11713.0)

Clear error cause

(SD1527) 0
(Un\G11714)

• Operation at abnormal completion

Clear start Clear failed Clear start Clear completed

Clear request ON
(SM1522) OFF
(Un\G11712.0)

The system is powered

Clear error ON
on when clearing was
(SM1523) OFF
failed. The system is powered
(Un\G11713.0)
off when clearing starts.
Clear error cause
(SD1527) Error cause 0
(Un\G11714)

1 FUNCTIONS
1.16 IP Address Change Function 235
 ■Cause of error at abnormal completion
If the IP address storage area is not cleared correctly, the cause of the error is stored as follows:
Module Storage location Stored value Cause of error
CPU module (built-in 'IP address storage area 200H Error occurred during clearing.
Ethernet port part) clear error cause' (SD1527)
400H Clearing was started during the write processing.
RJ71EN71, RnENCPU 'IP address storage area 200H Error occurred during clearing.
(network part) clear error cause'
400H Clearing was started during the write processing.
(Un\G11714)

Checking the IP address

Checking with the buffer memory

Check with the following buffer memory areas.
Item CPU module (built-in Ethernet port part) RJ71EN71, RnENCPU (network part)
Own node IP address Un\G50 to Un\G51 Un\G4 to Un\G5
Subnet mask Un\G60 to Un\G61 Un\G14 to Un\G15
Default gateway IP address Un\G64 to Un\G65 Un\G18 to Un\G19
Own node network number Un\G77 Un\G31
Station number Un\G78 Un\G32
Transient transmission group number  Un\G33

Checking with module diagnostics

Check by using the [Module Information List] tab of the "Module Diagnostics" window. ( Page 301 Module Information
List)

Checking the operating status

For the RJ71EN71 or the RnENCPU (network part), when operation is performed based on the IP address of the IP address
storage area, 'IP address change function operating status' (Un\G11715.0) turns on.

Precautions
The following section lists the precautions for using the IP address.

Power off and reset operation

Do not power off or reset when writing to or clearing the IP address storage area. The values may not be applied onto the IP
address storage area. Power off or reset after checking the falling edge of the IP address storage area write request or IP
address storage area clear request.

Parameter IP address
For the IP address of the Ethernet-equipped module, the value in the IP address storage area has precedence over the
parameter value. When using the IP address specified with the parameters, clear the IP address storage area.

1 FUNCTIONS
236 1.16 IP Address Change Function
Write processing and clear processing execution timing
• Executing the write or clear processing to the IP address storage area may not be possible if an operation that turns off and
1
on, or on and off an IP address storage area write request or IP address storage area clear request in a short time is
performed.
• If the IP address storage area write request is turned off and on again while writing to the IP address storage area, the write
processing that was executed first will complete normally, and the following write operation will be ignored. (This also
applies to the clear operation.)
• If the IP address storage area clear request is turned off and on while writing to the IP address storage area, the clear
operation will not be completed. (This applies to the write operation if writing is executed during the clear processing.)
• If both an IP address storage area write request and IP address storage area clear request are turned off and on, the write
operation will be executed as top priority, and the clear operation will not be completed.
• If the write operation and clear operation are performed on the IP address storage area in the RJ71EN71 or the RnENCPU
(network part), communication may be stopped. Execute requests while control is not being performed at P1 or P2.

Communications by network number/station number

• For the network number, station number, and transient transmission group number (RJ71EN71 or RnENCPU (network part)
only), the values in the IP address storage area have precedence over the module parameter values. To use the network
number, station number, and transient transmission group number specified in the module parameters, clear the IP address
storage area.
• When the IP address is stored in the IP address storage area, if the network number, station number, and transient
transmission group number (RJ71EN71 or RnENCPU (network part) only) are not stored, communications using the
network number and station number become impossible. For communications using the network number and station
number, even if not changing the values, store the network number, station number, and transient transmission group
number in the IP address storage area.

Execution of the IP address change function during execution of another function

During execution of the CPU module data backup/restoration function, the IP address change function of the CPU module
(built-in Ethernet port part) cannot be executed. Check that the CPU module data backup/restoration function is not being
executed and then execute the IP address change function.

1 FUNCTIONS
1.16 IP Address Change Function 237
 1.17 Redundant System Function
The system with a control system and a standby system is configured using the RJ71EN71. If an error occurs in the control
system, the standby system is switched as the new control system to continue communication.
Before using function, check the firmware version of the RJ71EN71 and the CPU module used. ( Page 436 Added and
Enhanced Functions)
When mounting the RJ71EN71 on the extension base unit in the redundant system with redundant extension base unit, refer
to the following.
Page 416 Using the Module in the Redundant System with Redundant Extension Base Unit

To switch the system when a communication error or cable disconnection on Ethernet is detected, use the
RJ71EN71.
The system is not switched when a communication error or cable disconnection in the CPU module (built-in
Ethernet port part) occurs.

System configuration
The Process CPU, redundant function module, and RJ71EN71 are mounted on the base units of both the system A and
system B of a redundant system.
A redundant system is configured by connecting the redundant function modules of both systems using tracking cables and
connecting the RJ71EN71s in both systems using Ethernet cables.

Set the network type for the RJ71EN71 to either of the following.
• "Port 1 Network Type" and "Port 2 Network Type" are set to "Ethernet".
• "Port 1 Network Type" is set to "Q Compatible Ethernet".

1 FUNCTIONS
238 1.17 Redundant System Function
System switching request
If an error of system switching cause occurs in the control system, the RJ71EN71 issues a system switching request to the 1
control system CPU module to switch the system.

The CPU module (built-in Ethernet port part) cannot issue a system switching request.

(1) (2)

1. A system switching request occurs in the control system (1). ( Page 239 System switching request)

2. The RJ71EN71 of control system (1) issues a system switching request to the control system CPU module.

3. The system switches from the control system to the standby system.

4. Standby system (2) starts operating as the new control system to continue network control.

For OPS connection, through establishing a TCP/IP connection with both systems, communication can be
smoothly continued simply by changing the communication destination even when system switching occurs.

Precautions
Depending on the operating status of the standby system, system switching is not executed.
For details on the operating status of the standby system and whether system switching is executable, refer to the following.
 MELSEC iQ-R CPU Module User's Manual (Application)
In the following cases, system switching is not executed even if the RJ71EN71 issues a system switching request.
• When one module in the redundant module group is operating normally ( Page 242 Redundant module group settings)
• When another port in the port group is operating normally ( Page 243 Port group setting)

1 FUNCTIONS
1.17 Redundant System Function 239
 System switching cause
This section describes causes that make the RJ71EN71 issue a system switching request. Whether to issue a system
switching request due to each cause is set in "Redundant System Settings" under "Application Settings". ( Page 295
Redundant System Settings)

For details on system switching causes other than a system switching request from the RJ71EN71, refer to
the following.
 MELSEC iQ-R CPU Module User's Manual (Application)

Moderate/major error and hardware failure

When detecting an error where the module cannot continue the processing, the RJ71EN71 notifies the control system CPU
module about the error and issues a system switching request.

Communication error detection

Set connections targeted by communication error detection in "Redundant System Settings" under "Application Settings".
( Page 295 Redundant System Settings)
The following connections can be set as targets of communication error monitoring.
• User connections
• Auto-open UDP port
• FTP transmission port (TCP/IP)
• MELSOFT transmission port (TCP/IP)
• MELSOFT transmission port (UDP/IP)
• Simple CPU communication port

■Alive check error

When the RJ71EN71 has not communicated with the external device for a certain period of time while the connection is open,
this function checks whether the external device is alive. ( Page 266 Existence Confirmation)
When no response is returned from the external device, the Ethernet-equipped module closes the relevant connection and
issues a system switching request to the control system CPU module.

■ULP timeout
When the TCP/IP connection is open and when data is being sent, if no ACK response is returned from the external device for
a period exceeding the TCP/ULP timer value set in the "Timer Settings for Data Communication" under "Application Settings",
a send error occurs and a system switching request is issued to the control system CPU module. ( Page 281 Timer
Settings for Data Communication)

1 FUNCTIONS
240 1.17 Redundant System Function
■Precautions
• The auto-open UDP port and MELSOFT transmission port (UDP/IP) will be handled as targets of communication error
monitoring only when the remote password setting is enabled and these ports are unlocked. 1
• Do not set connections with the following settings in module parameters as connections targeted by communication error
detection. Otherwise, when a communication error occurs by cable disconnection detection or due to the power-off of the
external device, system switching may continuously occur in a redundant system.
Setting items Description
"Own Node Settings" under "Basic Settings" "Do Not Open by Program" is selected for "Opening Method".
"External Device Configuration" under "Basic Settings" "UDP" is selected for "Protocol".
"KeepAlive" or "UDP" is set for "Existence Confirmation".

• Do not set connections with "MELSOFT Connection" set for "Communication Method" in "External Device Configuration"
under "Basic Settings", as connections targeted by communication error detection. Otherwise, all MELSOFT products
connected to the network will be targeted by communication error monitoring and external devices cannot be set.

Disconnection detection
Monitor the connection status of the cable connected to the RJ71EN71 in the control system.
When the disconnection state continues even after the disconnection detection monitoring time has elapsed, a system
switching request is issued to the control system CPU module. Disconnection detection occurs in any of the following cases.
• Disconnection between the RJ71EN71 and the hub
• Cable disconnection at the connector on the hub side
• Power-off of the hub
• Cable disconnection at the connector on the RJ71EN71 side

• Cable connection status monitoring is started after link-up. Disconnection detection is not performed on a
port that has never been linked up and a port unconnected to an Ethernet cable.
• Set a value in the range from several seconds to several tens of seconds for the disconnection detection
monitoring time. If the disconnection detection monitoring time is set too short, system switching may occur
due to such factors as noise.

1 FUNCTIONS
1.17 Redundant System Function 241
 Redundant group setting
The redundant group setting is used to ensure that when the Ethernet network is duplicated in a redundant system, system
switching is not executed for an error that occurs in one Ethernet network.
There are two types of redundant group setting: redundant module group setting and port group setting.

The redundant group setting is not available for the CPU module (built-in Ethernet port part).

Redundant module group settings

Two RJ71EN71s are mounted on each of the control system and standby system, so even if a communication error occurs in
one of the RJ71EN71s, when communication is possible using the network of the other RJ71EN71, a system switching
request is not issued and communication by the control system continues.
The redundant module group can be set only on modules that have adjacent start I/O numbers and are mounted on adjacent
slots of the base unit.

When both grouped RJ71EN71s have a communication error, a system switching request is issued.

■Setting procedure
[Navigation window]  [Parameter]  [System Parameter]  [I/O Assignment] tab  [Redundant Module Group
Setting]

If the RJ71EN71s set as a redundant module group are not mounted adjacently to each other on the base
unit, an error occurs. Check the mounting positions on the base unit and the start I/O number again.

1 FUNCTIONS
242 1.17 Redundant System Function
Port group setting
A cable is connected to each of the two Ethernet port of RJ71EN71, so even if a communication error occurs in one of the
1
ports, when communication is possible on the other port, a system switching request is not issued and communication by the
control system continues.

This function cannot be used when "Q Compatible Ethernet" is selected in the network type.

■Setting procedure
Set the port group in "Redundant System Settings" under "Application Settings". ( Page 295 Redundant System Settings)

• When "Switch Systems When a System Switching Error Occurs in Both of Port 1 and Port 2" is selected for
"Port Group Setting", an event at the time of system switching is registered into the event history of the P1
side only.
• Set the same value for the port group setting on the P1 side and P2 side each.

Precautions
• The redundant group setting is enabled when the RJ71EN71 issues a system switching request. When a cause other than
a moderate/major error or hardware failure in the RJ71EN71 occurs, or when a system switching request caused by other
than the system switching cause from the RJ71EN71 occurs, systems are switched regardless of this setting.
• In "Redundant System Settings" under "Application Settings", set "Enable" for either "System Switching Request Issuing at
Disconnection Detection" or "System Switching Request Issue at Communication Error". If "Disable" is set to the both
settings, system does not switch because a system switching request is not issued to the CPU module.

1 FUNCTIONS
1.17 Redundant System Function 243
 Communication path bypass function
When a communication error occurs between the application and Ethernet-equipped module supporting the following
redundant system, the path on which the error occurs is bypassed so that communication can continue without changing the
communication path setting.
• Applications operating on OPS
• GX Works3

The communications path bypass function cannot be used for direct connection. Use for connection via a hub.

Setting procedure
The bypass function is always enabled. The parameter setting is not required.

Precautions
If an Ethernet-equipped module detects a disconnection or communication error, it does not release the relevant connection
until the alive check function detects an error.
When a disconnection or communication error occurs continually, if the relevant connection has not been released, an
Ethernet-equipped module bypasses the communication path by using a new connection.
For that reason, if a disconnection or communication error is detected over and over again in a short period of time, available
connections run out and an error occurs in GX Works3.

1 FUNCTIONS
244 1.17 Redundant System Function
Both systems identical IP address setting function
When an IP address common to systems A and B (control system IP address) is used, even if system switching occurs, 1
programs can perform communication without changing the connection destination.
Note that even when this setting is used, communication using the individual IP address of systems A and B each is possible.

192.168.1.100 192.168.1.100

This control system IP address cannot be used when the network type for the RJ71EN71 is set to "Q
Compatible Ethernet".

Setting procedure
Set the control system IP address in "Redundant System Settings" under "Application Settings". ( Page 295 Redundant
System Settings)

Access range
When communicating using the control system IP address, access is only possible from an external device in the same
network.
Since a network number and station number are used for access from another network, communication using the control
system IP address is not possible.

1 FUNCTIONS
1.17 Redundant System Function 245
 Availability of control system IP address for each function
The following table lists the availability of control system IP address for each function.
: Available, : Restrictions exist, : Not available
Function Availability Precautions
Connection with MELSOFT products and  • When accessing from MELSOFT products (excluding GX Works3), the control system IP
a GOT address can be used. When accessing from GX Works3 and a GOT, use the IP address of
system A or B.
• When system switching occurs during file access, file access is interrupted. When accessing
files, use the IP address of system A or B.
• When system switching occurs due to a timeout or communication error in TCP/IP
communications, the connection needs to be re-opened.
• When the control system IP address is used, neither the write operation nor the control
operation can be performed. Use the IP address of system A or B.
SLMP communications  • When system switching occurs during file access, file access is interrupted. When accessing
files, use the IP address of system A or B.
• When system switching occurs due to a timeout or communication error in TCP/IP
communications, the connection needs to be re-opened.
Communications using the predefined  • In TCP/IP communications, the control system IP address can be used only when the
protocol Ethernet-equipped module side is set as Passive open. When it is set as Active open, use the
IP address of system A or B.
• In UDP/IP communications, the control system IP address can be used only when the
Ethernet-equipped module receives data.
• When system switching occurs due to a timeout or communication error in TCP/IP
communications, the connection needs to be re-opened.
• When using the protocol used for sending or sending/receiving data, use the IP address of
system A or B.
Socket communications  • In TCP/IP communications, the control system IP address can be used only when the
Communications using the fixed buffer  Ethernet-equipped module side is set as Passive open. When it is set as Active open, use the
IP address of system A or B.
Communication using the random access  • In UDP/IP communications, the control system IP address can be used only when the
buffer Ethernet-equipped module receives data.
• When system switching occurs due to a timeout or communication error in TCP/IP
communications, the connection needs to be re-opened.
Communications using a link dedicated  For details on dedicated instructions, refer to the following. ( Page 246 How to use dedicated
instruction instructions)
File transfer function (FTP server)  When system switching occurs during file access, file access is interrupted. When accessing
files, use the IP address of system A or B.
Time setting function (SNTP client)  
Security function  When using the remote password, after system switching occurs, the unlock processing needs to
be performed again.
IP address change function  
MODBUS/TCP communications  The device can be used when the firmware version of "42" or later is used.
Simple CPU Communication Function  The device can be used when the firmware version of "42" or later is used.

■How to use dedicated instructions

The following table lists how to use the control system IP address for dedicated instructions specifying an IP address.
Dedicated instruction Usage methods
GP.CONOPEN Set the external device IP address in the control data for the control system IP address.
SP.SOCOPEN
OPEN
SP.SOCCINF
SP.SOCCSET
READ Set the address specification method for the target station in the control data as the IP address, and set the control
system IP address to the target station.
SREAD
WRITE
SWRITE

1 FUNCTIONS
246 1.17 Redundant System Function
Precautions
• When using the control system IP address, set connections separately for system A and B IP addresses. When the control
1
system IP address and IP addresses of systems A and B are used together for the same connection, loss of data, data
arrival order interchange, and others may be occur.
• Even when the control system IP address is used, the IP address on the programmable controller side shown in "External
Device Configuration" under "Basic Settings" displays the IP address set in "Own Node Settings" under "Basic Settings".
• Do not set the control system IP address to the IP address in "PLC side I/F" of the "Specify Connection Destination
Connection" window. Even when the control system IP address is set, if system switching occurs during connection, the
new control system cannot be tracked.
• In TCP/IP communications, the control system IP address can be used only when the Ethernet-equipped module side is set
as Passive open. When it is set as Active open, use the IP address of system A or B.
• In UDP/IP communications, the control system IP address can be used only when the Ethernet-equipped module receives
data.
• When systems are switched, if communication using the control system IP address cannot be performed normally, perform
the processing to update the ARP table of the external device.
• If the external device does not have a function to update the ARP table when receiving a GARP, it cannot track the new
control system at the time of system switching, and communication becomes impossible until the ARP table of the external
device is updated. The following table lists modules with function to update the ARP table when receiving a GARP.
Applicable module Applicable version
MELSEC iQ-R series Process CPU (redundant mode) Firmware version of "04" or later
RJ71EN71 Firmware version of "12" or later
MELSEC-Q series QJ71E71-100 Serial number (first five digits) of "12062" or
later
MELSEC-L series LJ71E71-100 

For whether an external device not manufactured by Mitsubishi supports a function to update the ARP table
when receiving a GARP, check the manual or specifications for the relevant external device.

1 FUNCTIONS
1.17 Redundant System Function 247
 Functions restricted in a redundant system
Functions with restrictions when communicating with a redundant system over Ethernet are as follows.

Re-initial processing
When performing the re-initial processing, specify "0H" for the modification specification (S+2) in the control data of the UINI
instruction to execute the instruction.

Open/close processing
■Communications using TCP/IP
Set the Ethernet-equipped module side as Passive open and perform the open/close processing from the external device
side. When Active open is performed from the Ethernet-equipped module side, if system switching occurs before execution of
the close processing from the Ethernet-equipped module side, the close processing may become unexecutable.

■SLMP communications and communications using the random access buffer

When communicating with the standby system using user connection, set "Do Not Open by Program" for "Opening Method" in
"Own Node Settings" under "Basic Settings".

■When the network type is "Q Compatible Ethernet"

For the standby system CPU module, the open/close processing by input/output signals cannot be performed.

Direct connection with MELSOFT products and a GOT

When the network type is "Q Compatible Ethernet", execute direct connection with the engineering tool either using the CPU
module (built-in Ethernet port part) or after setting "Disable" for "System Switching Request Issuing at Disconnection
Detection" in "Redundant System Settings" under "Application Settings".
When "Enable" is set for "System Switching Request Issuing at Disconnection Detection", if a cable is disconnected after a
direct connection with the engineering tool is made, system switching will occur.

Searching the CPU module on the network

Even with the control system IP address set, when a CPU module search is performed, the control system IP address is not
displayed. The IP addresses of systems A and B are displayed.

SLMP communications
■Message format
For the request message, set 00H to the request destination network number and FFH to the request destination station
number.

■Access to the control system, standby system, and systems A and B

For SLMP communications, using the command request destination module I/O number, the control system CPU, standby
system CPU, system A CPU, or system B CPU can be specified as the access destination.
By specifying the access destination CPU module, even if system switching occurs due to a communication error, access to
the specified CPU module is possible using the communications path bypass function. For details on the request destination
module I/O number, refer to the following.
 SLMP Reference Manual

■When accessing other stations via a redundant system

When accessing other stations by dynamic routing via a redundant system on the same Ethernet, access via the control
system. An error occurs if accessing via the standby system.
When accessing other stations via the standby system on the same Ethernet, set "Routing Setting" of "CPU Parameter".

1 FUNCTIONS
248 1.17 Redundant System Function
■When the control system IP address is not used
When the control system IP address is not used, access the control system CPU module by using the following procedure.

1. Execute the open processing in the order system A  B. 1

2. Read 'Control system judgment flag' (SM1634) and 'Standby system judgment flag' (SM1635) to judge the control
system.

3. Specify the control system CPU module for the request destination module I/O number and send a command message.

4. Check the response message.

To continue the communication, send command messages continuously.
5. Execute the close processing in the order the control system  the standby system.

Communications using the predefined protocol

When the control system IP address is not used, establish the connection with the Ethernet-equipped modules of both
systems and perform communications. When only sending data from the external device to the Ethernet-equipped module,
send the data to the Ethernet-equipped modules of both the control and standby systems because the system switching
timing is not able to be ascertained.

Socket communications
■Receive processing by the standby system
If data is sent to the standby system Ethernet-equipped module, data reception processing will not be performed because the
module reads and discards the received data.

■Receive processing with interrupt program

If system switching occurs before execution with the interrupt program, and the control system is switched to the standby
system, the interrupt factor will not be transferred to the other system. The interrupt factor will be retained on the own system.
Therefore, if system switching occurs again and the own system becomes the control system, the interrupt program will be
executed by the retained interrupt factor.

■When data is sent from an external device

• When the control system IP address is not used, the system switching timing is not able to be ascertained. Send data to the
Ethernet-equipped modules of both the control and standby systems.
• To use the control system IP address, check whether the Ethernet-equipped module is alive from the external device side.

Communications using the fixed buffer

■Receive processing by the standby system
If data is sent to the standby system Ethernet-equipped module, data reception processing will not be performed because the
module reads and discards the received data.

■Receive processing with interrupt program

If system switching occurs before execution with the interrupt program, and the control system is switched to the standby
system, the interrupt factor will not be transferred to the other system. The interrupt factor will be retained on the own system.
Therefore, if system switching occurs again and the own system becomes the control system, the interrupt program will be
executed by the retained interrupt factor.

1 FUNCTIONS
1.17 Redundant System Function 249
 ■When data is sent from an external device
The data sending method will differ according to whether the communication method and the control system IP address are
used.
Communication Control system Send method
method IP address
Fixed Buffer (Procedure Not Use When system switching occurs because of a response timeout to the Ethernet-equipped module, send by
Exist) changing the connection destination to the other system.
Use When system switching occurs because of a response timeout to the Ethernet-equipped module, open a
new control system.
Also, check whether the Ethernet-equipped module is alive from the external device side.
Fixed Buffer (No  System switching timing cannot be ascertained because of no setting for the response timeout. Send data
Procedure) to the Ethernet-equipped modules of both systems.

When performing the resend processing when system switching occurs, pay attention to the following.
• When communicating while synchronizing send and receive, system switching may occur in the middle of
communication, and systems may be switched in a state where send and receive are not synchronized
together. When system switching occurs, out of safety considerations, restart communication after
initialization of synchronization.
• When using dedicated instructions, note that the completion of the execution of a write instruction needs to
be executed is difficult to judge, and that the same instruction needs to be executed again. Note, however,
that the same instruction may be executed twice.

Communication using the random access buffer

Because tracking is not performed on the buffer memory of the Ethernet-equipped module, when writing data to the random
access buffer, write the same data to the control and standby systems.

Communications using a dedicated instruction

■System switching during dedicated instruction execution
When systems are switched during execution of a dedicated instruction, the dedicated instruction may not be completed.
Execute the dedicated instruction again from the control system CPU module after system switching.

■When the control system IP address is used

When using dedicated instructions for the Ethernet-equipped modules of a redundant system, the same IP address can be set
for both systems A and B by setting the control system IP address for the external device IP address in the control data. (
Page 245 Both systems identical IP address setting function)

■Specification of the target station CPU type in dedicated instructions

For a dedicated instruction in which the target station CPU type is specified as a control data, the control system CPU,
standby system CPU, system A CPU, and system B CPU can be accessed by specifying the type. By specifying the access
destination CPU module, even if system switching occurs due to a communication error, access to the specified CPU module
is possible using the communications path bypass function. ( MELSEC iQ-R Programming Manual (CPU Module
Instructions, Standard Functions/Function Blocks),  MELSEC iQ-R Programming Manual (Module Dedicated Instructions))

■Processing when a dedicated instruction abnormally ends

When the dedicated instruction is executed by specifying the access destination CPU module, it may be completed with an
error if systems are switched in the target station. If the dedicated instruction was completed with an error, execute it again.

■SEND instruction
• When the target station is in a redundant system, the communication request source station must identify that the target
station is the control system to execute the SEND instruction. When the target station is the standby system, the RECV
instruction is not executed at the target station after data is sent by the SEND instruction, and the target station storage
channel becomes occupied and unable to be used.
• When a redundant system exists in a network where broadcast communications are performed, the RECV instruction is not
executed at the standby system, and the storage channel becomes occupied and unable to be used.

1 FUNCTIONS
250 1.17 Redundant System Function
■RECV and RECVS instructions
• When the SEND instruction is executed for the control system, if the systems are switched before execution of the RECV
instruction and interrupt program, the control system retains 'RECV instruction execution request' (Un\G5301) and the 1
interrupt program interrupt factor (interrupt pointer). If system switching occurs again, and the standby system is switched
to the control system, the RECV instruction and interrupt program will be executed by the retained 'RECV instruction
execution request' (Un\G5301) and interrupt program interrupt factor.
• When the SEND instruction is executed for the standby system, and the standby system receives data from the sending
station, the standby system retains 'RECV instruction execution request' (Un\G5301) and the interrupt program interrupt
factor (interrupt pointer). Therefore, when the standby system is switched to the control system due to system switching,
the RECV instruction and interrupt program will be executed by the retained 'RECV instruction execution request'
(Un\G5301) and interrupt program interrupt factor.

■REQ instruction
When performing remote STOP or remote RUN on a redundant system, do as follows: Perform STOP on the standby system
 STOP on the control system  RUN on the control system  RUN on the standby system.

File transfer function (FTP server)

Perform file writing with the file transfer function (FTP server) as follows.

1. Log into the Ethernet-equipped modules of both systems.

2. Perform remote STOP on the CPU modules of both systems.*1

3. Write the file to the CPU modules of both systems.*2

4. Perform remote RUN on the CPU modules of both systems.

5. Log out from the Ethernet-equipped modules of both systems.

6. Clear the errors from the standby system CPU module.*3

*1 When the status of the control system CPU module is STOP state, a continuation error occurs in the standby system CPU module.
*2 When the parameter file has been written, the CPU modules must be reset.
*3 When the status of the control system CPU module changed from STOP to RUN state, check the error status of the standby system
CPU module, and if an error has occurred, turn on 'Error reset' (SM50) to clear the error.

Time setting function (SNTP client)

When the time is set by a program, an error may occur if system switching occurs in the timing in which the program is
executed. If an error occurs, execute the program after system switching.

IP filter
When using an IP filter, exclude the control system IP address, system A IP address, and system B IP address from the IP
filter settings. Otherwise, operation may not be performed normally.

IP address change function

Do not use the IP address change function to change IP addresses in a redundant system. Normal communication is not
possible if an IP address has been changed. When the IP address is changed using the IP address change function, clear the
IP address storage area.

Communications with Different Networks

Precautions exist for communications with different networks via a redundant system. ( Page 409 When the networks
contain a redundant system)

1 FUNCTIONS
1.17 Redundant System Function 251
 MODBUS/TCP slave function
■When the control system IP address is not used
The processing to determine the present control system on the MODBUS/TCP master device side and to switch the
communication destination (system A or system B) is required. Whether the communication destination is the control system
or the standby system is determined by reading Control system judgment flag (SM1634) and Standby system judgment flag
(SM1635) of the slave station CPU module.

■When the control system IP address is used

Once system switching is executed, TCP connection used before is disconnected.
Execute the re-connection processing from the MODBUS/TCP master device to restart TCP connection.

■When the data is written to the buffer memory (H)

The buffer memory of the Ethernet-equipped module is not tracked. When executing the MODBUS command for write to the
MODBUS device assigned in the buffer memory (H), write the same data to the system A and system B.

Simple CPU communications

■When system switching is executed
Communications stop temporarily due to execution of system switching, therefore communications may not execute within the
"Execution Interval" specified in the "Simple PLC Communication Setting" under "Application Settings".

■When User setting area (Un\G722500 to Un\G1246787) is used

The buffer memory of the Ethernet-equipped module is not tracked. When writing the data to User setting area (Un\G722500
to Un\G1246787), write the same data to the system A and system B.

Even if system switching is executed, the data of User setting area (Un\G722500 to Un\G1246787) is held in
the system A and system B.

1 FUNCTIONS
252 1.17 Redundant System Function
Setting example
This section describes the setting details for socket communications in a redundant system. 1
System configuration example

Receiving side (redundant system) settings

Connect the engineering tool to the CPU module to be set as the control system and set the parameters.
In a redundant system, the same program and parameter are written to both systems. A new project does not need to be
created for the standby system.
1. Set the CPU module as follows.
[Project]  [New]

2. Click the [OK] button to add the module labels of the CPU module.

1 FUNCTIONS
1.17 Redundant System Function 253
 3. In the I/O assignment setting, set the redundant function module for slot No.0.
[Navigation window]  [Parameter]  [System Parameter]  [I/O Assignment] tab  [I/O Assignment Setting]

4. Set the RJ71EN71 for slot No.1

5. Click the [OK] button to add the module labels of the RJ71EN71.

1 FUNCTIONS
254 1.17 Redundant System Function
6. Set the items in "Basic Settings" as follows.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings] 1

7. Set the network configuration as follows.

[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings]  [External Device Configuration]

1 FUNCTIONS
1.17 Redundant System Function 255
 8. Set the redundant settings in the following items.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Application Settings]  [Redundant System Settings]

9. Set whether to issue a system switching request for the user connection.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Application Settings]  [Redundant System Settings]  [System Switching Request Issue at Communication Error] 
[User Connection]

10. In the "System A/B Setting" window, set the redundant function module of own system to system A, and either reset the
CPU modules of both systems or power off and on both systems.
[Online]  [Redundant PLC Operation]  [System A/B Setting]

1 FUNCTIONS
256 1.17 Redundant System Function
11. Write the set parameters to the system A CPU module.
[Online]  [Write to PLC]

12. Click the [Yes] button to write to the CPU modules of both systems. 1

13. Either reset the CPU modules of both systems or power off and on both systems.

In this setting example, default settings are used for the parameters other than those described. For the
parameter setting, refer to the chapter explaining the parameters in this manual. ( Page 261
PARAMETER SETTINGS)

Sending side
Connect the engineering tool to the CPU module on the sending side and set the parameters.

1. Set the CPU module as follows.

[Project]  [New]

2. Click the [Setting Change] button in the following window and set the item to use module labels.

3. Click the [OK] button to add the module labels of the CPU module.

1 FUNCTIONS
1.17 Redundant System Function 257
 4. In the I/O assignment setting, set the RJ71EN71 for slot No.0.
[Navigation window]  [Parameter]  [System Parameter]  [I/O Assignment] tab  [I/O Assignment Setting]

5. Click the [OK] button to add the module labels of the RJ71EN71.

6. Set the items in "Basic Settings" as follows.

[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)] 
[Basic Settings]

1 FUNCTIONS
258 1.17 Redundant System Function
7. Set the network configuration as follows. The redundant system control system IP address is specified for the send
destination IP address.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Port 1 Module Parameter (Ethernet)]  1
[Basic Settings]  [External Device Configuration]

8. Write the set parameters to the CPU module. Then reset the CPU module or power off and on the system.
[Online]  [Write to PLC]

In this setting example, default settings are used for the parameters other than those described. For the
parameter setting, refer to the chapter explaining the parameters in this manual. ( Page 261
PARAMETER SETTINGS)

1 FUNCTIONS
1.17 Redundant System Function 259
 1.18 Discard received data at CPU STOP
The received data from the communication destination is discarded when the status of the CPU module is changed from RUN
to STOP (PAUSE).
This function is available for below two communication methods:
• Communications using the fixed buffer
• Socket communications

Setting procedure
This function can be enabled/disabled by directly changing the value in 'Discard received data at CPU STOP setting area' of
buffer memory areas with a program.

■Discard received data at CPU STOP setting area

RJ71EN71, RnENCPU (network part): Un\G1950032 to Un\G1950039
CPU module (built-in Ethernet port part): Un\G275

1 FUNCTIONS
260 1.18 Discard received data at CPU STOP
2 PARAMETER SETTINGS
This chapter describes the parameter settings required for communications between the Ethernet-equipped module and
external devices.
2
2.1 Setting Parameters
1. Add the RJ71EN71 in the engineering tool.*1
[Navigation window]  [Parameter]  [Module Information]  Right-click  [Add New Module]

2. The basic setting and application setting are included in the parameter settings. Select one of the settings from the tree
on the window shown below.
[Navigation window]  [Parameter]  Target module  [Module Parameter]

3. After setting parameters, click the [Apply] button.

4. Write the settings to the CPU module using the engineering tool.
[Online]  [Write to PLC]

5. The settings are reflected by resetting the CPU module or powering off and on the system.
*1 Addition of the module is not required when using the Ethernet function of the CPU module (CPU part for the RnENCPU).

2.2 Basic Settings

Set the own node settings and external device configuration of the Ethernet-equipped module.

Setting items Description Reference

Own Node Settings Set the IP address and communication data code of the Ethernet-equipped module. Page 262 Own Node Settings
CC-Link IEF Basic Settings*1 Set the network configuration settings and refresh settings of CC-Link IE Field CC-Link IE Field Network Basic
Network Basic. Reference Manual
External Device Configuration Set the method and protocol used for communicating with external devices. Page 264 External Device
Configuration

*1 This setting is displayed only for modules supporting CC-Link IE Field Network Basic.

2 PARAMETER SETTINGS
2.1 Setting Parameters 261
 Own Node Settings
Set the IP address and communication data code of the Ethernet-equipped module.
Item Description Setting range
Parameter Setting Method Set the own station settings by parameters. Parameter Editor (fixed)
IP Address IP Address Set the IP address of the own station. Set the IP address class within the range • Blank
of classes A, B and C. • 0.0.0.1 to 223.255.255.254
Ensure that the Ethernet-equipped module on the own station and the external (Default: Blank)
device to be communicated with have the same class and subnet address.
Consult with the network manager for the IP address setting.
When the parameters are written without the IP address set (blank), the
following IP address is set.
• P1 connector of RJ71EN71: 192.168.3.40
• P2 connector of RJ71EN71: 192.168.4.40
• RnENCPU (network part): 192.168.3.40
• CPU module (built-in Ethernet port part): 192.168.3.39
When using the IP address in a redundant system, use as the system A IP
address.
Subnet Mask Set the subnet mask pattern of the default gateway when setting the IP address • Blank
of the default gateway and communicating with an external device on another • 0.0.0.1 to 255.255.255.255
network via a router. All the devices on a subnetwork must have the same (Default: Blank)
subnet mask. This setting is not required when communicating in single network.
Default Gateway Set the IP address of the default gateway (the device which the own node • Blank
passes through to access a device of another network). • 0.0.0.1 to 223.255.255.254
Set the value that satisfies the following conditions. (Default: Blank)
• The IP address class is any of A, B, and C.
• The subnet address of the default gateway is the same as that of the
Ethernet-equipped module on the own station.
• The host address bits are not all "0" or all "1".
Communications by  Select "Enable" to set the network number, station number, and transient • Disable
Network No./Station transmission group number*1. • Enable
No. This setting is not required when the following functions are not used. (Default: Disable)
• Connection with the MELSOFT products and the GOT (when connecting by
specifying the network number and station number)
• Communications using the SLMP (when specifying the target station with its
network number and station number)*1
• Communications using a link dedicated instruction*1
• Communications with different networks
Setting Method Select the method for setting the network number and station number. ( • Use IP Address
Page 263 Setting Method) • Not Use IP Address
(Default: Use IP Address)
Network Number Enter the network number of the own station when selecting "Not Use IP 1 to 239
Address" in "Setting Method". (Default: 1)
Set a unique network number.
Station No. Enter the station number of the own station when selecting "Not Use IP Address" 1 to 120
in "Setting Method". (Default: 1)
Transient Set the transient transmission group number of the own station. 0 to 32
Transmission Group (Default: 0)
No.*1
Enable/Disable Online Change Select whether to enable external devices to write data in SLMP • Disable All (SLMP)
communications while the CPU module is in RUN state. ( Page 263 Enable/ • Enable All (SLMP)
Disable Online Change) (Default: Disable All (SLMP))
Communication Data Code Select the communication data code used for communications. • Binary
• ASCII
(Default: Binary)
Opening Method Select how to open a connection when using UDP/IP communications or • Do Not Open by Program
Passive open of TCP/IP communications. • Open by Program
• When "Do Not Open by Program" is selected, a connection is open when the (Default: Do Not Open by
system received the Active request. Program for open/close processing is not Program)
required.
• When "Open by Program" is selected, the open/close processing are
performed by a program. The module cannot communicate when the CPU
module is in STOP state.

*1 This setting is not available for the CPU module (built-in Ethernet port part).

2 PARAMETER SETTINGS
262 2.2 Basic Settings
Details of items
■Setting Method
When "Use IP Address" is selected, network number and station number will be set from the third and fourth octet of the IP
address.
For example, when IP address is set to 192.168.1.10, the network number is set to "1" and the station number is set to "10". 2
When the IP address is used, the value out of the range of the network number and station number cannot be set in the third
octet and fourth octet
When "Not Use IP Address" is selected, set the network number and station number.

When "Port 1 Network Type" and "Port 2 Network Type" are set to "Ethernet" for the RJ71EN71 and the same
network number is set for both of P1 and P2, P1 is always used for relay to other networks.

■Enable/Disable Online Change

Select whether to enable SLMP data write command received by the Ethernet-equipped module received while the CPU
module is in RUN state.
This setting is effective for not only the CPU module on the own station but also the ones on the other stations.
When "Disable All (SLMP)" is selected, data writing using SLMP is disabled while the CPU module is in RUN state.
When "Enable All (SLMP)" is selected, data writing using SLMP is enabled even when the CPU module is in RUN state.
To write data to the FTP server when the CPU module is in RUN state, set "Allow Online Change" under "FTP Server
Settings" in "Application Settings". ( Page 272 FTP Server Settings)

2 PARAMETER SETTINGS
2.2 Basic Settings 263
 External Device Configuration
Set the method and protocol used for communicating with external devices.

Setting procedure
The procedure for setting the external device to be connected is shown below.

1. Select the external device to be connected in "Module List" and drag it to "List of devices" or "Device map area".

2. Set the required items. The required items vary depending on the selected external device.

3. Select [Close with Reflecting the Setting] to finish the external device configuration settings.
[Ethernet Configuration]  [Check]  [System Configuration]

External devices must be set from the connection No.1

To use specific connection number, set "MELSOFT Connection Module" in the connection number not used.
• When only the connection No.5 is used.

2 PARAMETER SETTINGS
264 2.2 Basic Settings
Setting items
Item Description Setting range
[Detect Now] button Execute the automatic detection of connected devices. 
The [Detect Now] button is displayed only when the CPU module (built-
in Ethernet port part) is used.
For details, refer to the following. 2
 iQ Sensor Solution Reference Manual
No. Connection number for distinguishing settings for each user The number is set in the following
connection. range starting with 1.
• RJ71EN71 and RnENCPU (network
part): 1 to 64*1
• CPU module (built-in Ethernet port
part): 1 to 16
Model Name The name of the external device is displayed. 
Communication Method Set the method for communication with the external device. • Broadcast Send
• Broadcast Receive
• Fixed Buffer (Procedure Exist)*2
• Fixed Buffer (No Procedure)*2
• Random Access Buffer*2
• Predefined Protocol
• Socket Communication*3
• MELSOFT Connection
• SLMP
• OPS Connection
• MODBUS/TCP*2
Protocol Select the communication protocol for the external device. • TCP*4
• UDP*4
Fixed Buffer Send/Receive Setting*2 For communications using the fixed buffer, select whether to use the • Send
buffer for sending or for receiving in a connection to the external • Receive
device. • Pairing (Receive)
• Pairing (Send)
PLC IP Address The IP address of the own node, which is set in "IP Address" under 
"Own Node Settings" of "Basic Settings", is displayed.
Or the IP address of the communication destination set in the device
supporting iQSS is displayed when using the automatic detection of
connected devices.
Port No. Set the port number for each connection of the Ethernet-equipped 1 to 4999, 5010 to 65534
module. (Default: Blank)*4
When "Communication Method" is set to "MODBUS/TCP", set the
same value to all port numbers.
Sensor/Device MAC Address The MAC address of the device supporting iQSS is displayed when 
using the automatic detection of connected devices.
Host Name Set the name for identifying the device supporting iQSS. 63 characters maximum
This setting is available only for the devices supporting iQSS which The following one-byte characters can
were detected by automatic detection of connected devices. be used.
• Number (0 to 9)
• Alphabetical character (a to z, A to
Z)
• Hyphen (-)
• Period (.)
• Colon (:)
• Underscore (_)
(Default: Blank)*4
IP Address Set the IP address of the external device. 0.0.0.1 to 223.255.255.254,
255.255.255.255*5
(Default: Blank)*4
Port No. Set the port number of the external device. 1 to 65534, 65535
Set "65535" to set all the port numbers as the target of data receive. (Default: Blank)*4
Subnet Mask Set the subnet mask of the device supporting iQSS. 192.0.0.0 to 255.255.255.252
This setting is available only for the devices supporting iQSS which (Default: Blank)*4
were detected by automatic detection of connected devices.
Default Gateway Set the default gateway of the device supporting iQSS. 0.0.0.1 to 223.255.255.254
This setting is available only for the devices supporting iQSS which (Default: Blank)*4
were detected by automatic detection of connected devices.

2 PARAMETER SETTINGS
2.2 Basic Settings 265
 Item Description Setting range
Existence Confirmation Select the method of alive check which is performed when the • KeepAlive
Ethernet-equipped module has not communicated with the external • UDP
device for a certain period of time. When the module cannot • Do not confirm existence
communicate with the external device, the connection will be closed.
( Page 266 Existence Confirmation)

*1 When "Q Compatible Ethernet" is selected in the network type, the setting range is 1 to 16.
*2 This setting is not available for the CPU module (built-in Ethernet port part).
*3 This setting is not available when the RJ71EN71 network type is set to "Q Compatible Ethernet".
*4 When the automatic detection of the connected devices is executed, the values read from the connected devices will be the default.
*5 When "Communication Method" is set to "OPS Connection", 255.255.255.255 can be set.

Comment can be set on the "Properties" window displayed by right-clicking the module in "List of devices" or
"Device map area" and selecting "Properties". The following can be performed depending on the selected
device.
• Changing the image
• Creating association with a file or application

■Existence Confirmation
When the Ethernet-equipped module has not communicated with the external device for a certain period of time while the
connection is open, this function checks whether the external device is alive by sending an alive check message to the device
and waiting for the response.
The following table lists the details on alive check.
Item Applicable protocol Description
KeepAlive TCP/IP This method is used for a connection opened using TCP/IP. The Ethernet-equipped module performs
an alive check by sending an alive check ACK message to the external device with which
communications have not been performed for a certain period of time and waiting to see whether the
response is received.
The connection will be automatically closed when the open state is not continued.*1
UDP UDP/IP This method is used for a connection opened using UDP/IP. The Ethernet-equipped module performs
an alive check by sending the PING command (ICMP echo request/response function) to the external
device with which communications have not been performed for a certain period of time and waiting to
see whether the response is received.*2
Do not confirm existence TCP/IP, UDP/IP Alive check is not performed.

*1 The connection may be disconnected if the external device does not support the TCP KeepAlive function (response to a KeepAlive ACK
message).
*2 The Ethernet-equipped module automatically sends an echo response packet when it receives a PING echo request command. (It
sends a response to the received PING command even if the connection used in the data communications with the external device is
closed.)
If a response message cannot be received from the external device (or if an error has been detected) using the alive check
function, the following are performed.
• The corresponding connection will be forcibly closed. (The line is disconnected.) Open the connection again using a user
program.
• Open completion signal is turned off, and the error code is stored in the buffer memory areas.

2 PARAMETER SETTINGS
266 2.2 Basic Settings
2.3 Application Settings
Set frame or communication speed of the Ethernet-equipped module.

RJ71EN71, RnENCPU (network part)

2

2 PARAMETER SETTINGS
2.3 Application Settings 267
 Setting item Description Reference
Frame Settings Set parameters for the Ethernet frame. Page 270 Frame Settings
Communication Speed Set the communication speed between the module and the external device. Page 271 Communication Speed
FTP Server Settings Set the file transfer function (FTP server). Page 272 FTP Server Settings
MODBUS/TCP Settings*1 Set MODBUS/TCP. Page 274 MODBUS/TCP Settings
Simple PLC Communication Set the simple CPU communication setting. Page 276 Simple CPU
Setting*1 communication setting
(RJ71EN71, RnENCPU (network
part))
Time Setting*1 Set the time setting function (SNTP client). Page 280 Time Setting
Timer Settings for Data Set the timer used for the following communications. Page 281 Timer Settings for Data
Communication • Connection with MELSOFT products and a GOT Communication
• Communications using the SLMP
• Communications using the predefined protocol
• Socket communications/Communications using the fixed buffer
• Communication using the random access buffer
• File transfer function (FTP server)
• File Transfer Function (FTP Client)
Security*1 Set the security measures for access to the Ethernet-equipped module. Page 284 Security
Gateway Parameter Settings Set to communicate with an external device on Ethernet via a router and gateway. Page 284 Gateway Parameter
Settings
Network/Station No. <-> IP Set to communicate with another network module or CPU module by network Page 286 Network/Station No. <->
information setting number and station number. IP information setting
Interrupt Settings Set to start up an interrupt program. Page 293 Interrupt Settings
IP Packet Transfer Setting*1 Set the IP packet transfer function. Page 293 IP Packet Transfer
For details on the IP packet transfer function, refer to the following. Setting
 MELSEC iQ-R CC-Link IE Controller Network User's Manual (Application)
 MELSEC iQ-R CC-Link IE Field Network User's Manual (Application)
Network Dynamic Routing*1 Set the dynamic routing. Page 294 Network Dynamic
Routing
Module Operation Mode Set the module operation mode. Page 294 Module Operation
Mode
Redundant system settings*2 Set when using an RJ71EN71 in a redundant system. Page 295 Redundant System
Settings

*1 This setting is not available when the RJ71EN71 network type is set to "Q Compatible Ethernet".
*2 This item is displayed only when the module configuration for a redundant system is used.

2 PARAMETER SETTINGS
268 2.3 Application Settings
CPU module (built-in Ethernet port part)

Setting item Description Reference

FTP Server Settings Set the file transfer function (FTP server). Page 272 FTP Server Settings
FTP Client Settings Set the file transfer function (FTP client). Page 273 FTP Client Settings
DNS Settings Set the DNS setting. Page 273 DNS Settings
Web Server Settings Set the Web server function. ( MELSEC iQ-R/MELSEC iQ-F Web Server 
Function Guide Book)
Simple PLC Communication Set the simple CPU communication setting. Page 278 Simple CPU
Setting communication setting (CPU
module (built-in Ethernet port
part))
Time Setting Set the time setting function (SNTP client). Page 280 Time Setting
Timer Settings for Data Set the timer used for the following communications. Page 281 Timer Settings for Data
Communication • Connection with MELSOFT products and a GOT Communication
• Communications using the SLMP
• Communications using the predefined protocol
• Socket communications/Communications using the fixed buffer
• Communication using the random access buffer
• File transfer function (FTP server)
• File Transfer Function (FTP Client)
Security Set the security measures for access to the Ethernet-equipped module. Page 284 Security
Gateway Parameter Settings Set to communicate with an external device on Ethernet via a router and gateway. Page 284 Gateway Parameter
Settings
Network/Station No. <-> IP Set to communicate with another network module or CPU module by network Page 286 Network/Station No. <->
information setting number and station number. IP information setting
IP Packet Transfer Setting Set the IP packet transfer function. Page 293 IP Packet Transfer
For details on the IP packet transfer function, refer to the following. Setting
 MELSEC iQ-R CC-Link IE Controller Network User's Manual (Application)
 MELSEC iQ-R CC-Link IE Field Network User's Manual (Application)
Redundant System Settings Set the redundant system function. Page 295 Redundant System
Only functions that meet usage conditions with a redundant system can be set. ( Settings
Page 238 Redundant System Function)
Built-in database access setting Set the function of CPU module built-in database access from an external device. 
( MELSEC iQ-R CPU Module User's Manual (Application))

2 PARAMETER SETTINGS
2.3 Application Settings 269
 Frame Settings
Set parameters for the Ethernet frame.
Item Description Setting range
Send Frame Set the frame of the Ethernet header for the data link layer to be sent Ethernet (V2.0) Frame (fixed)
by the RJ71EN71 or the RnENCPU (network part) to the Ethernet
(V2.0) frame.
Jumbo Frame*1 Set the frame size of the data to be sent over Ethernet. • Invalid (MTU 1500 byte)
Set when the data transmission speed is 1Gbps and communication is • 2KB (MTU 2034 byte)
not efficient because the frame size is too small. • 3KB (MTU 3058 byte)
• 4KB (MTU 4082 byte)
• 5KB (MTU 5106 byte)
• 6KB (MTU 6130 byte)
• 7KB (MTU 7154 byte)
• 8KB (MTU 8178 byte)
• 9KB (MTU 9004 byte)
(Default: Invalid (MTU 1500 byte))

*1 This setting is not available when the RJ71EN71 network type is set to "Q Compatible Ethernet".

Jumbo Frame
The following describes the precautions for using jumbo frames.
• In TCP/IP communications, the setting is enabled when the external device supports jumbo frames. If the external device
does not support jumbo frames, the Ethernet-equipped module sends data in normal frame size even though the "Jumbo
Frame" is enabled.
• In TCP/IP communications, data sending from the external device may fail when "Jumbo Frame" of the Ethernet-equipped
module is set to "Invalid (MTU 1500 byte)" and that of the external device is enabled. When communicating in jumbo
frames, enable the jumbo frame setting for both of the Ethernet-equipped module and external device.
• In UDP/IP communications, the Ethernet-equipped module sends data in jumbo frames according to the "Jumbo Frame"
even though the external device does not support jumbo frames.
• When the hub on the communication path does not support jumbo frames, the Ethernet-equipped module cannot
communicate with the external device because the hub discards the packets even if the module sends data in jumbo frame.
• Data can be sent in jumbo frames only when the transmission speed is 1Gbps. When "Automatic Negotiation" in
"Communication Speed" is set to "Jumbo Frame" and the Ethernet-equipped module communicates at a speed less than
1Gbps, the module sends data in the standard frame size.
• When the item other than "Automatic Negotiation" or "1Gbps/Full-Duplex" is set in "Communication Speed" of "Application
Settings", "Jumbo Frame" cannot be set to other than "Invalid (MTU 1500 byte)".

2 PARAMETER SETTINGS
270 2.3 Application Settings
Communication Speed
Select the communication speed and communication mode from the following. (Default: Automatic Negotiation)
When "Automatic Negotiation" is selected, communication speed will be automatically set to be the same as that of another
device connected to the network.
• Automatic Negotiation 2
• 1Gbps/Full-Duplex*1
• 100Mbps/Half-Duplex
• 100Mbps/Full-Duplex
• 10Mbps/Half-Duplex
• 10Mbps/Full-Duplex
*1 This setting is not available when the RJ71EN71 network type is set to "Q Compatible Ethernet".
Select "Automatic Negotiation" to use 1Gbps/full-duplex.

• When the auto-negotiation function is used, there is a time lag before starting communication because it
requires the time to determine the communication speed and communication mode by FLP burst.
• It is recommended to set the auto-negotiation also in the communication destination when using the auto-
negotiation function. If auto-negotiation is not set in ether of the Ethernet-equipped module or partner
external device, communication mode cannot be identified and it is automatically set to half-duplex mode,
resulting in unstable communication.
• Set the lower communication speed when communication fails due to noise or other causes.

2 PARAMETER SETTINGS
2.3 Application Settings 271
 FTP Server Settings
Set the file transfer function (FTP server).
Item Description Setting range
FTP Server Select whether to use the file transfer function (FTP server) of the • Not Use
Ethernet-equipped module. • Use
(Default: Not Use)
Login Name Set the login name to be used for file transfer request (login) from the 12 characters maximum (one-byte
external device. alphanumeric character)
[Default]
• RJ71EN71 and RnENCPU (network
part): RJ71EN71
• CPU module (built-in Ethernet port
part): RCPU
Advanced Password Setting Set the password to be used for file transfer request (login) from the 
Settings external device to the Ethernet-equipped module. ( Page 272
Password Setting)
FTP Timer Settings Set the following timers used for the file transfer function (FTP server). 
( Page 272 FTP Timer Settings)
• Command Input Monitoring Timer
• Response Monitoring Timer
Allow Online Change Select whether to enable data writing from the external device using • Disable
the file transfer function (FTP server) while the CPU module is in RUN • Enable
state. (Default: Disable)

Password Setting
■Current Password
Enter the current password for login to the Ethernet-equipped module.
Default password (initial setting) is the following.
Module Password
RJ71EN71, RnENCPU (network part) RJ71EN71
CPU module (built-in Ethernet port part) RCPU

Although the default password can be used, it is recommended to change it to another password to prevent unauthorized
access.

■New Password, Confirm New Password

Enter the new password in "New Password" and "Confirm New Password" when changing the password.
Set a password within 0 to 32 one-byte characters. Number, alphabet, special character (?,!&\%#*) can be used.

FTP Timer Settings

■Command Input Monitoring Timer
Set the monitoring time for the Ethernet-equipped module to monitor the command input time from the FTP client
It is recommended to use the default value (900s) for this timer value as much as possible.
When changing the setting value, determine the command input monitoring timer value upon consulting with the administrator
of the external device or system.
Set a value within the following range.
Unit Setting range
s 1 to 16383
ms*1 100 to 16383000

*1 Set in increments of 100ms.

The FTP connection is disconnected if there is no command input from the FTP client side within the time of the command
input monitoring timer value after the FTP client login.
When restarting the file transfer, start over from the login operation again.

2 PARAMETER SETTINGS
272 2.3 Application Settings
■Response Monitoring Timer
Set the monitoring time for a response from the CPU module after the Ethernet-equipped module receives the request data
from the external device and requests the CPU module for read/write.
It is recommended to use the default value (5s) for this timer value as much as possible.
When changing the setting value, determine the response monitoring timer value upon consulting with the system
administrator. 2
Set a value within the following range.
Unit Setting range
s 1 to 16383
ms 100 to 16383000 (in increments of 100ms)

FTP Client Settings

Set the file transfer function (FTP client).
Item Description Setting range
To Use or Not to Use FTP Client Settings Set whether to use the file transfer function (FTP client) or not. • Not Use
• Use
(Default: Not Use)
FTP Server Specification Set the specification method of the FTP server. • FTP Server Name
• FTP Server IP Address
(Default: FTP Server Name)
FTP Server Name Set the FTP server name (domain name) of the connection destination. 1 to 256 characters
FTP Server IP Address Set the IP address of the FTP server of the connection destination in 0.0.0.1 to 223.255.255.254
the decimal format.
Login Name Set the login name for login to the FTP server. 1 to 32 characters
Password Set the password for login to the FTP server. 0 to 32 characters
Connection Method Set the connection method of the FTP server. • PORT Mode
• PASV Mode
(Default: PORT Mode)
Port No. Set the port number for control of the FTP server. 1 to 65535
(Default: 21)

DNS Settings
Set the IP address of the DNS server.
Set the IP address in the following cases.
• When "FTP Server Specification" in "FTP Client Settings" is set to "FTP Server Name"
• When the FTP server is specified with the server name for the data logging file transfer function.
Item Description Setting range
To Use or Not to Use DNS Server Settings Set whether to use the DNS server or not. • Not Use
• Use
(Default: Not Use)
DNS Server 1 Address Set the IP address of the DNS server 1 in the decimal format. 0.0.0.1 to 223.255.255.254
DNS Server 2 Address Set the IP address of the DNS server 2 in the decimal format. 0.0.0.1 to 223.255.255.254

When "To Use or Not to Use DNS Server Settings" is set to "Use", set either one or both "DNS Server 1
Address" and "DNS Server 2 Address".

2 PARAMETER SETTINGS
2.3 Application Settings 273
 MODBUS/TCP Settings
Set MODBUS/TCP.
Item Description Setting range
To Use or Not to Use MODBUS/TCP "Use" is displayed when a MODBUS/TCP connection device is added • Not Use
Setting in "External Device Configuration" under "Basic Settings". ("To Use or • Use
Not to Use MODBUS/TCP Setting" cannot be edited.) (Default: Not Use)
CPU Response Monitoring Timer Set the time for monitoring the response from the CPU module. 
( Page 274 CPU Response Monitoring Timer)
Device Assignment Set the parameters to associate the MODBUS devices with the device 
memory areas of the CPU module.
( Page 274 Device Assignment)

CPU Response Monitoring Timer

Set the time for monitoring the response from the CPU module.
When the CPU module does not send a response within the set time after the reception of a request message from the
MODBUS/TCP master device, the state of waiting for the response from the Ethernet-equipped module is canceled.
Set the CPU Response Monitoring Timer within the following range.
Unit Setting range
s 1 to 16383
ms 100 to 16383000 (in increments of 100ms)

Device Assignment
Set the MODBUS device assignment parameters to use the MODBUS device assignment function.
Create the association between the following MODBUS devices and the device memory areas of the CPU module.
• Coil
• Input
• Input register
• Holding register

Item Description
Device Set the devices of the CPU module to be assigned to the MODBUS devices.
Use H to specify a buffer memory area. (Example: H1D5000)

2 PARAMETER SETTINGS
274 2.3 Application Settings
Item Description
Start MODBUS Device No. Set the start number of the devices of the CPU module to be assigned to the MODBUS devices.
The setting value for the start MODBUS device number can be obtained with the following formula.
• Start MODBUS device number = Last five digits of the target MODBUS device number - 1
Allocation Points Set the number of device points of the CPU module to be assigned to the MODBUS devices.

When "Device" is blank, values set in "Start MODBUS Device No." and "Allocation Points" are ignored.
2
In this case, data written into the programmable controller will not be assigned to the MODBUS devices.
(When the written data are read from the programmable controller, "Start MODBUS Device No." and
"Allocation Points" are set to 0.)

2 PARAMETER SETTINGS
2.3 Application Settings 275
 Simple CPU communication setting (RJ71EN71, RnENCPU
(network part))
This setting is used for using the simple CPU communication function with the RJ71EN71 or RnENCPU (network part).
Set "Use" to "To Use or Not to Use Simple PLC Communication" before setting other items.
Item Description Setting range
To Use or Not to Use Select whether to use the simple CPU communication or not. • Not Use
Simple PLC • Use
Communication (Default: Not Use)
CPU Response Monitoring Set the time for monitoring the response from the CPU module. • s: 1 to 16383
Timer When the CPU module does not send a response within the set time, the state of waiting • ms: 100 to 16383000 (in
for the response from the Ethernet-equipped module is canceled. increments of 100ms)
(Default: 5s)
Simple PLC Set the items to use the simple CPU communication. ( Page 276 Simple PLC communication setting)
Communication Setting
"Communication Click "Detailed Setting" to display the window. ( Page 277 "Communication Destination Setting" window)
Destination Setting"
window

Details of items
■Simple PLC communication setting
Set the items to use the simple CPU communication.
Item Description Setting range
Latency Time Set the time required to start communications after completion of the CPU module 0 to 255s (in increments of 1s)
startup. (Default: 0s)
This setting is common to all the setting numbers and cannot be changed for each
setting number.
After system switching in a redundant system, communications are restarted
regardless of the latency time.
Setting No. Setting numbers 1 to 512 are available. 
Any numbers can be used. (Numbers to use do not have be sequential.)
Communication Pattern Set whether to read or write data. • Read
• Write
(Default: Blank)
Communication Communication Set the data communication timing. • Fixed Interval
Setting: setting • On Request
Execution (Default: Fixed Interval)
Interval (ms)
Execution Set the execution interval of communications when "Fixed Interval" is set for the 1 to 65535ms (in increments of
interval communication setting. 1ms)
(Default: 100ms)
Communication Source Set the transmission source. Page 277 "Communication
Destination (IP When "Write" is set to "Communication Pattern", the own station (IP address of the Destination Setting" window
Address) own station) is displayed.
Destination Set the transmission destination.
When "Read" is set to "Communication Pattern", the own station (IP address of the
own station) is displayed.
Target PLC No. Specify the CPU number of the communication destination. • Not Specified
It will be the connected station when "Not Specified" is selected. • PLC No.1
• PLC No.2
• PLC No.3
• PLC No.4
(Default: Not Specified)
Bit Device Points Set the type, start number, and end number of the "Source" bit device and the type The setting range differs
and start number of the "Destination" bit device. When these values are input, the depending on the communication
Type
number of points will be displayed automatically. destination. ( Page 190
Start Devices that can be specified)
End
Word Device Points Set the type, start number, and end number of the "Source" word device and the
type and start number of the "Destination" word device. When these values are
Type
input, the number of points will be displayed automatically.
Start
End

2 PARAMETER SETTINGS
276 2.3 Application Settings
Item Description Setting range
Communication Time-out Period Set the time period until retries are performed after an error response from the 10 to 65535ms (in increments of
(ms) communication destination, the time period until the abnormal state is detected, 1ms)
and the time period to wait for a response from the communication destination. (Default: 1000ms)
Configure the setting so that (communication time-out period)  (execution When the device type of the
interval). communication destination set to
For details on the communication time-out period, refer to the following. "SLMP Corresponding Device
Page 204 Communication Time-out Period/Communication Retry Count/ (QnA Compatible 3E Frame)", the 2
Monitoring Time At Error value is fixed to 65535ms.
Communication Retry Count Set the number of communication retry to be performed within the communication 0 to 255 times
time-out period when the communication destination returns an error response or (Default: 3)
does not respond. When the device type of the
For details on the communication retry count, refer to the following. communication destination set to
Page 204 Communication Time-out Period/Communication Retry Count/ "SLMP Corresponding Device
Monitoring Time At Error (QnA Compatible 3E Frame)", the
value is fixed to 0.
Monitoring Time At Error (s) Set the communication time after a communication error has occurred. 1 to 300s
For details on the monitoring time at error, refer to the following. (Default: 30s)
Page 204 Communication Time-out Period/Communication Retry Count/
Monitoring Time At Error
Comment Sets a comment for the setting number, if required. 32 one-byte characters (16 double-
byte characters) maximum
(Default: Blank)

■"Communication Destination Setting" window

The communication destination of the simple CPU communication is specified on the window.
Item Description Setting range
Device Type Specify the device type of the communication destination. • MELSEC iQ-R (Built-in Ethernet)
• MELSEC-Q (Built-in Ethernet)
• MELSEC-L (Built-in Ethernet)
• MELSEC iQ-F (Built-in Ethernet)
• MELSEC iQ-L (Built-in Ethernet)
• MELSEC iQ-R (Ethernet Module)
• MELSEC-Q (Ethernet Module)
• MELSEC-L (Ethernet Module)
• MELSEC-A/AnS (Ethernet Module)
• MELSEC-FX3 (Ethernet Block/Adapter)
• SLMP Corresponding Device (QnA Compatible
3E Frame)
• OMRON (CS/CJ series)
• KEYENCE (KV series)
• Panasonic (FP2SH series)
• Panasonic (FP7 series)
• YASKAWA MP3000 series
• YASKAWA MP2000 series
• Yokogawa FA-M3 series
• MODBUS/TCP Corresponding Device
• SIEMENS S7 series
• Fuji Electric MICREX-SX series
• JTEKT TOYOPUC series
(Default: Blank)
UDP/TCP Set the protocol used for the communication. • UDP
• TCP
(Default: Blank)
IP Address Enter the IP address of the communication destination. 0.0.0.1 to 223.255.255.254
(Default: Blank)
Port No. Set the port number of the communication destination. 1 to 65534
(Default: Blank)
Host Station Port No. Set the port number of the own station. 1 to 65534
(Default: Blank)
Option (hexadecimal) Set the option setting value. The value differs depending on the external devices.
( Page 188 Option (hexadecimal))

2 PARAMETER SETTINGS
2.3 Application Settings 277
 Simple CPU communication setting (CPU module (built-in
Ethernet port part))
Set the following items when using the simple CPU communication function with the CPU module (built-in Ethernet port part).
Item Description Setting range
Latency Time Set the time required to start communications after completion of the CPU module 0 to 255s (in increments of 1s)
startup. (Default: 0s)
This setting is common to all the setting numbers and cannot be changed for each
setting number.
Setting No. Displays setting No.1 to 64. 
An arbitrary setting number can be set. (Numbers to use do not have be
sequential.)
Communication Pattern Set whether to read or write data. • Read
• Write
(Default: Blank)
Communication Communication Sets this item to communicate data periodically. Fixed
Setting: setting (Default: Fixed Interval)
Execution
Execution Set the execution interval of communications when "Fixed Interval" is set for the 10 to 65535ms (in increments of
Interval (ms)
interval communication setting. 1ms)
(Default: 100ms)
Communication Source Set the transmission source. Page 279 Communication
Destination (IP When "Write" is set to "Communication Pattern", the own station (IP address of the destination setting
Address) own station) is displayed.
Destination Set the transmission destination.
When "Read" is set to "Communication Pattern", the own station (IP address of the
own station) is displayed.
Target PLC No. Specify the CPU number of the communication destination. • Not Specified
It will be the connected station when "Not Specified" is selected. • PLC No.1
• PLC No.2
• PLC No.3
• PLC No.4
(Default: Not Specified)
Bit Device Points Set the type, start number, and end number of the "Source" bit device and the type The setting range differs
Type and start number of the "Destination" bit device. When these values are input, the depending on the communication
number of points will be displayed automatically. destination. ( Page 220
Start Devices that can be specified)
End
Word Device Points Set the type, start number, and end number of the "Source" word device and the
type and start number of the "Destination" word device. When these values are
Type
input, the number of points will be displayed automatically.
Start
End
Communication Time-out Period Set the time period until the retry is performed, the time period until a 10 to 65535ms (in increments of
(ms) communication error occurs, and the time period to wait a response from the 1ms)
communication destination after an error response from the communication (Default: 1000ms)
destination. When the communication
Configure the setting so that (communication time-out period)  (execution destination set to "SLMP
interval). Corresponding Device (QnA
For details on the communication time-out period, refer to the following. Compatible 3E Frame)", the value
Page 225 Communication Time-out Period/Communication Retry Count/ is fixed at 65535ms.
Monitoring Time At Error
Communication Retry Count Set the number of communication retry to be performed within the communication 0 to 255 times
time-out period when the communication destination returns an error response or (Default: 3)
does not respond. When the communication
For details on the communication retry count, refer to the following. destination set to "SLMP
Page 225 Communication Time-out Period/Communication Retry Count/ Corresponding Device (QnA
Monitoring Time At Error Compatible 3E Frame)", the value
is fixed at 0.
Monitoring Time At Error (s) Set the communication time after a communication error has occurred. 1 to 300s
For details on the monitoring time at error, refer to the following. (Default: 30s)
Page 225 Communication Time-out Period/Communication Retry Count/
Monitoring Time At Error
Comment Sets a comment for the setting number, if required. 32 one-byte characters (16 double-
byte characters) maximum
(Default: Blank)

2 PARAMETER SETTINGS
278 2.3 Application Settings
Communication destination setting
The following table lists the communication destination setting specified for the simple CPU communication.
Item Description Setting range
Device Type Specify the device type of the communication • MELSEC iQ-R (Built-in Ethernet)
destination. • MELSEC iQ-L (Built-in Ethernet)
• MELSEC iQ-F (Built-in Ethernet) 2
• MELSEC-Q (Built-in Ethernet)
• MELSEC-L (Built-in Ethernet)
• MELSEC-Q (Ethernet Module)
• MELSEC-L (Ethernet Module)
• MELSEC-A/AnS (Ethernet Module)
• MELSEC-FX3 (Ethernet Block/Adapter)
• SLMP Corresponding Device (QnA Compatible 3E Frame)
(Default: Blank)
IP Address Enter the IP address of the communication 0.0.0.1 to 223.255.255.254
destination. (Default: Blank)
Port No. Set the port number of the communication • MELSEC-A/AnS (Ethernet Module): 256 to 65534
destination. • MELSEC-FX3 (Ethernet Block/Adapter): 1025 to 5548, 5552 to 65534
• SLMP Corresponding Device (QnA Compatible 3E Frame): 1 to 4999, 5010
to 65534
• Other than the above: Setting not required
(Default: Blank)
Host Station Port No. Set the port number of the own station. • MELSEC-A/AnS (Ethernet Module): 1 to 4999, 5010 to 65534
• MELSEC-FX3 (Ethernet Block/Adapter): 1 to 4999, 5010 to 65534
• SLMP Corresponding Device (QnA Compatible 3E Frame): 1 to 4999, 5010
to 65534
• Other than the above: Setting not required
(Default: Blank)

2 PARAMETER SETTINGS
2.3 Application Settings 279
 Time Setting
Set the time setting function (SNTP client).
Item Description Setting range
Time Setting (SNTP Client) Select whether to use the time setting function (SNTP client). • Not Use
• Use
(Default: Not Use)
SNTP Server IP Address Set the IP address of the SNTP server. 0.0.0.1 to 223.255.255.254
(Default: 0.0.0.1)
Timer Setting After Power-on and Reset Select whether to execute the time setting function upon power-on or • Disable
reset. • Enable
(Default: Disable)
Execution  Select the execution timing of the time setting. • Fixed Time
Timing • Fixed Scan Interval
(Default: Fixed Time)
Time Intervals When "Fixed Scan Interval" is selected, set the time interval (minute) of 1 to 1440
time setting executions. (Default: 1 Minute)
Specified Time (Hour, When "Fixed Time" is selected, set the day of the week and the clock 
Minute, Day of Week) time (hour and minute) when the time setting function is executed.
( Page 280 Specified Time (Hour, Minute, Day of Week))

The SNTP server must be only one in a network. The time to be output is the same even though multiple
modules in the same system retrieve time from the same SNTP server.

Execution Timing
■Specified Time (Hour, Minute, Day of Week)
Set an execution time value within the following range in "Clock Time (Hour, Minute)".
Item Setting range
Hour 0 to 23
(Default: 12)
Minute 0 to 59
(Default: 0)

To specify the day of the week when time setting is executed, set "Not Set" in the day when time setting is not executed under
"Day of Week". (Time setting is set to be executed every day (all the days are set to "Set") by default.)
When specifying the day of the week, set at least one day of the week to "Set". An error occurs when all the days are set to
"Not Set".

2 PARAMETER SETTINGS
280 2.3 Application Settings
Timer Settings for Data Communication
Set the timer used for the following communications.
• Connection with MELSOFT products and a GOT
• Communications using the SLMP
• Communications using the predefined protocol 2
• Socket communications/Communications using the fixed buffer
• Communication using the random access buffer
• File transfer function (FTP server)
• File Transfer Function (FTP Client)
When changing the timer settings for data communication, refer to the precautions before setting. ( Page 282 Precautions
for settings)
Item Description Setting range
Change/Set Timer Value Select whether to change timer values from the default. • No
The timer operates with its default value when "No" is selected. • Yes
(Default: No)
TCP Resend Timer Set the waiting time to resend ACK if it is not returned when a Unit [s]: 1 to 16383
connection is opened or data is sent in TCP/IP. Unit [ms]: 100 to 16383000*1
This timer is also used as the minimum set time for arrival monitoring (Default: 10s)
for data link instructions.
Destination Alive Check Start Interval Timer Set the time interval between the reception of the last message from Unit [s]: 1 to 16383
the external device and the start of alive check. Unit [ms]: 100 to 16383000*1
(Default: 600s)
Destination Alive Check Interval Timer Set the time interval for performing alive check again when no Unit [s]: 1 to 16383
response is returned from the external device of alive check target. Unit [ms]: 100 to 16383000*1
(Default: 10s)
Destination Alive Check Resend Count Set the number of times to perform alive check when no response is 1 to 99999
returned from the external device of alive check target. (Default: 3)
Advanced Response Monitoring Set the following time. Unit [s]: 1 to 16383
Settings Timer • The time to wait for a response after sending command in Unit [ms]: 100 to 16383000*1
communications with a fixed buffer (procedure exists) (Default: 30s)
• The time interval between the first message and last message when
receiving the divided messages.
TCP ULP Timer Set the time-to-live of the send packet in TCP/IP communications. Unit [s]: 1 to 16383
For example, when the TCP resend timer value is set to 10 seconds Unit [ms]: 100 to 16383000*1
and the TCP ULP timer value is set to 30 seconds, data will be resend (Default: 30s)
every 10 seconds if no response is returned from the external device
after data sending, and timeout error occurs if no response is returned
within 30 seconds.
TCP End Timer When closing the TCP/IP connection by the own station, set the Unit [s]: 1 to 16383
monitoring time for waiting for a FIN from the external device after the Unit [ms]: 100 to 16383000*1
own station sends a FIN and an ACK is returned from the external (Default: 20s)
device. If a FIN is not received from the external device within the time
specified by the TCP end timer value, an RST is sent to the external
device and the connection is forcibly closed.
TCP Zero Window Timer The window means the receive buffer on the receive side. If the receive Unit [s]: 1 to 16383
buffer on the receive side has no free space (window size = 0), data Unit [ms]: 100 to 16383000*1
sending is waited until the receive side has free receive buffer space. (Default: 10s)
At this time, the sending side sends packets for checking the send
window to the receive side according to the TCP zero window timer
value to check the receiving status.
IP Assembly Timer The communication data may be divided at the IP level before being Unit [s]: 1 to 16383
sent due to the buffer limitation of the sending station or the receiving Unit [ms]: 100 to 16383000*1
station. Set the waiting time for the divided data in such a case. (Default: 5s)

*1 Set in increments of 100ms.

2 PARAMETER SETTINGS
2.3 Application Settings 281
 Precautions for settings
■Setting value for each timer of the Ethernet-equipped module side.
Set the timer values so that the following formula is met.

Response TCP IP
monitoring timer ≥ TCP ULP ≥ TCP end ≥ resend > assembly
value timer value timer value timer value timer value

TCP resend TCP zero window

=
timer value timer value

When connecting Mitsubishi products to the line, configure the same settings for both modules.

■Setting value for each timer of the external device side.

Set the timer values so that the following formula is met. The frequency of a communication error, such as a transmission
timeout, may be higher if the timer values do not meet the formula.

TCP ULP timer TCP resend timer value

value on the external > on the Ethernet-equipped
device module

Monitoring timer value of the TCP ULP timer value on

application software on the external > the Ethernet-equipped × n*1
device module

*1 "n" is the number of TCP segment transmission and is calculated by the following formula.

Message size sent by the Ethernet-equipped module

n = A value that is rounded up to the nearest integer
Maximum Segment size

Ex.
The number of TCP segment transmission when communications are performed on the same line
The Maximum Segment Size is 1460 bytes on the same line (without a router) and the number of TCP segment transmissions
is as follows.
• n = 1 when the size of the message sent by the Ethernet-equipped module is 1460 bytes or less
• n = 2 when the size of the message sent by the Ethernet-equipped module is greater than 1460 bytes

Ex.
The number of TCP segment transmission when communications are performed on a different line
The Maximum Segment Size is at least 536 bytes on another line (via a dialup router or other communication device) and the
number of TCP segment transmissions is as follows.
• n = 1 when the size of the message sent by the Ethernet-equipped module is 536 bytes or less
• n = 2 when the size of the message sent by the Ethernet-equipped module is greater than 536 bytes and no more than
1072 bytes
• n = 3 when the size of the message sent by the Ethernet-equipped module is greater than 1072 bytes and no more than
1608 bytes

2 PARAMETER SETTINGS
282 2.3 Application Settings
■Number of retries
When a communication failure occurs due to a problem such as noise, change the value so that the number of retries may
increase. The number of retries is obtained using the following formula. (When using the default values, 3 = 30  10)
Number of retries = TCP ULP timer value  TCP resend timer value

Ex.
When the number of retries is three and data sending fails, a data sending error occurs at the timing shown in the figure below 2
(in communications using the fixed buffer).

BUFSND instruction

1 scan

BUFSND instruction
Completion device + 1

RJ71EN71

Data 1st retry 2nd retry 3rd retry

command

A A A

TCP ULP timeout value

A: TCP resend timer value (The time at which data are sent when ACK is not returned after data transmission)

When not performing the above retry process (when setting 0 time), configure the setting so that the following formula is met.
TCP ULP timer value = TCP end timer value = TCP resend timer value
(Set the same value for the timer values.)

2 PARAMETER SETTINGS
2.3 Application Settings 283
 Security
Set the security measures for access to the Ethernet-equipped module.
Item Description Setting range
IP Filter IP Filter Set whether to enable the IP filter. • Not Use
Settings • Use
(Default: Not Use)
IP Filter Settings Set the IP address to be allowed or denied. ( Page 284 IP Filter 
Settings)
Disable Direct Connection with MELSOFT Set whether enable or disable direct connection to the engineering tool. • Disable
• Enable
(Default: Enable)
Do Not Respond to CPU Module Search Select whether to respond to the CPU module search. • Do Not Respond
• Respond
(Default: Respond)

IP Filter Settings
Up to 32 IP addresses can be set as an IP address to be allowed or denied by the IP filter.
Range specification and specification of the IP addresses to be excluded from the set range are also possible.
Item Description Setting range
Access from IP address below Select whether to allow or deny the access from the specified IP • Allow
addresses. • Deny
(Default: Allow)
Range Setting Select this item when specifying the IP addresses by range. (Default: Clear)
IP Address Set the IP address to be allowed or denied. 0.0.0.1 to 223.255.255.254
When selecting "Range Setting", enter the start IP address (left field) (Default: Blank)
and end IP address (right field) of the range.
IP Address Excluded from Range When selecting "Range Setting", set the IP address to be excluded 0.0.0.1 to 223.255.255.254
from the set range. (Default: Blank)
Up to 32 IP addresses can be set.

Gateway Parameter Settings

With gateway parameter settings, the Ethernet-equipped module can communicate with external devices on other Ethernet
networks via a router and gateway. One default router and up to eight routers can be set.
Item Description Setting range
Gateway Other Than Default Gateway Set to communicate with an external device on the other Ethernet via a • Use
router. • Not Use
(Default: Not Use)
Gateway No.1 to No.8 Set the information of the gateway other than the default gateway. 
Information ( Page 285 Gateway Information)

Set the default gateway when communicating via the default gateway. ( Page 262 Own Node Settings)

2 PARAMETER SETTINGS
284 2.3 Application Settings
Gateway Information
■Gateway IP Address
When communicating with an external device on another Ethernet network through a gateway other than the default gateway,
set the IP address of the gateway. (Setting range: 0.0.0.1 to 223.255.255.254)
Set a value that satisfies the following conditions. 2
• The IP address class is any of A, B, and C.
• The subnet address of the gateway is the same as that of the Ethernet-equipped module on the own station.
• The host address bits are not all "0" or all "1".

• When the Ethernet-equipped module communicates with an external device on another Ethernet network
by Passive open, communication is possible without gateway parameter settings.
• In a system where the Proxy router is used, the gateway parameter settings are not required.

■Subnet Address
When communicating with an external device on another Ethernet network through a gateway other than the default gateway,
set the network address*1 or subnet address*2 of the external device. (Setting range: 0.0.0.1 to 255.255.255.254)
Set a value that satisfies the following conditions.
• The IP address class is any of A, B, and C.
• The host address bits are all "0".
*1 Set the network address of the external device when its class (network address) is different from that of the Ethernet-equipped module
on the own station.
*2 Set the network address of the external device when its class (network address) is the same as that of the Ethernet-equipped module on
the own station.

Own station
Class B
IP address: 81052F01H(129.5.47.1)
Subnet mask: FFFFFC00H (255.255.252.0)

Ethernet 4

Router 1 Router 2 Router 3

Ethernet 1 Ethernet 2 Ethernet 3

Setting example 1 Setting example 2 Setting example 3

External device 1 External device device 2 External device 3
Class B Class A Class B
IP address: 81044001H (129.4.64.1) IP address: 71044001H (113.4.64.1) IP address: 81052902H (129.5.41.2)

Ex.
When the network addresses differ between the Ethernet-equipped module on the own station and the external device

Network address

81H 05H 2FH 01H

Own station
IP address (Class B) 1 0 0 0 0 0 0 1 0 0 0 0 0 1 0 1 0 0 1 0 1 1 1 1 0 0 0 0 0 0 0 1

81H 04H 40H 01H

External device 1
IP address (Class B) 1 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1

Set the network address of the external device 1.

Network address

81H 04H 00H 00H

Subnet address setting value 1 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

2 PARAMETER SETTINGS
2.3 Application Settings 285
 Ex.
When the classes differ between the Ethernet-equipped module on the own station and the external device

Network address

81H 05H 2FH 01H

Own station
IP address (Class B) 1 0 0 0 0 0 0 1 0 0 0 0 0 1 0 1 0 0 1 0 1 1 1 1 0 0 0 0 0 0 0 1

71H 04H 40H 01H

External device 2
IP address (Class A) 0 1 1 1 0 0 0 1 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1

Set the network address of the external device 2.

Network address

71H 00H 00H 00H

Subnet address setting value 0 1 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

Ex.
When the network address of the Ethernet-equipped module on the own station is the same as that of the external device

Network address

Own station 81H 05H 2FH 01H

IP address (Class B) 1 0 0 0 0 0 0 1 0 0 0 0 0 1 0 1 0 0 1 0 1 1 1 1 0 0 0 0 0 0 0 1

FFH FFH FCH 00H

Subnet mask 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0

81H 05H 29H 02H

External device 3
IP address (Class B) 1 0 0 0 0 0 0 1 0 0 0 0 0 1 0 1 0 0 1 0 1 0 0 1 0 0 0 0 0 0 1 0

Set the subnet address of the external device 3.

Subnet address

81H 05H 28H 00H

Subnet address setting value 1 0 0 0 0 0 0 1 0 0 0 0 0 1 0 1 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0

Network/Station No. <-> IP information setting

Set to communicate with another network module or CPU module by network number and station number.
Communication in Ethernet is performed according to the IP address and UDP port number, and access to another network is
performed according to the network number and station number.
Therefore, when the Ethernet-equipped module accesses another network, the IP address and UDP port number must be
converted into the network number and station number of the network.
Item Description Setting range
Setting System Select the system to obtain the IP address and port number of the • Automatic Response System
external device from its network number and station number. ( • IP Address Calculation System
Page 287 Setting system) • Table Conversion System
• Combination System
(Default: Automatic Response
System)
Subnet Mask Pattern Set the subnet mask pattern. ( Page 292 Subnet Mask Pattern) • Blank
• 0.0.0.1 to 255.255.255.255
(Default: Blank)
Conversion Settings Set the information of the external device. ( Page 293 Conversion 
Settings)

2 PARAMETER SETTINGS
286 2.3 Application Settings
 • When transferring messages which are sent to other stations specifying network number and station
number, to another network, "Gateway Parameter Settings" in "Application Settings" is required. ( Page
284 Gateway Parameter Settings)
• "Network/Station No. <-> IP information setting" is required when other stations are accessed via other
Ethernet network systems and must be registered in all the Ethernet-equipped module which has the 2
network number and station number.
• The setting can be made in the CPU module (built-in Ethernet port part) if it has the firmware version
supporting communications by network number/station number. ( Page 436 Added and Enhanced
Functions)

Setting system
Select the system to obtain the IP address and port number of the external device from its network number and station
number.
There are four methods as shown below. The items required to be set ("Subnet Mask Pattern" and "Conversion Settings")
differ depending on the method.
: Setting is required, : Setting is not required
Setting system Subnet mask pattern Conversion settings
Automatic Response System  
IP Address Calculation System  
Table Conversion System  
Combination System  

• In MELSOFT connection using UDP/IP, if the external device is not registered in the conversion table of
table conversion system, the Ethernet-equipped module communicates with the device using the automatic
response system. Therefore, even when both of communications with different networks using the link
dedicated instruction and MELSOFT connection are performed simultaneously, the Ethernet-equipped
module can communicate with the external device in MELSOFT connection regardless of the registered
data in the conversion table.
• If the IP address and port number cannot be retrieved when IP address calculation system, table conversion
system, or combination system is set, the Ethernet-equipped module will retrieve them using the automatic
response system and send a response to the external device.

2 PARAMETER SETTINGS
2.3 Application Settings 287
 ■Automatic Response System
This system differs from the other conversion method in that specification can only be made when the own station is the
communication request destination station or communication relay receiving station.
Relay communications via other networks can be performed easily because the IP address and port number of the destination
station are not required to be set.

Communication request source station

CPU RJ71
module EN71

Ethernet

Communication relay receiving station Communication relay sending station

CPU RJ71 RJ71

module EN71 EN71

The automatic response

system can be set. Ethernet

CPU RJ71
module EN71

Communication request destination station

Communication relay station

Communication
Previous request message Communication Communication Next
relay receiving relay sending Response
station station station station
message

Conversion processing of the automatic response system is as below.

• When receiving the communication request message (command frame), the Ethernet-equipped module internally stores
the send source network number, IP address, and UDP port number in the request message, as the station information.
The response message (response) for the communication request message is returned to the destination IP address and
UDP port number calculated from the stored network number and station number. Therefore, by receiving the other station
access communication request message first, the communication destination stations can be maintained.
• The maximum number of station information that can be set is 120. When more than 120 other station access
communication request messages are received, the Ethernet-equipped module starts deleting from the oldest data to store
the station information in the newly received message communication request message. However, it is ignored if the station
information is the same as the station information already stored. (Information from the same station is not stored twice.)

2 PARAMETER SETTINGS
288 2.3 Application Settings
■IP Address Calculation System
This system obtains the IP address of the destination station by calculating the network number and station number with the
formula described below. The UDP port number predefined for the Ethernet-equipped module is used as the UDP port
number of the destination.

2
Net mask pattern for
IP address Logical CC-Link IE Controller Network, Logical Network number
IP address of the partner station = of the own CC-Link IE Field Network, and station number
station product MELSECNET/H, MELSECNET/10 sum of the destination
routing

Conversion processing of the IP address calculation system is as below.

• When a communication request message (command frame) to access other station is received, the IP address is
calculated from the network number and station number of the destination in the communication request message, which
are stored in the Ethernet-equipped module, and the communication request message is sent to the next station (relay
station or destination station).
• The response message (response) for the communication request message is returned based on the return IP address and
the stored data above.

Ex.
IP address calculation example
The logical product and logical sum are calculated differently depending on the class of the own station IP address. An IP
address is calculated as follows.
(For class A)
• When the own station IP address is 79238102H
• When the net mask pattern for routing other networks is FF000000H
• When the destination network number is 03H, and the station number is 05H

Own station IP Address 7 9 . 2 3 . 8 1 . 0 2

Net Mask Pattern Logical product F F . 0 0 . 0 0 . 0 0

Logical product value 7 9 . 0 0 . 0 0 . 0 0

Network No. and station No. Logical sum 0 3 . 0 5

Partner station IP Address 7 9 . 0 0 . 0 3 . 0 5

(For class B)
• When the own station IP address is 8438FA0AH
• When the net mask pattern for routing other networks is FFFF0000H
• When the destination network number is 03H, and the station number is 05H

Own station IP Address 8 4 . 3 8 . F A . 0 A

Net Mask Pattern Logical product F F . F F . 0 0 . 0 0

Logical product value 8 4 . 3 8 . 0 0 . 0 0

Network No. and station No. Logical sum 0 3 . 0 5

Partner station IP Address 8 4 . 3 8 . 0 3 . 0 5

2 PARAMETER SETTINGS
2.3 Application Settings 289
 (For class C)
• When the own station IP address is CA65300AH
• When the net mask pattern for routing other networks is FFFFFF00H
• When the destination station number is 02H (The network number is not used.)

Own station IP Address C A . 6 5 . 3 0 . 0 A

Net Mask Pattern Logical product F F . F F . F F . 0 0

Logical product value C A . 6 5 . 3 0 . 0 0

Network No. and station No. Logical sum 0 2

Partner station IP Address C A . 6 5 . 3 0 . 0 2

• IP address configuration of class A

31 30 ⋅⋅⋅ 24 23 ⋅⋅⋅ 16 15 ⋅⋅⋅ 0
Network
Class address Host address

• IP address configuration of class B

31 30 29 ⋅⋅⋅ 16 15 ⋅⋅⋅ 0
Class Network address Host address

• IP address configuration of class C

31 ⋅⋅⋅ 29 28 ⋅⋅⋅ 8 7 ⋅⋅⋅ 0
Class Network address Host address

■Table Conversion System

This system uses the network number, station number, IP address set in the conversion table of the Network/Station number
<-> IP information. The UDP port number predefined for the Ethernet-equipped module is used as the UDP port number of the
destination.
If duplicate network and station numbers are set in the conversion table, the data set with the younger registration number is
used.
If no data is registered in the conversion table, communication may not be performed successfully.
Conversion processing of the table conversion system is as below.
• When a communication request message (command frame) to access other station is received, the same network number
and station number are searched in the conversion table of the Network/Station No. <-> IP information, and the
communication request message is sent to the destination station with the corresponding IP address.
• The response message (response) for the communication request message is returned based on the return IP address and
the data in the conversion table above.

2 PARAMETER SETTINGS
290 2.3 Application Settings
Ex.
Conversion table registration example
The following shows the example of conversion table registration based on the network map.

(1) Communication request source station

2
CPU RJ71 Network No.: 1
module EN71 Station No.: 11
IP Address: (192. 0. 1. 11)

Ethernet (Network No.1)

(2) Communication relay receiving station (3) Communication relay sending station

Network No.: 1 CPU RJ71 RJ71 Network No.: 2

Station No.: 12 module EN71 EN71 Station No.: 21
IP Address: (192. 0. 1. 12) IP Address: (192. 0. 2. 21)

Ethernet (Network No.2)

CPU RJ71 Network No.: 2

module EN71 Station No.: 22
IP Address: (192. 0. 2. 22)

(4) Communication request destination station

(a): For communication request message transmission, b): For response message transmission
Item Setting details of each Ethernet-equipped module when accessing from (1) to (2)
(1) Communication (2) (3) (4)
request source
station (a)
Setting Network No., Station No. 1, 12 Setting not required Setting not required Setting not required
value
IP Address 192.0.1.12
(decimal)

Item Setting details of each Ethernet-equipped module when accessing from (1) to (4)
(1) Communication (2) Communication (3) Communication (4) Communication
request source relay receiving relay sending station request destination
station (a) station (b) (a) station (b)
Setting Network No., Station No. 1, 12 1, 11 2, 22 2, 21
value IP Address 192.0.1.12 192.0.1.11 192.0.2.22 192.0.2.21
(decimal)

Item Setting details of each Ethernet-equipped module when accessing from (2) to (1)
(1) (2) Communication (3) (4)
request destination
station (a)
Setting Network No., Station No. Setting not required 1, 11 Setting not required Setting not required
value
IP Address 192.0.1.11
(decimal)

Item Setting details of each Ethernet-equipped module when accessing from (3) to (4)
(1) (2) (3) Communication (4)
relay sending station
(a)
Setting Network No., Station No. Setting not required Setting not required 2, 22 Setting not required
value
IP Address 192.0.2.22
(decimal)

Item Setting details of each Ethernet-equipped module when accessing from (4) to (1)
(1) Communication (2) Communication (3) Communication (4) Communication
request source relay sending station relay receiving request destination
station (b) (a) station (b) station (a)
Setting Network No., Station No. 1, 12 1, 11 2, 22 2, 21
value IP Address 192.0.1.12 192.0.1.11 192.0.2.22 192.0.2.21
(decimal)

2 PARAMETER SETTINGS
2.3 Application Settings 291
 Item Setting details of each Ethernet-equipped module when accessing from (4) to (3)
(1) (2) (3) (4) Communication
request destination
station (a)
Setting Network No., Station No. Setting not required Setting not required Setting not required 2, 21
value
IP Address 192.0.2.21
(decimal)

■Combination System
This system combines the IP address calculation system and the table conversion system.
Select this system when accessing other stations with the same network number, accessing other stations in other networks
or Ethernet with different network number, or relaying from other networks to the Ethernet network system.
The set target Ethernet-equipped module can be installed either at a communication request source station, communication
relay station, or communication request destination station.
Conversion processing of the combination system is as below.
• When a communication request message (command frame) to access other station is received, the communication request
message is sent to the next station obtained by the table conversion system at first.
• If the IP address of the external device cannot be retrieved by the table conversion system, the IP address is retrieved by
the IP address calculation system to send the communication request message.
• The response message (response) to the communication request message is returned based on the return IP address and
data in the conversion table, or the stored data.
The relationship between the conversion method and the definition of the Ethernet-equipped module mounted station is as
follows.
: Can be set, : Cannot be set
Conversion method Ethernet-equipped module mounted station definition
Communication Communication relay station Communication
request source station Relay receiving station Relay sending station request destination
station
Automatic Response System *1  *1 
IP Address Calculation    
System
Table Conversion System    
Combination System    

*1 For the external device that completed the communication, the station can be a communication request source station or a relay sending
station.

Subnet Mask Pattern

Specify the mask value based on the guidelines given below. This pattern is used in a logical sum with the own station IP
address when calculating the IP address of the external device using the IP address calculation system.
When setting the subnet mask, specify the target settings of the IP address class, network address, and subnet address so
that all bits are "1" in the mask pattern.
Specify the mask pattern with a decimal/hexadecimal value obtained by dividing the 32-bit mask value into 8-bit segments.
When the subnet mask is not specified, the mask pattern setting is not necessary. The following mask value is used as the
mask pattern according to the own station IP Address class.
Class Mask value used
Class A FF.00.00.00H
Class B FF.FF.00.00H
Class C FF.FF.FF.00H

2 PARAMETER SETTINGS
292 2.3 Application Settings
Conversion Settings
The conversion setting is required to obtain the IP address from the network number and station number using the table
conversion system.
If the own station is an Ethernet-equipped module and the next station to which the communication request/response
message is passed to access other station is also an Ethernet-equipped module, specify the network number, station number,
2
and IP address of the Ethernet-equipped module of the next station.

Interrupt Settings
Set the parameters required for starting up an interrupt program.
Item Description Setting range
Interrupt Occurrence Factor Set the interrupt cause.*2 • SEND Instruction Data Reception*3
• Reception Connection
(Default: Blank)
Channel No./Connection No. Set the start condition of an interrupt program. When "Interrupt • SEND Instruction Data Reception: 1
Occurrence Factor" is set to "SEND Instruction Data Reception", set to 8
the number of the channel which receives send data. • Reception Connection: 1 to 64*1
When "Interrupt Occurrence Factor" is set to "Reception Connection", (Default: Blank)
set the number of the connection which receives send data.
Detection Method The detection method for the interrupt condition is displayed when Edge
"Interrupt Occurrence Factor" is set. (Default: Blank)
Interrupt Pointer Set an interrupt pointer (device (I)) to be used for a program. Device: I0 to I15, I50 to I1023
(Default: Blank)
Comment Set a comment for the interrupt pointer used, if required. 256 one-byte characters maximum
(Default: Blank)

*1 When "Q Compatible Ethernet" is selected in the network type, the setting range is 1 to 16.
*2 An interrupt program is started when the receive data is stored in the channel or connection specified in "Channel No./Connection No.".
*3 When selecting "SEND Instruction Data Reception", set "Communications by Network No./Station No." under "Own Node Settings" of
"Basic Settings" to "Enable", and set the network number and station number.

Maximum number of interrupt settings can be set to one module (sum of the settings for the P1 connector and
the P2 connector) is 16.
Setting number of the interrupt settings is shared in P1 connector and P2 connector.
For example, when SI00 is set on the P1 connector side, SI00 on the P2 connector side cannot be set.

IP Packet Transfer Setting

Set when using the IP packet transfer function.
The IP packet transfer function enables the Ethernet device (such as computers) connected to the Ethernet-equipped module
to communicate with the device on other networks that has an IP address via CC-Link IE Field Network or CC-Link IE
Controller Network.
To use this function, set "IP Packet Transfer Function" to "Not Use". (Default: Not Use)
For details on the IP packet transfer function, refer to the following.
•  MELSEC iQ-R CC-Link IE Controller Network User's Manual (Application)
•  MELSEC iQ-R CC-Link IE Field Network User's Manual (Application)

If the application timeout of the request source device occurs due to a heavy communication load on the path
that an IP packet takes, measure the response time using the PING command from the request source device
and adjust the application timeout time. Data size must be within 1460 bytes when the PING command is
used.

2 PARAMETER SETTINGS
2.3 Application Settings 293
 Network Dynamic Routing
Set when using the dynamic routing.
Setting "Network Dynamic Routing" is possible only when values are set in "Network No." and "Station No." under "Own Node
Settings" of "Basic Settings". ( Page 263 Details of items)
For details, refer to the following.
Page 407 Communications with Different Networks

• When the communication path is set in "Routing Setting" of "CPU Parameter", setting of "Routing Setting"
has a priority.
• When enabling dynamic routing, do not connect the CPU module (built-in Ethernet port part) and the
Ethernet-equipped module on the same Ethernet using a hub or other means.

Module Operation Mode

Set the module operation mode.
Set the same operation mode for both of the P1 connector and P2 connector.
For a redundant system, select the module operation mode of system A.
For details on module communication test mode, refer to the following.
Page 302 Module communication test
Item Description Setting range
Module Operation Mode Online • Online
• Normal operation mode • Offline
Offline • Module Communication Test
• Communication with other stations and dedicated instruction cannot (Default: Online)
be performed in this mode. Select this mode to debug the program
while the network is not yet connected.
Module Communication Test
• A mode for operating the module communication test. Select this
mode to check the operation when the module is in abnormal
condition.

When different operation modes are set for the P1 connector and P2 connector, the Ethernet-equipped module operates with
the following operation modes.
Module Operation Mode Operation mode of Ethernet-equipped
P1 connector P2 connector module

Online Offline Offline

Module Communication Test Module Communication Test
Offline Online Offline
Module Communication Test Module Communication Test
Module Communication Test Online Module Communication Test
Offline

2 PARAMETER SETTINGS
294 2.3 Application Settings
Redundant System Settings
Set when using an Ethernet-equipped module in a redundant system.
Item Description Setting range
To Use or Not to Use Redundant Select whether to use the redundant function or not. • Use
System Settings Set the same setting for port 1 and port 2.
Select "Use" when installing the RJ71EN71 to the main base unit.
• Not Use
(Default: Use)
2
Select "Not Use" when installing the RJ71EN71 to the extension base unit.
Own Node (System A) IP The IP address set in "Own Node Settings" under "Basic Settings" is displayed. 
Address Not displayed when it has not been set.
System B IP Address Set the IP address of system B. • Blank
Ensure that this address has the same class and subnet address as "Own • 0.0.0.1 to 223.255.255.254
Node (System A) IP Address". (Default: Blank)
When the parameters are written without the IP address set (blank), the
following IP address is set.
• P1 connector of RJ71EN71: 192.168.3.42
• P2 connector of RJ71EN71: 192.168.4.42
• CPU module (built-in Ethernet port part): 192.168.3.41
Own Node (System A) Station The station number set in "Own Node Settings" under "Basic Settings" is 
Number displayed.
Not displayed when it has not been set.
System B Station Number*1 Set the system B station number. 1 to 120
Set when the station number is set in "Own Node Settings" under "Basic (Default: 2)
Settings".
Use of Control System IP Set whether to use the control system IP address or not. • Not Use
Address*2 • When "Use" is selected, set the control system IP address. When the control • Use
system IP address is used, access using the control IP address is possible (Default: Not Use)
even if system switching occurs.
• When "Not Use" is selected, access is made using the own node (system A)
or system B IP address.
When the RJ71EN71 is used, pay attention to the following.
• When using port group settings, the setting for "Use of Control System IP
Address" should be the same for port 1 and port 2.
Control System IP Address*2 Set the control system IP address. Set the address after setting "Use" to "Use • Blank
of Control System IP Address". • 0.0.0.1 to 223.255.255.254
Set so that the IP address has the same class and subnet address as the IP (Default: Blank)
addresses used in the system. Consult with the network manager for the IP
address setting.
Set the IP address not to overlap the one used in the system.
Set the IP address class within the range of classes A, B and C.
Set the same control system IP address for system A P1 and system B P1, or
for system A P2 and system B P2.
Own Node (System A) Module The module operation mode set for "Module Operation Mode" under 
Operation Mode "Application Settings" is displayed.
System B Module Operation Set the module operation mode of system B. • Online
Mode*1 For details on the module operation mode, refer to the following. • Offline
Page 294 Module Operation Mode • Module Communication Test
(Default: Online)
Port Group Setting*1*2 Set the port group. • No Setting
Set the same value for port 1 and port 2. • Switch Systems When a System
If "No Setting" is selected, when a system switching error occurs on either port, Switching Error Occurs in Port 1
performs system switching. • Switch Systems When a System
This setting is not available when "Q Compatible Ethernet" is set for the Switching Error Occurs in Port 2
RJ71EN71 network type. • Switch Systems When a System
Switching Error Occurs in Both of Port
1 and Port 2
(Default: No Setting)
System Switching Request Set whether to issue a system switching request when a cable disconnection is • Enable
Issuing at Disconnection detected. • Disable
Detection*1 (Default: Enable)
Disconnection Detection Set the time between cable disconnection detection after communication starts Unit [s]: 0.0 to 30.0
Monitoring Time*1 normally and issuance of a system switching request to the control system CPU Unit [ms]: 0 to 30000 (in increments of
module. 100ms)
(Default: 2s)

2 PARAMETER SETTINGS
2.3 Application Settings 295
 Item Description Setting range
System Switching Request Set whether to issue a system switching request when a communication error • Enable
Issue at Communication Error*1 occurs. • Disable
(Default: Disable)
User Connection*1 Set the connection for issuance of a system switching request when a • Not to Issue
communication error occurs, from the connections set in "External Device • Issue
Configuration" under "Basic Settings". (Default: Not to Issue)
By setting the comment for the connection device in "External Device
Configuration" under "Basic Settings", the connection can be easily identified.
( Page 264 External Device Configuration)
System Connection*1 Set whether to issue a system switching request when a communication error occurs for each port. Set this item after setting
"Enable" to "System Switching Request Issue at Communication Error". Page 296 System connection

*1 This setting is not available for the CPU module (built-in Ethernet port part).
*2 This setting is not available when the RJ71EN71 network type is set to "Q Compatible Ethernet".

System connection
Set "Enable" to "System Switching Request Issue at Communication Error" before setting the following items.
Item Description Setting range
Auto-open Set whether to issue a system switching request using the auto open UDP port when a • No System Switching Request at
UDP Port communication error occurs. This port is used for SLMP communications. Communication Error
This setting is enabled when the following conditions are met. • System Switching Request at
• The remote password setting is enabled. Communication Error
• The remote password is unlocked. (Default: No System Switching Request
When the above conditions are not met, even if a communication error occurs in the target at Communication Error)
connection, a system switching request will not be issued.
MELSOFT Set whether to issue a system switching request using the MELSOFT transmission port (UDP/ • No System Switching Request at
Transmission IP) when a communication error occurs. This port is used for UDP/IP communications with Communication Error
Port (UDP/IP) MELSOFT products. • System Switching Request at
This setting is enabled when the following conditions are met. Communication Error
• The remote password setting is enabled. (Default: No System Switching Request
• The remote password is unlocked. at Communication Error)
When the above conditions are not met, even if a communication error occurs in the target
connection, a system switching request will not be issued.
When "System Switching Request at Communication Error" is selected, a system switching
request is issued when a communication error occurs in the following ports.
• Port used for communications using a dedicated instruction
• Relay transmission port with other networks
• MELSOFT direct connection port
• Direct connection port with the engineering tool
When "No System Switching Request at Communication Error" is selected, even if a
communication error occurs in any of the above ports, a system switching request will not be
issued.
MELSOFT Set whether to issue a system switching request using the MELSOFT transmission port (TCP/ • No System Switching Request at
Transmission IP) when a communication error occurs. This port is used for TCP/IP communications with Communication Error
Port (TCP/IP) MELSOFT products. • System Switching Request at
Communication Error
(Default: No System Switching Request
at Communication Error)
FTP Set whether to issue a system switching request using the FTP transmission port (TCP/IP) when • No System Switching Request at
Transmission a communication error occurs. This port is used for the file transfer function (FTP server). Communication Error
Port (TCP/IP) • System Switching Request at
Communication Error
(Default: No System Switching Request
at Communication Error)
Simple CPU Set whether to issue a system switching request using the simple CPU communication port • No System Switching Request at
communication when a communication error occurs. This port is used for the simple CPU communication Communication Error
port function. • System Switching Request at
Communication Error
(Default: No System Switching Request
at Communication Error)

2 PARAMETER SETTINGS
296 2.3 Application Settings
Precautions on simple CPU communication
Before using the simple CPU communication in a redundant system, check the following.

■Redundant system settings

To execute system switching when a communication error (alive check error and ULP timeout) is detected, set the following
items in "Redundant System Settings" under "Application Settings". ( Page 240 Communication error detection) 2
• "System Switching Request Issue at Communication Error": Enable
• "Simple PLC Communication Port under System connection": System Switching Request at Communication Error (
Page 296 System connection)
System switching is executed only when a communication error occurs. When the following errors occur, system switching is
not executed.
• CFB4H: An abnormal response was received from the external device.
• CFB5H: The frame received from the external device is incorrect.
When the simple CPU communication have never been executed, system switching is not executed even if a communication
error occurs.

■Operation during system switching

Depending on "Communication Setting: Execution Interval (ms)" in "Simple PLC Communication Setting" under "Application
Settings", system switching operates in the following manner.
Communication Operation
setting
Fixed interval Communications stop temporarily during system switching and restart automatically from the new control system.
On Request In the same manner as in the normal operation start, when Request to start communication at request (Un\G721896 to Un\G721899,
Un\G1247300 to Un\G1247327) of each setting numbers is turned on under the following status after system switching is completed,
communications restart.
• Preparation completion (Un\G721912 to Un\G721915, Un\G1247412 to Un\G1247439) for each setting number is turned on: Ready
• Simple CPU communication status (Un\G721936 to Un\G721999, Un\G1247460 to Un\G1247907) for each setting number is 2:
Waiting for request

2 PARAMETER SETTINGS
2.3 Application Settings 297
 3 TROUBLESHOOTING
This chapter describes troubleshooting of when the Ethernet function is used.

3.1 Checking with LED

This section describes troubleshooting using LED.
Error status can be determined by status of the RUN LED and the ERR LED.
RUN LED ERR LED Error status*1 Description
Off On, flashing Major error An error such as hardware failure or memory failure. The module stops operating.
On Flashing Moderate error An error, such as parameter error, which affect module operation. The module stops operating.
On On Minor error An error such as communication failure. The module continues operating.

*1 When multiple errors occur, the error status is displayed in the order of major, moderate, and minor.

For the RJ71EN71 or RnENCPU, whether the error occurs in the P1 or P2 can be checked with P ERR LED.

When the RUN LED or READY LED turns off

When the READY LED of the CPU module turns off after power-on, refer to the troubleshooting of the CPU module. (
MELSEC iQ-R CPU Module User's Manual (Application))
When the RUN LED of the RJ71EN71 or RnENCPU turns off, check the following.
Check item Action
Is the Ethernet-equipped module mounted correctly? Securely mount the Ethernet-equipped module on the base unit.

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)

When the ERROR LED or ERR LED turns on or is flashing

When the ERROR LED of the CPU module turns on or is flashing, perform the module diagnostics of the CPU module.
[Diagnostics]  [Module Diagnostics (CPU Diagnostics)]
When the ERR LED of the RJ71EN71 or RnENCPU turns on or is flashing, identify the error cause using the engineering tool.
( Page 300 Checking the Module Status)
If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)

3 TROUBLESHOOTING
298 3.1 Checking with LED
When the SD/RD LED does not turn on at data sending
When the SD/RD LED does not turn on at data sending, check the following items.
Check item Action
Is the ERROR LED or ERR LED on or flashing? Identify the error cause using the engineering tool. ( Page 300 Checking
the Module Status,  Page 304 Checking the Network Status).
Are the cables properly connected? Correct the cable properly.
Perform the following tests to check for the status of the cable connection and
line.
• PING test ( Page 309 PING Test)
• Communication status test ( Page 310 Communication Status Test)
3
Is the program correct? Check and correct the send program of the Ethernet-equipped module.

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)*1
*1 The module communication test cannot be performed for the CPU module (built-in Ethernet port part). Perform the troubleshooting of
the CPU module and check for hardware failure. ( MELSEC iQ-R CPU Module User's Manual (Startup))

When data cannot be received with the SD/RD LED off

When data cannot be received with the SD/RD LED off, check the following.
Check item Action
Is the ERROR LED or ERR LED on or flashing? Identify the error cause using the engineering tool. ( Page 300 Checking
the Module Status,  Page 304 Checking the Network Status).
Are the cables properly connected? Correct the cable properly.
Perform the following tests to check for the status of the cable connection and
line.
• PING test ( Page 309 PING Test)
• Communication status test ( Page 310 Communication Status Test)
Are the parameter settings correct? Check the module parameters of the Ethernet-equipped module. Correct the
value for the following setting if it is wrongly set.
• "IP Address" under "Own Node Settings" of "Basic Settings"
• "Gateway Parameter Settings" of "Application Settings"
Page 261 PARAMETER SETTINGS
Is the program correct? Check and correct the send program of the external device.

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)*1
*1 The module communication test cannot be performed for the CPU module (built-in Ethernet port part). Perform the troubleshooting of
the CPU module and check for hardware failure. ( MELSEC iQ-R CPU Module User's Manual (Startup))

When the L ER LED turns on

When the L ER LED turns on, check the following.
Check item Action
Are the Ethernet cables used normally? • Check if the Ethernet cable which conforms the standard is used. (
MELSEC iQ-R Ethernet/CC-Link IE User's Manual (Startup))
• Check if the station-to-station distance is set within range. ( MELSEC
iQ-R Ethernet/CC-Link IE User's Manual (Startup))
• Check if the Ethernet cables are not disconnected.
Does the cabling condition (bending radius) meet the specifications? Refer to the manual for the Ethernet cable, and correct the bending radius.
Is the hub used operating normally? • Check if the hub which conforms the standard is used. ( MELSEC iQ-R
Ethernet/CC-Link IE User's Manual (Startup))
• Power off and on the hub.
Is there any source of noise near the module or cables? Change the location of the module or cables.

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)

3 TROUBLESHOOTING
3.1 Checking with LED 299
 3.2 Checking the Module Status
The following table lists the functions which can be used in the "Module Diagnostics" window of the Ethernet-equipped
module.
Functions Applications
Error Information Displays the details of the errors currently occurring.
Click the [Event History] button to check the history of errors that have
occurred on the network, errors detected for each module, and operations that
have been executed.
Module information list Displays various status information of the Ethernet-equipped module
Supplementary Function Ethernet Diagnostics Enables checking the cause to resolve the problem when an error occurs in
the Ethernet system. ( Page 304 Checking the Network Status)

Error Information
Check the details of the error currently occurring and action to remove the error.

Item Description
Status Major: An error such as hardware failure or memory failure. The module stops operating.
Moderate: An error, such as parameter error, which affect module operation. The module stops operating.
Minor: An error such as communication failure. The module continues operating.
Detailed Information Displays detailed information about each error (maximum of 3 pieces).
Cause Displays the detailed error causes.
Corrective Action Displays the actions to eliminate the error causes.

3 TROUBLESHOOTING
300 3.2 Checking the Module Status
Module Information List
Switch to the [Module Information List] tab to check various status information of the Ethernet-equipped module. (The
displayed items vary depending on the module.)

Item Description
LED information Displays the LED status of the Ethernet-equipped module.
Individual information (P1: Network Number Displays the network number set for the selected module.
Ethernet)*1
Station Number Displays the station number set for the selected module.
Transient transmission group No. Displays the transient transmission group number set for the selected module.
Send Frame Displays the send frame setting set for the selected module.
Jumbo Frame Displays the jumbo frame setting set for the selected module.
Communication speed setting Displays the communication mode set for the selected module.
IP address (1st octet) to IP address Displays the IP address set for the selected module.
(4th octet)
Control system IP address (1st octet) Displays the control system IP address set for the selected module.
to Control system IP address (4th
octet)
MAC address (1st octet) to MAC Displays the MAC address of the selected module.
address (6th octet)
Individual information (P2: Ethernet)*1 (Same as the P1 connector)

*1 This item is displayed when the network type is set to "Ethernet".

For when the network type is set to "CC-Link IE Control", refer to the following.
 MELSEC iQ-R CC-Link IE Controller Network User's Manual (Application)
For when the network type is set to "CC-Link IE Field", refer to the following.
 MELSEC iQ-R CC-Link IE Field Network User's Manual (Application)

3 TROUBLESHOOTING
3.2 Checking the Module Status 301
 Module communication test
The module communication test checks the hardware of the RJ71EN71 or the RnENCPU (network part). When the
communication using the RJ71EN71 or the RnENCPU (network part) is unstable, whether a hardware failure occurs or not
can be checked.
The following table lists the tests performed.
Test item Description
Internal self-loopback test Checks whether the communication function of the module can be performed normally.
External self-loopback test Checks whether the communication can be performed normally with the cable connected between two
connectors.

Procedure
■Systems other than the redundant system
1. Set the module operation mode for P1 and P2 each to module communication test mode in the following item.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Module Parameter]  [Application
Settings]  [Module Operation Mode]
2. Connect the P1 and P2 of the RJ71EN71 or the RnENCPU (network part) with an Ethernet cable.

3. Write the module parameters to the CPU module.

4. Reset or power off and on the CPU module to start the module communication test.

Do not perform a module communication test while connected to another station. The operation of another
station may failed.

■Redundant system
To perform a module communication test for a redundant system, set the operation mode to separate mode. ( MELSEC
iQ-R CPU Module User's Manual (Application))
Before execution, perform system switching in advance so that the module communication test target station operates as the
standby system.
The following describes a procedure for executing a module communication test for the RJ71EN71 of system B (standby
system).
1. Set the module operation mode of system A to online mode in the following item.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Module Parameter]  [Application
Settings]  [Module Operation Mode]

2. Set the module operation mode of system B to module communication test mode in the following item.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71]  [Module Parameter]  [Application
Settings]  [Redundant System Settings]  [System B Module Operation Mode]

3. Connect the P1 and P2 of the RJ71EN71 of system B with an Ethernet cable.

4. Set the system B CPU module to the STOP state.

5. Write the module parameters to the system B CPU module.

6. Reset or power off and on the system B CPU module to start a module communication test.

3 TROUBLESHOOTING
302 3.2 Checking the Module Status
 • To perform a module communication test on system A, set the module operation mode of system A to
module communication test mode and the module operation mode of system B to online mode.
• When returning the module to a normal operation state after the test, reconnect the Ethernet cable as
before the test, and then execute the CPU module memory copy to transfer the parameters of the control
system to the standby system. ( MELSEC iQ-R CPU Module User's Manual (Application))
• Do not perform a module communication test while connected to another station. The operation of another
station may failed.
3
Check of status and result
The test status and result can be checked with the dot matrix LED of the module.
Test status LED display
Test in progress The dot matrix LED displays "UCT".
Normal completion The dot matrix LED displays "OK".
Abnormal end The ERR LED turns on and the dot matrix LED indicates "ERR" and error number alternately at intervals of 1 second.

■Error number when the test abnormally ended.

The dot matrix LED indicates the error number with the form of "Target Ethernet port Error number".
For example, "1 3" is displayed when error No.3 occurs in P1.
If the module communication test fails, take the following actions.
Error Description Action
number
1 Internal self-loopback test Please consult your local Mitsubishi representative.
failure
2 External self-loopback test Check the Ethernet cable connection or replace the Ethernet cable, and perform the test again. If the test
connection error fails again, Please consult your local Mitsubishi representative.
3 External self-loopback test Replace the Ethernet cable and perform the test again. If the test fails again, Please consult your local
communication error Mitsubishi representative.

3 TROUBLESHOOTING
3.2 Checking the Module Status 303
 3.3 Checking the Network Status
Ethernet diagnostics
The communication status of the Ethernet-equipped module and external device can be checked with Ethernet diagnostics.
[Diagnostics]  [Ethernet Diagnostics]

Set the Ethernet-equipped module to be diagnosed in "Target Module Specification".

3 TROUBLESHOOTING
304 3.3 Checking the Network Status
 • The Ethernet diagnostics cannot be started when "Other Station (Co-existence Network)" has been
specified in "Other Station Setting" on the "Specify Connection Destination Connection" window and "CC-
Link" or "C24" has been specified in "Co-existence Network Route".
• When starting the Ethernet diagnostics with a setting other than "No Specification" in "Other Station Setting"
on the "Specify Connection Destination Connection" window, use the engineering tool of the version 1.035M
or later.
• When a setting other than "No Specification" has been specified in "Other Station Setting" of "Specify
Connection Destination Connection", specify an Ethernet-equipped module to be diagnosed in "Other 3
Station Setting" of "Specify Connection Destination Connection". If another Ethernet-equipped module is
specified, the Ethernet diagnostics can be started only for the specified Ethernet-equipped module, but not
for the non-specified Ethernet-equipped module even if it is on the same base unit. The Ethernet
diagnostics can be started for stations of up to eight networks ahead (number of relay stations: 7) including
the network to which the station directly connected with the engineering tool belongs.
• In a redundant system, the Ethernet diagnostics cannot be started when system A or system B has been
specified under "Specify Redundant CPU" of "Target system" in the "Specify Connection Destination
Connection" window. Directly connect a station to be diagnosed to the engineering tool and specify the host
CPU module ("Specify Redundant CPU" is set to "Not Specified") to start the Ethernet diagnostics.
• In a redundant system configuration of the remote head module, the Ethernet diagnostics cannot be started
when the engineering tool is connected to the remote head module of the standby system. Connect it to the
remote head module of the control system, and start the diagnostics.
• In a redundant system, the Ethernet diagnostics cannot be started when the system is switched from A/B to
B/A in "Main Base Information" of "System Monitor".

Precautions
If the communication path includes the following items, the Ethernet diagnostics cannot be started.
• MELSECNET/H
• Multidrop connection with a serial communication module
• Interface board for a personal computer
• GOT (when the transparent function is used)
• MELSEC-Q/L series network module

3 TROUBLESHOOTING
3.3 Checking the Network Status 305
 Status of Each Connection
The status of each connection of the Ethernet-equipped module selected.

The following table lists the displayed items in "Status of Each Connection" tab.
Item Description
Connection No./Function Displays the connection number and functions (FTP server, FTP client*3, MELSOFT direct connection).
Host Station Port No. Displays the own station port number used.
Communication Destination Displays the communication method.
Communication Method*2
Communication Destination IP Displays the IP address of the sensor/device to be connected, which is set in the parameter settings.
Address
Communication Destination Port No. Displays the port number of the sensor/device to be connected, which is set in the parameter settings.
Latest Error Code Displays the error code that indicates the definition of latest error occurred.
Protocol Displays the protocol (TCP/IP or UDP/IP)
Open System Displays the open method (Active, Unpassive, or Fullpassive) when the protocol of the connection is TCP/IP.
TCP Status Displays the status (open status) of connection with the sensor/device when the protocol of the connection status is
TCP/IP.
Pairing Open*1 Displays the setting status of pairing open when the communication method of the connection is the fixed buffer.
Existence Confirmation*1 Displays the alive check method set in the parameter settings.
Remote Password Status Displays the remote password setting status.
Consecutive failed unlock attempts Displays the total number of continuous failure of remote password unlock.
Force Deactivation Status Displays the status of forced invalidation specification.

*1 This item is displayed only for the RJ71EN71 and the RnENCPU (network part).
*2 This item is displayed only when the network type of the RJ71EN71 is set to "Q Compatible Ethernet" and "MELSOFT Connection
Module" is set as an external device in "External Device Configuration" of "Basic Settings".
*3 This item is displayed only for the CPU module (built-in Ethernet port part).
Click the [Clear Latest Error Code] button to clear all the errors displayed in "Latest Error Code" of each connection.

Information about connection No.17 to 64, FTP server, MELSOFT direct connection are not displayed when
"Q Compatible Ethernet" is set in the network type of the RJ71EN71.

3 TROUBLESHOOTING
306 3.3 Checking the Network Status
Status of Each Protocol
The total number of packets sent/received by each protocol of the selected Ethernet-equipped module can be checked.

The following table lists the displayed items in "Status of Each Protocol" tab.
Item Description Display range
Total Number of Receives Displays the total number of received packets. 0 to 4294967295
Total Number of Sends Displays the total number of sent packets. 0 to 4294967295
Total Number of Sum Check Error Displays the number of times the received packet was discarded due to checksum error. 0 to 4294967295
Cancels
Total Number of Echo Request Displays the total number of received ICMP echo request packets. 0 to 4294967295
Receives
Total Number of Echo Reply Sends Displays the total number of sent ICMP echo reply packets. 0 to 4294967295
Total Number of Echo Request Sends Displays the total number of sent ICMP echo request packets. 0 to 4294967295
Total Number of Echo Reply Receives Displays the total number of received ICMP echo reply packets. 0 to 4294967295

3 TROUBLESHOOTING
3.3 Checking the Network Status 307
 Connection Status
The communication status of the Ethernet-equipped module.

The following table lists the displayed items in "Connection Status" tab.
Item Description Display range
Communication Full Duplex/Half Duplex Displays whether the line is full-duplex or half-duplex. 
Status Connection Status Displays the cable connection status. 
Communication Rate Displays the communication speed. 
Number of Displays the number of times the line entered a state where communication cannot 0 to 65535
Disconnections be performed.
Broadcast Maximum Size of Displays the maximum size of discarded broadcast messages. 0 to 65535
Detection
Amount of Data per Unit Displays the size (latest value) per second of discarded broadcast messages. 0 to 4294967295
Time (Latest)
Amount of Data per Unit Displays the size (maximum value) per second of discarded broadcast messages. 0 to 4294967295
Time (Maximum)

Click the [Clear Line Status] button to clear all the data in "Broadcast".

Information in "Broadcast" is not displayed when "Q Compatible Ethernet" is selected for the network type of
the RJ71EN71.

3 TROUBLESHOOTING
308 3.3 Checking the Network Status
PING Test
The PING test checks existence of an Ethernet device on the same Ethernet network.
This test is performed on the network of stations connected to the engineering tool by sending packets for check. If a
response returns, the communication can be performed.
"Ethernet Diagnostics" window  [PING Test] button

■Procedure
Set the required items in "Input Item" and click the [Execute] button to execute the PING test. The test results are displayed in
the "Result" box.

• When executing the PING test from the RJ71EN71 and the RnENCPU (network part) by connecting the
engineering tool and CPU module with a USB cable, network number and station number setting is required
to specify the PING executing station.
• When the Ethernet diagnostics are started with a setting other than "No Specification" in "Other Station
Setting" on the "Specify Connection Destination Connection" window, the PING test cannot be used.

■Action for abnormal end

If the test fails, check the following and perform the test again.
• Whether the Ethernet-equipped module is properly mounted on the base unit
• Connection to the Ethernet network
• Parameter settings written in the CPU module
• Operating status of the CPU module (whether or not an error has occurred)
• IP addresses set in the engineering tool and the PING test target station
• Whether the external device has been reset after the Ethernet-equipped module was replaced

3 TROUBLESHOOTING
3.3 Checking the Network Status 309
 Communication Status Test
The communication status test checks whether the communication between the own station and the external device on the
same Ethernet is operated normally.
The following external devices are the target of communication status test.
• RJ71EN71 (when the Ethernet function is used)
• RnENCPU (network part) (when the Ethernet function is used)
• MELSEC-Q series Ethernet interface module (function version B or later)
• MELSEC-L series Ethernet interface module
This test is performed on the network of stations connected to the engineering tool, by sending the test messages sequentially
to specified network and station number range. If the module that received the message returns a response, communication
is normal.
"Ethernet Diagnostics" window  [Communication Status Test] button

The communication status test cannot be used in the following cases.

• When the Ethernet function of the CPU module (CPU part for the RnENCPU) is used
• When the Ethernet diagnostics are started with a setting other than "No Specification" in "Other Station
Setting" on the "Specify Connection Destination Connection" window

■Procedure
Set the required items in "Setting Item" and click the [Execute] button to execute the communication status test. The test
results are displayed in the "Result" box.

3 TROUBLESHOOTING
310 3.3 Checking the Network Status
■Action for abnormal end
If the communication status test fails, "No Response" or an error code is displayed in the "IP Address / Error Code" field in
"Result".
Displayed test Status of the Cause Action
result external device
No Response No error The initial process for the Ethernet-equipped module Correct the module parameters.
has not been completed normally.
There is an error in the line connection to the • Check the cable.
Ethernet-equipped module. (Cable disconnection, • Check the hub and gateway.
line disconnection, or others) 3
The IP address of the Ethernet-equipped module is Correct the module parameters.
incorrect. (The class or subnet address differs from
that of the Ethernet-equipped module.)
The same IP address has been set to multiple
Ethernet-equipped modules.
The same network number or station number has
been set to multiple Ethernet-equipped modules.
No error/Error exists The Ethernet line is heavily loaded. Perform the test again when the Ethernet line is not
heavily loaded.
Error exists The routing settings are not configured. Correct the set value for "Routing Setting" of "CPU
Parameter".
Error code No error The "MELSOFT Transmission Port (UDP/IP)" for the Disable the remote password setting and write the
Ethernet-equipped module is locked with the remote parameters to the CPU module.
password.
The target module does not support the Check the module name and function version.
communication status test.
No error/Error exists The Ethernet line is heavily loaded. Perform the test again when the Ethernet line is not
heavily loaded.

■Precautions
• The communication status test cannot be executed when "MELSOFT Transmission Port (UDP/IP)" for the target Ethernet-
equipped module is locked with the remote password.
• When executing the communication status test, set "Gateway Other Than Default Gateway" under "Gateway Parameter
Settings" in "Application Settings" to "Not Use".

3 TROUBLESHOOTING
3.3 Checking the Network Status 311
 Simple CPU communication diagnostics
The communication status of the simple CPU communication function can be checked with "Simple CPU Communication
Diagnostics".
[Diagnostics]  [Simple CPU Communication Diagnostics]

Item Description
Set No. Displays the setting number of the simple CPU communication.
Comm Patn Displays the communication pattern (read/write) set with the parameters.
Comm Set Displays the communication setting (Fixed Interval/On Request) set with the parameters.
Tgt PLC No. Displays the communication destination set with the parameters.
The destination is displayed when the simple CPU communication is executed with the RJ71EN71 or RnENCPU (network part).
Status Displays the communication status ("Not Set", "Prepg", "Rqst Wtng", "Exctng", "Stpng", "Rtryng", "Mntrng", or "Comm Dis").
During system switching in a redundant system, "Prepg" is displayed.
IP Address Displays the IP address of the communication destination set with the parameters.
Port No. Displays the port number of the communication destination set with the parameters.
Tgt PLC No. Displays the target PLC number set with the parameters.
Exe Intv [ms] (Prsnt) Displays the current value, the maximum value, and the minimum value of the execution interval in increments of ms.
The values will not be updated during retry or monitoring. During communication stop, 0 is displayed on "Exe Intv [ms] (Prsnt)".
Exe Intv [ms] (Max)
During system switching in a redundant system, 0 is displayed.
Exe Intv [ms] (Min) Displays "-----" when "On Request" is set to "Comm Set" in "Simple PLC Communication Settings" under "Application Setting".
Norm Compl Displays the accumulated count of communications that have been completed successfully, completed with an error, and
retried.
Err Compl
• 0 to 4294967295: Accumulated count
Retries When the count exceeds 4294967295, counting is continued from 1 again.
Latest Err Displays the latest error code. When no error has occurred, "No Error" is displayed.
The error remains displayed even after the communication status has changed to the state in which the communication can be
performed normally. When another error occurs, it will be overwritten with a new one.
Err Det... Displays the descriptions and corrective actions for the error occurring in the selected setting number.
[Clear Latest Error Code] Clears the error code.
button This operation also clears the error codes (Un\G1194 to Un\G1257) of the corresponding setting number in the CPU buffer
memory.
(Own station) IP address The IP address set in "Own Node Settings" under "Basic Settings" in the RJ71EN71 or RnENCPU (network part) is displayed.
In a redundant system (with control system IP address), the control system IP address is displayed.

3 TROUBLESHOOTING
312 3.3 Checking the Network Status
• Even if system switching is executed, "Norm Compl", "Err Compl", "Retries", "Latest Err", and "Err Det..."
are not tracked and the data is stored in the system A and system B. Therefore, "Norm Compl", "Err Compl",
and "Retries" is accumulated per system and "Latest Err" and "Err Det..." are different between the system
A and system B.
• When the engineering tool version is not the latest version, "-----" is displayed as a diagnostics result. To
diagnose correctly, update the engineering tool version.
• When "Not Specified" is set to "Specify Redundant CPU" on the "Specify Connection Destination
Connection" window in a redundant system, the simple CPU diagnostics does not start. Directly connect a 3
station to be diagnosed to the engineering tool and specify the host CPU module ("Specify Redundant CPU"
is set to "Not Specified") to start the Ethernet diagnostics.
• In a redundant system of the remote head module, the simple CPU diagnostics does not start when the
engineering tool is connected to the remote head module of the standby system. Connect it to the remote
head module of the control system, and start the diagnostics.
• In a redundant system, the simple CPU communication diagnostics cannot be started when the system is
switched between A and B in "Main Base Information" of "System Monitor".

3 TROUBLESHOOTING
3.3 Checking the Network Status 313
 3.4 Troubleshooting by Symptom
This section describes troubleshooting method by symptom. If an error has occurred in the Ethernet-equipped module,
identify the error cause using the engineering tool. ( Page 300 Checking the Module Status)

Communications cannot be performed with the external device.

The following table lists how to troubleshoot the problem when the Ethernet-equipped module cannot communicate with the
external device.
Check item Action
Is the READY LED of the CPU module off? If the READY LED of the CPU module is off, perform the troubleshooting of
the CPU module. ( MELSEC iQ-R CPU Module User's Manual
(Application))
Is the RUN LED of the RJ71EN71 or the RnENCPU (network part) off? If the RUN LED of the RJ71EN71 or the RnENCPU (network part) is off, reset
the CPU module. If the RUN LED is still off even after resetting the CPU
module, the possible cause is a hardware failure. Replace the RJ71EN71 or
RnENCPU and restart all the external devices that were performing
communications with the own station.*1
Is the Ethernet cable securely connected? If the Ethernet cable is not securely connected, take following actions.
• Securely lock the cable.
• Check the wiring. ( MELSEC iQ-R Ethernet/CC-Link IE User's Manual
(Startup))
Does the external device conform to the Ethernet standard? If the device does not conform to the Ethernet standard, replace it with one
conforming to the standard. ( MELSEC iQ-R Ethernet/CC-Link IE User's
Manual (Startup))
Is the external device powered on? If the external device is not powered on, power it on.
Does any error occur in the external device, hub, router, or other devices? If an error occurs, refer to the manual for each device and take action.
Does the protocol (TCP/IP or UDP/IP) match with that of the external device? Correct the parameters so that the protocol matches with that of the external
device. ( Page 264 External Device Configuration)
Is the access from the external device set to be denied in "IP Filter Settings" If the access from the external device is denied, change the setting so that the
under "Security" of "Application Settings"? access is allowed. ( Page 284 IP Filter Settings)
Was a device on the line (such as an Ethernet-equipped module, external If a device was replaced, take any of the following actions.
device, hub, and router) replaced with the one with the same IP address? • Wait for update of the ARP cache (waiting time varies depending on the
device)
• Restart all the devices on the line.*1
Is the IP address of the external device specified correctly? Execute a PING test to the IP address of the external device.
If the existence of the external device cannot be checked, network
configuration is incorrect. Consult with the system or network manager.
Is "Module Operation Mode" of "Application Settings" set to other mode than Set "Module Operation Mode" of "Application Settings" to "Online". ( Page
"Online"?*4 294 Module Operation Mode)
Has the initial processing been completed normally? (Check 'Initial status' If the initial processing has not been completed successfully, correct the
(Un\G1900024.0))*3 module parameters. ( Page 261 PARAMETER SETTINGS)
Does the communication data code (ASCII or binary) setting match with that If the data code settings do not match, data cannot be sent or received
of the external device? because the external device cannot normally decode commands.*2
Set the same data code as that of the external device in "Communication Data
Code" under "Own Node Settings" of "Basic Settings". ( Page 262 Own
Node Settings)
Is the target connection in forcibly invalidated state in the "Force Deactivation Turn off the area corresponding to the target connection in 'Forced connection
Status" column in the "Status of Each Connection" tab of the "Ethernet invalidation setting area' (Un\G5646 to Un\G5650) to cancel the forced
Diagnostics" window? invalidation.
Is the access from the Ethernet-equipped module denied by the security Correct the security setting (such as firewall) of the external device.
setting of the external device?
For the RJ71EN71 or the RnENCPU (network part), is 'IP address change When 'IP address change function operating status' (Un\G11715.0) is on, the
function operating status' (Un\G11715.0) on? module is operating according to the settings of the IP address change
function. Either clear the IP address storage area, or correct the settings.
( Page 230 IP Address Change Function)
Does a timeout occur when connecting to the engineering tool? Increase the value for "Check at Communication Time" and "Retry Times" in
the following windows in the "Specify Connection Destination Connection"
window and connect again.
• "Host Station Detailed Setting" window of "No Specification"
• "Other Station Detailed Setting" window of "Other Station (Single Network)"
or "Other Station (Co-existence Network)"

3 TROUBLESHOOTING
314 3.4 Troubleshooting by Symptom
When the problem cannot be solved with above actions, check the error cause according to the communication processing
and take action.
• Communications using the SLMP ( Page 317 Communications using the SLMP cannot be performed.)
• Communications using the predefined protocol ( Page 318 Communications using the predefined protocol cannot be
performed.)
• Socket communications/Communications using the fixed buffer ( Page 319 Socket communications/communications
using the fixed buffer cannot be performed.)
• Communications using the random access buffer ( Page 320 Communications using the random access buffer cannot
be performed.)
• Communications using a link dedicated instruction ( Page 322 Communications using a link dedicated instruction
3
cannot be performed.)
• File transfer function (FTP server) ( Page 322 Access using the file transfer function (FTP server) cannot be
performed.)
*1 A device on Ethernet has a table of IP addresses and their corresponding MAC address, called "ARP cache". When a device on the line
is replaced by the one having the same IP address, the MAC address in the ARP cache is different from that of the replaced device;
therefore, communications may not be normally performed. The "ARP cache" is updated by resetting the device or after a while. The
time varies depending on the device.
*2 If the communication data code setting is different between the Ethernet-equipped module and the external device, error codes that are
not found in the error code list may be returned to the external device. When receiving data with different data codes, the Ethernet-
equipped module cannot decode commands normally. The Ethernet-equipped module returns an error response according to the
communication data code setting.
*3 The buffer memory address is for when the network type of the RJ71EN71 or the RnENCPU (network part) is set to "Ethernet" and the
P1 connector is used.
When using the P2 connector or the CPU module (built-in Ethernet port part), or setting the network type to "Q Compatible Ethernet",
refer to the following.
Page 355 Buffer Memory
*4 Check this item only for the modules that have the relevant setting in the module parameters.

3 TROUBLESHOOTING
3.4 Troubleshooting by Symptom 315
 A message sent from the external device cannot be received frequently.
When the Ethernet-equipped module frequently fails to receive a message sent from the external device, check the following
items.
Check item Action
Are there many detected errors in 'Simultaneous transmission error detection If many errors are detected or a system error is stored, there may be a heavy
count (receive buffer full count)' (Un\G5022 to Un\G5023)?*1 load on the Ethernet line due to data sending and receiving between
connected devices.
Has a system error been stored in 'Latest error code' (Un\G100 to Un\G163
(Connection No.1 to No.64 latest error code))?*1 • Taking action such as separating networks or decreasing the number of
data sending reduces the load on the Ethernet line.
• Consult with the network manager and reduce the load on the Ethernet line.
Has 1H been stored in 'State of receive buffer' (Un\G1900030)?*3 • Taking action such as separating networks or decreasing the number of
data sending reduces the load on the Ethernet line.
• When communications using the fixed buffer is used, check whether the
BUFRCV instruction is executed. ( Page 74 Receive procedure)
• To receive data at shorter intervals than the scan time of the CPU module
using the fixed buffer, add the normally closed contact for the completion
device of the BUFRCV instruction to the execution conditions of the
BUFRCV instruction. ( Page 93 Labels)

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)*2
*1 The buffer memory address is for when the network type of the RJ71EN71 or the RnENCPU (network part) is set to "Ethernet" and the
P1 connector is used.
When using the P2 connector or the CPU module (built-in Ethernet port part), or setting the network type to "Q Compatible Ethernet",
refer to the following.
Page 355 Buffer Memory
*2 The module communication test cannot be performed for the CPU module (built-in Ethernet port part). Perform the troubleshooting of
the CPU module and check for hardware failure. ( MELSEC iQ-R CPU Module User's Manual (Startup))
*3 Availability for the buffer memory depends on the firmware version. ( Page 436 Added and Enhanced Functions)

Direct connection to the engineering tool is not possible.

When the direct connection to the engineering tool is not possible, check the following items.
Check item Action
Is the Ethernet-equipped module directly connected to the engineering tool Directly connect the Ethernet-equipped module to the engineering tool with a
with a single cable? single cable.
Is "Disable Direct Connection with MELSOFT" under "Security" of "Application If "Disable Direct Connection with MELSOFT" is set to "Disable", change the
Settings" is set to "Disable"? setting to "Enable".
Is the transfer setup setting of the engineering tool correct? If the setting is incorrect, check the following items.
• Check that "Ethernet Board" is selected in "PC side I/F".
• Check that "Ethernet Port Direct Connection" is selected in the "PLC side I/
F Detailed Setting of PLC Module" window or "PLC side I/F Detailed Setting
of Ethernet Module" window of "PLC side I/F".
• When "PLC side I/F" is "Ethernet Module", check that "Other Station (Single
Network)" is selected for "Other Station Setting" and "Access to Ethernet
module set on PLC side I/F" is selected in the "Network Communication
Route Detailed Setting of Ethernet" window of "Network Communication
Route".
Does a timeout occur when connecting to the engineering tool? Increase the value for "Check at Communication Time" and "Retry Times" in
the "Other Station Detailed Settings" window of "Other Station Setting" of the
"Specify Connection Destination Connection" window and connect again.
Does the device (personal computer) to be connected support the direct If the device does not support the direct connection, connect a hub.
connection?

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)*1
*1 The module communication test cannot be performed for the CPU module (built-in Ethernet port part). Perform the troubleshooting of
the CPU module and check for hardware failure. ( MELSEC iQ-R CPU Module User's Manual (Startup))

3 TROUBLESHOOTING
316 3.4 Troubleshooting by Symptom
CPU module search on the network cannot be performed.
When the CPU module search on the network cannot be performed, check the following items.
Check item Action
Is "Do Not Respond to CPU Module Search" under "Security" of "Application Set "Do Not Respond to CPU Module Search" under "Security" of "Application
Settings" is set to "Do Not Respond"? Settings" to "Respond".
Is the CPU module cannot be searched connected to a router? The CPU module connected via a router cannot be searched.
Modify the connection to search the CPU module.
Is the CPU module cannot be searched connected with wireless LAN? Perform the search again. (The packet may be lost.)
Is the service processing (such as file read) load of the search target CPU • Increase the response waiting time and perform the search again. 3
module high? • Reduce the service processing load of the CPU module.

Communications using the SLMP cannot be performed.

When communications using the SLMP cannot be performed, check the following items.
Check item Action
Has the connection with the external device been opened? (Check 'Open • If the connection with the external device is not opened, perform the open
completion signal' (Un\G1900000 to Un\G1900007)*1*2 processing.
• If an error occurs, check and eliminate the error cause.
Is the correct command format used for the command type, device, address, Correct the command format. ( SLMP Reference Manual)
and others?
Is "Enable/Disable Online Change" under "Own Node Settings" in "Basic If "Enable/Disable Online Change" is set to "Disable All (SLMP)", change the
Settings" set to "Disable All (SLMP)"? setting to "Enable All (SLMP)". ( Page 262 Own Node Settings)
Did the external device send a command? If the device did not send a command, send a command to the Ethernet-
equipped module.
Was a response returned to the device that had sent the command? • If no response was returned, check if the correct IP address was specified
in the command. If not, correct the IP address and send the command
again.
• If a response was returned, check the end and error codes to correct the
error.
Is the communication method of the connection used for communication with Correct the communication method setting if an item other than "SLMP" is set.
the external device is set to an item other than "SLMP" in the "External Device ( Page 264 External Device Configuration)
Configuration" window of "Basic Settings"?

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)*3
*1 The buffer memory address is for when the network type of the RJ71EN71 or the RnENCPU (network part) is set to "Ethernet" and the
P1 connector is used.
When using the P2 connector or the CPU module (built-in Ethernet port part), or setting the network type to "Q Compatible Ethernet",
refer to the following.
Page 355 Buffer Memory
*2 If the connection of only the external device is closed due to cable disconnection, personal computer restart, or other reasons, reopen
the connection using the same port used before the error occurred. The E71 does not close a connection if it receives an Active open
request again from the external device with a different IP address or a port number.
*3 The module communication test cannot be performed for the CPU module (built-in Ethernet port part). Perform the troubleshooting of
the CPU module and check for hardware failure. ( MELSEC iQ-R CPU Module User's Manual (Startup))

3 TROUBLESHOOTING
3.4 Troubleshooting by Symptom 317
 Communications using the predefined protocol cannot be performed.
When communications using the predefined protocol cannot be performed, check the following items and take action.
Check item Action
Is the IP address setting of the external device correct? Check and correct the IP address of the external device.
Has the connection with the external device been opened? (Check 'Open • If the connection with the external device is not opened, perform the open
completion signal' (Un\G1900000 to Un\G1900007)*1*2 processing.
• If an error occurs, check and eliminate the error cause.
Has the send/receive processing (dedicated instruction) for the • If the send/receive processing has not been executed, check and correct
communications using the predefined protocol been executed properly? the execution condition of the send/receive processing.
• If send/receive processing has completed with an error, check the error
code in the completion status and eliminate the error cause.
Is the appropriate protocol used for the external device in the predefined Correct the predefined protocol settings and program If inappropriate protocol
protocol settings and program? is used.
For appropriate protocol for the external device, refer to the manual for the
device used.
Is the communication method of the connection used for communication with Correct the communication method setting if an item other than "Predefined
the external device is set to an item other than "Predefined Protocol" in the Protocol" is set. ( Page 264 External Device Configuration)
"External Device Configuration" window of "Basic Settings"?
Is 'Predefined protocol ready' (Un\G1901002.0) on?*1 If 'Predefined protocol ready' (Un\G1901002.0) is off, write the protocol setting
data to the module.

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)*3
*1 The buffer memory address is for when the network type of the RJ71EN71 or the RnENCPU (network part) is set to "Ethernet" and the
P1 connector is used.
When using the P2 connector or the CPU module (built-in Ethernet port part), or setting the network type to "Q Compatible Ethernet",
refer to the following.
Page 355 Buffer Memory
*2 If the connection of only the external device is closed due to cable disconnection, personal computer restart, or other reasons, reopen
the connection using the same port used before the error occurred. The E71 does not close a connection if it receives an Active open
request again from the external device with a different IP address or a port number.
*3 The module communication test cannot be performed for the CPU module (built-in Ethernet port part). Perform the troubleshooting of
the CPU module and check for hardware failure. ( MELSEC iQ-R CPU Module User's Manual (Startup))

3 TROUBLESHOOTING
318 3.4 Troubleshooting by Symptom
Socket communications/communications using the fixed buffer cannot be performed.
When socket communications or communications using the fixed buffer cannot be performed, check the following items and
take action.
Check item Action
Has the connection with the external device been opened? (Check 'Open • If the connection with the external device is not opened, perform the open
completion signal' (Un\G1900000 to Un\G1900007)*1*2 processing.
• If an error occurs, check and eliminate the error cause.
Has the send/receive processing been executed properly? • If the send/receive processing has not been executed, check and correct
the execution condition of the send/receive processing. 3
• If send/receive processing has completed with an error, check the error
code in the completion status and eliminate the error cause.
Does 'Socket/fixed buffer reception status signal' (Un\G1900016 to • Send data from the external device.
Un\G1900023) turn on when receive processing is executed? • If data has been sent, check that the destination address (IP address and
port number) is correctly set.
Is the communication method of the connection used for communication with Correct the communication method setting if an item other than the one
the external device is set to an item other than the following in the "External described in the left is set. ( Page 264 External Device Configuration)
Device Configuration" window of "Basic Settings"?
• Socket communications: "Socket Communication"
• Communications using the fixed buffer: "Fixed Buffer (Procedure Exist)" or
"Fixed Buffer (No Procedure)"
Is the communication method of the connection used for communication with Correct the communication method setting if an item other than the one
the external device is set to an item other than "Broadcast Send" or described in the left is set. ( Page 264 External Device Configuration)
"Broadcast Receive" in the "External Device Configuration" window of "Basic
Settings" when broadcast communications is performed?

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)*3
*1 The buffer memory address is for when the network type of the RJ71EN71 or the RnENCPU (network part) is set to "Ethernet" and the
P1 connector is used.
When using the P2 connector or the CPU module (built-in Ethernet port part), or setting the network type to "Q Compatible Ethernet",
refer to the following.
Page 355 Buffer Memory
*2 If the connection of only the external device is closed due to cable disconnection, personal computer restart, or other reasons, reopen
the connection using the same port used before the error occurred. The E71 does not close a connection if it receives an Active open
request again from the external device with a different IP address or a port number.
*3 The module communication test cannot be performed for the CPU module (built-in Ethernet port part). Perform the troubleshooting of
the CPU module and check for hardware failure. ( MELSEC iQ-R CPU Module User's Manual (Startup))

3 TROUBLESHOOTING
3.4 Troubleshooting by Symptom 319
 Communications using the random access buffer cannot be performed.
When communications using the random access buffer cannot be performed, check the following items and take action.
Check item Action
Has the connection with the external device been opened? (Check 'Open • If the connection with the external device is not opened, perform the open
completion signal' (Un\G1900000 to Un\G1900007)*1*2 processing.
• If an error occurs, check and eliminate the error cause.
Did the external device send a command? Send a command to the Ethernet-equipped module from the external device.
Is the correct buffer memory address specified for the command? If the specified buffer memory address is incorrect, correct it and send the
command again.
Has data been set in the specified address of the random access buffer? If any data has not been set, write the data.
Has the write data been set in the external device? If any write data has not been set, set the data.
Was a response returned to the device that had sent the command? • If no response was returned, check if the correct IP address was specified
in the command. If not, correct the IP address and send the command
again.
• If a response was returned, check the end and error codes to correct the
error.
Is the communication method of the connection used for communication with Correct the communication method setting if an item other than "Random
the external device is set to an item other than "Random Access Buffer" in the Access Buffer" is set. ( Page 264 External Device Configuration)
"External Device Configuration" window of "Basic Settings"?

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)
*1 The buffer memory address is for when the network type of the RJ71EN71 or the RnENCPU (network part) is set to "Ethernet" and the
P1 connector is used.
When using the P2 connector or setting the network type to "Q Compatible Ethernet", refer to the following.
Page 355 Buffer Memory
*2 If the connection of only the external device is closed due to cable disconnection, personal computer restart, or other reasons, reopen
the connection using the same port used before the error occurred. The E71 does not close a connection if it receives an Active open
request again from the external device with a different IP address or a port number.

3 TROUBLESHOOTING
320 3.4 Troubleshooting by Symptom
Communications using MODBUS/TCP cannot be performed.
■Communication fails at MODBUS/TCP connection.
When communication is not possible at MODBUS/TCP connection, check the following items and take action.
Check item Action
Does the external device support MODBUS/TCP? If the device does not support MODBUS/TCP, replace it with the one
supporting the MODBUS/TCP standard.
Is the external device a MODBUS/TCP master device? The external device must be a MODBUS/TCP master device.
Was a new connection attempted when 64 external devices have already
been connected?
Reduce the number of external devices connected to the Ethernet-equipped
module. 3
If the number of connections with external devices exceeds 64, the connection
is disconnected automatically from the device for which the longest time has
elapsed from the last communication.
Is the Ethernet-equipped module supporting the MODBUS/TCP function Check the firmware version of the Ethernet-equipped module and ensure that
used? the module supports the MODBUS/TCP function.
When the Ethernet-equipped module being used does not support the
MODBUS/TCP function, replace it with the module that supports the function.

■Messages sent from the MODBUS/TCP master device cannot be received.

When messages sent from the MODBUS/TCP master device cannot be received completely or frequently, check the following
items and take action.
Check item Action
Are there times when 'State of receive buffer' (Un\G1900030) becomes 1 The load on the Ethernet line may high due to the data communication
(Receive buffer full)? between the nodes. Take the following actions.
• Reduce the load on the Ethernet line by separating networks, decreasing
the number of data sending, or other method.
• Consult with the network manager and reduce the load on the Ethernet line.

■A response message cannot be sent to the MODBUS/TCP master device.

When a response message to the request message sent from the MODBUS/TCP master device or a supposed response
message cannot be sent, check the following items and take action.
Check item Action
Is the registration of the MODBUS device assignment parameters correct? Check the settings of the MODBUS device assignment parameters.
Was an abnormal response code sent? Check the abnormal response code and correct any possible problems.
Is there any error code stored in 'Error log area for MODBUS/TCP function' Take an appropriate action in accordance with the stored error code.
(Un\G720896 to Un\G721153)? ( Page 329 List of Error Codes)
Is the request message received from the MODBUS/TCP master device Correct the request message that the MODBUS/TCP master device sends.
correct?
Is the message length of the application data area of the Ethernet frame six
bytes or longer (from communication ID to message length of the MBAP
header)?
Does the message length of the MBAP header + 6 bytes match with the
message length of the application data area of the Ethernet frame?

3 TROUBLESHOOTING
3.4 Troubleshooting by Symptom 321
 A dedicated instruction is not completed.
If the dedicated instruction is not completed when using the RJ71EN71 or the RnENCPU (network part), check if an option
other than "Online" is set in "Module Operation Mode" under "Application Settings".
Set "Online".

Communications using a link dedicated instruction cannot be performed.

When communications using a link dedicated instruction cannot be performed, check the following items and take action.
Check item Action
Are the network number and station number set in the Ethernet-equipped Set the network number and station number.
module?
Is the number of resends set upon every instruction execution? Modify the program to set the number of resends upon every instruction
execution.
Are station numbers unique? Change the duplicated station number.
Is the network number duplicated on the network? Correct the parameters so than the network number is not overlapped.
Is a communication path by the dynamic routing function is determined? • Power on the system and start transient transmission after a while.
• When "Dynamic Routing" under "Application Settings" of the station on the
communication path is set to "Disable", change it to "Enable".
Does the relay station to be passed support the dynamic routing function? If the relay station to be passed does not support the dynamic routing function,
set all the stations on the communication path in "Routing Setting" of "CPU
Parameter".
Are multiple link dedicated instructions with same channel setting executed • Set different channel to each instructions.
simultaneously? • Shift the execution timing of the link dedicated instructions.

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)

Access using the file transfer function (FTP server) cannot be performed.
When the Ethernet-equipped module cannot be accessed from the external device (FTP client) using the file transfer function
(FTP server), check the following items and take action.
Check item Action
Is the file transfer function (FTP server) for the Ethernet-equipped module Set "FTP Server" under "FTP Server Settings" of "Application Settings" to
enabled? "Use". ( Page 272 FTP Server Settings)
Are the login name and password correct? Check the login name and password set in the parameters, and log in again.
( Page 272 FTP Server Settings)
Is the IP address entered at login correct? Check the IP address of the Ethernet-equipped module set in the parameters,
and log in again. ( Page 262 Own Node Settings)
Is executed command used properly? Check the instructions of the command and use the command properly. (
Page 121 FTP command)
In multiple CPU system, is the access destination CPU module correct? Execute the cpuchg command and change the access destination CPU
module.

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)*1
*1 The module communication test cannot be performed for the CPU module (built-in Ethernet port part). Perform the troubleshooting of
the CPU module and check for hardware failure. ( MELSEC iQ-R CPU Module User's Manual (Startup))

3 TROUBLESHOOTING
322 3.4 Troubleshooting by Symptom
Access using the file transfer function (FTP client) cannot be performed.
When the CPU module cannot access to the external device (FTP server) during execution of the file transfer function (FTP
client), check the following items and take action.
Check item Action
Is a value other than 0000H stored in (s1)+1 (Completion status) of the Take action for the error code stored in (s1)+1 (Completion status), and
SP.FTPPUT or SP.FTPGET instruction? execute the instruction again. ( Page 329 List of Error Codes)

The time setting function (SNTP client) cannot be performed normally. 3

When the time setting function (SNTP client) cannot be performed normally, check the following items and take action.
Check item Action
Is the time setting function (SNTP client) is enabled for the Ethernet-equipped Set "Time Setting (SNTP Client)" under "Time Setting" of "Application
module? Settings" to "Use". ( Page 280 Time Setting)
Is "SNTP Server IP Address" set correctly? Change the "SNTP Server IP Address" under "Time Setting" in "Application
Settings" to the correct IP address. ( Page 280 Time Setting)

If the above action does not solve the problem, perform the module communication test to check for hardware failure. (
Page 302 Module communication test)*1
*1 The module communication test cannot be performed for the CPU module (built-in Ethernet port part). Perform the troubleshooting of
the CPU module and check for hardware failure. ( MELSEC iQ-R CPU Module User's Manual (Startup))

The access cannot be allowed/denied correctly by the IP filter.

When the access cannot be allowed/denied correctly by the IP filter, check the following items and take action.
Check item Action
Is "Access from IP address below" correctly set in "IP Filter Settings" under Correct the setting of "Access from IP address below".
"Security" of "Application Settings"?
Are the IP addresses set in "IP Address" in "IP Filter Settings" under "Security" Correct the IP addresses.
of "Application Settings"? When the IP addresses are specified by range, check also "IP Address
Excluded from Range".
Is the IP address of the proxy server set to be allowed? Set the IP address of the proxy server to be denied.

Remote password does not work.

When the remote password does not work, check the following items and take action.
Check item Action
Is the remote password setting of the target connection disabled in the If the remote password is disabled, change the setting so that it is enabled.
"Remote Password Detail Setting" window? ( Page 177 Remote password)

3 TROUBLESHOOTING
3.4 Troubleshooting by Symptom 323
 Communications using the built-in Ethernet port are slow.
When communications using the built-in Ethernet port are slow, check the following items and take action.
Check item Action
Is the communication request load from the external device high? Check the buffer memory Un\G100 (receive packet count (current) per unit
time (one second)) of the CPU module (built-in Ethernet port part), and if the
value is significantly large compared to the normal communications, the
following actions may improve the processing speed.
• Review the communication request from the engineering tool and GOT.
• Review the communication request from the transfer destination (execution
source) of the simple CPU communications.
• Review the file transfer function (FTP server).
• Review the communications using the SLMP.
Is the communication request load from the CPU module high? Check the buffer memory Un\G102 (send packet count (current) per unit time
(one second)) of the CPU module (built-in Ethernet port part), and if the value
is significantly large compared to the normal communications, the following
actions may improve the processing speed.
• Review the execution frequency of the instructions for the built-in Ethernet
function (socket communications instruction/predefined protocol support
function instruction/SLMP frame send instruction/file transfer function
instruction)
• Review the settings (such as the number of points) of CC-Link IE Field
Network Basic.
• Review the settings (such as the execution interval and the number of
points) of the simple CPU communications.
• Review the settings (such as automatic detection and backup execution) of
iQSS (built-in Ethernet).
• Review the settings (such as the number of executions) of data logging file
transfer.

3 TROUBLESHOOTING
324 3.4 Troubleshooting by Symptom
When the simple CPU communication function is used
■Communications cannot be performed with the communication destination.
When communications with the external device cannot be performed using the simple CPU communication function, check
the following items and take action.
Check item Action
Does any error occur in the simple CPU communication diagnostics or simple Eliminate the error cause. When communications can be performed by
CPU communication error code in the buffer memory? increasing the communication retry count and communication time-out period,
review the communication retry count and communication time-out period, or
check the line status of Ethernet communications with the external device, 3
such as a cable, hub, and router, to check if the line is busy.
Is the communication status of the simple CPU communication diagnostics or Check the cable between the Ethernet-equipped module and hub, and check
the simple CPU communication status of the buffer memory "preparing"? if the hub is operating normally.
Is the module supporting the simple CPU communication function used? In "Product Information List" of "System Monitor", check the firmware version
of the target module, and ensure that the module supports the simple CPU
communication.
When the module being used does not support the simple CPU
communication, replace it with the module that supports the function.
Is the own station port number set in the external device configuration within When the communication destination of the simple CPU communication is a
the range of 61696 to 65534? Mitsubishi Electric programmable controller, the own station port number is
dynamically set within the range of 61696 to 65534.
When the own station port number is set within the range of 61696 to 65534 in
the external device configuration, the port numbers overlap, resulting in a
communication failure. Set the own station port number to a number other
than 61696 to 65534 in the external device configuration.

If communications cannot be performed despite the check for the above items, the hardware failure may have been occurred.
Please consult your local Mitsubishi representative.

■Communications with the communication destination are unstable.

When communications with the communication destination using the simple CPU communication is unstable, check the
following items and take action.
Check item Action
Does any error occur in the simple CPU communication diagnostics or simple Eliminate the error cause.
CPU communication error code in the CPU buffer memory?
Is the retry of communications performed? Check the line status of Ethernet communications with the external device,
such as a cable, hub, and router, to check if the line is busy.

If communications cannot be performed despite the check for the above items, the hardware failure may have been occurred.
Please consult your local Mitsubishi representative.

■Communications cannot be performed at the set execution interval.

When communications cannot be performed at the set execution interval in the simple CPU communication function, check
the following items and take action.
Check item Action
Is another Ethernet function executed simultaneously in the CPU module Review the Ethernet function executed simultaneously in the CPU module
where the simple CPU communication function is set? where the simple CPU communication function is set.
Is the service processing load of the CPU module of the communication • When the communication destination is the model for which service
destination high? processing setting is available, increase the number of times and the time of
service processing of the communication destination.
• If the communication destination supports the COM(P) instruction and
CCOM instruction, incorporate the COM(P) instruction and CCOM
instruction into the sequence program of the communication destination.
• Review the execution interval.
Is the Ethernet communication load high? Or, is the communication quality Check the line status of Ethernet communication with the external device,
low? such as a cable, hub, and router, to reduce the load and improve the
communication quality. (Check the buffer memory Un\G100/Un\G101 (receive
packet count per unit time (one second)) or Un\G102/Un\G103 (send packet
count per unit time (one second)) of the CPU module (built-in Ethernet port
part) and reduce the load and improve the communication quality.)
Is the response from the SLMP-compatible device delayed? (When the • Check the function execution status of the communication destination
SLMP-compatible device (QnA-compatible 3E frame) is used) (SLMP-compatible device).
• Review the execution interval.

3 TROUBLESHOOTING
3.4 Troubleshooting by Symptom 325
 ■The update by reading and writing the device data is slow.
When the update by reading and writing the device data is slow in the simple CPU communications, check the following items
and take action.
Check item Action
The scan time of the CPU module where the simple CPU communication Incorporate the COM(P) instruction and CCOM instruction into the sequence
function is set is long. program of the CPU module where the simple CPU communication function is
set.

3 TROUBLESHOOTING
326 3.4 Troubleshooting by Symptom
When the redundant system function is used
■Communications cannot be performed with the external device.
When communications with the external device cannot be performed using the redundant system function, check the
following items and take action.
Check item Action
Are the control system IP address and the IP addresses of systems A and B Set the different connections for the each of control system IP address and IP
used together for the same connection? addresses of systems A and B.

■System switching cannot be performed normally. 3

When system switching cannot be performed normally by the redundant system function, check the following items and take
action.
Check item Action
Is the power supply module, CPU module, or redundant function module of Perform troubleshooting on the power supply module, CPU module, or
the standby system operating normally? redundant function module of the standby system. ( MELSEC iQ-R CPU
Module User's Manual (Startup))
Has a system switching request been issued to the CPU module? (Check Check an error on the Ethernet-equipped module mounted on the control
'Module number in the system switching request issued from the own system system CPU module, and correct the error.
network module' (SD1645) of the control system CPU module.)
In "Redundant System Settings" under "Application Settings", is "Enable" In "Redundant System Settings" under "Application Settings", select "Enable"
selected for "System Switching Request Issue at Communication Error"? for "System Switching Request Issue at Communication Error".
For "User Connection" or "System Connection" of "System Switching Request For "User Connection" or "System Connection" of "System Switching Request
Issue at Communication Error" in "Redundant System Settings" under Issue at Communication Error" in "Redundant System Settings" under
"Application Settings", is it specified that a system switching request is issued "Application Settings", specify that a system switching request is issued in the
in the target connection? target connection.
Do the settings of the engineering tool and the buffer memory details match? Write the set parameters to the CPU module, and reset the CPU module or
power off and on the system.
Has a cable disconnection been detected? Check that there is no error in the external device.
In "Redundant System Settings" under "Application Settings", is "Enable" In "Redundant System Settings" under "Application Settings", select "Enable"
selected for "System Switching Request Issuing at Disconnection Detection"? for "System Switching Request Issuing at Disconnection Detection".
In "Redundant System Settings" under "Application Settings", is the value set In "Redundant System Settings" under "Application Settings", correct the
for "Disconnection Detection Monitoring Time" correct? value set for "Disconnection Detection Monitoring Time".
In "Timer Settings for Data Communication" under "Application Settings", is In "Timer Settings for Data Communication" under "Application Settings",
the value set for "TCP ULP Timer" correct? correct the value set for "TCP ULP Timer".
In "External Device Configuration" under "Basic Settings", is "Existence In "External Device Configuration" under "Basic Settings", set "Existence
Confirmation" set to "KeepAlive"? Confirmation" to "KeepAlive".
In "Timer Settings for Data Communication" under "Application Settings", is In "Timer Settings for Data Communication" under "Application Settings",
the value set for "Destination Alive Check Start Interval Timer" correct? correct the value set for "Destination Alive Check Start Interval Timer".
In "Timer Settings for Data Communication" under "Application Settings", is In "Timer Settings for Data Communication" under "Application Settings",
the value set for "Destination Alive Check Interval Timer" correct? correct the value set for "Destination Alive Check Interval Timer".
In "External Device Configuration" under "Basic Settings", is "Communication In "External Device Configuration" under "Basic Settings", set
Method" set to "Broadcast Send"? "Communication Method" to an option other than "Broadcast Send", and set
"IP Address" in "Sensor/Device".
Has the connection with the external device been opened? (Check 'Open • If the connection with the external device is not opened, perform the open
completion signal' (Un\G1900000 to Un\G1900007)*1*2 processing.
• If an error occurs, check and eliminate the error cause.
For configuration using the redundant module group setting, are settings Correct the settings for "Redundant Module Group Setting" in the [I/O
made for "Redundant Module Group Setting" in the [I/O Assignment] tab of the Assignment] tab of the "System Parameter" window.
"System Parameter" window?
For configuration using the port group setting, are settings made for "Port In "Redundant System Settings" under "Application Settings", correct the
Group Setting" in "Redundant System Settings" under "Application Settings"? settings for "Port Group Setting".

*1 The buffer memory address is for when the network type of the RJ71EN71 is set to "Ethernet" and the P1 connector is used.
When using the P2 connector or the CPU module (built-in Ethernet port part), or setting the network type to "Q Compatible Ethernet",
refer to the following.
Page 355 Buffer Memory
*2 If the connection of only the external device is closed due to cable disconnection, personal computer restart, or other reasons, reopen
the connection using the same port used before the error occurred. The E71 does not close a connection if it receives an Active open
request again from the external device with a different IP address or a port number.

3 TROUBLESHOOTING
3.4 Troubleshooting by Symptom 327
 ■Communication fails at OPS connection.
When communication using the redundant system function is not possible at the time of an OPS connection, check the
following items and take action.
Check item Action
In "External Device Configuration" under "Basic Settings", is "OPS Connection Correct the settings for "External Device Configuration" under "Basic
Module" set for the external device? Settings".
In "External Device Configuration" under "Basic Settings", is the port number
setting correct?
In "External Device Configuration" under "Basic Settings", is the external
device IP address setting correct?

3 TROUBLESHOOTING
328 3.4 Troubleshooting by Symptom
3.5 List of Error Codes
This section lists the error codes, error details and causes, and action for the errors occur in the processing for data
communication between the Ethernet-equipped module and slave stations or caused by processing requests from the CPU
module on the own station.
Error codes are classified into major error, moderate error, and minor error, and can be checked in the [Error Information] tab
in the "Module Diagnostics" window of an Ethernet-equipped module. ( Page 300 Error Information)
Error
code
Error details and causes Action Detailed information
3
1080H The number of writes to the flash ROM has exceeded Replace the module. 
100000.
1120H Clock setting has failed when the system is powered on • Check if the time settings are correctly set in 
or the CPU module is reset. parameter.
• Check if the specified SNTP server is operating
normally and there is no failure on the network
accessing to the SNTP server computer.
1124H • The default gateway is not set correctly. • Correct the default gateway IP address. Parameter information
• The gateway IP address is not set correctly. • Set the same network address as that of the IP • Parameter type
• The default gateway/gateway IP address (network address. • I/O No.
address after the subnet mask) is different from that of • Parameter No.
the IP address of the own node. • Network No.
• Station No.
1128H The port number is incorrect. Correct the port number. 
1129H The port number of the external device is not set Correct the port number of the external device. 
correctly.
112CH The request using all stations specification has failed. Try the request using current station specification. 
112DH The data was sent to the external device while the IP • Correct the IP address of the external device in 
address setting of the device set in "External Device "External Device Configuration" under "Basic
Configuration" under "Basic Settings" was incorrect. Settings".
• Check that the IP address class of the external device
is set to A/B/C in "External Device Configuration"
under "Basic Settings".
112EH A connection could not be established in the open • Check the operation of the external device. 
processing. • Check if the open processing has been performed in
the external device.
• Correct the port number of the Ethernet-equipped
module, IP address/port number of the external device,
and opening method.
• When the firewall is set in the external device, check if
the access is permitted.
• Check if the Ethernet cable is disconnected.
1133H The response send failed during socket communications • Check the operation of the external device or switching 
or communications using the fixed buffer. hub.
• Since there may be congestion of packets on the line,
send data after a certain period of time.
• Check if the connection cable is disconnected.
• Check that there is no connection failure with the
switching hub.
• Execute the communication status test, and if the test
was completed with an error, take the corrective action.
• Execute the module communication test, and check
that there is no failure in the module.
1134H A TCP ULP timeout error has occurred in the TCP/IP • Check the operation of the external device. 
communication. (The external device does not send an • Correct the TCP ULP timeout value of the Ethernet-
ACK response.) equipped module.
• Since there may be congestion of packets on the line,
send data after a certain period of time.
• Check if the connection cable is disconnected.
1152H • The IP address is not set correctly. • Correct the IP addresses. Parameter information
• The same IP address has been set to port 1 and port 2 • Set different IP addresses for port 1 and port 2. • Parameter type
of the Ethernet-equipped module. • I/O No.
• Parameter No.
• Network No.
• Station No.

3 TROUBLESHOOTING
3.5 List of Error Codes 329
 Error Error details and causes Action Detailed information
code
1155H • The specified connection was already closed in TCP/IP • Perform the open processing for the specified 
communications. connection.
• Open processing is not performed. • Check if the open processing has been performed in
the external device.
1157H • The specified connection was already closed in UDP/ • Perform the open processing for the specified 
IP communications. connection.
• Open processing is not performed. • Check if the open processing has been performed in
the external device.
1158H • The receive buffer or send buffer is not sufficient. • Check the operation of the external device or switching 
• The window size of the external device is not sufficient. hub.
• When communications using a fixed buffer or socket
communications is used, increase the execution
frequency of the BUFRCV/SOCRCV instruction.
• When the value of 'State of receive buffer'
(Un\G1900030) is 0001H, reduce the frequency of data
receive from the external device.
1165H Data was not sent correctly with UDP/IP. • Check the settings for connection with the external 
device.
• Check the operation of the external device or switching
hub.
• Since there may be congestion of packets on the line,
send data after a certain period of time.
• Check if the connection cable is disconnected.
• Check that there is no connection failure with the
switching hub.
• Execute the PING test and communication status test,
and if the test was completed with an error, take the
corrective action.
1166H Data was not sent correctly with TCP/IP. • Check the settings for connection with the external 
device.
• Check the operation of the external device or switching
hub.
• Since there may be congestion of packets on the line,
send data after a certain period of time.
• Check if the connection cable is disconnected.
• Check that there is no connection failure with the
switching hub.
• Execute the PING test and communication status test,
and if the test was completed with an error, take the
corrective action.
• The close request may have been received from the
external device when the data was sent. Check
whether "TCP Status" of the corresponding connection
number is set to "Disconnected" with the Ethernet
diagnostics of the engineering tool.
1167H Unsent data found, but could not be sent. • Check the settings for connection with the external 
device.
• Check the operation of the external device or switching
hub.
• Since there may be congestion of packets on the line,
send data after a certain period of time.
• Check if the connection cable is disconnected.
• Check that there is no connection failure with the
switching hub.
• Execute the PING test and communication status test,
and if the test was completed with an error, take the
corrective action.
1180H • The same IP address has been set as the system A IP • Set different IP addresses for the system A IP address, Parameter information
address, system B IP address, and/or control system system B IP address, and control system IP address. • Parameter type
IP address. • Set the same network address for the system A IP • I/O No.
• Network addresses of the system A IP address, address, system B IP address, and control system IP • Parameter No.
system B IP address, and control system IP address address. • Network No.
are different. • Station No.

3 TROUBLESHOOTING
330 3.5 List of Error Codes
Error Error details and causes Action Detailed information
code
1801H IP address of the external device could not be acquired. • Correct the IP address in "Network/Station No. <-> IP Parameter information
information setting" under "Application Settings". • Parameter type
• Check if the network or station number of the external • I/O No.
device is correctly specified by using control data of the • Parameter No.
dedicated instruction. • Network No.
• Station No.
1811H An error was detected in the CPU module. Check the error of the CPU module and take action using 
the module diagnostics of the engineering tool.
1830H Number of reception requests of transient transmission
(link dedicated instruction) exceeded upper limit of
Lower the transient transmission usage frequency, and
then perform again.

3
simultaneously processable requests.
1845H Too many processings of transient transmission (link Correct the transient transmission execution count. 
dedicated instruction) and cannot perform transient
transmission.
20E0H The module cannot communicate with the CPU module. The hardware failure of the CPU module may have been 
occurred. Please consult your local Mitsubishi
representative.
2160H Overlapping IP addresses were detected. Check and correct the IP addresses. 
2220H • A network module having the firmware version not • Use a network module having the firmware version that Parameter information
supporting the simple CPU communication function is supports 512 simple CPU communication settings. • Parameter type
used. • Set the simple CPU communication setting within the
• The number of simple CPU communication settings is range from No.1 to No.64.
65 or more. • Check the detailed information of the error by
• The parameter setting is corrupted. executing module diagnostics using the engineering
tool, and write the displayed parameter. If the error
occurs again even after taking the above, the possible
cause is a hardware failure of the module. Please
consult your local Mitsubishi representative.
2221H The set value is out of the range. Check the detailed information (parameter information) of Parameter information
the error by executing module diagnostics using the • Parameter type
engineering tool, and correct the parameter setting • I/O No.
corresponding to the displayed number (parameter • Parameter No.
number). If the same error code is displayed again, the • Network No.
possible cause is a hardware failure of the data memory • Station No.
of the CPU module, a memory card, the I/O module, or
intelligent function module. Please consult your local
Mitsubishi representative.
2250H The protocol setting data stored in the CPU module is not Write the protocol setting data for the Ethernet-equipped Parameter information
for the Ethernet-equipped module. module to the CPU module. • Parameter type
24C0H An error was detected on the system bus. • Take measures to reduce noise. System configuration
to • Reset the CPU module, and run it again. If the error information
24C3H occurs again even after taking the above, the possible • I/O No.
cause is a hardware failure of the module, base unit, or • Base No.
extension cable. Please consult your local Mitsubishi • Slot No.
representative. • CPU No.
24C6H An error was detected on the system bus. • Take measures to reduce noise. 
• Reset the CPU module, and run it again. If the error
occurs again even after taking the above, the possible
cause is a hardware failure of the module, base unit, or
extension cable. Please consult your local Mitsubishi
representative.
3008H In the redundant system with redundant extension base When mounting a module on the extension base unit in Parameter information
unit, a module name other than "RJ71EN71(E+E)" and the redundant system with redundant extension base • Parameter type
"RJ71EN71(Q)" is set on the extension base. unit, select "RJ71EN71(E+E)" or "RJ71EN71(Q)" for the • I/O No.
module name in the "Add New Module" window. • Parameter No.
• Network No.
• Station No.
3019H • When mounting a module on the main base unit in the • When mounting a module on the main base unit in the Parameter information
redundant system, "Not Use" is set to "To Use or Not to redundant system, set "Use" to "To Use or Not to Use • Parameter type
Use Redundant System Settings" under "Application Redundant System Settings" under "Application
Settings". Settings".
• When mounting a module on the extension base unit in • When installing a module to the extension base unit in
the redundant system with redundant extension base the redundant system with redundant extension base
unit, "Use" is set to "To Use or Not to Use Redundant unit, set "Not Use" to "To Use or Not to Use Redundant
System Settings" under "Application Settings". System Settings" under "Application Settings".

3 TROUBLESHOOTING
3.5 List of Error Codes 331
 Error Error details and causes Action Detailed information
code
301AH When mounting a module on the extension base unit in When mounting a module on the extension base unit in Parameter information
the redundant system with redundant extension base the redundant system with redundant extension base • Parameter type
unit, "Enable" is set to "Dynamic Routing" under unit, Set "Disable" to "Dynamic Routing" under
"Application Settings". "Application Settings".
301BH When mounting a module on the extension base unit in When mounting a module on the extension base unit in Parameter information
the redundant system with redundant extension base the redundant system with redundant extension base • Parameter type
unit, "Use" is set to "IP Packet Transfer Function" under unit, set "Not Use" to "IP Packet Transfer Function" under
"Application Settings". "Application Settings".
3020H A value of the port number is out of range. • Check the each system port number registered in the 
buffer memory.
• If the error occurs again even after taking the above,
the possible cause is a hardware failure of the error
module. Please consult your local Mitsubishi
representative.
3040H Response data of the dedicated instruction cannot be • Increase the request interval. 
created. • Decrease the number of request nodes.
• Wait for a response to the previous request before
sending the next request.
• Correct the timeout value.
3060H The send/receive data size exceeds the allowable range. • Check and change the send data size of the Ethernet- 
equipped module or the external device.
• If the same error code is displayed again, the possible
cause is a hardware failure of the error module or CPU
module. Please consult your local Mitsubishi
representative.
3C00H A hardware failure has been detected. • Take measures to reduce noise. 
to • Reset the CPU module, and run it again. If the same
3C03H error code is displayed again, the possible cause is a
hardware failure of the error module. Please consult
your local Mitsubishi representative.
3C0FH A hardware failure has been detected. • Take measures to reduce noise. 
to • Reset the CPU module, and run it again. If the same
3C11H error code is displayed again, the possible cause is a
hardware failure of the error module. Please consult
your local Mitsubishi representative.
3C13H A hardware failure has been detected. Reset the CPU module, and run it again. If the same 
error code is displayed again, the possible cause is a
hardware failure of the error module. Please consult your
local Mitsubishi representative.
3C14H A hardware failure has been detected. Reset the CPU module, and run it again. If the same 
error code is displayed again, the possible cause is a
hardware failure of the error module or CPU module.
Please consult your local Mitsubishi representative.
3C2FH An error was detected in the memory. Reset the CPU module, and run it again. If the same 
error code is displayed again, the possible cause is a
hardware failure of the error module. Please consult your
local Mitsubishi representative.
3E01H Network type of the own station is unexpected setting. Rewrite the module parameter using the engineering 
tool. If the same error code is displayed again, the
possible cause is a hardware failure of the error module.
Please consult your local Mitsubishi representative.
4000H Errors detected by the CPU module ( MELSEC iQ-R CPU Module User's Manual (Application))
to
4FFFH
C001H • The IP address setting value of the E71 for the initial • Correct the IP address setting value for the initial 
processing is incorrect. processing.
• The setting value of the subnet mask field for the router • Check if the class of the IP address is set to A/B/C.
relay function is incorrect. • Correct the subnet mask setting value for the initial
processing.
C012H The port number used in a connection already opened is Correct the port numbers of the Ethernet-equipped 
set. (For TCP/IP) module and the external device.
C013H The port number used in a connection already opened is Correct the port numbers of the Ethernet-equipped 
set. (For UDP/IP) module and the external device.

3 TROUBLESHOOTING
332 3.5 List of Error Codes
Error Error details and causes Action Detailed information
code
C015H • The specified IP address of the external device for the • Correct the specified IP address of the external device 
open processing is incorrect. of the CONOPEN/OPEN instruction. Set the class to A/
• The specified IP address of the external device of the B/C.
dedicated instruction is incorrect. • Execute the dedicated instruction again after
correcting the specified IP address of the external
device.
C016H The open processing of the connection specified for • Check that none of the connections targeted for pairing 
pairing open has been already completed. open has been opened.
• Correct the combination of modules set for pairing
open. 3
C018H The specified IP address of the external device is Correct the specified IP address of the external device. 
incorrect.
C020H The send/receive data length exceeds the allowable • Correct the data length to be sent. 
range. • When the amount of data to be sent exceeds the limit,
divide the data into smaller chunks to send it.
C021H An abnormal end response was received for • Check the command/response type of the subheader. 
communications using the fixed buffer and random • Check the data length setting to be sent.
access buffer. • Check if the communication data code setting of the
Ethernet-equipped module meets the binary/ASCII of
the message to be sent.
C022H • A response could not be received within the response • Check the operation of the external device. 
monitoring timer value. • Correct the response monitoring timer value of the
• The connection with the external device was closed Ethernet-equipped module.
while waiting for a response. • Check the open status of the connection with the
external device.
C024H • Communications using the fixed buffer or • Check that there is no error in the connection number 
communications using a random access buffer were specification of the dedicated instruction.
executed when communication method is set to the • Correct the communication method of the connection
"Predefined Protocol" connection. with the external device.
• Predefined protocol was executed when
communication method is set to "Fixed Buffer
(Procedure Exist)" or "Fixed Buffer (No Procedure)"
connection.
C025H There is an error in the usage setting area when starting • When starting the open by using the CONOPEN/ 
the open processing by the CONOPEN/OPEN instruction OPEN instruction, correct the usage setting area of the
or I/O signals. control data.
• When starting the open by I/O signals, correct the
connection usage setting area of the buffer memory.
C026H An error has occurred when reading/writing/verifying the • Check that connection cable with the engineering tool 
predefined protocol setting data. is not disconnected and read/write/verify the
predefined protocol setting data again.
• Do not write data simultaneously when writing protocol
setting data from multiple engineering tools.
C027H Message send of the socket communications has failed. • Check the operation of the external device or switching 
hub.
• Since there may be congestion of packets on the line,
send data after a certain period of time.
• Check if the connection cable is disconnected.
• Check that there is no connection failure with the
switching hub.
• Execute the communication status test, and if the test
was completed with an error, take the corrective action.
• Execute the module communication test, and check
that there is no failure in the module.
• Check the IP address specified as the destination.
C028H Message send of the fixed buffer has failed. • Check the operation of the external device or switching 
hub.
• Since there may be congestion of packets on the line,
send data after a certain period of time.
• Check if the connection cable is disconnected.
• Check that there is no connection failure with the
switching hub.
• Execute the communication status test, and if the test
was completed with an error, take the corrective action.
• Execute the module communication test, and check
that there is no failure in the module.
• Check the IP address specified as the destination.

3 TROUBLESHOOTING
3.5 List of Error Codes 333
 Error Error details and causes Action Detailed information
code
C029H • Description of control data is not correct. • Correct the descriptions of the control data. 
• Open instruction was executed through open settings • Set the open settings parameters. Execute the OPEN
parameter even though parameters are not set. instruction through control data.
C035H The existence of the external device could not be • Check the operation of the external device. 
checked within the response monitoring timer value. • Correct the settings in "Timer Settings for Data
Communication" under "Application Settings" of the
Ethernet-equipped module.
• Check if the connection cable is disconnected.
C040H • Not all the data could be received within the response • Correct the data length of the communication data. 
monitoring timer value. • The packets may be crowded in the line, so send the
• Sufficient data for the data length could not be data again from the external device after a random
received. time has passed.
• The remaining part of the message divided at the TCP/
IP level could not be received within the response
monitoring timer value.
C050H When "ASCII" has been selected in the communication Check if ASCII code data which cannot be converted into 
data code setting of the Ethernet-equipped module, binary code data has been sent from the external device.
ASCII code data which cannot be converted into binary
code data has been received.
C051H • The number of read/write points from/to the device of Correct the number of read/write points and send the 
SLMP message is out of the allowable range in the SLMP message to the Ethernet-equipped module again.
CPU module (in units of words).
• The number of write points for the long counter of
SLMP message is not in two-word units.
C052H The number of read/write points from/to the device of Correct the number of read/write points and send the 
SLMP message is out of the allowable range in the CPU SLMP message to the Ethernet-equipped module again.
module (in units of bits).
C053H The number of read/write points from/to the random Correct the number of read/write points and send the 
device of SLMP message is out of the allowable range in SLMP message to the Ethernet-equipped module again.
the CPU module (in units of bits).
C054H The number of read/write points from/to the random Correct the number of read/write points and send the 
device of SLMP message is out of the allowable range in SLMP message to the Ethernet-equipped module again.
the CPU module (in units of words, double words).
C055H The read/write size from/to the file data of SLMP Correct the read/write size and send the SLMP message 
message is out of the allowable range. to the Ethernet-equipped module again.
C056H The read/write request exceeds the largest address. Correct the start address or the number of read/write 
points so that the request does not exceed the largest
address and send the data to the Ethernet-equipped
module again.
C057H The request data length of the SLMP message does not Check and correct the text or request data length, and 
match with the number of data in the character (a part of send the SLMP message to the Ethernet-equipped
text). module again.
C058H The request data length of the SLMP message after the Check and correct the text or request data length, and 
ASCII/binary conversion does not match with the number send the SLMP message to the Ethernet-equipped
of data in the character (a part of text). module again.
C059H • The specified command and subcommand of the • Check that there is no error in the specification of the 
SLMP message are incorrect command and subcommand of the SLMP message.
• The function which is not supported by the target • Check whether the function executed is supported by
device was executed. the target device.
• Check the version of the target device.
C05AH The Ethernet-equipped module cannot read/write data Correct the specification of the device to be read/written 
from/to the device specified by the SLMP message. and send the SLMP message to the Ethernet-equipped
module again.
C05BH The Ethernet-equipped module cannot read/write data Correct the specification of the device to be read/written 
from/to the device specified by the SLMP message. and send the SLMP message to the Ethernet-equipped
module again.
C05CH • The received request data of the SLMP message is • Correct the request data and send the SLMP message 
incorrect. to the Ethernet-equipped module again.
• The setting value of the communication setting when • Correct the setting details of when the iQSS function is
the iQSS function is executed is out of range. executed, and retry the operation.
• When the iQSS function is executed, the items of
communication setting which cannot be set on the
target device are set.
• When the iQSS function is executed, the required
setting items have not been set to the target device.

3 TROUBLESHOOTING
334 3.5 List of Error Codes
Error Error details and causes Action Detailed information
code
C05DH The "Monitor Request" command is received before the Register the monitoring data using "Monitor Registration/ 
monitor registration is performed by "Monitor Clear" command and perform monitoring.
Registration/Clear" command of the SLMP message.
C05EH • The time between received the SLMP message from • Increase the monitoring timer value. 
the Ethernet-equipped module and returned response • Check if the access destination is operating normally.
from the access destination exceeded the monitoring • Correct the network number or request destination
timer value set in the SLMP command. station number.
• An SLMP request message to which a command • When the access destination is a module with a
without a response message is specified is send to a
module with the other network number as an access
different network number, check if "Routing Setting" of
"CPU Parameter" is correctly set. 3
destination. • If the access destination is a module with a different
network number, check if the network number is not in
use.
• If an SLMP request message to which a command
without a response message is specified is send to a
module with the other network number as an access
destination, this error code is responded, which does
not mean failure.
C05FH This request cannot be executed to the access Correct the access destination. 
destination specified by the SLMP message.
C060H The request details for bit devices of the SLMP message Correct the request details and send the SLMP message 
is incorrect. to the Ethernet-equipped module again.
C061H • The request data length of the SLMP message does • Check and correct the text or request data length, and 
not match with the number of data in the character (a send the SLMP message to the Ethernet-equipped
part of text). module again.
• The write data length specified by the label write • Add the dummy data for one byte, and specify the
command is not even byte. length by even byte.
• When the iQSS function is executed, incorrect frame is • Check the operating status and connection status of
received. the target device of when the iQSS function is
executed.
• Check the connection of an Ethernet cable and a hub
of when the iQSS function is executed.
• Check the line status of Ethernet of when the iQSS
function is executed.
• Reset the CPU module and device to be targets of the
iQSS function, and retry the operation.
For the error occurred when the iQSS function is
executed, contact the manufacturer of the target device if
the above actions do not solve the problem.
C070H The device memory cannot be extended for the access • Correct the SLMP message to read/write data without 
destination specified by the SLMP message. the device memory set for extension.
• Specify the extension of the device memory only for an
Ethernet-equipped module mounted station and an R/
Q/QnACPU via CC-Link IE Controller Network,
MELSECNET/H, or MELSECNET/10.
C071H The number of device points for data read/write set for Correct the number of read/write points and send the 
modules other than an R/Q/QnACPU is out of the range. SLMP message to the Ethernet-equipped module again.
C072H The request details of the SLMP message is incorrect. • Check if the data can be requested to the access 
(For example, a request for data read/write in bit units destination.
has been issued to a word device.) • Correct the request details and send the SLMP
message to the Ethernet-equipped module again.
C073H The access destination of the SLMP message cannot Correct the request details of the SLMP message. 
issue this request. (For example, the number of double
word access points cannot be specified for modules other
than an R/Q/QnACPU.)

3 TROUBLESHOOTING
3.5 List of Error Codes 335
 Error Error details and causes Action Detailed information
code
C075H The request data length for the label access is out of • Correct the number of array points and the number of 
range. read/write points, and send the SLMP message to the
Ethernet-equipped module again.
• Correct the number of abbreviated label points and
send the SLMP message to the Ethernet-equipped
module again.
• Correct the label name length and send the SLMP
message to the Ethernet-equipped module again.
• Correct the label to shorten the label name and send
the SLMP message to the Ethernet-equipped module
again.
• Correct the read/write data length and send the SLMP
message to the Ethernet-equipped module again.
C081H The termination processing for the Ethernet-equipped Finish all the communications to perform the 
module that is involved with the reinitialization processing reinitialization processing of the Ethernet-equipped
is being performed, and arrival of link dedicated module.
instructions cannot be checked.
C083H The communication processing was abnormally ended in • Check if the relay station and external station are 
the link dedicated instruction communications operating normally.
• Check if there is an error with the cable connection
between the own station and the external station.
• If the line is heavily loaded, reduce the load, and retry
the operation.
• Increase the number of resends for the link dedicated
instructions and execute the operation.
C084H The communication processing was abnormally ended in • Check if the own station/relay station/external station is 
the link dedicated instruction communications operating normally.
• Check if there is an error with the cable connection
between the own station and the external station.
• Increase the TCP resend timer value of the Ethernet-
equipped module.
C085H The target station's channel specified by the link Correct the target station's channel of the SEND 
dedicated instruction SEND is currently in use. instruction.
C0B2H There is no sufficient space in the receive buffer or the • Increase the request interval (execution interval) and 
send buffer of the relay station or external station for the execute the operation.
MELSOFT connection, link dedicated instructions, or • Do not access through one station using the
SLMP. (Send  receive buffer full error) MELSOFT connection, link dedicated instruction, or
SLMP.
• Wait for a response to the previous request before
sending the next request.
• Correct the set value for "Timer Settings for Data
Communication" under "Application Settings" of the
Ethernet-equipped module.
C0B3H A request that cannot be processed was issued from the • Correct the request details. 
CPU module. • Correct the network number or request destination
station number.
C0B6H The channel specified by the dedicated instruction is out Correct the channel to a value within the allowable range 
of the range. of each dedicated instruction.
C0BAH Since the close processing is in execution using the Do no perform the send processing during the close 
CONCLOSE/CLOSE instruction, a send request cannot processing.
be accepted.
C0C4H The UINI instruction has been executed during Execute the UINI instruction after closing all connections. 
communications.
C0D0H The specified data length of the link dedicated instruction Correct the data length. 
is incorrect.
C0D1H The number of resends of the link dedicated instruction is Correct the number of resends. 
incorrect.
C0D3H The number of relay stations to communicate with other • Check if the specification (network number/station 
networks exceeds the allowable range. number) for the communication destination is correct.
• Check that number of relay stations accessing to the
communication destination is 7 or less.
• Correct the settings in the Network station number <->
IP information for the stations between the own station
and the communication destination.

3 TROUBLESHOOTING
336 3.5 List of Error Codes
Error Error details and causes Action Detailed information
code
C0D4H The number of relay stations to communicate with other • Check if the specification (network number/station 
networks exceeds the allowable range. number) for the communication destination is correct.
• Check that number of relay stations accessing to the
communication destination is 7 or less.
• Correct the settings in the Network station number <->
IP information for the stations between the own station
and the communication destination.
C0D5H The number of retries of the link dedicated instruction is Correct the number of retries. 

C0D6H
incorrect.
The network number or station number of the link Check if the specification (network number/station 
3
dedicated instruction is incorrect. number) for the communication destination is correct.
C0D7H Data were sent without the initial processing completed. After normal completion of the initial processing, perform 
the communications with the external device.
C0D8H The number of specified blocks exceeded the range. Correct the number of blocks. 
C0D9H The specified subcommand of the SLMP message is Correct the subcommand. 
incorrect.
C0DAH A response to the PING test could not be received within • Correct the IP address and host name of the target 
the time of the communication time check. module where the PING test is executed.
• Check that the initial processing of the Ethernet-
equipped module where the PING test is executed is
completed successfully.
C0DBH The IP address and host name of the target module Correct the IP address and host name of the target 
where the PING test is execute are incorrect. module where the PING test is executed.
C0DEH Data could not be received within the specified arrival • Correct the specified arrival monitoring time. 
monitoring time. • Correct the channel of the link dedicated instruction.
• Check if the sending station and relay station are
operating normally.
C101H A response could not be received from the DNS server. • Check the address of the DNS server. 
• Check that the data communications with the DNS
server is possible by using the Ping command.
• Check that the own station IP address and the DNS
server IP address are in the same class. (If not, check
the router setting.)
C1A2H • A response to the request could not be received. • Check and correct the response waiting time. 
• In transient transmission, the number of relay to other • Change the system configuration so that the number of
networks exceeded seven. relay stations may be seven or less.
• For the RECV instruction, execute again after
correcting the channels used by own station in the
control data.
• For the RECV instruction, check that 'RECV execution
request' (Un\G5301 b0 to b7) are on.
• Check the operation of the external device.
• Check if the external device supports the executed
function.
C1A4H • Any of the specified command, subcommand, or • Check that all of the specified command, 
request destination module I/O number of the SLMP subcommand, and request destination module I/O
message is incorrect. number of the SLMP message is correct.
• The specified clear function set by the ERRCLEAR • Correct the specified value for the clear function set by
instruction is incorrect. the ERRCLEAR instruction.
• The specified information to be read set by the ERRRD • Correct the specified value for the information to be
instruction is incorrect. read set by the ERRRD instruction.
• The Ethernet diagnostics, CC-Link IE Field Network • Connect it directly to the CPU module (built-in Ethernet
diagnostics, or CC-Link IE Controller Network port part) or use a USB cable to use the Ethernet
diagnostics was tried to be used when the engineering diagnostics, CC-Link IE Field Network diagnostics, or
tool is directly connected to the Ethernet port of the CC-Link IE Controller Network diagnostics.
RJ71EN71.
• The function which is not supported by the target
device was executed.
C1A5H The specified target station or clear target is incorrect. Correct the specified the target station or clear target. 
C1A6H The specified connection number is incorrect. Correct the setting value of the connection number. 
C1A7H The specified network number is incorrect. Correct the specified network number. 
C1A8H The specified station number is incorrect. Correct the specified station number. 
C1A9H The specified device number is incorrect. Correct the specified device number. 
C1AAH The specified device name is incorrect. Correct the specified device name. 

3 TROUBLESHOOTING
3.5 List of Error Codes 337
 Error Error details and causes Action Detailed information
code
C1ACH The specified number of resends is incorrect. Correct the number of resends. 
C1ADH The specified data length is incorrect. Correct the specified data length. 
C1AFH The specified port number is incorrect. Correct the specified port number 
C1B0H The open processing of the specified connection has • Do not perform the open processing to a connection 
been already completed. already opened.
• When communications with the external device cannot
be performed, perform the close processing before the
open processing.
C1B1H The open processing of the specified connection has not After completion of the open processing, perform the 
been completed. communication.
C1B2H The open or close processing using CONOPEN/ Execute again after the CONOPEN/CONCLOSE/OPEN/ 
CONCLOSE/OPEN/CLOSE instruction is being executed CLOSE instruction is completed.
in the specified connection.
C1B3H Another send or receive instruction is being executed in • Change the channel number. 
the specified channel. • Execute again after the send or receive instruction is
completed.
C1B4H The specified arrival monitoring time is incorrect. Set the arrival monitoring time to a value within the 
allowable range.
C1B8H The RECV instruction was executed for the channel that • Correct the execution condition of the RECV 
had not received data. instruction for the channel that had received data.
• Correct the specified channel of the RECV instruction.
C1B9H The CONOPEN/OPEN instruction cannot be executed Correct the specified connection. 
for the specified connection.
C1BAH The dedicated instruction was executed with the Execute the dedicated instruction after the initial 
initialization not completed. processing is completed.
C1BBH The target station CPU type of the link dedicated Correct the specified target station CPU type. 
instruction is incorrect.
C1BCH The target network number of the link dedicated • Execute the link dedicated instruction again after 
instruction is incorrect. correcting the network number.
• When specifying another network station, check if the
settings in "Routing Setting" of "CPU Parameter" are
made correctly.
C1BDH The target station number of the link dedicated instruction • Execute the link dedicated instruction again after 
is incorrect. correcting the target station number.
• When specifying another network station, check if the
settings in "Routing Setting" of "CPU Parameter" are
made correctly.
C1BEH The command code of the dedicated instruction is • Execute again after correcting the command code at 
incorrect. the request source.
• If the request source is on another network, check if
the routing parameters are set correctly, and take
action.
C1BFH The channel used in the dedicated instruction is • Execute again after correcting the used channel within 
incorrect. the allowable range at the request source.
• If the request source is on another network, check if
the routing parameters are set correctly, and take
action.
C1C0H The transient data is incorrect. • Correct the transient data at the request source, and 
retry the operation.
• If the error occurs again even after taking the above,
please consult your local Mitsubishi representative.
C1C1H The transient data is incorrect. • Correct the transient data at the request source, and 
retry the operation.
• If the error occurs again even after taking the above,
please consult your local Mitsubishi representative.
C1C2H When the dedicated instruction was executed, data was • Check the network status and take corrective action 
received twice. using the Ethernet diagnostics of the engineering tool.
• Check if the switching hub and the cables at the
request source are connected properly.
• If the request source is on another network, check if
the routing parameters are set correctly, and take
action.

3 TROUBLESHOOTING
338 3.5 List of Error Codes
Error Error details and causes Action Detailed information
code
C1C4H The arrival check of the link dedicated instruction was • Execute link dedicated instruction again after changing 
completed with an error. the execution type in the control data to "No arrival
acknowledgment".
• For the REQ instruction, execute again after correcting
request type.
C1C5H A dedicated instruction which the target station does not • Change the target station at the station that executed 
support was executed. the SEND instruction.
• If the error occurs again even after taking the above,

C1C6H The execution or error completion type of the dedicated

please consult your local Mitsubishi representative.
• Execute again after correcting the execution/error 
3
instruction is incorrect. completion type in the control data.
• If the problem cannot be resolved with the above
actions, the possible cause is a hardware failure of the
module. Please consult your local Mitsubishi
representative.
C1C7H The request type of the REQ instruction is incorrect. • Execute again after correcting the request type of the 
REQ instruction.
• If the problem cannot be resolved with the above
actions, the possible cause is a hardware failure of the
module. Please consult your local Mitsubishi
representative.
C1C8H The channel specified in the dedicated instruction is in Change the channels used by own station or the target 
use. station's channel in the control data.
C1C9H The device specification for the ZNRD/ZNWR instruction • Execute again after correcting the device specification 
is not correct. for the ZNRD/ZNWR instruction.
• If the problem cannot be resolved with the above
actions, the possible cause is a hardware failure of the
module. Please consult your local Mitsubishi
representative.
C1CAH The device specification for the ZNRD/ZNWR instruction • Execute again after correcting the device specification 
is not correct. for the ZNRD/ZNWR instruction.
• If the problem cannot be resolved with the above
actions, the possible cause is a hardware failure of the
module. Please consult your local Mitsubishi
representative.
C1CBH The transient data is incorrect. • Correct the transient data at the request source, and 
retry the operation.
• If the error occurs again even after taking the above,
please consult your local Mitsubishi representative.
C1CCH A response of the data length that exceeds the allowable • Execute again after correcting the request data to be 
range was received by the SLMPSND instruction. within the range.
• If the error occurs again even after taking the above,
please consult your local Mitsubishi representative.
C1CDH Message send of the SLMPSND instruction has failed. • Check the operation of the external device or switching 
hub.
• Since there may be congestion of packets on the line,
send data after a certain period of time.
• Check if the connection cable is disconnected.
• Check that there is no connection failure with the
switching hub.
• Execute the communication status test, and if the test
was completed with an error, take the corrective action.
• Execute the module communication test, and check
that there is no failure in the module.
• Check the IP address specified as the destination.
C1D0H The requested module I/O No. of the dedicated • Execute again after correcting the requested module I/ 
instruction is incorrect. O No. at the request source of the dedicated
instruction.
• If the error occurs again even after taking the above,
please consult your local Mitsubishi representative.
C1D2H The target station IP address of the link dedicated Execute the link dedicated instruction again after 
instruction is incorrect. correcting the IP address.

3 TROUBLESHOOTING
3.5 List of Error Codes 339
 Error Error details and causes Action Detailed information
code
C1D3H The dedicated instruction not supported by the • Check that the dedicated instruction can be executed 
communication method of the connection was executed. by the specified communication method. Correct the
program when the instruction cannot be executed.
• Check that there is no error in the connection
specification of the dedicated instruction.
C200H The remote password is incorrect. Correct the remote password, and unlock/lock the remote 
password again.
C201H The remote password status of the port used for After unlocking the remote password, perform 
communications is in the lock status. communications.
C202H When another station was accessed, the remote When accessing another station, do not set the remote 
password could not be unlocked. password on the relay station or access station, or do not
execute the remote password check on them.
C203H An error has occurred by checking the remote password. Correct the remote password, and unlock/lock the remote 
password again.
C204H The device is different from the one requesting the Request the lock processing of the remote password 
remote password unlock processing. from the external device that requested the unlock
processing of the remote password.
C205H When another station was accessed, the remote When accessing another station, do not set the remote 
password could not be unlocked. password on the relay station or access station, or do not
execute the remote password check on them.
C207H The file name has too many characters. Name the file with 255 characters or less. 
C208H The password length is out of range. Set the password within 6 to 32 characters. 
C400H The ECPRTCL instruction was executed when • Execute the ECPRTCL instruction after Predefined 
Predefined protocol ready is not completed. protocol ready has turned on.
• Execute the ECPRTCL instruction after rewriting the
protocol setting data to the Ethernet-equipped module.
• If the error occurs again even after taking the above,
the possible cause is a hardware failure of the module.
Please consult your local Mitsubishi representative.
C401H The protocol number specified by the ECPRTCL • Correct the specified protocol number and execute the 
instruction is not registered in the Ethernet-equipped instruction again.
module. • Register the protocol specified protocol number to the
Ethernet-equipped module.
C402H An error has occurred in the protocol setting data Correct the protocol setting data and register it again. 
registered in the Ethernet-equipped module and the
ECPRTCL instruction cannot be executed.
C403H Multiple dedicated instructions was executed • Do not execute the dedicated instructions which do not 
simultaneously. support simultaneous execution.
• Correct the specified connection number and execute
the dedicated instruction again.
C404H The protocol being executed by the ECPRTCL instruction Check the canceled protocol in the control data of the 
was canceled. ECPRTCL instruction (execution count result) and
eliminate the cause of the cancellation.
C405H The protocol number specified by the ECPRTCL Correct the specified protocol number. 
instruction is incorrect.
C406H The continuous protocol execution count of the Correct the continuous protocol execution count. 
ECPRTCL instruction is incorrect.
C407H The connection number specified by the ECPRTCL • Correct the specified connection number and execute 
instruction is incorrect. the protocol again.
• Correct the specified connection number in "External
Device Configuration" under "Basic Settings" of the
Ethernet-equipped module and execute the protocol
again.
C408H An error has occurred when the send processing of the • Check the operation of the external device or switching 
predefined protocol using the ECPRTCL instruction was hub.
performed. • Since there may be congestion of packets on the line,
send data after a certain period of time.
• Check if the connection cable is disconnected.
• Check that there is no connection failure with the
switching hub.
• Execute the communication status test, and if the test
was completed with an error, take the corrective action.
• Execute the module communication test, and check
that there is no failure in the module.

3 TROUBLESHOOTING
340 3.5 List of Error Codes
Error Error details and causes Action Detailed information
code
C410H Receive waiting time of the ECPRTCL instruction timed • Check if the cable is disconnected. 
out. • Correct the specified connection number in "External
Device Configuration" under "Basic Settings" of the
Ethernet-equipped module and execute the protocol
again.
• Check that there is no error in the external device.
• Check that the sending from the external device is not
interrupted.
• Check that there is no data lost due to a receive error.
• Check that there is no error in the data (packet) sent by 3
the external device.
C412H The data which cannot be converted from ASCII to binary • Check that there is no data lost due to a receive error. 
code was received. • Check that there is no error in the data (packet) sent by
the external device.
C413H The number of digits of the received data using the • Check that there is no data lost due to a receive error. 
predefined protocol is not sufficient. • Check that there is no error in the data (packet) sent by
the external device.
C414H The number of digits of the received data using the • Check that there is no data lost due to a receive error. 
predefined protocol is incorrect. • Check that there is no error in the data (packet) sent by
the external device.
C417H The data length or data quantity of the received data • Check the maximum allowable data length and specify 
using the predefined protocol is out of range. the maximum length or less in the data length storage
area.
• Check the maximum allowable data quantity, and
specify the maximum quantity or less in the data
quantity storage area.
C420H Protocol setting data write has failed. • Write the data again. 
• If the error occurs again even after taking the above,
the possible cause is a hardware failure of the
specified module. Please consult your local Mitsubishi
representative.
C421H Writing was requested to the module whose flash ROM Replace the module because the number of writes 
write count had exceeded the limit. exceeded the limit.
C430H Protocol setting data was written during the ECPRTCL Do not write the protocol setting data during the 
instruction execution. ECPRTCL instruction execution.
C431H Close processing of the connection was performed • Check the operation of the external device. 
during the ECPRTCL instruction execution. • Check the connection open status with the external
device.
• Open the connection with the external device again
and execute the instruction.
C440H A communication error has occurred with an engineering • Execute the communication status test, and if the test 
to tool when executing the Ethernet diagnostics. was completed with an error, take the corrective action.
C44FH • Execute the module communication test, and check
that there is no failure in the module.
C610H The module processing was completed with an error. • Execute the communication status test, and if the test 
to was completed with an error, take the corrective action.
C613H • Execute the module communication test, and check
that there is no failure in the module.
C614H The module processing was completed with an error. • Correct the setting value of "Response Monitoring 
Timer" under "FTP Server Settings" because writing
files may require a longer time.
• Execute the communication status test, and if the test
was completed with an error, take the corrective action.
• Execute the module communication test, and check
that there is no failure in the module.
C615H The module processing was completed with an error. • Execute the communication status test, and if the test 
was completed with an error, take the corrective action.
• Execute the module communication test, and check
that there is no failure in the module.

3 TROUBLESHOOTING
3.5 List of Error Codes 341
 Error Error details and causes Action Detailed information
code
C616H Connection of the control port to the FTP server failed. • Correct the IP address setting of the Ethernet- 
equipped module.
• Correct the FTP server setting.
• Check connection with the FTP server.
• Disconnect the user session on the FTP server.
• Data communications may not be ready. Wait for a
while and perform the operation again.
• Correct the TCP ULP timeout value because
connecting to the FTP server may require a longer
time.
C617H Disconnection of the control port to the FTP server failed. • Correct the FTP server setting. 
• Check connection with the FTP server.
C618H Login to the FTP server failed. • Correct the FTP server setting (login user name and 
login password).
• Check the FTP server software settings (login user
name and login password).
• Check the data communication history of the FTP
server software.
C619H Execution of the FTP command to the FTP server failed. • Correct the FTP server setting (folder path and 
connection method).
• Check that the user has a right to access (read/write)
the FTP server or the specified file.
• Check that the specified folder path exists in the FTP
server.
• Check that the specified file exists in the FTP server.
• Correct the FTP server software settings.
• Check the data communication history of the FTP
server software.
• Check that the file access is being performed in the
FTP server.
C620H Connection of the data transfer port to the FTP server • Check connection with the FTP server. 
failed. • Correct the FTP server setting (connection method).
• If a firewall is active or the proxy server is on the
connection path, consult a network administrator about
the settings.
C621H Disconnection of the data transfer port to the FTP server • Check connection with the FTP server. 
failed. • Correct the FTP server setting (connection method).
• If a firewall is active or the proxy server is on the
connection path, consult a network administrator about
the settings.
C622H An error has occurred during file transfer to the FTP • Delete unnecessary files on the FTP server to increase 
server. free space.
• Check connection with the FTP server.
• The specified file may be used in the other process.
Wait for a while and perform the operation again.
• The Ethernet line may be congested. Wait for a while
and perform the operation again.
C623H A response could not be received from the FTP server. • Check that the FTP server name is registered in the 
DNS.
• Change the FTP server name to the IP address, and
check the operation.
• Check that the data communications with the FTP
server is possible by using the Ping command.
C700H The module processing was completed with an error. • Execute the communication status test, and if the test 
was completed with an error, take the corrective action.
• Execute the module communication test, and check
that there is no failure in the module.
C701H The IP address (network number) setting is incorrect in Check the IP address (network number). 
communications using the IP packet transfer function.
C702H The IP address (station number) setting is incorrect in Check the IP addresses (station number). 
communications using the IP packet transfer function.
C703H The destination IP address (upper level) setting is Check the destination IP address. 
incorrect in communications using the IP packet transfer
function.

3 TROUBLESHOOTING
342 3.5 List of Error Codes
Error Error details and causes Action Detailed information
code
C704H The destination IP address (lower level) setting is Check the destination IP address. 
incorrect in communications using the IP packet transfer
function.
C705H The module processing was completed with an error. • Execute the communication status test, and if the test 
to was completed with an error, take the corrective action.
C707H • Execute the module communication test, and check
that there is no failure in the module.
C708H When communicating with the IP packet transfer When communicating with the IP packet transfer 
function, "IP Packet Transfer Function" is set as "Not
Use" in "IP Packet Transfer Setting" under "Application
function, set "IP Packet Transfer Function" as "Not Use"
in "IP Packet Transfer Setting" under "Application
3
Settings" of the Ethernet-equipped module connected Settings".
with the Ethernet devices.
C709H A communication error has occurred with MELSOFT • Do no execute the specification of the direct 
direct connection. connection when direct connection is not used.
• Do not power off the system or reset the CPU module,
or remove the cable during the communications when
direct connection is used.
C810H Remote password authentication has failed when Set a correct password and perform password 
required. authentication again.
C811H Remote password authentication has failed when Set a correct password and perform password 
required. authentication again one minute later.
C812H Remote password authentication has failed when Set a correct password and perform password 
required. authentication again 5 minutes later.
C813H Remote password authentication has failed when Set a correct password and perform password 
required. authentication again 15 minutes later.
C814H Remote password authentication has failed when Set a correct password and perform password 
required. authentication again 60 minutes later.
C815H Remote password authentication has failed when Set a correct password and perform password 
required. authentication again 60 minutes later.
C816H The security function was activated and remote Set a correct password and perform password 
password authentication cannot be performed. authentication again after a certain period of time.
C840H Number of transient request exceeded the upper limit of • Pause the transient transmission temporarily, and retry 
simultaneously processable requests. the operation.
• Lower the transient transmission usage frequency, and
then perform again.
C842H The routing setting is not set to reach to the destination • Execute the link dedicated instruction again after 
network number. correcting the target network number and station
number.
• When the dynamic routing is used, check that
communication path to the destination network number
is set.
• When the dynamic routing is not used, or a module of
the series other than MELSEC iQ-R is included, retry
the operation after correcting the settings in "Routing
Setting" of "CPU Parameter".
C843H Link dedicated instruction that cannot be executed on the Check the network type of the Ethernet-equipped 
network type were executed. module.
C844H Incorrect frame is received. Correct the request data at the transient request source, 
• Unsupported pre-conversion protocol and retry the operation.
• Unsupported frame type
• Application header variable part
• Application header HDS
• Application header RTP
• Read command not requiring response
C860H The CPU response monitoring timer issued a timeout When the CPU module has an error, eliminate it. 
during MODBUS/TCP communications.
C861H A request message containing an unsupported function Check the supported function code, and correct the 
code was received during MODBUS/TCP request message issued on the master side.
communications.
C862H A request message containing an unsupported sub-code Check the supported sub-code and correct the request 
was received during MODBUS/TCP communications. message issued on the master side.

3 TROUBLESHOOTING
3.5 List of Error Codes 343
 Error Error details and causes Action Detailed information
code
C863H The MODBUS device assignment parameters have not Set the MODBUS device assignment parameters for the 
been set for the MODBUS device specified in the MODBUS device specified in the request message.
received request message in MODBUS/TCP
communications.
C864H The range of the MODBUS devices specified in the Set the MODBUS device assignment parameters so that 
received request message exceeded the setting range of they include the range of the MODBUS devices specified
the MODBUS device assignment parameters in in the request message.
MODBUS/TCP communications.
C865H The range of the MODBUS devices specified in the Check the MODBUS devices specified on the master 
received request message exceeded the upper limit for side that sent the request message.
the MODBUS devices in MODBUS/TCP
communications. (The upper limit of extended file register
is 10000 and the upper limit of the MODBUS device is
65536.)
C866H The start address and the number of access points of the • Check if the specified value exceeds the maximum 
MODBUS device specified in the received request number of access points for the function.
message are incorrect in MODBUS/TCP • Ensure that the number of access points is not 0.
communications. • When accessing a MODBUS device to which a long
device is assigned in the MODBUS device assignment
parameters, check that the start address and the
number of access points are specified in units of two
points.
• When accessing a MODBUS device to which LTN or
LSTN is assigned in the MODBUS device assignment
parameters, check that the start address and the
number of access points are specified in units of four
points.
C867H The number of write points specified for the received Check the number of write points and the number of 
request message does not match with the specified bytes specified on the master side that issued the
number of bytes in MODBUS/TCP communications. request message.
C868H The received write data size does not match with the Check the write data size and the number of bytes 
specified number of bytes in MODBUS/TCP specified on the master side that issued the request
communications. message.
C869H The value of the reference type specified in the received Check the reference type specified on the master side 
request message (FC20, FC21) is incorrect in MODBUS/ that issued the request message.
TCP communications.
C86AH The content of the data part of the received request Check the data part of the request message on the 
message is incorrect in MODBUS/TCP communications. master side that issued the message.
The size of the received request message is smaller than
the minimum size required for the function code, or larger
than the maximum size required for the function code.
C86BH The content of MBAP header of the received request Check the content of the request message on the master 
message is incorrect in MODBUS/TCP communications. side that issued it.
C86CH The number of received request messages exceeded the Wait for a while and retry sending on the master side that 
number that can be received simultaneously. issued it. (The number of request messages that can be
received simultaneously is 64 for each of PORT1 and
PORT2.)
CEE0H The devices supporting iQSS which were detected by the Execute the other function after the automatic detection 
other peripheral device, or other iQSS functions were of connected devices is completed.
executed while the automatic detection of connected
devices is in process.
CEE1H Incorrect frame is received. • Check the operating status and connection status of 
the target device.
• Check the connection of an Ethernet cable and a hub.
• Check the line status of Ethernet.
• Reset the CPU module and target device, and retry the
operation.
If the above actions do not solve the problem, contact the
manufacturer of the target device.

3 TROUBLESHOOTING
344 3.5 List of Error Codes
Error Error details and causes Action Detailed information
code
CEE2H Incorrect frame is received. • Check the operating status and connection status of 
the target device.
• Check the connection of an Ethernet cable and a hub.
• Check the line status of Ethernet.
• Reset the CPU module and target device, and retry the
operation.
If the above actions do not solve the problem, contact the
manufacturer of the target device.

CF10H Incorrect frame is received. • Check the operating status and connection status of
the target device. 3
• Check the connection of an Ethernet cable and a hub.
• Check the line status of Ethernet.
• Reset the CPU module and target device, and retry the
operation.
If the above actions do not solve the problem, contact the
manufacturer of the target device.
CF20H • The setting value of the communication setting is out of Correct the setting details, and retry the operation. 
range.
• The items of communication setting which cannot be
set on the target device are set.
• The required setting items have not been set to the
target device.
CF30H The parameter which is not supported by the target Check the version of the target device. 
device was specified.
CF31H Incorrect frame is received. • Check the operating status and connection status of 
the target device.
• Check the connection of an Ethernet cable and a hub.
• Check the line status of Ethernet.
• Reset the CPU module and target device, and retry the
operation.
If the above actions do not solve the problem, contact the
manufacturer of the target device.
CF70H An error occurred on the Ethernet communication path. • Check the operation of the target device. 
• Check if the connection cable is disconnected.
CF71H A timeout error has occurred. • Check the operation of the target device. Since there 
may be congestion of packets on the line, perform the
operation after a while.
• Correct the setting details of when the iQSS function is
executed, and retry the operation.
• Check the connection of an Ethernet cable and a hub.
CFB0H Sending data failed due to a resend timeout while the • Check the operation of the communication destination. 
simple CPU communication. • Check the line status with the communication
destination such as a cable, hub, and router.
• Check and correct the latency time.
• Correct the IP address and Ethernet address of the
communication destination.
• Check if the communication destination has the ARP
function, and communicate with a communication
destination that has the ARP function.
• When the communication destination is a MODBUS/
TCP-compatible device and "Write" is set to
"Communication Pattern", do not specify Input or Input
Register for the transmission destination.
• The type of the communication destination depends on
the firmware version of the network module. Check the
firmware version. ( Page 215 Restrictions
applicable depending on versions)

3 TROUBLESHOOTING
3.5 List of Error Codes 345
 Error Error details and causes Action Detailed information
code
CFB1H Communications with the communication destination do • Check if the connection cable is disconnected. 
not executed while the simple CPU communication. Or • Check the line status with the communication
the external device is disconnected. destination such as a cable, hub, and router.
• Correct the IP address and Ethernet address of the
communication destination.
• Check if the communication destination has the ARP
function, and communicate with a communication
destination that has the ARP function.
• The type of the communication destination depends on
the firmware version of the network module. Check the
firmware version. ( Page 215 Restrictions
applicable depending on versions)
CFB2H The same specified own station port number is already • Correct the specified port number so that it is not 
used for the simple CPU communication. duplicate.
• It depends on the firmware version whether the
network module can make multiple settings for the
same communication destination. Check the firmware
version of the network module.
CFB3H The request to the CPU module has failed while the • Check and correct the monitoring time of the CPU 
simple CPU communication. Response Monitoring Timer.
• Check and correct the device/label access service
processing setting.
CFB4H An abnormal response was received from the Check the abnormal response code in the buffer memory. 
communication destination while the simple CPU
communication.
CFB5H The frame received from the communication destination • Check the operation of the communication destination. 
is incorrect while the simple CPU communication. Check the line status with the communication
destination such as a cable, hub, and router.
CFBDH The device specified as the communication destination is Correct the address of "Type", "Start", "End" of the device 
out of specification range for the simple CPU specified as the communication destination in "Simple
communication. PLC Communication Setting" under "Application
settings".
CFBEH A communication error has occurred with an engineering • Execute the communication status test, and if the test 
tool during the simple CPU communication diagnostics. was completed with an error, take the corrective action.
Execute the module communication test, and check
that there is no failure in the module.
CFBFH The simple CPU communication cannot be executed. • When the communication destination is the MELSEC- 
Q (Ethernet module) or MELSEC-L (Ethernet module),
set the network number and station number in "Own
Node Settings" under "Basic Settings".
• Take measures to reduce noise.
• It depends on the firmware version of the network
module whether the on-request communications is
possible or not. Check the firmware version of the
network module.
• The type of the communication destination depends on
the firmware version of the network module. Check the
firmware version. ( Page 215 Restrictions
applicable depending on versions)
• If the same error code is displayed even after
executing the simple CPU communication again,
please consult your local Mitsubishi representative.

3 TROUBLESHOOTING
346 3.5 List of Error Codes
3.6 List of Parameter Numbers
This section lists the parameter numbers displayed in the module diagnostics.

System Parameter
Item Parameter No.
Redundant Module Group Setting 0400H

3
Basic Settings
Item Parameter No.
Own Node Settings Parameter Setting Method 7100H
IP Address IP Address A012H
Subnet Mask A012H
Default Gateway A013H
Communications by Network No./Station No. (RJ71EN71 and RnENCPU (network part)) 7100H
Communications by Network No./Station No. (CPU module (built-in Ethernet port part)) 7A20H
Setting Method 7100H
Network Number 7100H
Station No. 7100H
Transient Transmission Group No. A010H
Enable/Disable Online Change A030H
Communication Data Code A031H
Opening Method A031H
CC-Link IEF Basic Setting Network Configuration Settings 7A00H
Refresh Settings 7420H
External Device Configuration A031H

Application Settings
Item Parameter No.
Frame Settings A036H
Communication Speed 7100H
FTP Server Settings A037H
FTP Client Settings A03DH
DNS Settings A03EH
Web Server Settings A035H
MODBUS/TCP Settings To Use or Not to Use MODBUS/TCP Setting A0B0H
CPU Response Monitoring Timer A0B0H
Device Assignment A0B2H
Simple PLC Communication Setting (RJ71EN71 and RnENCPU (network part)) A0E1H
Simple PLC Communication Setting (CPU Module (built-in Ethernet port part)) 7A10H
Time Setting A039H
Timer Settings for Data Communication A038H
Security IP Filter Settings A03AH
Disable Direct Connection with MELSOFT A034H
Do Not Respond to CPU Module Search A034H
Gateway Parameter Settings A013H
Network/Station No. <-> IP information setting A033H
Interrupt Settings Interrupt Occurrence Factor A014H
Channel No./Connection No. A014H
Detection Method A014H
Interrupt Pointer A014H
Comment A015H

3 TROUBLESHOOTING
3.6 List of Parameter Numbers 347
 Item Parameter No.
IP Packet Transfer Setting A030H
Network Dynamic Routing A030H
Module Operation Mode 7100H
Redundant System Settings System B IP Address A03CH
System B Station Number 7110H
Use of Control System IP Address A03CH
Control System IP Address A03CH
System B Module Operation Mode 7110H
Port Group Setting A03CH
System Switching Request Issuing at Disconnection Detection A03CH
Disconnection Detection Monitoring Time A03CH
System Switching Request Issue at Communication Error A03CH
User Connection A03CH
System Connection A03CH
Built-in database access setting A0E0H

3 TROUBLESHOOTING
348 3.6 List of Parameter Numbers
3.7 Event List
This section lists the events occurs in Ethernet.
Event Event type Description Cause
code
00100 System Link-up Link-up has occurred when the network cable connected to the
external device was connected.
00110 TCP connection communication start/end Communication using the TCP connection with the external device was
started or ended.
3
00120 FTP connection start/stop FTP connection was started from the external device or disconnected.
00130 Receive frame error • Receive frame error was detected.
• The Ethernet-equipped module was connected to the CC-Link IE
Controller Network or CC-Link IE Field Network.
00140 Time synchronization failure No response was returned from the time information server (SNTP
server) and time synchronization has failed.
00400 Restart by a program The module was restarted by the program.
00800 Link-down Link-down has occurred when network cable connected to the external
device was disconnected.
00901 Data length error The send/receive data length exceeds the allowable range.
00902 Initial processing error Socket communications or communications using the fixed buffer were
executed before the initial processing was completed.
00903 Specification IP address error Broadcast address was specified to the IP address of the external
device other than Unpassive.
00904 Socket communications transmission failed Message send of the socket communications has failed.
00905 Not opened • The open processing of the external device has not been completed.
• The connection with the external device is closed.
00906 Alive check error The existence of the external device could not be checked within the
response monitoring timer value.
00907 Divided messages receive timeout error • Not all the data could be received within the response monitoring
timer value.
• Sufficient data for the data length could not be received.
• The remaining part of the message divided at the TCP/IP level could
not be received within the response monitoring timer value.
00908 IP assembly timeout error An IP assembly timeout error has occurred. (The remaining part of the
divided data could not be received and a timeout has occurred.)
00909 TCP specification port number error The port number used in a connection already opened is set. (For TCP/
IP)
0090A UDP specification port number error The port number used in a connection already opened is set. (For
UDP/IP)
00A00 System switching request issued A system switching request occurred.
00C02 Access abnormal response of another station • Abnormal response was returned from another station when
accessing another station.
• Abnormal response was returned to another station when accessed
from another station.
00D00 Fixed buffer response send failed Response send of the communications using the fixed buffer has
failed.
00D01 Pairing open error The open processing of the connection specified for pairing open has
been already completed.
00D02 End code error An abnormal end response was received for communications using the
fixed buffer and random access buffer.
00D03 Response monitoring timeout error • A response could not be received within the response monitoring
timer value.
• The connection with the external device was closed while waiting for
a response.
00D04 Fixed buffer send failed Message send of the fixed buffer has failed.
00D05 Random access communication error The parameter (start address and data word) of the data received by
the random access communication is faulty.

3 TROUBLESHOOTING
3.7 Event List 349
 Event Event type Description Cause
code
10200 Security Remote password lock The lock processing of the remote password was performed.
10201 Remote password unlock successful The unlock processing of the remote password was succeeded.
10202 Remote password unlock failed The unlock processing of the remote password has failed.
10300 Access from IP restricted with IP filter setting Accessed from IP address restricted with the IP filter setting.
10500 Forced invalidation setting Forced invalidation setting was executed.
10501 Forced invalidation cancel Forced invalidation setting was canceled.
24E00 Operation ERR LED off execution The ERR LED has turned off using the output signal Y17 of the
module.

3 TROUBLESHOOTING
350 3.7 Event List
3.8 End Codes Returned to an External Device During
Data Communications
The following table lists the error codes stored in the end code appended to a response during data communications.
End Error details and causes Action
code
00H Normal completion When each communication is normally completed, the error code

02H The device range destination of devices to be read/written from/to is incorrect.

00H is stored.
Check and correct the specified start device and the number of
3
points.
50H • Codes for the command/response type of a subheader are not within the • Check and correct the command/response type set for the
specifications. external device. (Because the Ethernet-equipped module
• In communications using the fixed buffer, if the data length setting is smaller automatically adds the command/response type, the user
than the actual data amount, the remaining data is processed as the second setting is not required.)
data. In this case, a subheader undefined command type error may occur. • Check and correct the data length.

51H In communications using the random access buffer, the start address specified Check and correct the specified start address.
by an external device has been set outside the range from 0 to 6143.
52H • In communications using the random access buffer, the start address and • Check and correct the start address and the number of data
the number of data words (depending on the setting when reading data) words.
specified by an external device exceeds the range from 0 to 6143. • Correct the number of read/write points.
• Data by the number of words specified (text) cannot be sent in one frame.
(The data length value or the amount of the text sent/received are not in the
allowable range.)
54H When "ASCII" has been selected for "Communication Data Code" in "Own Check and correct the data sent from the external device.
Node Settings" under "Basic Settings" of the Ethernet-equipped module, ASCII
code data which cannot be converted into binary code data has been sent from
the external device.
55H • When "Disable All (SLMP)" has been selected for "Enable/Disable Online • Set "Enable All (SLMP)" for "Enable/Disable Online Change" in
Change" in "Own Node Settings" under "Basic Settings" of the Ethernet- "Own Node Settings" under "Basic Settings" of the Ethernet-
equipped module, the external device requested a data write while the CPU equipped module, and write data. (However, a parameter,
module was running. program, or microcomputer program cannot be written while the
• While the CPU module was running, the external device requested for CPU module is running.)
writing a parameter or program. • Set the switch on the CPU module to STOP and write the data.
56H The external device specified an incorrect device. Correct the device specification.
57H • The number of points for a command specified by an external device • Correct the specified points or the start address (device number
exceeds the maximum number of processing points (number of processes and step number).
that can be executed per communication) for each process. • Check the data length of the command and set the data again.
• Addresses from the start address (start device number and start step • Register the monitoring data.
number) to the specified number of points exceed the largest addresses • Data cannot be read from/written to an area with an address
(device number and step number) for each process. after the last address. Correct the specified address.
• The byte length of a command is not within the range defined by the • Correct the block number.
specifications. • In the block number specification of the extension file register,
• When data is written, the set number of write data points is different from the do not specify a block number exceeding the range of the
specified number of points. corresponding memory cassette size.
• A monitor request was issued even though monitoring data is not registered.
58H • The start address (start device number and start step number) of a • Correct the value to the one within the range that can be
command specified by an external device has been set outside the range specified for each process.
that can be specified. • Correct the block number.
• For data read/write in a microcomputer program or file register (R), values • Correct the device specification.
exceeding the CPU module parameter setting range has been specified. • Correct the command or specified device.
• A block number specified for an extension file register does not exist.
• A file register cannot be specified.
• A word device has been specified for the command for bit devices.
• The start number of bit devices has been specified using a value other than a
multiple of 16 in the command for word devices.
59H An extension file register cannot be specified. Correct the device specification.
60H The communication time between the CPU module and the Ethernet-equipped Increase the response monitoring timer value.
module exceeded the response monitoring timer value.
63H In communications using the fixed buffer, the remote password of the port for • After unlocking the remote password using the SLMP, perform
the destination Ethernet module is in the lock status. communications using the fixed buffer.
• Exclude ports used for communications using the fixed buffer
from the targets of the remote password check.

3 TROUBLESHOOTING
3.8 End Codes Returned to an External Device During Data Communications 351
 APPENDICES
Appendix 1 Module Label
The I/O signals and buffer memory of the Ethernet-equipped module can be set using module label.

Structure of the module label

The module label name is defined with the following structure.
"Instance name"_"Module number"."Port number"."Label name"
"Instance name"_"Module number"."Label name"
"Instance name"_"Module number"."Port number"."Label name"_D
"Instance name"_"Module number"."Label name"_D

Ex.
EN71_EE_1.stPort1.wnVal_IP_Address_D[0]

■Instance name
The following are the instance names of the RJ71EN71 and the RnENCPU (network part) corresponding to each network type
setting.
Model Instance name
RJ71EN71 RnENCPU (network part)
RJ71EN71 (E+E)  EN71_EE
RJ71EN71 (CCIEC) _RJ71EN71(CCIEC) EN71_C
RJ71EN71 (E+CCIEC) _RJ71EN71(E+IEC) EN71_EC
RJ71EN71 (CCIEF) _RJ71EN71(CCIEF) EN71_F
RJ71EN71 (E+CCIEF) _RJ71EN71(E+IEF) EN71_EF

■Module number
A sequential number starting with "1" for identifying a module from the one with the same instance name.

■Port number
The port number is added to the module labels corresponding the buffer memory areas other than P1/P2 common area.
The following lists the characters corresponding to the port numbers
Port number Added characters
P1 stPort1
P2 stPort2

■Label name
A label name unique to the module.

■_D
This symbol indicates that the module label is for direct access. The label without "_D" is for refresh. The following are the
differences between refresh and direct access.
Type Description Access timing
Refresh The values read/written from/to the module labels are reflected to the module at refresh. The At refresh
execution time of the program can be shortened.
Direct access The values read/written from/to the module labels are reflected to the module immediately. At writing to or reading from
Although the execution time of the program is longer than the one at refresh, the responsiveness is the module label
improved.

APPX
352 Appendix 1 Module Label
Appendix 2 I/O Signals
This section describes the I/O signals of the RJ71EN71 and the RnENCPU (network part) for the CPU module. The I/O signal
assignment of when the start I/O number of the RJ71EN71 or the RnENCPU (network part) is "0" is listed below.

List of I/O signals

The following table lists I/O signals. The device X is an input signal from the RJ71EN71 and the RnENCPU (network part) to
the CPU module. The device Y is an input signal from the CPU module to the RJ71EN71 and the RnENCPU (network part).
The I/O signals differ when the network type is Ethernet, and Q-compatible Ethernet.

When network type is "Ethernet"

■Input signals
Device number Signal name
X0*1 Module failure
(On: Module failure, Off: Module normal)
X1 to XE Use prohibited
XF Module READY
(On: Module operation possible, Off: Module operation not possible)
X10 to X1F Use prohibited

*1 This signal enabled when the network type for the P2 connector is set to "CC-Link IE Field". For details on operation of the signal, refer
to the following.
MELSEC iQ-R CC-Link IE Field Network User's Manual (Application)

■Output signals
Device number Signal name
Y0 to Y1F Use prohibited

A
• Do not use (turn on) any "use prohibited" signals as an input or output signal to the CPU module. Doing so
may cause malfunction of the programmable controller system.
• For the I/O signals of the P2 connector when its network type is set to "CC-Link IE Control", refer to the
following.
MELSEC iQ-R CC-Link IE Controller Network User's Manual (Application)
• For the I/O signals of the P2 connector when its network type is set to "CC-Link IE Field", refer to the
following.
MELSEC iQ-R CC-Link IE Field Network User's Manual (Application)

APPX
Appendix 2 I/O Signals 353
 When the network type is "Q Compatible Ethernet"
With the Q-compatible Ethernet, the same I/O signals as the MELSEC-Q series Ethernet interface module can be used
except in some cases.
The following table lists the differences of the RJ71EN71 and MELSEC-Q series Ethernet interface modules.
Device number RJ71EN71 QJ71E71-100
X1C ERR LED lit confirmation*1 COM.ERR. LED lit confirmation
(On: Lit, Off: ) (On: Lit, Off: )
Y17 ERR LED off request*2 COM.ERR. LED off request
(On: At off request, Off: ) (On: At off request, Off: )
Y19 Use prohibited Initial request signal
(On: At request, Off: )

*1 This signal turns on when the ERR LED or the P ERR LED of P1 is on or flashing.
*2 The details are listed below.
 The ERR LED and the P ERR LED of P1 turn off.
 An off request continues to be issued while this signal is on. (Does not light while on.)
 The event is registered in event history when off process is executed.
 This signal cannot be turned off during major error.
 If the error occurs again after turning on and off, the ERR LED or P ERR LED will turn on or flash according to the details of the error.
 Currently occurring error and error history information is not cleared.
For details on the other I/O signals, refer to the following.
 Q Corresponding Ethernet Interface Module User's Manual (Basic)

Do not use (turn on) any "use prohibited" signals as an input or output signal to the CPU module. Doing so
may cause malfunction of the programmable controller system.

APPX
354 Appendix 2 I/O Signals
Appendix 3 Buffer Memory
The buffer memory is used for the following applications.
Module Application
RJ71EN71, RnENCPU (network part) Exchanges data with the CPU module.
CPU module (built-in Ethernet port part) Stores data such as the setting values for the Ethernet function and monitor values, and data used for
exchanging data with the multiple CPU function.

Buffer memory values are reset to default when the CPU module is reset or the system is powered off.

List of buffer memory addresses

RJ71EN71, RnENCPU (network part)

The following table lists the buffer memory addresses of the RJ71EN71 and the RnENCPU (network part) when the network
type is set to "Ethernet".
For the addresses of the RJ71EN71 when the network type is set to "Q Compatible Ethernet", refer to the following.
( Page 366 When using the RJ71EN71 (network type: Q-compatible Ethernet))
P1 address (P2 address*1) Application Name
Decimal Hexadecimal
0 to 3 0H to 3H (1E8480H to System area
(2000000 to 2000003) 1E8483H)
4 to 5 4H to 5H (1E8484H to Own node setting status Own node IP address
(2000004 to 2000005) 1E8485H) storage area
6 to 13 6H to DH (1E8486H to System area
(2000006 to 2000013) 1E848DH)
14 to 15 EH to FH (1E848EH to Subnet mask
(2000014 to 2000015) 1E848FH)
16 to 17 10H to 11H (1E8490H to System area
(2000016 to 2000017) 1E8491H) A
18 to 19 12H to 13H (1E8492H to Default gateway IP address
(2000018 to 2000019) 1E8493H)
20 to 27 14H to 1BH (1E8494H to System area
(2000020 to 2000027) 1E849BH)
28 to 30 1CH to 1EH (1E849CH Own node MAC address
(2000028 to 2000030) to 1E849EH)
31 1FH (1E849FH) Own node network number
(2000031)
32 20H (1E84A0H) Station number
(2000032)
33 21H (1E84A1H) Transient transmission group number
(2000033)
34 22H (1E84A2H) Send frame setting
(2000034)
35 23H (1E84A3H) Jumbo frame setting
(2000035)
36 24H (1E84A4H) Communication speed setting
(2000036)
37 25H (1E84A5H) Auto-open UDP port number
(2000037)
38 26H (1E84A6H) MELSOFT connection TCP port number
(2000038)
39 27H (1E84A7H) MELSOFT connection UDP port number
(2000039)
40 28H (1E84A8H) MELSOFT direct connection port number
(2000040)
41 to 99 29H to 63H (1E84A9H to System area
(2000041 to 2000099) 1E84E3H)

APPX
Appendix 3 Buffer Memory 355
 P1 address (P2 address*1) Application Name
Decimal Hexadecimal
100 to 163 64H to A3H (1E84E4H Connection status storage Connection No.1 latest error code to Connection No.64 latest error code
(2000100 to 2000163) to 1E8523H) area
164 to 999 A4H to 3E7H (1E8524H System area
(2000164 to 2000999) to 1E8867H)
1000 3E8H System port latest error FTP server latest error code
(2001000) (1E8868H) code storage area
1001 3E9H MELSOFT direct connection latest error code
(2001001) (1E8869H)
1002 to 4999 3EAH to 1387H System area
(2001002 to 2004999) (1E886AH to 1E9807H)
5000 to 5001 1388H to 1389H Status for each protocol IP packet Received packet total count
(2005000 to 2005001) (1E9808H to 1E9809H)
5002 to 5003 138AH to 138BH Received packet checksum error
(2005002 to 2005003) (1E980AH to 1E980BH) discard count
5004 to 5005 138CH to 138DH Sent packet total count
(2005004 to 2005005) (1E980CH to 1E980DH)
5006 to 5021 138EH to 139DH System area
(2005006 to 2005021) (1E980EH to 1E981DH)
5022 to 5023 139EH to 139FH Simultaneous transmission error
(2005022 to 2005023) (1E981EH to 1E981FH) detection count (receive buffer full count)
5024 to 5028 13A0H to 13A4H System area
(2005024 to 2005028) (1E9820H to 1E9824H)
5029 13A5H Receive abort count
(2005029) (1E9825H)
5030 to 5039 13A6H to 13AFH System area
(2005030 to 2005039) (1E9826H to 1E982FH)
5040 to 5041 13B0H to 13B1H ICMP packet Received packet total count
(2005040 to 2005041) (1E9830H to 1E9831H)
5042 to 5043 13B2H to 13B3H Received packet checksum error
(2005042 to 2005043) (1E9832H to 1E9833H) discard count
5044 to 5045 13B4H to 13B5H Sent packet total count
(2005044 to 2005045) (1E9834H to 1E9835H)
5046 to 5047 13B6H to 13B7H Received echo request total count
(2005046 to 2005047) (1E9836H to 1E9837H)
5048 to 5049 13B8H to 13B9H Sent echo reply total count
(2005048 to 2005049) (1E9838H to 1E9839H)
5050 to 5051 13BAH to 13BBH Sent echo request total count
(2005050 to 2005051) (1E983AH to 1E983BH)
5052 to 5053 13BCH to 13BDH Received echo reply total count
(2005052 to 2005053) (1E983CH to 1E983DH)
5054 to 5079 13BEH to 13D7H System area
(2005054 to 2005079) (1E983EH to 1E9857H)
5080 to 5081 13D8H to 13D9H TCP packet Received packet total count
(2005080 to 2005081) (1E9858H to 1E9859H)
5082 to 5083 13DAH to 13DBH Received packet checksum error
(2005082 to 2005083) (1E985AH to 1E985BH) discard count
5084 to 5085 13DCH to 13DDH Sent packet total count
(2005084 to 2005085) (1E985CH to 1E985DH)
5086 to 5119 13DEH to 13FFH System area
(2005086 to 2005119) (1E985EH to 1E987FH)
5120 to 5121 1400H to 1401H UDP packet Received packet total count
(2005120 to 2005121) (1E9880H to 1E9881H)
5122 to 5123 1402H to 1403H Received packet checksum error
(2005122 to 2005123) (1E9882H to 1E9883H) discard count
5124 to 5125 1404H to 1405H Sent packet total count
(2005124 to 2005125) (1E9884H to 1E9885H)

APPX
356 Appendix 3 Buffer Memory
P1 address (P2 address*1) Application Name
Decimal Hexadecimal
5126 to 5159 1406H to 1427H Status for each protocol System area
(2005126 to 2005159) (1E9886H to 1E98A7H)
5160 to 5161 1428H to 1429H Receiving error Framing error count
(2005160 to 2005161) (1E98A8H to 1E98A9H)
5162 to 5163 142AH to 142BH Receive FIFO overflow count
(2005162 to 2005163) (1E98AAH to 1E98ABH)
5164 to 5165 142CH to 142DH CRC error count
(2005164 to 2005165) (1E98ACH to 1E98ADH)
5166 to 5188 142EH to 1444H System area
(2005166 to 2005188) (1E98AEH to 1E98C4H)
5189 1445H Own node operation LED status
(2005189) (1E98C5H) status storage area
5190 1446H System area
(2005190) (1E98C6H)
5191 1447H Hub connection status area Communication mode
(2005191) (1E98C7H)
5192 1448H Connection status
(2005192) (1E98C8H)
5193 1449H Communication speed
(2005193) (1E98C9H)
5194 144AH Disconnection count
(2005194) (1E98CAH)
5195 to 5199 144BH to 144FH System area
(2005195 to 2005199) (1E98CBH to 1E98CFH)
5200 1450H IP address duplication status Same IP address detection flag
(2005200) (1E98D0H) storage area
5201 to 5203 1451H to 1453H MAC address of the station already
(2005201 to 2005203) (1E98D1H to 1E98D3H) connected to the network
5204 to 5206 1454H to 1456H MAC address of the station with the IP
(2005204 to 2005206) (1E98D4H to 1E98D6H) address already used
A
5207 to 5300 1457H to 14B4H System area
(2005207 to 2005300) (1E98D7H to 1E9934H)
5301 14B5H Area for sending/receiving RECV instruction execution request
(2005301) (1E9935H) instructions
5302 to 5322 14B6H to 14CAH System area
(2005302 to 2005322) (1E9936H to 1E994AH)
5323 14CBH Link dedicated instruction ZNRD instruction execution result
(2005323) (1E994BH)
5324 14CCH System area
(2005324) (1E994CH)
5325 14CDH ZNWR instruction execution result
(2005325) (1E994DH)
5326 to 5625 14CEH to 15F9H System area
(2005326 to 2005625) (1E994EH to 1E9A79H)
5626 15FAH Remote password lock Remote password lock status (connection No.1 to 16)
(2005626) (1E9A7AH) status storage area
5627 15FBH Remote password lock status (connection No.17 to 32)
(2005627) (1E9A7BH)
5628 15FCH Remote password lock status (connection No.33 to 48)
(2005628) (1E9A7CH)
5629 15FDH Remote password lock status (connection No.49 to 64)
(2005629) (1E9A7DH)
5630 15FEH Remote password lock status system port
(2005630) (1E9A7EH)
5631 to 5645 15FFH to 160DH System area
(2005631 to 2005645) (1E9A7FH to 1E9A8DH)

APPX
Appendix 3 Buffer Memory 357
 P1 address (P2 address*1) Application Name
Decimal Hexadecimal
5646 160EH Forced connection Forced connection invalidation (connection No.1 to 16)
(2005646) (1E9A8EH) invalidation setting area
5647 160FH Forced connection invalidation (connection No.17 to 32)
(2005647) (1E9A8FH)
5648 1610H Forced connection invalidation (connection No.33 to 48)
(2005648) (1E9A90H)
5649 1611H Forced connection invalidation (connection No.49 to 64)
(2005649) (1E9A91H)
5650 1612H Forced connection invalidation system port
(2005650) (1E9A92H)
5651 to 8299 1613H to 206BH System area
(2005651 to 2008299) (1E9A93H to 1EA4EBH)
8300 206CH Predefined protocol Connection No.1 Protocol execution status
(2008300) (1EA4ECH) support function execution
status check area
8301 206DH System area
(2008301) (1EA4EDH)
8302 to 8317 206EH to 207DH Received data verification result (receive
(2008302 to 2008317) (1EA4EEH to 1EA4FDH) packet No.1 to 16)
8318 207EH (1EA4FEH) Protocol execution count
(2008318)
8319 (2008319) 207FH Protocol cancellation specification
(1EA4FFH)
8320 to 8335 2080H to 208FH System area
(2008320 to 2008335) (1EA500H to 1EA50FH)
8336 to 8875 2090H to 22ABH Connection No.2 to Connection No.16
(2008336 to 2008875) (1EA510H to 1EA72BH)
8876 to 10999 22ACH to 2AF7H System area
(2008876 to 2010999) (1EA72CH to 1EAF77H)
11000 2AF8H Time setting function Time setting function operation result
(2011000) (1EAF78H) (SNTP) area
11001 2AF9H Time setting function execution (Year)
(2011001) (1EAF79H) time
11002 2AFAH (Month)
(2011002) (1EAF7AH)
11003 2AFBH (Day)
(2011003) (1EAF7BH)
11004 2AFCH (Hour)
(2011004) (1EAF7CH)
11005 2AFDH (Minute)
(2011005) (1EAF7DH)
11006 2AFEH (Second)
(2011006) (1EAF7EH)
11007 2AFFH (Day of the week)
(2011007) (1EAF7FH)
11008 2B00H Time setting function required response time
(2011008) (1EAF80H)
11009 2B01H Time setting function (SNTP client) execution
(2011009) (1EAF81H)
11010 to 11049 2B02H to 2B29H System area
(2011010 to 2011049) (1EAF82H to 1EAFA9H)
11050 to 11051 2B2AH to 2B2BH IP packet transfer function IP packet transfer latest data volume
(2011050 to 2011051) (1EAFAAH to 1EAFABH) area
11052 to 11053 2B2CH to 2B2DH IP packet transfer maximum data volume
(2011052 to 2011053) (1EAFACH to
1EAFADH)
11054 to 11499 2B2EH to 2CEBH System area
(2011054 to 2011499) (1EAFAEH to 1EB16BH)
11500 to 11514 2CECH to 2CFAH Dynamic routing function Communication path determination status
(2011500 to 2011514) (1EB16CH to 1EB17AH) area

APPX
358 Appendix 3 Buffer Memory
P1 address (P2 address*1) Application Name
Decimal Hexadecimal
11515 to 11599 2CFBH to 2D4FH System area
(2011515 to 2011599) (1EB17BH to 1EB1CFH)
11600 to 11663 2D50H to 2D8FH Remote password function Connection No.1 continuous unlock failure count to Connection No.64
(2011600 to 2011663) (1EB1D0H to 1EB20FH) monitoring area continuous unlock failure count
11664 2D90H Auto-open UDP port continuous unlock failure count
(2011664) (1EB210H)
11665 2D91H MELSOFT transmission port (UDP/IP) continuous unlock failure count
(2011665) (1EB211H)
11666 2D92H MELSOFT transmission port (TCP/IP) continuous unlock failure count
(2011666) (1EB212H)
11667 2D93H FTP transmission port (TCP/IP) continuous unlock failure count
(2011667) (1EB213H)
11668 2D94H MELSOFT direct connection continuous unlock failure count
(2011668) (1EB214H)
11669 2D95H System area
(2011669) (1EB215H)
11670 to 11671 2D96H to 2D97H Area for both systems Control system IP address
(2011670 to 2011671) (1EB216H to 1EB217H) identical IP address
setting function
11672 to 11699 2D98H to 2DB3H System area
(2011672 to 2011699) (1EB218H to 1EB233H)
11700 to 11701 2DB4H to 2DB5H IP address change IP Address IP address
(2011700 to 2011701) (1EB234H to 1EB235H) function area
11702 to 11703 2DB6H to 2DB7H Subnet mask
(2011702 to 2011703) (1EB236H to 1EB237H)
11704 to 11705 2DB8H to 2DB9H Default Gateway
(2011704 to 2011705) (1EB238H to 1EB239H)
11706 2DBAH Communications by Network Network number
(2011706) (1EB23AH) No./Station No.
11707
(2011707)
2DBBH
(1EB23BH)
Station number
A
11708 2DBCH Transient transmission group number
(2011708) (1EB23CH)
11709 2DBDH IP address storage area write request
(2011709) (1EB23DH)
11710 2DBEH IP address storage area write error
(2011710) (1EB23EH)
11711 2DBFH IP address storage area writing error cause
(2011711) (1EB23FH)
11712 2DC0H IP address storage area clear request
(2011712) (1EB240H)
11713 2DC1H IP address storage area clear error
(2011713) (1EB241H)
11714 2DC2H IP address storage area clear error cause
(2011714) (1EB242H)
11715 2DC3H IP address change function operating status
(2011715) (1EB243H)
11716 to 19999 2DC4H to 4E1FH System area
(2011716 to 2019999) (1EB244H to 1ED29FH)
20000 to 26143 4E20H to 661FH Random access buffer Random access buffer
(2020000 to 2026143) (1ED2A0H to 1EEA9FH) area
26144 to 65534 6620H to FFFEH System area
(2026144 to 2065534) (1EEAA0H to 1F847EH)
65535 FFFFH Network type information Network type information
(2065535) (1F847FH) area

APPX
Appendix 3 Buffer Memory 359
 P1 address (P2 address*1) Application Name
Decimal Hexadecimal
65536 10000H Area for communication Fixed buffer No.1 Data length
(2065536) (1F8480H) using a fixed buffer
65537 to 70655 10001H to 113FFH Fixed buffer data
(2065537 to 2070655) (1F8481H to 1F987FH)
70656 to 147455 11400H to 23FFFH Fixed buffer No.2 to Fixed buffer (The bit configuration is the same as
(2070656 to 2147455) (1F9880H to 20C47FH) No.16 Fixed buffer No.1)
147456 to 720895 24000H to AFFFFH System area
(2147456 to 2720895) (20C480H to 29847FH)
720896 B0000H Error log area for Number of errors
(2720896) (298480H) MODBUS/TCP function
720897 B0001H Error log write pointer
(2720897) (298481H)
720898 B0002H Error log 1 Detail error code
(2720898) (298482H)
720899 B0003H Abnormal response code
(2720899) (298483H)
720900 B0004H Function code
(2720900) (298484H)
720901 B0005H Own station port number
(2720901) (298485H)
720902 to 720903 B0006H to B0007H Destination IP address
(2720902 to 2720903) (298486H to 298487H)
720904 B0008H Destination port number
(2720904) (298488H)
720905 B0009H System area
(2720905) (298489H)
720906 to 721153 B000AH to B0101H Error log 2 to Error log 32 (Same as Error log 1)
(2720906 to 2721153) (29848AH to 298581H)
721154 to 721895 B0102H to B03E7H System area
(2721154 to 2721895) (298582H to 298867H)
721896 to 721899 B03E8H to B03EBH Simple CPU Request to start communication at request for each setting number
(2721896 to 2721899) (298868H to 29886BH) communication area
721900 to 721903 B03ECH to B03EFH Request to stop fixed interval communication for each setting number
(2721900 to 2721903) (29886CH to 29886FH)
721904 to 721907 B03F0H to B03F3H Request to restart fixed interval communication for each setting number
(2721904 to 2721907) (298870H to 298873H)
721908 to 721911 B03F4H to B03F7H Execution status flag for each setting number
(2721908 to 2721911) (298874H to 298877H)
721912 to 721915 B03F8H to B03FBH Preparation completion for each setting number
(2721912 to 2721915) (298878H to 29887BH)
721916 to 721935 B03FCH to B040FH System area
(2721916 to 2721935) (29887CH to 29888FH)
721936 to 721999 B0410H to B044FH Simple CPU communication status for each setting number
(2721936 to 2721999) (298890H to 2988CFH)
722000 to 722063 B0450H to B048FH Simple CPU communication error code for each setting number
(2722000 to 2722063) (2988D0H to 29890FH)
722064 to 722127 B0490H to B04CFH Abnormal response code for each setting number
(2722064 to 2722127) (298910H to 29894FH)

APPX
360 Appendix 3 Buffer Memory
P1 address (P2 address*1) Application Name
Decimal Hexadecimal
722128 to 722191 B04D0H to B050FH Simple CPU Execution interval (current value) for each setting number
(2722128 to 2722191) (298950H to 29898FH) communication area
722192 to 722499 B0510H to B0643H System area
(2722192 to 2722499) (298990H to 298AC3H)
722500 to 1246787 B0644H to 130643H User setting area
(2722500 to 3246787) (298AC4H to 318AC3H)
1246788 to 1247299 130644H to 130843H System area
(3246788 to 3247299) (318AC4H to 318CC3H)
1247300 to 1247327 130844H to 130859H Request to start communication at request for each setting number
(3247300 to 3247327) (318CC4H to 318CDFH)
1247328 to 1247355 130860H to 13087BH Request to stop fixed interval communication for each setting number
(3247328 to 3247355) (318CE0H to 318CFBH)
1247356 to 1247383 13087CH to 130897H Request to restart fixed interval communication for each setting number
(3247356 to 3247383) (318CFCH to 318D17H)
1247384 to 1247411 130898H to 1308B3H Execution status flag for each setting number
(3247384 to 3247411) (318D18H to 318D33H)
1247412 to 1247439 1308B4H to 1308CFH Preparation completion for each setting number
(3247412 to 3247439) (318D34H to 318D4FH)
1247440 to 1247459 1308D0H to 1308E3H System area
(3247440 to 3247459) (318D50H to 318D63H)
1247460 to 1247907 1308E4H to 130AA3H Simple CPU communication status for each setting number
(3247460 to 3247907) (318D64H to 318F23H)
1247908 to 1248355 130AA4H to 130C63H Simple CPU communication error code for each setting number
(3247908 to 3248355) (318F24H to 3190E3H)
1248356 to 1248803 130C64H to 130E23H Abnormal response code for each setting number
(3248356 to 3248803) (3190E4H to 3192A3H)
1248804 to 1249251 130E24H to 130FE3H Execution interval (current value) for each setting number
(3248804 to 3249251) (3192A4H to 319463H)
1249252 to 1899999 130FE4H to 1CFFDDFH System area
(3249252 to 3899999) (319464H to 3B825FH)
A
*1 The P2 address cannot be used for the RnENCPU (network part).

APPX
Appendix 3 Buffer Memory 361
 ■P1/P2 common area
Address Application Name
Decimal Hexadecimal
1900000 to 1900007 1CFDE0H to 1CFDE7H Ethernet PORT1/2 common information Open completion signal
1900008 to 1900015 1CFDE8H to 1CFDEFH Open request signal
1900016 to 1900023 1CFDF0H to 1CFDF7H Socket/fixed buffer reception status signal
1900024 1CFDF8H Initial status
1900025 1CFDF9H Initial error code
1900026 to 1900029 1CFDFAH to 1CFDFDH System area
1900030*1 1CFDFEH Receive buffer status storage area State of receive buffer
1900031 to 1901001 1CFDFFH to 1D01C9H System area
1901002 1D01CAH Predefined protocol support function Predefined protocol ready
check area
1901003 to 1901019 1D01CBH to 1D01DBH System area
1901020 1D01DCH Predefined protocol setting data check Predefined protocol setting data Protocol number
area error information
1901021 1D01DDH Setting type
1901022 1D01DEH Packet number
1901023 1D01DFH Element number
1901024 1D01E0H Number of registered predefined protocols
1901025 to 1901031 1D01E1H to 1D01E7H System area
1901032 to 1901047 1D01E8H to 1D01F7H Predefined protocol registration
1901048 to 1901999 1D01F8H to 1D05AFH System area
1902000 to 1904047 1D05B0H to 1D0DAFH Send/receive area for predefined Send/receive area for predefined protocol support function
protocol support function
1904048 to 1921023 1D0DB0H to 1D4FFFH System area
1921024 to 1929215 1D5000H to 1D6FFFH User setting area for MODBUS/TCP function
1929216 to 1950031 1D7000H to 1DC14FH System area
1950032 to 1950039 1DC150H to 1DC157H Discard received data at CPU STOP setting area

1950040 to 1999999 1DC158 to 1E847FH System area

*1 Availability for the buffer memory depends on the firmware version. ( Page 436 Added and Enhanced Functions)

• Do not write any data to the system area. Doing so may cause malfunction of the programmable controller
system.
• If the value in an area of one word in size becomes equal to or higher than 65536, the count stops at 65535
(FFFFH).

APPX
362 Appendix 3 Buffer Memory
CPU module (built-in Ethernet port part)
The following table lists the buffer memory addresses related to the Ethernet function of the CPU module (built-in Ethernet
port part).
Address Application Name
Decimal Hexadecimal
50 to 51 32H to 33H Own node setting status Own node IP address
storage area
60 to 61 3CH to 3DH Subnet mask
64 to 65 40H to 41H Default gateway IP address
74 to 76 4AH to 4CH Own node MAC address
77 4DH Own node network number
78 4EH Station number
80 50H Send frame setting
82 52H Communication speed setting
83 53H Auto-open UDP port number
84 54H MELSOFT connection TCP port number
85 55H MELSOFT connection UDP port number
86 56H MELSOFT direct connection port number
87 57H Network number/Station number setting status
100 64H Communication load Receive packet count per unit time Receive packet count (current) per unit time (one
status of the built-in (one second) second)
Ethernet port
101 65H Receive packet count (maximum) per unit time (one
second)
102 66H Send packet count per unit time Send packet count (current) per unit time (one second)
103 67H (one second) Send packet count (maximum) per unit time (one
second)
130 to 145 82H to 91H Connection status Connection No.1 latest error code to Connection No.16 latest error code
storage area
146 92H System port latest error
code storage area
FTP server latest error code A
147 93H MELSOFT direct connection latest error code
148 94H FTP client latest error code
150 to 151 96H to 97H Status for each protocol IP packet Received packet total count
152 to 153 98H to 99H Received packet checksum error discard count
154 to 155 9AH to 9BH Sent packet total count
172 to 173 ACH to ADH Simultaneous transmission error detection count
(Receive buffer full count)
179 B3H Receive abort count
182 to 183 B6H to B7H ICMP packet Received packet total count
184 to 185 B8H to B9H Received packet checksum error discard count
186 to 187 BAH to BBH Sent packet total count
188 to 189 BCH to BDH Received echo request total count
190 to 191 BEH to BFH Sent echo reply total count
192 to 193 C0H to C1H Sent echo request total count
194 to 195 C2H to C3H Received echo reply total count
196 to 197 C4H to C5H TCP packet Received packet total count
198 to 199 C6H to C7H Received packet checksum error discard count
200 to 201 C8H to C9H Sent packet total count
204 to 205 CCH to CDH UDP packet Received packet total count
206 to 207 CEH to CFH Received packet checksum error discard count
208 to 209 D0H to D1H Sent packet total count
224 to 225 E0H to E1H Receiving error Framing error count
226 to 227 E2H to E3H Receive FIFO overflow count
228 to 229 E4H to E5H CRC error count

APPX
Appendix 3 Buffer Memory 363
 Address Application Name
Decimal Hexadecimal
242 F2H Own node operation Hub connection status area Communication mode
status storage area
243 F3H Connection status
244 F4H Communication speed
245 F5H Disconnection count
251 FBH IP address duplication status Same IP address detection flag
storage area
252 to 254 FCH to FEH MAC address of the station already connected to the
network
255 to 257 FFH to 101H MAC address of the station with the IP address already
used
270 10EH Remote password lock Remote password lock status connection No.1 to 16
status storage area
271 10FH Remote password lock status system port
275 113H Discard received data at Discard received data connection No.1 to 16
CPU STOP setting area
280 118H Forced connection Forced connection invalidation connection No.1 to 16
invalidation setting area
281 119H Forced connection invalidation system port
290 122H Time setting function Time setting function operation result
(SNTP) area
291 123H Time setting function execution (Year)
time
292 124H (Month)
293 125H (Day)
294 126H (Hour)
295 127H (Minute)
296 128H (Second)
297 129H (Day of the week)
298 12AH Time setting function required response time
299 12BH Time setting function (SNTP client) execution
310 to 311 136H to 137H IP packet transfer IP packet transfer latest data volume
function area
312 to 313 138H to 139H IP packet transfer maximum data volume
320 to 335 140H to 14FH Remote password Connection No.1 continuous unlock failure count to Connection No.16 continuous unlock
function monitoring area failure count
336 150H Auto-open UDP port continuous unlock failure count
337 151H MELSOFT transmission port (UDP/IP) continuous unlock failure count
338 152H MELSOFT transmission port (TCP/IP) continuous unlock failure count
339 153H FTP transmission port (TCP/IP) continuous unlock failure count
340 154H MELSOFT direct connection continuous unlock failure count
350 15EH Predefined protocol Connection No.1 Protocol execution status
support function
351 15FH System area
execution status check
352 to 367 160H to 16FH area Received data verification result (receive packet No.1 to
16)
368 170H Protocol execution count
369 171H Protocol cancellation specification
370 to 669 172H to 29DH Connection No.2 to Connection No.16
680 2A8H Open completion signal Open completion signal
681 2A9H Open request signal Open request signal
682 2AAH Socket communications Socket communications reception status signal
reception status signal
683 2ABH Initial status Initial status
684 2ACH Initial error code Initial error code
692 2B4H Predefined protocol Predefined protocol ready
support function check
area

APPX
364 Appendix 3 Buffer Memory
Address Application Name
Decimal Hexadecimal
710 2C6H Predefined protocol Predefined protocol setting data Protocol number
setting data check area error information
711 2C7H Setting type
712 2C8H Packet number
713 2C9H Element number
714 2CAH Number of registered predefined protocols
722 to 729 2D2H to 2D9H Predefined protocol registration
740 to 741 2E4H to 2E5H Area for both systems Control system IP address
identical IP address
setting function
770 to 785 302H to 311H Connection status Connection No.1 latest error code (communication error) to Connection No.16 latest error code
storage area (communication error)
786 312H FTP server latest error code (communication error)
787 313H MELSOFT direct connection latest error code (communication error)
788 314H FTP client latest error code (communication error)
789 315H Auto-open UDP port latest error code (communication error)
790 316H MELSOFT connection auto-open UDP port latest error code (communication error)
791 317H MELSOFT connection auto-open TCP port latest error code (communication error)
792 318H Insufficient send buffer or memory count
1094 446H Simple CPU Request to stop fixed interval Stop request setting No.1 to 16
communication function communication for each setting
1095 447H Stop request setting No.17 to 32
number
1096 448H Stop request setting No.33 to 48
1097 449H Stop request setting No.49 to 64
1098 44AH Request to restart fixed interval Restart request setting No.1 to 16
1099 44BH communication for each setting Restart request setting No.17 to 32
number
1100 44CH Restart request setting No.33 to 48
1101 44DH Restart request setting No.49 to 64
1102 44EH Execution status flag for each
setting number
Execution status flag setting No.1 to 16 A
1103 44FH Execution status flag setting No.17 to 32
1104 450H Execution status flag setting No.33 to 48
1105 451H Execution status flag setting No.49 to 64
1106 452H Preparation completion for each Preparation completion setting No.1 to 16
1107 453H setting number Preparation completion setting No.17 to 32
1108 454H Preparation completion setting No.33 to 48
1109 455H Preparation completion setting No.49 to 64
1130 to 1193 46AH to 4A9H Simple CPU communication status Simple CPU communication status setting No.1 to
for each setting number Simple CPU communication status setting No.64
1194 to 1257 4AAH to 4E9H Simple CPU communication error Simple CPU communication error code setting No.1 to
code for each setting number Simple CPU communication error code setting No.64
1258 to 1321 4EAH to 529H Execution interval (current value) Execution interval (current value) setting No.1 to
for each setting number Execution interval (current value) setting No.64

• Do not write any data to the system area. Doing so may cause malfunction of the programmable controller
system.
• If the value in an area of one word in size becomes equal to or higher than 65536, the count stops at 65535
(FFFFH).

APPX
Appendix 3 Buffer Memory 365
 When using the RJ71EN71 (network type: Q-compatible Ethernet)
With the Q-compatible Ethernet, the same buffer memory addresses as the MELSEC-Q series Ethernet interface module can
be used, excluding some addresses.

■Buffer memory addresses usable only with RJ71EN71

The following table lists the buffer memory addresses that can be used only with RJ71EN71.
Address Application Name
Decimal Hexadecimal
20700 to 20701 50DCH to Forced connection Forced connection invalidation specification
50DDH invalidation 20700 (b0 to 15): Connection No.1 to 16
20701 (b0): Auto-open UDP port
20701 (b1): MELSOFT transmission port (UDP/IP)
20701 (b2): MELSOFT transmission port (TCP/IP)
20701 (b3): FTP transmission port
65535 FFFFH Network type information Network type information

■Buffer memory addresses differing from MELSEC-Q series Ethernet interface modules
The following table lists the buffer memory addresses having specifications that differ from the ones of the MELSEC-Q series
Ethernet interface module.
Address Name
Decimal Hexadecimal MELSEC-Q series Ethernet interface module RJ71EN71
0 to 1 0H to 1H Own station E71 IP address Own station IP address
Initial value: C00001FEH Initial value: C0A80328H
4 4H Special function settings Special function settings
Initial value: 100H Initial value: 10H
31 1FH Communication condition setting (Ethernet Operation Communication condition setting area
Setting) area Initial value: 100H
Initial value: 0H Communication data code (b1)
Communication data code setting (b1) 0: Binary
0: Communications in a binary code 1: ASCII
1: Communications in an ASCII code Enable/disable online change (b6)
TCP existence confirmation setting (b4) 0: Disable all (SLMP)
0: Use the Ping 1: Enable all (SLMP)
1: Use the KeepAlive Opening method (b8)
Send frame setting (b5) 0: Open by program
0: Ethernet 1: Do not open by program
1: IEEE 802.3 Reinitialization specification (b15)
Setting of write enable/disable at RUN time (b6) 0: Reinitialization process complete (reset by the system)
0: Disable 1: Reinitialization process request (set by the user)
1: Enable
Initial timing setting (b8)
0: Do not wait for OPEN (Communications impossible at
STOP time)
1: Always wait for OPEN (Communication possible at STOP
time)
Reinitialization specification (b15)
0: Reinitialization process complete (reset by the system)
1: Reinitialization process request (set by the user)
40 28H Communication address Own station port No. Communication address Own station port No.
setting area Initial value: 0H setting area Initial value: 0H
41 to 42 29H to 2AH Connection No.1 Destination IP address
Connection No.1
Destination IP address
Initial value: 0H Initial value: 0H
43 2BH Destination Port No. Destination Port No.
Initial value: 0H Initial value: 0H
44 to 46 2CH to 2EH Destination MAC address System area
Initial value:
FFFFFFFFFFFFH
47 to 95 2FH to 5FH Communication address setting area Connection No.2 to 8 Communication address setting area Connection No.2 to 8
(Same as connection No.1) (Same as connection No.1)
106 to 107 6AH to 6BH Own station IP address Own station IP address
Initial value: 0H Initial value: C0A80328H
108 to 110 6CH to 6EH Own station MAC address Own station MAC address
Initial value: 0H Initial value: MAC address of the RJ71EN71

APPX
366 Appendix 3 Buffer Memory
Address Name
Decimal Hexadecimal MELSEC-Q series Ethernet interface module RJ71EN71
116 74H Auto-open UDP port number Auto-open UDP port number
Initial value: 0H Initial value: 1388H
200 C8H LED status LED status
INIT. LED (b0) P ERR LED (b0)
0: Off 0: Off
1: On (initial processing completed) 1: On or flashing
OPEN LED (b1)
0: Off
1: On (connection open processing completed)
ERR. LED (b3)
0: Off
1: On (setting error)
COM.ERR. LED (b4)
0: Off
1: On (communication error)
201 C9H Hub connection status area Hub connection status area
Communication mode (b9) Communication mode (b9)
0: Half-duplex 0: Half-duplex
1: Full-duplex 1: Full-duplex
Hub connection status (b10) Hub connection status (b10)
0: Hub not connected/disconnected 0: Hub not connected/disconnected
1: Hub connected 1: Hub connected
Data transmission speed (b15, b14) Data transmission speed (b15, b14)
00: Operating at 10BASE-T 00: Operating at 10BASE-T
01: Operating at 100BASE-TX 01: Operating at 100BASE-TX
10: Operating at 1000BASE-T
202 CAH Switch status (Operational mode setting) Module operation mode setting
0: Online 0: Online mode
1: Offline 1: Offline mode
2: Self-loopback test 4: Module communication test mode
3: Hardware test
203 CBH Status of settings with a programming tool Status of settings with a programming tool
Initial value: 0H Initial value: 100H
Communication data code setting (b1) Communication data code setting (b1) A
0: Communications in a binary code 0: Communications in a binary code
1: Communications in an ASCII code 1: Communications in an ASCII code
Initial/open method setting (b2) Send frame setting (b5)
0: No parameter setting (startup according to the sequence 0: Ethernet (fixed)
program) Setting of write enable/disable at RUN time (b6)
1: Parameter setting (startup according to the parameters) 0: Disable
TCP existence confirmation setting (b4) 1: Enable
0: Use the Ping Opening method (b8)
1: Use the KeepAlive 0: Open by program
Send frame setting (b5) 1: Do not open by program
0: Ethernet
1: IEEE 802.3
Setting of write enable/disable at RUN time (b6)
0: Disable
1: Enable
Initial timing setting (b8)
0: Do not wait for OPEN (Communications impossible at
STOP time)
1: Always wait for OPEN (Communication possible at STOP
time)
398 to 399 18EH to 18FH Simultaneous transmission error detection count Receive buffer full count
20486 5006H Remote password status Remote password lock/unlocked status (user connection)
Initial value: 0H Initial value: Depending on the remote password setting
20487 5007H Remote password status Remote password lock/unlocked status (system connection)
Initial value: 0H Initial value: Depending on the remote password setting
20595 5073H Connection No.1 Accumulated count of unlock process Connection No.1 Remote password mismatch count
abnormal end
20600 5078H Connection No.2 Accumulated count of unlock process Connection No.2 Remote password mismatch count
abnormal end
20605 507DH Connection No.3 Accumulated count of unlock process Connection No.3 Remote password mismatch count
abnormal end

APPX
Appendix 3 Buffer Memory 367
 Address Name
Decimal Hexadecimal MELSEC-Q series Ethernet interface module RJ71EN71
20610 5082H Connection No.4 Accumulated count of unlock process Connection No.4 Remote password mismatch count
abnormal end
20615 5087H Connection No.5 Accumulated count of unlock process Connection No.5 Remote password mismatch count
abnormal end
20620 508CH Connection No.6 Accumulated count of unlock process Connection No.6 Remote password mismatch count
abnormal end
20625 5091H Connection No.7 Accumulated count of unlock process Connection No.7 Remote password mismatch count
abnormal end
20630 5096H Connection No.8 Accumulated count of unlock process Connection No.8 Remote password mismatch count
abnormal end
20635 509BH Connection No.9 Accumulated count of unlock process Connection No.9 Remote password mismatch count
abnormal end
20640 50A0H Connection No.10 Accumulated count of unlock process Connection No.10 Remote password mismatch count
abnormal end
20645 50A5H Connection No.11 Accumulated count of unlock process Connection No.11 Remote password mismatch count
abnormal end
20650 50AAH Connection No.12 Accumulated count of unlock process Connection No.12 Remote password mismatch count
abnormal end
20655 50AFH Connection No.13 Accumulated count of unlock process Connection No.13 Remote password mismatch count
abnormal end
20660 50B4H Connection No.14 Accumulated count of unlock process Connection No.14 Remote password mismatch count
abnormal end
20665 50B9H Connection No.15 Accumulated count of unlock process Connection No.15 Remote password mismatch count
abnormal end
20670 50BEH Connection No.16 Accumulated count of unlock process Connection No.16 Remote password mismatch count
abnormal end
20675 50C3H Auto-open UDP port Auto-open UDP port
Accumulated count of unlock process abnormal end Remote password mismatch count
20680 50C8H MELSOFT application transmission port (UDP) MELSOFT transmission port (UDP/IP)
Accumulated count of unlock process abnormal end Remote password mismatch count
20685 50CDH MELSOFT application transmission port (TCP) MELSOFT transmission port (TCP/IP)
Accumulated count of unlock process abnormal end Remote password mismatch count
20690 50D2H FTP transmission port FTP transmission port
Accumulated count of unlock process abnormal end Remote password mismatch count
21056 5240H Receive buffer full detection signal State of receive buffer

APPX
368 Appendix 3 Buffer Memory
■Buffer memory addresses not supported by the RJ71EN71
The following table lists the buffer memory addresses of the MELSEC-Q series Ethernet interface modules that are not
supported by the RJ71EN71.
Address Application Name
Decimal Hexadecimal
228 E4H Error log area Error log write pointer
229 to 372 E5H to 174H Error log block area
944 to 949 3B0H to 3B5H FTP setting area FTP login name
950 to 953 3B6H to 3B9H Password
20488 5008H System port System port use System port use prohibited designation
information area prohibited
designation area
20592 5070H Monitoring area Remote password Remote password mismatch notification accumulated count designation (user
function connection)
monitoring area
20593 5071H Remote password mismatch notification accumulated count designation
(system connection)
20594 5072H Connection No.1 Accumulated count of unlock process normal
completion
20596 5074H Accumulated count of lock process normal
completion
20597 5075H Accumulated count of lock process abnormal end
20598 5076H Accumulated count of lock process based on close
20599 5077H Connection No.2 Accumulated count of unlock process normal
completion
20601 5079H Accumulated count of lock process normal
completion
20602 507AH Accumulated count of lock process abnormal end
20603 507BH Accumulated count of lock process based on close
20604 507CH Connection No.3 Accumulated count of unlock process normal
completion
A
20606 507EH Accumulated count of lock process normal
completion
20607 507FH Accumulated count of lock process abnormal end
20608 5080H Accumulated count of lock process based on close
20609 5081H Connection No.4 Accumulated count of unlock process normal
completion
20611 5083H Accumulated count of lock process normal
completion
20612 5084H Accumulated count of lock process abnormal end
20613 5085H Accumulated count of lock process based on close
20614 5086H Connection No.5 Accumulated count of unlock process normal
completion
20616 5088H Accumulated count of lock process normal
completion
20617 5089H Accumulated count of lock process abnormal end
20618 508AH Accumulated count of lock process based on close
20619 508BH Connection No.6 Accumulated count of unlock process normal
completion
20621 508DH Accumulated count of lock process normal
completion
20622 508EH Accumulated count of lock process abnormal end
20623 508FH Accumulated count of lock process based on close

APPX
Appendix 3 Buffer Memory 369
 Address Application Name
Decimal Hexadecimal
20624 5090H Monitoring area Remote password Connection No.7 Accumulated count of unlock process normal
function completion
monitoring area
20626 5092H Accumulated count of lock process normal
completion
20627 5093H Accumulated count of lock process abnormal end
20628 5094H Accumulated count of lock process based on close
20629 5095H Connection No.8 Accumulated count of unlock process normal
completion
20631 5097H Accumulated count of lock process normal
completion
20632 5098H Accumulated count of lock process abnormal end
20633 5099H Accumulated count of lock process based on close
20634 509AH Connection No.9 Accumulated count of unlock process normal
completion
20636 509CH Accumulated count of lock process normal
completion
20637 509DH Accumulated count of lock process abnormal end
20638 509EH Accumulated count of lock process based on close
20639 509FH Connection No.10 Accumulated count of unlock process normal
completion
20641 50A1H Accumulated count of lock process normal
completion
20642 50A2H Accumulated count of lock process abnormal end
20643 50A3H Accumulated count of lock process based on close
20644 50A4H Connection No.11 Accumulated count of unlock process normal
completion
20646 50A6H Accumulated count of lock process normal
completion
20647 50A7H Accumulated count of lock process abnormal end
20648 50A8H Accumulated count of lock process based on close
20649 50A9H Connection No.12 Accumulated count of unlock process normal
completion
20651 50ABH Accumulated count of lock process normal
completion
20652 50ACH Accumulated count of lock process abnormal end
20653 50ADH Accumulated count of lock process based on close
20654 50AEH Connection No.13 Accumulated count of unlock process normal
completion
20656 50B0H Accumulated count of lock process normal
completion
20657 50B1H Accumulated count of lock process abnormal end
20658 50B2H Accumulated count of lock process based on close
20659 50B3H Connection No.14 Accumulated count of unlock process normal
completion
20661 50B5H Accumulated count of lock process normal
completion
20662 50B6H Accumulated count of lock process abnormal end
20663 50B7H Accumulated count of lock process based on close
20664 50B8H Connection No.15 Accumulated count of unlock process normal
completion
20666 50BAH Accumulated count of lock process normal
completion
20667 50BBH Accumulated count of lock process abnormal end
20668 50BCH Accumulated count of lock process based on close

APPX
370 Appendix 3 Buffer Memory
Address Application Name
Decimal Hexadecimal
20669 50BDH Monitoring area Remote password Connection No.16 Accumulated count of unlock process normal
function completion
monitoring area
20671 50BFH Accumulated count of lock process normal
completion
20672 50C0H Accumulated count of lock process abnormal end
20673 50C1H Accumulated count of lock process based on close
20674 50C2H Auto-open UDP port Accumulated count of unlock process normal
completion
20676 50C4H Accumulated count of lock process normal
completion
20677 50C5H Accumulated count of lock process abnormal end
20678 50C6H Accumulated count of lock process based on close
20679 50C7H MELSOFT Accumulated count of unlock process normal
transmission port completion
(UDP/IP)
20681 50C9H Accumulated count of lock process normal
completion
20682 50CAH Accumulated count of lock process abnormal end
20683 50CBH Accumulated count of lock process based on close
20684 50CCH MELSOFT Accumulated count of unlock process normal
transmission port completion
(TCP/IP)
20686 50CEH Accumulated count of lock process normal
completion
20687 50CFH Accumulated count of lock process abnormal end
20688 50D0H Accumulated count of lock process based on close
20689 50D1H FTP transmission port Accumulated count of unlock process normal
completion
20691 50D3H Accumulated count of lock process normal
completion
20692 50D4H Accumulated count of lock process abnormal end A
20693 50D5H Accumulated count of lock process based on close
20737 to 5101H to 5177H HTTP status storage area
20855
20992 5200H "Issue system "Issue system switching request at disconnection detection"
20993 5201H switching request Disconnection detection monitoring time
at disconnection
detection" status
storage area
21008 to 5210H to 5211H "System switching settings when communication error occurs" status storage area
21009
22640 to 5870H to E-mail status storage area
24575 5FFFH

For details on other buffer memory addresses that can be used in the RJ71EN71, refer to the following.
 Q Corresponding Ethernet Interface Module User's Manual (Basic)

APPX
Appendix 3 Buffer Memory 371
 Details of buffer memory addresses (RJ71EN71, RnENCPU
(network part))
This section describes the details of buffer memory addresses of the RJ71EN71 and RnENCPU (network part).
The buffer memory addresses are for when the P1 connector is used.

Own node setting status storage area

■Own node IP address (Un\G4 to Un\G5)
The IP address set with the module parameter is stored.
Address Description
Un\G4 Third octet, fourth octet
Un\G5 First octet, second octet

■Subnet mask (Un\G14 to Un\G15)

The subnet mask set with the module parameter is stored.
Address Description
Un\G14 Third octet, fourth octet
Un\G15 First octet, second octet

■Default gateway IP address (Un\G18 to Un\G19)

The default gateway IP address set with the module parameter is stored.
Address Description
Un\G18 Third octet, fourth octet
Un\G19 First octet, second octet

■Own node MAC address (Un\G28 to Un\G30)

The MAC address of the Ethernet-equipped module is stored.
Address Description
Un\G28 5th byte, 6th byte of the MAC address
Un\G29 3rd byte, 4th byte of the MAC address
Un\G30 1st byte, 2nd byte of the MAC address

■Jumbo frame setting (Un\G35)

Address Description
Un\G35 Stores the jumbo frame set with the module parameter.
0: Disable (MTU 1500 byte)
2: 2KB (MTU 2034 byte)
3: 3KB (MTU 3058 byte)
4: 4KB (MTU 4082 byte)
5: 5KB (MTU 5106 byte)
6: 6KB (MTU 6130 byte)
7: 7KB (MTU 7154 byte)
8: 8KB (MTU 8178 byte)
9: 9KB (MTU 9004 byte)

■Communication speed setting (Un\G36)

Address Description
Un\G36 Stores the communication speed set with the module parameter.
0: Automatic negotiation
1: 10Mbps/half-duplex
2: 10Mbps/full-duplex
3: 100Mbps/half-duplex
4: 100Mbps/full-duplex
6: 1Gbps/full-duplex

APPX
372 Appendix 3 Buffer Memory
Connection status storage area
■Connection No.1 latest error code to connection No.64 latest error code (Un\G100 to Un\G163)
The latest error code for each connection is stored.
Address Name
Un\G100 Connection No.1 latest error code
Un\G101 Connection No.2 latest error code

Un\G162 Connection No.63 latest error code
Un\G163 Connection No.64 latest error code

Status for each protocol

■IP packet (Un\G5000 to Un\G5029)
The IP status is counted in the range of 0 to 4294967295 (FFFFFFFH). (The number of receive aborts is counted in the range
of 0 to 65535 (FFFFH).)
Address Name
Un\G5000 to Un\G5001 Received packet total count
Un\G5002 to Un\G5003 Received packet checksum error discard count
Un\G5004 to Un\G5005 Sent packet total count
Un\G5022 to Un\G5023 Simultaneous transmission error detection count (receive buffer full count)
Un\G5029 Receive abort count

■ICMP packet (Un\G5040 to Un\G5053)

The ICMP status is counted in the range of 0 to 4294967295 (FFFFFFFH).
Address Name
Un\G5040 to Un\G5041 Received packet total count
Un\G5042 to Un\G5043 Received packet checksum error discard count
A
Un\G5044 to Un\G5045 Sent packet total count
Un\G5046 to Un\G5047 Received echo request total count
Un\G5048 to Un\G5049 Sent echo reply total count
Un\G5050 to Un\G5051 Sent echo request total count
Un\G5052 to Un\G5053 Received echo reply total count

■TCP packet (Un\G5080 to Un\G5085)

The TCP status is counted in the range of 0 to 4294967295 (FFFFFFFH).
Address Name
Un\G5080 to Un\G5081 Received packet total count
Un\G5082 to Un\G5083 Received packet checksum error discard count
Un\G5084 to Un\G5085 Sent packet total count

■UDP packet (Un\G5120 to Un\G5125)

The UDP status is counted in the range of 0 to 4294967295 (FFFFFFFH).
Address Name
Un\G5120 to Un\G5121 Received packet total count
Un\G5122 to Un\G5123 Received packet checksum error discard count
Un\G5124 to Un\G5125 Sent packet total count

■Receiving error (Un\G5160 to Un\G5165)

The receive error status is counted in the range of 0 to 4294967295 (FFFFFFFH).
Address Description
Un\G5160 to Un\G5161 Framing error count
Un\G5162 to Un\G5163 Receive FIFO overflow count
Un\G5164 to Un\G5165 CRC error count

APPX
Appendix 3 Buffer Memory 373
 Own node operation status storage area
■LED status (Un\G5189)
Address Description
Un\G5189 Stores the on/off status of the P ERR LED.
0: Off
1: On or flashing

■Hub connection status area (Un\G5191 to Un\G5194)

The hub connection status of the Ethernet-equipped module is stored.
Address Name Description
Un\G5191 Communication mode Stores the communication mode.
0: Half-duplex
1: Full-duplex
Un\G5192 Connection status Stores the connection status.
0: Hub not connected or disconnected
1: Hub connected
Un\G5193 Communication speed Stores the communication speed.
0: Operating at 10BASE-T
1: Operating at 100BASE-TX
2: Operating at 1000BASE-T
Un\G5194 Disconnection count Stores the number of times the cable was disconnected.

■IP address duplication status storage area (Un\G5200 to Un\G5206)

Information when IP address is duplicated is stored.
Address Name Description
Un\G5200 Same IP address detection flag Stores IP address duplication status.
0: IP address not duplicated
1: IP address duplicated
Un\G5201 to Un\G5203 MAC address of the station already connected to the Stores the MAC address of the station that has been
network already connected to the network in the station with
duplicated IP address.
Un\G5201: 5th and 6th byte of the MAC address
Un\G5202: 3rd and 4th byte of the MAC address
Un\G5203: 1st and 2nd byte of the MAC address
"FFFFFFFFFFFFH" is stored in the station that has been
already connected to the network.
Un\G5204 to Un\G5206 MAC address of the station with the IP address already Stores the MAC address of the station with duplicated IP
used address in the station that has been already connected to
the network.
Un\G5204: 5th and 6th byte of the MAC address
Un\G5205: 3rd and 4th byte of the MAC address
Un\G5206: 1st and 2nd byte of the MAC address
"FFFFFFFFFFFFH" is stored in the station with the
duplicated IP address.

APPX
374 Appendix 3 Buffer Memory
Area for sending/receiving instructions
■RECV instruction execution request (Un\G5301)
Address Description
Un\G5301 Stores the RECV instruction execution request status of each channel in b0 to b7 (channel 1 to 8).
On: Requesting
Off: No request

■Link dedicated instruction (Un\G5323 to Un\G5325)

The execution result of the link dedicated instruction is stored.
Address Name Description
Un\G5323 ZNRD instruction execution result Stores the execution result of the ZNRD instruction.
0: Completed successfully
Other than 0: Completed with an error (An error code is
stored.)
Un\G5325 ZNWR instruction execution result Stores the execution result of the ZNWR instruction.
0: Completed successfully
Other than 0: Completed with an error (An error code is
stored.)

Remote password lock status storage area

The remote password lock status of each connection is stored.
• 0: Unlocked or remote password not set
• 1: Lock status
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G5626 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G5629 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

The numbers in the table indicate connection numbers. A

■Remote password lock status system port (Un\G5630)
Address Description
Un\G5630 Stores the remote password lock status of the system port in b0 to b4.
0: Unlocked or remote password not set
1: Lock status
The bits corresponding to each system port are shown below.
b0: Auto-open UDP port
b1: MELSOFT transmission port (UDP/IP)
b2: MELSOFT transmission port (TCP/IP)
b3: FTP transmission port
b4: MELSOFT direct connection

APPX
Appendix 3 Buffer Memory 375
 Forced connection invalidation setting area
Set the connection to be forcibly invalidated.
• 0: Use allowed
• 1: Use prohibited
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G5646 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G5649 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

The numbers in the table indicate connection numbers.

■Forced connection invalidation system port (Un\G5650)

Address Description
Un\G5650 Set the system port to be forcibly invalidated.
0: Use allowed
1: Use prohibited
The bits corresponding to each system port are shown below.
b0: Auto-open UDP port
b1: MELSOFT transmission port (UDP/IP)
b2: MELSOFT transmission port (TCP/IP)
b3: FTP transmission port
b4: MELSOFT direct connection

APPX
376 Appendix 3 Buffer Memory
Predefined protocol support function execution status check area
■Connection No.1 (Un\G8300 to Un\G8335)
The execution status of the predefined protocol support function is stored.
For addresses corresponding to connections after the connection No.2, refer to the following.
Page 355 List of buffer memory addresses
Address Name Description
Un\G8300 Protocol execution status Stores the status of the protocol being executed at connection No.1.
0: Unexecuted
1: Waiting for transmission
2: Sending
3: Waiting for data reception
4: Receiving
5: Execution completed
Un\G8301 System area 
Un\G8302 Received data verification result (receive packet No.1) Stores the verification results of receive packet No.1.
• Element No. where the verification result did not match (b0 to b7)
0: Verification matched
1 to 32: Element No. where the verification result did not match
FFH: Verification not performed
• The cause of mismatch (verification result code) (b8 to b15)*1
Un\G8303 to Un\G8317 Received data verification result (receive packet No.2 to 16) The configuration is the same as receive packet No.1.
Un\G8318 Protocol execution count Stores the number of protocol executions in Connection No.1.
0: Protocol not executed
1 to 65535: Number of executions (When the number exceeds
65535, the value remains 65535.)
Un\G8319 Protocol cancellation specification Cancels the protocol executed in Connection No.1.
0: No cancellation instruction
1: Cancellation request (set by user)
2: Cancellation completed (set by system)
Un\G8320 to Un\G8335 System area 

*1 The following table lists the verification result codes and causes of verification mismatch. A
Stored value Description Cause
00H Normal 
01H Insufficient receive data The total packet size of receive data is smaller than that set in protocol data.
10H Data not matched The receive data do not match the value set in protocol data.
11H ASCII-binary conversion error When the code type setting is "ASCII Hexadecimal", data not in ASCII code are received.
12H Data length error The received length value exceeded 2046 bytes.
30H Data length size error The Length value received from the external device does not match the actual length.
FFH Verification not performed 

APPX
Appendix 3 Buffer Memory 377
 Time setting function (SNTP) area
■Time setting function operation result (Un\G11000)
Address Description
Un\G11000 Stores the operation result of the time setting function.
0: Unexecuted
1: Success
FFFFH: Failure

■Time setting function execution time (Un\G11001 to Un\G11007)

Address Name Description
Un\G11001 Year Stores the year that the time setting function was executed.
Un\G11002 Month Stores the month that the time setting function was executed.
Un\G11003 Day Stores the date that the time setting function was executed.
Un\G11004 Hour Stores the time (hour) that the time setting function was executed.
Un\G11005 Minute Stores the time (minute) that the time setting function was executed.
Un\G11006 Second Stores the time (second) that the time setting function was executed.
Un\G11007 Day of the week Stores the day of the week that the time setting function was
executed.
0: Sunday
1: Monday
2: Tuesday
3: Wednesday
4: Thursday
5: Friday
6: Saturday

■Time setting function required response time (Un\G11008)

Address Description
Un\G11008 Stores the time required for the module to set the time after sending to the SNTP server.
Range: 0 to FFFEH (Unit: ms)

■Time setting function (SNTP client) execution (Un\G11009)

Address Description
Un\G11009 Executes the time setting function when b0 is turned on.
The time setting function can be executed at a random time from a program.
The function is not executed if b0 is turned on during execution of the time setting function.
This is valid only when "Use" is set for "Time Setting (SNTP Client)" under "Time Setting" in "Application Settings".

IP packet transfer function area

■IP packet transfer latest data volume (Un\G11050 to Un\G11051)
Address Description
Un\G11050 to Un\G11051 Stores the latest value (byte/s) of the total size (byte) per unit time (one second) of the transferred IP packet.
(The low-order 16-bit value is stored in the 1st word, and the high-order 16-bit value is stored in the 2nd word.)
Range: 0 to 4294967295 (FFFFFFFFH)
The value is 4294967295 (FFFFFFFFH) if the above value is exceeded.

■IP packet transfer maximum data volume (Un\G11052 to Un\G11053)

Address Description
Un\G11052 to Un\G11053 Stores the maximum value (byte/s) of the total size (byte) per unit time (one second) of the transferred IP packet.
(The low-order 16-bit value is stored in the 1st word, and the high-order 16-bit value is stored in the 2nd word.)
Range: 0 to 4294967295 (FFFFFFFFH)
The value is 4294967295 (FFFFFFFFH) if the above value is exceeded.

APPX
378 Appendix 3 Buffer Memory
Dynamic routing function area
■Communication path determination status (Un\G11500 to Un\G11514)
The determination status of the communication path for each network number of the destination station is stored.
• 0: Path undetermined
• 1: Path determined
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G11500 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G11514 Empty 239 238 237 236 235 234 233 232 231 230 229 228 227 226 225

The numbers in the table indicate network numbers.

Remote password function monitoring area

The number of times each connection and system port remote password unlocking failed continuously is counted in the range
of 0 to 65535.
Address Name
Un\G11600 Connection No.1 continuous unlock failure count
Un\G11601 Connection No.2 continuous unlock failure count

Un\G11662 Connection No.63 continuous unlock failure count
Un\G11663 Connection No.64 continuous unlock failure count
Un\G11664 Auto-open UDP port continuous unlock failure count
Un\G11665 MELSOFT transmission port (UDP/IP) continuous unlock failure count
Un\G11666 MELSOFT transmission port (TCP/IP) continuous unlock failure count
Un\G11667 FTP transmission port (TCP/IP) continuous unlock failure count
Un\G11668 MELSOFT direct connection continuous unlock failure count

A
Area for both systems identical IP address setting function
■Control system IP address (Un\G11670 to Un\G11671)
The control system IP address set with the module parameter is stored.
Address Description
Un\G11670 Third octet, fourth octet
Un\G11671 First octet, second octet

APPX
Appendix 3 Buffer Memory 379
 IP address change function area
■IP address setting (Un\G11700 to Un\G11705)
Set the IP address, subnet mask, and default gateway to be stored in the IP address storage area (flash ROM).
Address Name Description
Un\G11700 IP address Third octet, fourth octet
Un\G11701 First octet, second octet
Un\G11702 Subnet mask Third octet, fourth octet
Un\G11703 First octet, second octet
Un\G11704 Default Gateway Third octet, fourth octet
Un\G11705 First octet, second octet

■Communications by network number/station number (Un\G11706 to Un\G11708)

Set the network number, station number, and transient transmission group number to be stored in the IP address storage area
(flash ROM).
Address Name
Un\G11706 Network number
Un\G11707 Station number
Un\G11708 Transient transmission group number

■IP address storage area write request (Un\G11709)

Address Description
Un\G11709 • When b0 is turned off and on, writes the values stored in 'IP address setting' (Un\G11700 to Un\G11705) and
'Communications by Network No./Station No.' (Un\G11706 to Un\G11708) to the IP address storage area (flash ROM).
• When the data is completely written to the IP address storage area (flash ROM), b0 turns off regardless of the write
results.

■IP address storage area write error (Un\G11710)

Address Description
Un\G11710 When writing to the IP address storage area (flash ROM) ends abnormally, b0 turns on. When writing completes
successfully, b0 turns off.

■IP address storage area writing error cause (Un\G11711)

Address Description
Un\G11711 Stores the cause of the abnormal end of writing to the IP address storage area (flash ROM).
0H: No error
100H:The value for 'IP address' (Un\G11700 to Un\G11701) exceeds the setting range.
101H:The value for 'Default gateway' (Un\G11704 to Un\G11705) exceeds the setting range.
102H:The network address of 'Default gateway' (Un\G11704 to Un\G11705) or of the gateway IP address is different from
that of the IP address of the own node.
103H:The value for 'Network number' (Un\G11706) exceeds the setting range.
104H:The value for 'Station number' (Un\G11707) exceeds the setting range.
105H:The value for 'Transient transmission group number' (Un\G11708) exceeds the setting range.
106H:The port 1 and port 2 IP addresses written in the IP address storage area are the same.
107H:The port 1 and port 2 network numbers or station numbers written in the IP address storage area are the same.
200H:An error occurred during write.
400H:Writing was started during the clear processing.

■IP address storage area clear request (Un\G11712)

Address Description
Un\G11712 • When b0 is turned off and on, clears the IP address storage area (flash ROM).
• When the IP address storage area (flash ROM) is cleared completely, b0 turns off regardless of the clear results.

■IP address storage area clear error (Un\G11713)

Address Description
Un\G11713 When clearing the IP address storage area (flash ROM) ends abnormally, b0 turns on. When clearing completes
successfully, b0 turns off.

APPX
380 Appendix 3 Buffer Memory
■IP address storage area clear error cause (Un\G11714)
Address Description
Un\G11714 Stores the cause of the abnormal end of clearing the IP address storage area (flash ROM).
0H: No error
200H:Error occurred during clearing.
400H:Clearing was started during the write processing.

■IP address change function operating status (Un\G11715)

Address Description
Un\G11715 Stores the IP address change function operating status.
0: Operating according to the module parameter settings
1: Operating according to the IP address storage area (flash ROM) settings

Random access buffer area

■Random access buffer (Un\G20000 to Un\G26143)
This area is used for reading or writing the data when exchanging data with the random access buffer.

Network type information area

■Network type information (Un\G65535)
Address Description
Un\G65535 Stores the network type.
0: Ethernet
1: CC-Link IE Field Network
2: CC-Link IE Controller Network
3: Ethernet (Q series-compatible)

Area for communication using a fixed buffer

■Fixed buffer No.1 (Un\G65536 to Un\G70655)
This area is used for sending and receiving data during fixed buffer communication.
A
For addresses corresponding to connections after the connection No.2, refer to the following.
Page 355 List of buffer memory addresses
Address Name Description
Un\G65536 Data length Stores the data length of the fixed buffer data.
Un\G65537 to Un\G70655 Fixed buffer data Stores the fixed buffer data.

APPX
Appendix 3 Buffer Memory 381
 Error log area for MODBUS/TCP function
■Number of errors (Un\G720896)
This area is used for storing the number of errors that occurred during communications using MODBUS/TCP.

■Error log write pointer (Un\G720897)

This area is used for storing the error log number at which the latest error log was registered.

■Error log 1 (Un\G720898 to Un\G720905)

Address Name Description
Un\G720898 Detail error code Stores an error code. ( Page 329 List of Error Codes)
Un\G720899 Abnormal response code Stores a MODBUS abnormal response code. ( MELSEC iQ-R MODBUS and
MODBUS/TCP Reference Manual)
Un\G720900 Function code Stores a function code that caused the error.
Un\G720901 Own station port number Stores the own station port number when the error occurred.
Un\G720902 to Un\G720903 Destination IP address Stores the IP address of the destination station when the error occurred.
Un\G720904 Destination port number Stores the port number of the destination station when the error occurred.
Un\G720905 System area 

■Error log 2 to 32 (Un\G720906 to Un\G721153)

These areas are used for storing the information of the 2nd to 32th errors in the same order as Error log 1.

APPX
382 Appendix 3 Buffer Memory
Simple CPU communication area
■Request to start communication at request for each setting number (Un\G721896 to
Un\G721899, Un\G1247300 to Un\G1247327)
This request contact starts the data send when the communication setting is "On Request" and is stored using the following bit
pattern for each setting number.
• Off  On: Requested (start request)
• On  Off: Completed (start completion)
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G721896 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G721899 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0

Un\G1247300 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65

Un\G1247327 512 511 510 509 508 507 506 505 504 503 502 501 500 509 508 507

■Request to stop fixed interval communication for each setting number (Un\G721900 to
Un\G721903, Un\G1247328 to Un\G1247355)
This request contact stops the data send when the communication setting is "Fixed Interval" and is stored using the following
bit pattern for each setting number.
• Off  On: Requested (stop request)
• On  Off: Completed (stop completion)
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G721900 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G721903 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49
A
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G1247328 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65

Un\G1247355 512 511 510 509 508 507 506 505 504 503 502 501 500 509 508 507

■Request to restart fixed interval communication for each setting number (Un\G721904 to
Un\G721907, Un\G1247356 to Un\G1247383)
This request contact restarts the data send when the communication setting is "Fixed Interval" and is stored using the
following bit pattern for each setting number.
• Off  On: Requested (restart request)
• On  Off: Completed (restart completion)
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G721904 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G721907 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0

Un\G1247356 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65

Un\G1247383 512 511 510 509 508 507 506 505 504 503 502 501 500 509 508 507

APPX
Appendix 3 Buffer Memory 383
 ■Execution status flag for each setting number (Un\G721908 to Un\G721911, Un\G1247384 to
Un\G1247411)
The status of data communication is stored using the following bit pattern for each setting number.
• Off: Communication stop (function not used)
• On: Communicating
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G721908 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G721911 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0

Un\G1247384 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65

Un\G1247411 512 511 510 509 508 507 506 505 504 503 502 501 500 509 508 507

■Preparation completion for each setting number (Un\G721912 to Un\G721915, Un\G1247412 to

Un\G1247439)
The preparation completion status of the simple CPU communication is stored using the following bit pattern for each setting
number.
• Off: Not ready (function not used)
• On: Ready
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G721912 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G721915 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0

Un\G1247412 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65

Un\G1247439 512 511 510 509 508 507 506 505 504 503 502 501 500 509 508 507

■Simple CPU communication status for each setting number (Un\G721936 to Un\G721999,
Un\G1247460 to Un\G1247907)
Address Name Description
Un\G721936 Simple CPU communication status setting No.1 The simple CPU communication status is stored.
Un\G721937 Simple CPU communication status setting No.2 0H: Unset (function not used)
1H: Preparing
 2H: Waiting for the request
Un\G721998 Simple CPU communication status setting No.63 3H: Communicating
4H: Communication stop
Un\G721999 Simple CPU communication status setting No.64
5H: Retry being executed
6H: Monitoring
AH: Communications impossible

Address Name Description

Un\G1247460 Simple CPU communication status setting No.65 The simple CPU communication status is stored.
Un\G1247461 Simple CPU communication status setting No.66 0H: Unset (function not used)
1H: Preparing
 2H: Waiting for the request
Un\G1247906 Simple CPU communication status setting No.511 3H: Communicating
4H: Communication stop
Un\G1247907 Simple CPU communication status setting No.512
5H: Retry being executed
6H: Monitoring
AH: Communications impossible

APPX
384 Appendix 3 Buffer Memory
■Simple CPU communication error code for each setting number (Un\G722000 to Un\G722063,
Un\G1247908 to Un\G1248355)
Address Name Description
Un\G722000 Simple CPU communication error code setting No.1 The cause of the error detected in the simple CPU
communication is stored.
Un\G722001 Simple CPU communication error code setting No.2
0: No error (function not used)
 Other than 0: Error code ( Page 329 List of Error Codes)
Un\G722062 Simple CPU communication error code setting No.63 The value is cleared to 0 with a clear request from the
engineering tool.
Un\G722063 Simple CPU communication error code setting No.64

Address Name Description

Un\G1247908 Simple CPU communication error code setting No.65 The cause of the error detected in the simple CPU
communication is stored.
Un\G1247909 Simple CPU communication error code setting No.66
0: No error (function not used)
 Other than 0: Error code ( Page 329 List of Error Codes)
Un\G1248354 Simple CPU communication error code setting No.511 The value is cleared to 0 with a clear request from the
engineering tool.
Un\G1248355 Simple CPU communication error code setting No.512

■Abnormal response code for each setting number (Un\G722064 to Un\G722127, Un\G1248356
to Un\G1248803)
Address Name Description
Un\G722064 Abnormal response code setting No.1 The abnormal response code detected in the simple CPU
Un\G722065 Abnormal response code setting No.2 communication is stored.
0: No error (function not used)
 Other than 0: Abnormal response code
Un\G722126 Abnormal response code setting No.63 For abnormal response codes, refer to the manual for the
external device.
Un\G722127 Abnormal response code setting No.64
This function is available when CFB4H is stored in "Simple
CPU communication error code for each setting number"
(Un\G722000 to Un\G722063).

Address Name Description

Un\G1248356
Un\G1248357
Abnormal response code setting No.65
Abnormal response code setting No.66
The abnormal response code detected in the simple CPU
communication is stored.
A
0: No error (function not used)
 Other than 0: Abnormal response code
Un\G1248802 Abnormal response code setting No.511 For abnormal response codes, refer to the manual for the
external device.
Un\G1248803 Abnormal response code setting No.512
This function is available when CFB4H is stored in "Simple
CPU communication error code for each setting number"
(Un\G1247908 to Un\G1248355).

■Execution interval (current value) for each setting number (Un\G722128 to Un\G722191,
Un\G1248804 to Un\G1249251)
Address Name Description
Un\G722128 Execution interval (current value) setting No.1 If "Fixed" is set for communication setting, the current value of
the execution interval is stored.
Un\G722129 Execution interval (current value) setting No.2
0: Unset (function not used), communications impossible
 Other than 0: Execution interval (unit: ms)
Un\G722190 Execution interval (current value) setting No.63
Un\G722191 Execution interval (current value) setting No.64

Address Name Description

Un\G1248804 Execution interval (current value) setting No.65 If "Fixed" is set for communication setting, the current value of
the execution interval is stored.
Un\G1248805 Execution interval (current value) setting No.66
0: Unset (function not used), communications impossible
 Other than 0: Execution interval (unit: ms)
Un\G1249250 Execution interval (current value) setting No.511
Un\G1249251 Execution interval (current value) setting No.512

■User setting area (Un\G722500 to Un\G1246787)

This area can be used freely during simple CPU communication.

APPX
Appendix 3 Buffer Memory 385
 Ethernet PORT1/2 common information
■Open completion signal (Un\G1900000 to Un\G1900007)
The open status of each connection is stored.
• 0: Closed or not open
• 1: Open completed
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G1900000 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G1900007 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113

The numbers in the table indicate connection numbers.

■Open request signal (Un\G1900008 to Un\G1900015)

The open processing status of each connection is stored.
• 0: No open request
• 1: Requesting open
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G1900008 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G1900015 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113

The numbers in the table indicate connection numbers.

■Socket/fixed buffer reception status signal (Un\G1900016 to Un\G1900023)

The reception status of each connection is stored.
• 0: Data not received
• 1: Data reception completed
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G1900016 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G1900023 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113

The numbers in the table indicate connection numbers.

■Initial status (Un\G1900024)

Address Description
Un\G1900024 Stores the status of the initial processing of the RJ71EN71 or the RnENCPU (network part).
Initial normal completion status (b0)
0: 
1: Initialization normal completion
Initial abnormal completion status (b1)
0: 
1: Initialization abnormal completion
b2 to b15: Use prohibited

■Initial error code (Un\G1900025)

Address Description
Un\G1900025 Stores the information when the initial processing of the RJ71EN71 or the RnENCPU (network part) is completed
abnormally.
0: In initial processing or initial normal completion
Other than 0: Initial processing error code (An error code is stored.)

APPX
386 Appendix 3 Buffer Memory
Receive buffer status storage area
■State of receive buffer (Un\G1900030)
Address Description
Un\G1900030 Stores the receive buffer status.
0: Receive buffer not full
1: Receive buffer full

Predefined protocol support function check area

■Predefined protocol ready (Un\G1901002)
Address Description
Un\G1901002 Stores the ready status of the protocol setting data.
0: 
1: Ready

Predefined protocol setting data check area

■Predefined protocol setting data error information (Un\G1901020 to Un\G1901023)
Address Name Description
Un\G1901020 Protocol number When a protocol setting data error is detected, stores the
protocol number where the error was detected.
Protocol is checked in order from smallest protocol number. The
protocol number where an error was detected first is stored.
0: No error
1 to 128: Protocol number
65535: Cannot identify*1
Un\G1901021 Setting type 0 is stored if an error is detected in the packet setting or element
setting.
1 is stored if an error is detected in the protocol detailed setting.
(Valid when protocol number value is 1 to 128)
0: Packet setting or element setting A
1: Protocol preferences
65535: Cannot identify*1
Un\G1901022 Packet number When an error is detected in the protocol setting data, stores the
packet number that detected the error.
The packets are checked in order of send packets and then
receive packets (expected packets) from smallest number. The
packet number where an error was detected first is stored. (Valid
when setting type value is 0)
0: Send packet
1 to 16: Receive packet number
65535: Cannot identify*1
Un\G1901023 Element number When an error is detected in the protocol setting data, stores the
element number where the error was detected.
The elements are checked in order of smallest element number.
The element number where an error was detected first is stored.
(Valid when setting type value is 0)
1 to 32: Element number
65535: Cannot identify*1

*1 The setting value may be unidentifiable (65535) in the following cases.

 When a setting that cannot be detected by the current Ethernet-equipped module version is written in
 When protocol setting data is broken (hardware failure)

■Number of registered predefined protocols (Un\G1901024)

Address Description
Un\G1901024 Stores the protocol number of the registered protocol setting data.
0 is stored if the protocol setting data check result is abnormal.
0: No registration
1 to 128: Number of registrations

APPX
Appendix 3 Buffer Memory 387
 ■Predefined protocol registration (Un\G1901032 to Un\G1901047)
Whether protocol setting data is registered or not is stored.
All bits are set to 0 if the protocol setting data check result is abnormal.
• 0: No registration
• 1: Registered
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G1901032 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G1901039 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113
Un\G1901040 to Empty
Un\G1901047

The numbers in the table indicate protocol numbers.

Send/receive area for predefined protocol support function

■Send/receive area for predefined protocol support function (Un\G1902000 to Un\G1904047)
This area is used for sending and receiving data during communication with predefined protocol.

User setting area for MODBUS/TCP function

■User setting area for MODBUS/TCP function (Un\G1921024 to Un\G1929215)
This area is used for sending and receiving data during communications using MODBUS/TCP.

Discard received data at CPU STOP setting area

■Discard received data at CPU STOP setting area (Un\G1950032 to Un\G1950039)
Stores one of the following bit patterns for each connection number.
• 0: Disable (The receive data is not discarded during CPU STOP.)
• 1: Enable (The receive data is discarded during CPU STOP.)
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G1950032 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G1950039 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113

The numbers in the table indicate connection numbers.

APPX
388 Appendix 3 Buffer Memory
Details of buffer memory addresses (CPU module (built-in
Ethernet port part))
This section descries the details of buffer memory addresses of the CPU module (built-in Ethernet port part).

Own node setting status storage area

■Own node IP address (Un\G50, Un\G51)
The IP address set with the module parameter is stored.
Address Description
Un\G50 Third octet, fourth octet
Un\G51 First octet, second octet

■Subnet mask (Un\G60, Un\G61)

The subnet mask set with the module parameter is stored.
Address Description
Un\G60 Third octet, fourth octet
Un\G61 First octet, second octet

■Default gateway IP address (Un\G64, Un\G65)

The default gateway IP address set with the module parameter is stored.
Address Description
Un\G64 Third octet, fourth octet
Un\G65 First octet, second octet

■Own node MAC address (Un\G74 to Un\G76)

The MAC address of the Ethernet-equipped module is stored.
Address Description
Un\G74 5th byte, 6th byte of the MAC address A
Un\G75 3rd byte, 4th byte of the MAC address
Un\G76 1st byte, 2nd byte of the MAC address

■Network number/Station number setting status (Un\G87)

This area is used for storing the setting status of the network number/station number.
Address Name Description
Un\G87 Network number/Station number setting status Stores the setting status of the network number/station
number that has been set with parameters or by the IP
address change function.
b0: Network number/station number validity flag (0: Disabled,
1: Enabled)

APPX
Appendix 3 Buffer Memory 389
 Communication load status
■Receive packet count per unit time (one second) (Un\G100, Un\G101)
The number of receive packets per unit time (one second) of the built-in Ethernet port communications is stored.
Address Name Description
Un\G100 Receive packet count (current) per unit time (one ■The number of receive packets per unit time (one second) of
second) the built-in Ethernet port is stored.
■When the processing speed of the built-in Ethernet
communications is slow and if this value is large, the following
actions may improve the processing speed.
• Review the communication request from the engineering
tool and GOT.
• Review the communication request from the transfer
destination (execution source) of the simple CPU
communications.
• Review the file transfer function (FTP server).
• Review the communications using the SLMP.
Un\G101 Receive packet count (maximum) per unit time (one The maximum value of the number of receive packets per unit
second) time (one second) of the built-in Ethernet port is stored.

■Send packet count per unit time (one second) (Un\G102, Un\G103)
The number of send packets per unit time (one second) of the built-in Ethernet port communications is stored.
Address Name Description
Un\G102 Send packet count (current) per unit time (one second) ■The number of send packets per unit time (one second) of
the built-in Ethernet port is stored.
■When the processing speed of the built-in Ethernet
communications is slow and if this value is large, the following
actions may improve the processing speed.
• Review the execution frequency of the instructions for the
built-in Ethernet function (socket communications
instruction/predefined protocol support function instruction/
SLMP frame send instruction/file transfer function
instruction)
• Review the settings (such as the number of points) of CC-
Link IE Field Network Basic.
• Review the settings (such as the execution interval and the
number of points) of the simple CPU communications.
• Review the settings (such as automatic detection and
backup execution) of iQSS (built-in Ethernet).
• Review the settings (such as the number of executions) of
data logging file transfer.
Un\G103 Send packet count (maximum) per unit time (one second) The maximum value of the number of send packets per unit
time (one second) of the built-in Ethernet port is stored.

Connection status storage area

■Connection No.1 latest error code to connection No.16 latest error code (Un\G130 to Un\G145)
The latest error code for each connection is stored.
Address Name
Un\G130 Connection No.1 latest error code
Un\G131 Connection No.2 latest error code

Un\G144 Connection No.15 latest error code
Un\G145 Connection No.16 latest error code

APPX
390 Appendix 3 Buffer Memory
Own node operation status storage area
■Hub connection status area (Un\G242 to Un\G245)
The hub connection status of the Ethernet-equipped module is stored.
Address Name Description
Un\G242 Communication mode Stores the communication mode.
0: Half-duplex
1: Full-duplex
Un\G243 Connection status Stores the connection status.
0: Hub not connected or disconnected
1: Hub connected
Un\G244 Communication speed Stores the communication speed.
0: Operating at 10BASE-T
1: Operating at 100BASE-TX
2: Operating at 1000BASE-T
Un\G245 Disconnection count Stores the number of times the cable was disconnected.

■IP address duplication status storage area (Un\G251 to Un\G257)

Information when IP address is duplicated is stored.
Address Name Description
Un\G251 Same IP address detection flag Stores IP address duplication status.
0: IP address not duplicated
1: IP address duplicated
Un\G252 to Un\G254 MAC address of the station already connected to the Stores the MAC address of the station that has been
network already connected to the network in the station with
duplicated IP address.
Un\G252: 5th and 6th byte of the MAC address
Un\G253: 3rd and 4th byte of the MAC address
Un\G254: 1st and 2nd byte of the MAC address
"FFFFFFFFFFFFH" is stored in the station that has been
already connected to the network.
Un\G255 to Un\G257 MAC address of the station with the IP address already
used
Stores the MAC address of the station with duplicated IP
address in the station that has been already connected to A
the network.
Un\G255: 5th and 6th byte of the MAC address
Un\G256: 3rd and 4th byte of the MAC address
Un\G257: 1st and 2nd byte of the MAC address
"FFFFFFFFFFFFH" is stored in the station with the
duplicated IP address.

Remote password lock status storage area

■Remote password lock status system port (Un\G270)
The remote password lock status of each connection is stored.
• 0: Unlocked or remote password not set
• 1: Lock status
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G270 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

The numbers in the table indicate connection numbers.

■Remote password lock status system port (Un\G271)

Address Description
Un\G271 Stores the remote password lock status of the system port in b0 to b4.
0: Unlocked or remote password not set
1: Lock status
The bits corresponding to each system port are shown below.
b0: Auto-open UDP port
b1: MELSOFT transmission port (UDP/IP)
b2: MELSOFT transmission port (TCP/IP)
b3: FTP transmission port
b4: MELSOFT direct connection

APPX
Appendix 3 Buffer Memory 391
 Discard received data at CPU STOP setting area
■Discard received data at CPU STOP setting area (Un\G275)
Stores one of the following bit patterns for each connection number.
• 0: Disable (The receive data is not discarded during CPU STOP.)
• 1: Enable (The receive data is discarded during CPU STOP.)
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G275 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

The numbers in the table indicate connection numbers.

Forced connection invalidation setting area

■Forced connection invalidation setting area (Un\G280)
Set the connection to be forcibly invalidated.
• 0: Use allowed
• 1: Use prohibited
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G280 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

The numbers in the table indicate connection numbers.

■Forced connection invalidation system port (Un\G281)

Address Description
Un\G281 Set the system port to be forcibly invalidated.
0: Use allowed
1: Use prohibited
The bits corresponding to each system port are shown below.
b0: Auto-open UDP port
b1: MELSOFT transmission port (UDP/IP)
b2: MELSOFT transmission port (TCP/IP)
b3: FTP transmission port
b4: MELSOFT direct connection

Time setting function (SNTP) area

■Time setting function operation result (Un\G290)
Address Description
Un\G290 Stores the operation result of the time setting function.
0: Unexecuted
1: Success
FFFFH: Failure

■Time setting function execution time (Un\G291 to Un\G297)

Address Name Description
Un\G291 Year Stores the year that the time setting function was executed.
Un\G292 Month Stores the month that the time setting function was executed.
Un\G293 Day Stores the date that the time setting function was executed.
Un\G294 Hour Stores the time (hour) that the time setting function was executed.
Un\G295 Minute Stores the time (minute) that the time setting function was executed.
Un\G296 Second Stores the time (second) that the time setting function was executed.
Un\G297 Day of the week Stores the day of the week that the time setting function was executed.
0: Sunday
1: Monday
2: Tuesday
3: Wednesday
4: Thursday
5: Friday
6: Saturday

APPX
392 Appendix 3 Buffer Memory
Connection status storage area
■Latest error code connection No.1 (communication error) to latest error code connection
No.16 (communication error) (Un\G770 to Un\G785)
The latest error code (communication error) for each connection is stored.
Address Name
Un\G770 Latest error code connection No.1 (communication error)
Un\G771 Latest error code connection No.2 (communication error)

Un\G784 Latest error code connection No.15 (communication error)
Un\G785 Latest error code connection No.16 (communication error)

■FTP server latest error code (communication error) (Un\G786)

The latest error code (communication error) for the FTP server is stored.
Address Name
Un\G786 FTP server latest error code (communication error)

■MELSOFT direct connection latest error code (communication error) (Un\G787)

The latest error code (communication error) for MELSOFT direct connection is stored.
Address Name
Un\G787 MELSOFT direct connection latest error code (communication error)

■FTP client latest error code (communication error) (Un\G788)

The latest error code (communication error) for the FTP client is stored.
Address Name
Un\G788 FTP client latest error code (communication error)

■Auto-open UDP port latest error code (communication error) (Un\G789)

The latest error code (communication error) for the auto-open UDP port is stored. A
Address Name
Un\G789 Auto-open UDP port latest error code (communication error)

■MELSOFT connection auto-open UDP port latest error code (communication error) (Un\G790)
The latest error code (communication error) for the MELSOFT connection auto-open UDP port is stored.
Address Name
Un\G790 MELSOFT connection auto-open UDP port latest error code (communication error)

■MELSOFT connection auto-open TCP port latest error code (communication error) (Un\G791)
The latest error code (communication error) for the MELSOFT connection auto-open TCP port is stored.
Address Name
Un\G791 MELSOFT connection auto-open TCP port latest error code (communication error)

■Send buffer memory number of exhaustion (Un\G792)

The insufficient send buffer or memory count is stored.
Address Name
Un\G792 Send buffer memory number of exhaustion

APPX
Appendix 3 Buffer Memory 393
 Simple CPU communication function
■Request to stop fixed interval communication for each setting number (Un\G1094 to
Un\G1097)
This request contact stops the data send when the communication setting is "Fixed" and is stored using the following bit
pattern for each setting number
• Off  On: Requested (stop request)
• On  Off: Completed (stop completion)
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G1094 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G1097 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

■Request to restart fixed interval communication for each setting number (Un\G1098 to
Un\G1101)
This request contact restarts the data send when the communication setting is "Fixed" and is stored using the following bit
pattern for each setting number
• Off  On: Requested (restart request)
• On  Off: Completed (restart completion)
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G1098 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G1101 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

■Execution status flag for each setting number (Un\G1102 to Un\G1105)

The status of data communication is stored using the following bit pattern for each setting number.
• Off: Communication stop (function not used)
• On: Communicating
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G1102 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G1105 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

■Preparation completion for each setting number (Un\G1106 to Un\G1109)

The preparation completion status of the simple CPU communication is stored using the following bit pattern for each setting
number.
• Off: Not ready (function not used)
• On: Ready
Address b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0
Un\G1106 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

Un\G1109 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

■Simple CPU communication status for each setting number (Un\G1130 to Un\G1193)
Address Name Description
Un\G1130 Simple PLC status setting No.1 The simple CPU communication status is stored.
Un\G1131 Simple PLC status setting No.2 0H: Unset (function not used)
1H: Preparing
 3H: Communicating
Un\G1192 Simple PLC status setting No.63 4H: Communication stop
5H: Retry being executed
Un\G1193 Simple PLC status setting No.64
6H: Monitoring at error
AH: Communications impossible

APPX
394 Appendix 3 Buffer Memory
■Simple CPU communication error code for each setting number (Un\G1194 to Un\G1257)
Address Name Description
Un\G1194 Simple PLC error code setting No.1 The cause of the error detected in the simple CPU
communication is stored.
Un\G1195 Simple PLC error code setting No.2
0: No error (function not used)
 Other than 0: Error code ( Page 329 List of Error Codes)
Un\G1256 Simple PLC error code setting No.63 The value is cleared to 0 with a clear request from the
engineering tool.
Un\G1257 Simple PLC error code setting No.64

■Execution interval (current value) for each setting number (Un\G1258 to Un\G1321)
Address Name Description
Un\G1258 Execution interval (current value) setting No.1 If "Fixed" is set for communication setting, the current value of
the execution interval is stored.
Un\G1259 Execution interval (current value) setting No.2
0: Unset (function not used), communications impossible
 Other than 0: Execution interval (unit: ms)
Un\G1320 Execution interval (current value) setting No.63
Un\G1321 Execution interval (current value) setting No.64

APPX
Appendix 3 Buffer Memory 395
 Appendix 4 Dedicated Instruction
This section describes the dedicated instruction that can be used in Ethernet.
The following shows the meaning of the marks in the tables of this chapter.
: Available, : Not available

For details on dedicated instructions used in the RJ71EN71 and RnENCPU (network part), refer to the
following.
MELSEC iQ-R Programming Manual (Module Dedicated Instructions)
For details on dedicated instructions used in the CPU module (built-in Ethernet port part), refer to the
following.
MELSEC iQ-R Programming Manual (CPU Module Instructions, Standard Functions/Function Blocks)

Precautions
■Data change
Do not change any data specified (such as control data) until execution of the dedicated instruction is completed.

■When the dedicated instruction is not completed

Check whether "Module Operation Mode" in "Application Settings" of the RJ71EN71 and the RnENCPU (network part) is
"Online".
A dedicated instruction cannot be executed when the mode is "Offline" or "Module Communication Test".

Open/close processing instructions

The following table lists the Ethernet instructions to connect or disconnect the connection with the communication destination.
Instruction Description RJ71EN71, RnENCPU CPU module (built-in
symbol (network part) Ethernet port part)
GP.OPEN Establishes a connection.  
ZP.OPEN  
GP.CONOPEN  
SP.SOCOPEN  
GP.CLOSE Closes the connection.  
ZP.CLOSE  
GP.CONCLOSE  
SP.SOCCLOSE  

Instruction for SLMP communications

The following table lists the built-in Ethernet instructions used for communications using the SLMP.
Instruction Description RJ71EN71, RnENCPU CPU module (built-in
symbol (network part) Ethernet port part)
SP.SLMPSND Sends SLMP message to the SLMP-compatible device.  

APPX
396 Appendix 4 Dedicated Instruction
Instructions for predefined protocol communications
The following table lists the Ethernet instructions and built-in Ethernet instructions used for communications using the
communication protocol.
Instruction Description RJ71EN71, RnENCPU CPU module (built-in
symbol (network part) Ethernet port part)
GP.ECPRTCL Executes the protocol registered with the engineering tool's communication  
protocol support function.
SP.ECPRTCL  
SP.SOCCINF*1 Reads connection information  *2
*1
SP.SOCCSET Changes the communication target  *2

*1 These instructions are the same as the instruction for the socket communications (SP.SOCCINF/SP.SOCCSET). ( MELSEC iQ-R
Programming Manual (CPU Module Instructions, Standard Functions/Function Blocks))
*2 Only the following models can be used. The supporting firmware version differs depending on the model.
 R00CPU, R01CPU, R02CPU: There are no restrictions on the version.
 Programmable controller CPUs other than the above: "29" or later

Socket communications instructions

The following table lists the Ethernet instructions and built-in Ethernet instructions used for socket communications.
Instruction Description RJ71EN71, RnENCPU CPU module (built-in
symbol (network part) Ethernet port part)
GP.SOCRCV Reads the receive data from the external device.  
SP.SOCRCV  
G.SOCRCVS  
S.SOCRCVS  
GP.SOCSND Sends data to the external device.  
SP.SOCSND  
SP.SOCCINF Reads connection information  
SP.SOCCSET Changes the communication target   A
SP.SOCRMODE Changes the connection receive mode.  
S.SOCRDATA Reads the specified size of data from the socket communication receive data  
area.
SP.SOCRDATA  

If the instruction has a completion device, do not change the various data (such as control data and request
data) specified with the executed instruction until execution of the instruction is completed.

Instructions for communications using the fixed buffer

The following table lists the Ethernet instructions used for communications using the fixed buffer.
Instruction Description RJ71EN71, RnENCPU CPU module (built-in
symbol (network part) Ethernet port part)
GP.BUFRCV Reads the receive data from the external device.  
ZP.BUFRCV  
G.BUFRCVS Reads the receive data with an interrupt program.  
Z.BUFRCVS  
GP.BUFSND Sends data to the external device.  
ZP.BUFSND  

APPX
Appendix 4 Dedicated Instruction 397
 Link dedicated instructions
The following table lists the instructions common to Ethernet and CC-Link IE used for transient transmission with
programmable controllers on other stations.
A station on a network other than Ethernet can also be accessed. ( Page 407 Communications with Different Networks)
Instruction Description RJ71EN71, RnENCPU CPU module (built-in
symbol (network part) Ethernet port part)
JP.READ Reads data from the word device of another station.  
GP.READ  
JP.SREAD Reads data from the word device of another station. (with completion device)  
GP.SREAD  
JP.WRITE Writes data in the word device of another station.  
GP.WRITE  
JP.SWRITE Writes data in the word device of another station. (with completion device)  
GP.SWRITE  
JP.SEND Sends data to another station.  
GP.SEND  
JP.RECV Reads the receive data from another station. (for main program)  
GP.RECV  
G.RECVS Reads the receive data from another station. (for interrupt program)  
Z.RECVS  
J.ZNRD Reads data from the word device in another station (ACPU).  
JP.ZNRD  
J.ZNWR Writes data in the word device in another station (ACPU).  
JP.ZNWR  
J.REQ Requests the remote RUN/STOP to the CPU module on another station.  
JP.REQ  
G.REQ  
GP.REQ  
J.REQ Reads/Writes the clock data from/to the CPU module of other stations.  
JP.REQ  
G.REQ  
GP.REQ  

Precautions
When executing multiple link dedicated instructions simultaneously, check that the channels for the instructions are not
duplicated. Link dedicated instructions with the same channel cannot be executed simultaneously. To use the same channel
for multiple link dedicated instructions, configure an interlock so that an instruction is executed after completion of another.

File transfer function instruction

The following table lists the built-in Ethernet instructions used for the file transfer function (FTP client).
Instruction Description RJ71EN71, RnENCPU CPU module (built-in
symbol (network part) Ethernet port part)
SP.FTPPUT This instruction sends files in the CPU module (FTP client) to the folder path of  
the specified FTP server.
SP.FTPGET This instruction retrieves files on the FTP server to the folder path of the  
specified CPU module (FTP client).

APPX
398 Appendix 4 Dedicated Instruction
Other dedicated instructions
The following table lists the other Ethernet instructions.
Instruction Description RJ71EN71, RnENCPU CPU module (built-in
symbol (network part) Ethernet port part)
GP.ERRCLEAR Turns off the LED and clears error information.*1  
ZP.ERRCLEAR  
GP.ERRRD Reads error information.  
ZP.ERRRD  
G.UINI Performs re-initial processing.  
GP.UINI  
Z.UINI  
ZP.UINI  

*1 Availability for turning off the LED depends on the firmware version of the RJ71EN71. ( Page 436 Added and Enhanced Functions)

APPX
Appendix 4 Dedicated Instruction 399
 Appendix 5 TCP/IP Communications, UDP/IP
Communications
This chapter describes the communication flow and procedure of TCP/IP communications and UDP/IP communications.

TCP/IP communications
This section describes TCP/IP communications.

Establishing a connection
With TCP/IP communications, a connection must be established between the communicating devices. If the server side
device has executed the Passive open processing and is in the standby state, the client side device makes an open request
(Active open processing) to the server. When a response is returned, the connection is established.
With TCP/IP communications, a connection is established during communication. Since data is exchanged while checking
that the data has correctly reached the communication destination, the data reliability can be ensured. Note that the line load
is larger than UDP/IP communications.

Ex.
When the Ethernet-equipped module is Passive open

Server Client

Open request

Response

Ethernet-equipped module External device

Connection
Passive open Active open

APPX
400 Appendix 5 TCP/IP Communications, UDP/IP Communications
Communication flow
This section describes the flow from the establishment of connection to end of communication.
Server Client

Ethernet-equipped module
After performing External device
Passive open, the server
will wait for an open request
from the client.
Passive open When the client sends
an Active open request
Open request and the server accepts it,
Active open
a connection is established
between the client and the
server.
Response

Connection established Connection established

Data sending The client requests data

Data sending sending and sends data.

Response
The client receives the response
Receive processing to the data.

Data sending
Data sending The client receives data and sends
back the response to the data.

Response
Receive processing

A
Close request
Close processing

Response

Close request
Close request The packet to stop communications is
exchanged then the connection is
disconnected.
Response

Closed Closed

Wait at least 500ms or more before executing the open processing again after the close request is sent from
the external device to the Ethernet-equipped module.

APPX
Appendix 5 TCP/IP Communications, UDP/IP Communications 401
 Active open procedure
Active open is a connection method that performs an active open processing in respect to an external device (Passive open)
that is in a passive open standby state for a connection. The following figure shows the process for the Ethernet-equipped
module to Active open.
For OPEN/CLOSE instruction, refer to the following.
 MELSEC iQ-R Programming Manual (Module Dedicated Instructions)

Ex.
Open/close processing for connection No.1
Parameter
communications
Power-on completed
Open status Ò

Open enable status

(closed)

Closed status

'Initial status'
(Un\G1900024.0)
Ó

OPEN instruction
1 scan

OPEN instruction
completion device

OPEN instruction Abnormally ended

completion device +1

Ö
CLOSE instruction
1 scan

CLOSE instruction
completion device
Abnormally
CLOSE instruction ended
completion device +1
'Open completion signal
(connection No.1)'
(Un\G1900000.0)
'Open request signal
(connection No.1)'
(Un\G1900008.0)
SYN ACK FIN ACK
Ô × Ø

SYN + ACK FIN + ACK

 After the module parameters are set, check that the initial processing for the Ethernet-equipped module has completed normally. ('Initial status'
(Un\G1900024.0): On)
 Start the open processing using the OPEN instruction.*3 ('Open request signal (connection No.1)' (Un\G1900008.0): On)
 The Ethernet-equipped module executes the open processing. (The module sends open request (SYN) to the external device.)
 Data can be exchanged after the open processing completes normally.*1
 Start the close processing using the CLOSE instruction. ('Open request signal (connection No.1)' (Un\G1900008.0): Off)
 The Ethernet-equipped module executes the close processing. (The module sends close request (FIN) to external device.)
 Data communication ends when close processing completes normally.*2
*1 If RST is returned from the external device after SYN is sent from the Ethernet-equipped module, open abnormal completion occurs
immediately, and the open processing ends.
*2 If ACK or FIN is not returned even after the TCP end timer time, the Ethernet-equipped module forcibly cuts off the connection (sends
RST). (Close abnormal completion)
*3 If the open processing target port has not been linked up, the OPEN instruction will complete with an error. Execute the open processing
again after link-up, or check that 'Connection status' (Un\G5192) is set to 1 before starting the open processing. If auto-negotiation fails,
the open processing will complete with an error. Retry the open processing after a while.
If the open processing completes with an error again, check the Ethernet cable connection or the operation of the external device and
switching hub.

APPX
402 Appendix 5 TCP/IP Communications, UDP/IP Communications
Passive open procedure
The following two types of connection methods can be used to Passive open the Ethernet-equipped module.
Connection Description
method
Unpassive This connection method executes a passive open processing for the connection to all devices connected to the network without restriction to
the IP address or port number of the communication destination.
Fullpassive When the IP address and port number of the communication destination are specified, this connection method executes a passive open
processing for the connection of the specific external device.

The open/close processing procedure for Passive open follows the setting of "Opening Method" under "Own Node Settings"
in "Basic Settings". ( Page 262 Own Node Settings)

■When "Do Not Open by Program" is set

The Ethernet-equipped module is constantly in the open standby state, so the connection is established when Active open is
initiated by the external device. This eliminates the need for an open/close processing program on the Ethernet-equipped
module side.

Ex.
Open/close processing for connection No.1
Parameter
communications
Power-on completed Ò

Open status
*1
Open enable status (closed)
(Active open acceptance enabled)

Closed status

A
'Initial status' (Un\G1900024.0)

'Open completion signal Õ

(connection No.1)'
(Un\G1900000.0)
'Open request signal
(connection No.1)'
SYN + ACK FIN + ACK
(Un\G1900008.0)
Ó Ô
SYN ACK FIN ACK

 After the module parameters are set, check that the initial processing for the Ethernet-equipped module has completed normally. ('Initial status'
(Un\G1900024.0): On) When the initial processing completes normally, the connection enters the open enable state, and the module waits for the open
request from the external device.
 The Ethernet-equipped module executes the open processing when an open request (SYN) is received from the external device. When the open processing
ends normally, 'Open completion signal (connection No.1)' (Un\G1900000.0) turns on and data communication is enabled.
 The Ethernet-equipped module executes the close processing when the close request (FIN) is received from the external device. When the close
processing completes normally, the open completion signal turns off and data communication is disabled.
 After the internal processing in the Ethernet-equipped module completes, the connection stands by for the open request again.
*1 The open request (SYN) received between the initial processing normal completion to the open request standby state is handled as an
error, and the Ethernet-equipped module sends a connection forced close (RST) (to the external device that sent the open request
(SYN)).

When the open/close processing is executed with a dedicated instruction from the Ethernet-equipped module,
even if "Do Not Open by Program" is set in "Opening Method" under "Own Node Settings" in "Basic Settings",
the connection will not return to the open request standby state after the close processing completes.

APPX
Appendix 5 TCP/IP Communications, UDP/IP Communications 403
 ■When "Open by Program" is set
Before the open/close request is received from the external device, the Ethernet-equipped module must execute the OPEN/
CLOSE instruction and enter the open/close standby state. Data can be sent and received after the open processing
completes normally.
For OPEN/CLOSE instruction, refer to the following.
 MELSEC iQ-R Programming Manual (Module Dedicated Instructions)

Ex.
Open/close processing for connection No.1
Parameter
communications
Power-on completed

Open status Ò
Open enable status (closed) *1
(Active open acceptance
enabled)

Closed status

'Initial status'
(Un\G1900024.0)
Ó
OPEN instruction
1 scan

OPEN instruction
completion device
Abnormally
OPEN instruction ended
completion device +1
Ö
CLOSE instruction
1 scan

CLOSE instruction
completion device
Abnormally
ended
CLOSE instruction
completion device +1
'Open completion signal
(connection No.1)'
(Un\G1900000.0)
'Open request signal
(connection No.1)'
(Un\G1900008.0) SYN + ACK FIN + ACK
Ô Õ
SYN ACK FIN ACK
 After the module parameters are set, check that the initial processing for the Ethernet-equipped module has completed normally. ('Initial status'
(Un\G1900024.0): On)
 Start the open processing using the OPEN instruction. ('Open request signal (connection No.1)' (Un\G1900008.0): On)
 The Ethernet-equipped module executes the open processing when an open request (SYN) is received from the external device. When the open processing
ends normally, 'Open completion signal (connection No.1)' (Un\G1900000.0) turns on and data communication is enabled.
 The Ethernet-equipped module executes the close processing when the close request (FIN) is received from the external device. When the close
processing completes normally, the open completion signal turns off and data communication is disabled.
*1 The open request (SYN) received between the initial processing normal completion to the open request standby state is handled as an
error, and the Ethernet-equipped module sends a connection forced close (RST) (to the external device that sent the open request
(SYN)).

• Change the connection setting before executing the OPEN instruction.

• After the open processing is executed, the open request cannot be canceled until the open processing
completes. Execute the close processing (CLOSE instruction) after open completes.

APPX
404 Appendix 5 TCP/IP Communications, UDP/IP Communications
UDP/IP communications
This section describes the UDP/IP communications. Since UDP/IP communications does not establish a connection during
communication and does not check that the communication destination has correctly received the data, the line load is lower.
Note that the data reliability is lower than TCP/IP communications.

Communication flow
UDP/IP communications does not require a process to establish a connection with the external device as is required with
TCP/IP communications.

Server Client

Ethernet-equipped module
External device

Open The client opens

Open
the port.

Data sending The client specifies

Data sending request
the destination and
sends data to it.

The server requests

data reception and Receive processing (reading)
reads the received data.

Data sending
Data sending request

A
Receive processing (reading)

The client performs

Close Close
the close processing.

Wait at least 500ms or more before executing the open processing again after the close request is sent from
the external device to the Ethernet-equipped module.

Open procedure
The open/close processing procedure is as follows, according to the setting of "Opening Method" under "Own Node Settings"
in "Basic Settings". ( Page 262 Own Node Settings)

■When "Do Not Open by Program" is set

After the Ethernet-equipped module mounted station starts up, the UDP/IP communications setting connection automatically
opens, and data send/receive is enabled. Program for open/close processing is not required.

When the open/close processing is executed with a dedicated instruction from the Ethernet-equipped module,
even if "Do Not Open by Program" is set in "Opening Method" under "Own Node Settings" in "Basic Settings",
the open/close processing after a connection with the external device is established must be executed by the
program.

APPX
Appendix 5 TCP/IP Communications, UDP/IP Communications 405
 ■When "Open by Program" is set
Before the open/close request is received from the external device, the Ethernet-equipped module must execute the OPEN/
CLOSE instruction and enter the open/close standby state. Data can be sent and received after the open processing
completes normally.
For OPEN/CLOSE instruction, refer to the following.
 MELSEC iQ-R Programming Manual (Module Dedicated Instructions)

Ex.
Open/close processing for connection No.1
Parameter
communications
Power-on completed
Open status
Ò

Open enable status (closed)

Closed status

'Initial status'
(Un\G1900024.0)
Ó
OPEN instruction
1 scan

OPEN instruction
completion device

OPEN instruction Abnormally ended

completion device +1
Ö
CLOSE instruction
1 scan

CLOSE instruction
completion device
Abnormally
CLOSE instruction ended
completion device +1

'Open completion signal

(connection No.1)'
(Un\G1900000.0) Ô Õ × Ø
Internal processing Internal processing

 After the module parameters are set, check that the initial processing for the Ethernet-equipped module has completed normally. ('Initial status'
(Un\G1900024.0): On)
 Start the open processing using the OPEN instruction. ('Open request signal (connection No.1)' (Un\G1900008.0): On)
 The Ethernet-equipped module executes the open processing. (only internal processing)
 Data can be exchanged after the open processing completes normally.
 Start the close processing using the CLOSE instruction. ('Open request signal (connection No.1)' (Un\G1900008.0): Off)
 The Ethernet-equipped module executes the close processing. (only internal processing)
 Data communication ends when close processing completes normally.

APPX
406 Appendix 5 TCP/IP Communications, UDP/IP Communications
Appendix 6 Communications with Different Networks
Different network stations can be accessed with dedicated instructions or the engineering tool, allowing seamless
communication.
CC-Link IE Controller Network

Network No.1

Engineering tool

(Relay station)

Ethernet CC-Link IE Field Network

Network No.3 Network No.2

The following functions are used to communicate with different networks.

Functions capable of communication Communication request Reference source
source
Communications using the SLMP External device Page 29 SLMP Communications
SLMP Reference Manual
A
Communications using a link dedicated CPU module on another station Page 116 Link Dedicated Instruction Communication
instruction
Communications with other stations using the Engineering tool GX Works3 Operating Manual
engineering tool

• UDP/IP communications is used to communicate with other networks. Data is always exchanged as binary
codes.
• Communications can be made with stations up to eight networks apart (number of relay stations: 7).

APPX
Appendix 6 Communications with Different Networks 407
 When the networks consist of only MELSEC iQ-R series
Communication paths are automatically set for communication with the following networks of MELSEC iQ-R series.
• Ethernet
• CC-Link IE Controller Network
• CC-Link IE Field Network

■Setting procedure
Use the following procedure.

1. Set the network number, station number, and transient transmission group number in the "Own Node Settings" under
"Basic Settings". ( Page 263 Details of items)
2. Set the "Network Dynamic Routing" under "Application Settings" to "Enable".

• Communication paths are automatically set, but they can also be manually set. To set communication paths
manually, refer to the following. ( Page 408 When the networks consist of MELSEC iQ-R series and
other series)
• The communication path cannot be set automatically for Ethernet-equipped modules connected via a
router. Set the communication path manually. ( Page 408 When the networks consist of MELSEC iQ-R
series and other series)

When the networks consist of MELSEC iQ-R series and other series
Setting communication paths allows communication with the following networks configured with modules other than MELSEC
iQ-R series.
• Ethernet
• CC-Link IE Controller Network
• CC-Link IE Field Network
• MELSECNET/H
• MELSECNET/10

■Setting procedure
Use the following procedure.
1. Set the network number, station number, and transient transmission group number in the "Own Node Settings" under
"Basic Settings". ( Page 263 Details of items)

2. Set the send destination station information in "Network/Station No. <-> IP information setting" under "Application
Settings". ( Page 286 Network/Station No. <-> IP information setting)
3. Set communication paths in "Routing Setting" of "CPU Parameter".
( MELSEC iQ-R CPU Module User's Manual (Application))

APPX
408 Appendix 6 Communications with Different Networks
When the networks contain a redundant system
• When setting a communication path automatically, after the time specified by the destination alive check timer (time
calculated from destination alive check start interval timer value, destination alive check interval timer value, and
destination alive check resend count), the communication path setting will be changed. Set as small a value as possible for
the "Destination Alive Check Start Interval Timer", "Destination Alive Check Interval Timer", and "Destination Alive Check
Resend Count".
• When the communication paths are automatically set, the paths are updated if system switching occurs in a redundant
system on the paths. During update of the communication paths, communications may be interrupted or data may be lost
because the paths are temporarily undetermined. If an error occurs in communications, resend data from the request
source.
• When the request source is a redundant system and the communication paths are automatically set, perform the
communications from the control system. When performing the communications from the standby system, set "Routing
Setting" of "CPU Parameter"
• When the request destination is a redundant system and the communication paths are automatically set, specify the control
system station as the destination. When specifying the standby system as the request destination, set "Routing Setting" of
"CPU Parameter".
• When relaying a redundant system and setting the communication paths manually, set the control system station as a relay
station in "Routing Setting" of "CPU Parameter". If system switching occurs, the relay station needs to be changed to a
station in the new control system using the RTWRITE instruction. ( MELSEC iQ-R Programming Manual (CPU Module
Instructions, Standard Functions/Function Blocks))

APPX
Appendix 6 Communications with Different Networks 409
 Appendix 7 Processing Time
Calculate the minimum processing time for each function with the following formula. Note that the processing time may be
even longer due to the network load rate (line congestion), each connected device's window size, number of connections
being used simultaneously, and the system configuration. The value calculated with the following formula is a guide for the
processing time when communicating with only one connection.

Minimum processing time of fixed buffer communications (between the RJ71EN71s*1)

*1 The processing time will be the same even if the RnENCPU (network part) is mixed.

■Procedure exists
Tfs = St + Ke + (Kdf  Df) + Sr
• Tfs: Time from start to end of send (unit: ms)
• St: Sending station scan time
• Ke, Kdf: Constant (refer to following table)
• Df: Number of send data words
• Sr: Receiving station scan time
Item RJ71EN71, RnENCPU
During TCP/IP communications During UDP/IP communications
Ke Kdf Ke Kdf
When communicating with binary code data 6 0.0030 3 0.0020
When communicating with ASCII code data 6 0.0100 4 0.0015

■No procedure
Tfs = St + Ke + (Kdf  Df)
• Tfs: Time from start to end of send (unit: ms)
• St: Sending station scan time
• Ke, Kdf: Constant (refer to following table)
• Df: Number of send data bytes
Item RJ71EN71, RnENCPU
During TCP/IP communications During UDP/IP communications
Ke Kdf Ke Kdf
When communicating with binary code data 4 0.0010 3 0.0007

Minimum processing time of communications using the random access buffer

Trs = Kr + (Kdr  Df) + external device ACK processing time (added only during TCP/IP communications)
• Trs: Time from reception of personal computer request data to complete of process by RJ71EN71 (unit: ms)
• Kr, Kdr: Constant (refer to following table)
• Df: Number of request data words
• External device ACK process time: Time until external device returns ACK upon completion of random access buffer read/
write
Item RJ71EN71, RnENCPU
During TCP/IP communications During UDP/IP communications
Kr Kdr Kr Kdr
During read When communicating with binary code data 2.5 0.0020 1.8 0.0025
When communicating with ASCII code data 2.5 0.0060 1.9 0.0065
During write When communicating with binary code data 2.5 0.0025 1.8 0.0025
When communicating with ASCII code data 2.6 0.0070 1.9 0.0060

APPX
410 Appendix 7 Processing Time
Processing time of communications using MODBUS/TCP
The following shows the time required by the Ethernet-equipped module when it receives a request message from the
MODBUS/TCP master device, completes the processing, and sends a response message.

■Calculation formula
Tsl = Ks1 + (Ks2  n1) + (St  n2) [ms]
Variable Meaning Processing time, constant
Tsl Request message processing time (performance of the automatic response 
function) (unit: ms)
Ks1 Internal processing time of the automatic response function (unit: ms) Fixed to 2.5ms
Ks2 Communication time between the Ethernet-equipped module and CPU module Fixed to 4.5ms
(unit: ms)
St Own station scan time (unit: ms) 
n1 Function code for the processing target and setting details of the memory Function code CPU module device Buffer memory
assignment assignment assignment
01 1 0
02 1 0
03 1 0
04 1 0
05 1 0
06 1 0
15 1 0
16 1 0
20 1 0
21 1 0
22 2 0
23 2 0
n2 Function code for the processing target and setting details of the memory Function code CPU module device Buffer memory
assignment assignment assignment A
Normal Worst
case
01 1 2 0
02 1 2 0
03 1 2 0
04 1 2 0
05 1 2 0
06 1 2 0
15 1 2 0
16 1 2 0
20 1 2 0
21 1 2 0
22 2 4 0
23 2 4 0

APPX
Appendix 7 Processing Time 411
 System switching time when a redundant system is used
The following shows the system switching time when the Ethernet-equipped module mounted on the control system in the
redundant system detects a communication error or cable disconnection and sends a system switching request to the control
system CPU module. System switching time is the time from communication error or cable disconnection detection to when
the control system CPU module is switched over.

■Calculation formula
The following is the formula to calculate the system switching time.*1
System switching cause System switching time [ms]
Communication error detection (alive check error) Tsi + (Ti  (Tr + 1)) + St + Tsw
Communication error detection (ULP timeout occurrence) Ttu + St + Tsw
Disconnection detection Td + St + Tsw

*1 The meanings of the variables in the equation are as follows.

Variable Meaning
Tsi Destination alive check start interval timer [ms] ( Page 281 Timer Settings for Data Communication)
Ti Destination alive check interval timer [ms] ( Page 281 Timer Settings for Data Communication)
Tr Destination alive check resend count ( Page 281 Timer Settings for Data Communication)
St 1 scan time [ms] ( MELSEC iQ-R CPU Module User's Manual (Application))
Tsw CPU module system switching time [ms] ( MELSEC iQ-R CPU Module User's Manual (Application))
Ttu TCP ULP timer value [ms] ( Page 281 Timer Settings for Data Communication)
Td Disconnection detection monitoring time [ms] ( Page 295 Redundant System Settings)

APPX
412 Appendix 7 Processing Time
■Timing chart
This section describes a timing chart for each system switching cause.
• Communication error detection (alive check error)
Communications have not been performed
with the external device for a fixed period.
(Tr = 2)
RJ71EN71 (system A) Operating as a control system Operating as a standby system

Tsi Ti Ti Ti
Issuing a system
switching request

Scan time of the system A CPU

System A Control system Standby system

Tsw

System B Standby system Control system

Scan time of the system B CPU

Operating as
RJ71EN71 (system B) Operating as a standby system a control system
System switching time

• Communication error detection (ULP timeout occurrence)

No response from the external device

RJ71EN71 (system A) Operating as a control system Operating as a standby system

Ttu
Issuing a system
switching request

Scan time of the system A CPU

System A Control system Standby system

Tsw

System B Standby system Control system

Scan time of the system B CPU

A
RJ71EN71 (system B) Operating as a standby system Operating as a control system

System switching time

• Disconnection detection
Disconnected

RJ71EN71 (system A) Operating as a control system Operating as a standby system

Td
Issuing a system
switching request

Scan time of the system A CPU

System A Control system Standby system

Tsw

System B Standby system Control system

Scan time of the system B CPU

RJ71EN71 (system B) Operating as a standby system Operating as a control system

System switching time

APPX
Appendix 7 Processing Time 413
 Performance list of simple CPU communication function
The following shows the performance of the execution interval (simple CPU communication function). The execution interval
varies depending on the number of settings, the number of communication points, and the scan time of the CPU module. The
interval is also affected by the execution conditions of other functions or Ethernet communication condition.

Condition
• Communication setting: "Fixed"
• Sequence scan time (own station) =: 1ms (scan time before the execution of simple CPU communication function)
• Communication destination: MELSEC iQ-R (built-in Ethernet)
• Sequence scan time (communication destination): 1ms (any model)
• Device data: Bit device = M, Word device = D
• The number of settings is as shown in the table (1, 8, 16, 32, and 64) and all settings are for the different communication
destinations (not for the same destination).
• The retry of communication is not performed.
Communication Number of communication points for Processing time by the number of settings (unit: ms)
pattern one setting 1 8*2 16*2 32*2 64*2
Read 32 words for each device*1 10 11 17 34 76
(Total 64 words)
64 words for each device*1 10 11 17 35 77
(Total 128 words)
256 words for each device*1 10 13 20  
(Total 512 words)
Write 32 words for each device*1 10 11 18 35 77
(Total 64 words)
64 words for each device*1 10 11 18 35 80
(Total 128 words)
256 words for each device*1 10 13 20  
(Total 512 words)

*1 Number of points for each device (bit device and word device)
*2 The larger the number of settings for the same communication destination is, the longer the execution interval becomes, and it becomes
up to eight times longer.

APPX
414 Appendix 7 Processing Time
Appendix 8 Mounting the Module with a Remote
Head Module
This chapter describes restrictions and precautions for using the RJ71EN71 that is mounted with a remote head module.

Restrictions on functions and specifications

Functions
Function Restriction
Communications using the SLMP • The command that can be used differs from that of the CPU module. ( SLMP Reference Manual)
• The file that can be operated differs from that of the CPU module. ( MELSEC iQ-R CC-Link IE Field Network
Remote Head Module User's Manual (Application))
Communications using the This function cannot be used.
predefined protocol
Socket communications This function cannot be used.
Communications using the fixed This function cannot be used.
buffer
Communications using MODBUS/ • When the network type is "Q Compatible Ethernet", this function cannot be used.
TCP • The default values set for the MODBUS device assignment parameters cannot be used for creating a project for the
engineering tool using the remote head module. Clear the values first before starting the setting.
Communications using a link Although the own station can be specified as the relay station or target station, the link dedicated instruction cannot be
dedicated instruction executed from the own station.
File transfer function (FTP server) • The file that can be operated differs from that of the CPU module. ( MELSEC iQ-R CC-Link IE Field Network
Remote Head Module User's Manual (Application))
• The number of files that can be written to the data memory differs from that of the CPU module. ( MELSEC iQ-R CC-
Link IE Field Network Remote Head Module User's Manual (Startup))
Time setting function (SNTP This function cannot be used.
client)
IP filter function When the network type is "Q Compatible Ethernet", this function cannot be used.
Simple CPU communication When the network type is "Q Compatible Ethernet", this function cannot be used. A
function
IP address change function When the network type is "Q Compatible Ethernet", this function cannot be used.
Redundant system function Although the RJ71EN71 can be connected to a redundant system of a remote head module, redundant system of the
RJ71EN71 cannot be configured.

Module parameters
There are differences between when the RJ71EN71 is connected to the CPU module and when the RJ71EN71 is connected
to the remote head module. For details, refer to the following.
 MELSEC iQ-R CC-Link IE Field Network Remote Head Module User's Manual (Application)
This manual describes the restrictions specific to the RJ71EN71.
Parameter name Restrictions
Basic Own Node Settings Select "Do Not Open by Program" for "Opening Method".
Settings
External Device When performing TCP/IP communications, select "Unpassive Connection Module" or "Fullpassive Connection Module"
Configuration for the external device.

Open/close processing
Perform the open/close processing of the connection from the external device.

APPX
Appendix 8 Mounting the Module with a Remote Head Module 415
 Appendix 9 Using the Module in the Redundant
System with Redundant Extension Base
Unit
This chapter describes restrictions and precautions for using the RJ71EN71 that is mounted on the extension base unit in the
redundant system.

Restrictions on functions and specifications

Applicable network combination

Network type Setting in GX Works3 Restrictions
Ethernet RJ71EN71(E+E) The network can be used for a module with firmware version of "50" or
later.*1
CC-Link IE Controller Network RJ71EN71(CCIEC) This network type cannot be used.
CC-Link IE Field Network RJ71EN71(CCIEF) This network type cannot be used.
Ethernet + CC-Link IE Controller Network RJ71EN71(E+CCIEC) This network type cannot be used.
Ethernet + CC-Link IE Field Network RJ71EN71(E+CCIEF) This network type cannot be used.
Q Compatible Ethernet RJ71EN71(Q) The network can be used for a module with firmware version of "50" or
later.*1

*1 When using the network, check the versions of the CPU module compatible with the extension base unit and the engineering tool.

Functions
Function Restriction
Connection with MELSOFT products and a When "Not Specified" is set, a CPU module of the control system is accessed.
GOT When the CPU module in the system A is in the control system, enable communication by specifying "System
A", "Control System", or "Not Specified" for "Redundant CPU Setting" in "Specify Connection Destination
Connection".
When the CPU module in the system A is in the standby system, enable communication by specifying "System
A" or "Standby System" for "Redundant CPU Setting" in "Specify Connection Destination Connection".
Communications using the predefined This function cannot be used.
protocol
Socket communications This function cannot be used.
Communications using the fixed buffer When the network type is only "Q Compatible Ethernet", this function can be used. ( Page 418 Example of
communications using the fixed buffer)
MODBUS/TCP communications When the network type is "Q Compatible Ethernet", this function cannot be used.
Communications using a link dedicated Although the own station can be specified as the relay station or target station, the link dedicated instruction
instruction cannot be executed from the own station.
File transfer function (FTP server) This function cannot be used.
IP filter When the network type is "Q Compatible Ethernet", this function cannot be used.
Simple CPU communication function When the network type is "Q Compatible Ethernet", this function cannot be used.
IP address change function When the network type is "Q Compatible Ethernet", this function cannot be used.

Dedicated instructions
Any dedicated instructions of the RJ71EN71 cannot be used.
When using the dedicated instructions for the RJ71EN71, install it to the main base unit.

When the network type is "Q Compatible Ethernet", the "ERR LED off request" (Y17) can be used instead of
the ERRCLEAR instruction. ( Page 354 When the network type is "Q Compatible Ethernet")

Module FBs
Any module FBs of the RJ71EN71 cannot be used.

APPX
416 Appendix 9 Using the Module in the Redundant System with Redundant Extension Base Unit
Module parameters
■Application Settings
• Set "Not Use" to "To Use or Not to Use Redundant System Settings" in "Redundant System Settings".
• Do not specify Interrupt settings.
• Set "Disable" to "Dynamic Routing Setting" under "Network Dynamic Routing".
• Set "Not Use" to "IP Packet Transfer Function" in "IP Packet Transfer Setting".

Open/close processing
The open/close processing by input/output signals cannot be performed.

Precautions
• When system switching occurs during communications using MELSOFT connection, SLMP communication from other
stations, or communications using dedicated instructions of other stations, communication timeout error may occur.
• When system switching occurs during simple CPU communication, a timeout error may occur in the CPU response
monitoring timer. If required, try the CPU response monitoring timer again.
• When system switching occurs during MODBUS/TCP communications, a timeout error may occur in the CPU response
monitoring timer. If required, try the CPU response monitoring timer again.
• For replacement from the MELSEC-Q series, set "Q Compatible Ethernet" to the RJ71EN71 network type

APPX
Appendix 9 Using the Module in the Redundant System with Redundant Extension Base Unit 417
 Example of communications using the fixed buffer
An example of communications using a fixed buffer when the RJ71EN71 is installed to the extension base unit is shown
below.

System configuration
(1) (2)

(3) (4)

(1) Control system (R35B, R61P, R08PCPU, R6RFM)

(2) Standby system (R35B, R61P, R08PCPU, R6RFM)
(3) First level (R68WRB, R63RP, R63RP, RJ71EN71)
(4) Communication destination device

Parameter setting
Connect the engineering tool to the CPU module to be set as the control system and set the parameters.
In a redundant system, the same program and parameter are written to both systems. A new project does not need to be
created for the standby system.

1. Set the CPU module as follows.

[Project]  [New]

2. Click the [OK] button to add the module labels of the CPU module.

APPX
418 Appendix 9 Using the Module in the Redundant System with Redundant Extension Base Unit
3. Set the base unit information as follows.
[Navigation window]  [Parameter]  [System Parameter]  [Base/Power/Extension Cable Setting]

4. Specify the information for the redundant function module and RJ71EN71 as follows.
[Navigation window]  [Parameter]  [System Parameter]  [I/O Assignment Setting]

5. Set the IP address as follows.

[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71(Q)]  [Basic Settings]  [Own Node
Settings]

APPX
Appendix 9 Using the Module in the Redundant System with Redundant Extension Base Unit 419
 6. Set the network configuration as follows.
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71(Q)]  [Basic Settings]  [External Device
Configuration]

7. Set "Not Use" to "To Use or Not to Use Redundant System Settings".
[Navigation window]  [Parameter]  [Module Information]  [RJ71EN71(Q)]  [Application Settings]  [Redundant
System Settings]

8. Write the set parameters to the control system CPU module.

[Online]  [Write to PLC]

9. Click the [Yes] button to write to the CPU modules of both systems.

10. Either reset the CPU modules of both systems or power off and on both systems.

• In this setting example, default settings other than above are used for the parameters. For the parameter
setting, refer to the chapter explaining the parameters in this manual. ( Page 261 PARAMETER
SETTINGS)
• Since PLS instructions and other instructions in the program, check that "Transfer" has been set to "Signal
Flow Memory Tracking Setting" in "Tracking Setting" under "Redundant Settings" in "CPU Parameter".

APPX
420 Appendix 9 Using the Module in the Redundant System with Redundant Extension Base Unit
Program examples
In this example, connection No.1 is opened and data is sent to an external device.
Also, the data from an external device is received using connection No.2.
Classification Label name
Label to be defined Define global labels as shown below:

APPX
Appendix 9 Using the Module in the Redundant System with Redundant Extension Base Unit 421
 APPX
422 Appendix 9 Using the Module in the Redundant System with Redundant Extension Base Unit
(0) When bOpenInstruction_1 is turned on, open processing of connection No.1 is performed.
(66)When bSendInstruction is turned on, data is sent to an external device using connection No.1.
(125)When bCloseInstruction_1 is turned on, close processing of connection No.1 is performed.
(201)When bRecvInstruction is turned on, data is sent to an external device using connection No.2.

APPX
Appendix 9 Using the Module in the Redundant System with Redundant Extension Base Unit 423
 Appendix 10 Port Numbers Used by Ethernet-
equipped Module
The following port numbers are used by the system and cannot be specified.
Port Number Applications
Decimal Hexadecimal CPU module (built-in Ethernet port part) RJ71EN71, RnENCPU (network part)
5000 1388H For system Auto-open UDP port (default value)
5001 1389H MELSOFT transmission port (UDP/IP)
5002 138AH For system MELSOFT transmission port (TCP/IP)
5003 138BH For system MELSOFT direct connection port
5004 138CH For system For system
5005 138DH Auto-open UDP port (default value) For system
5006 138EH MELSOFT transmission port (UDP/IP) For system
5007 138FH MELSOFT transmission port (TCP/IP) For system
5008 1390H MELSOFT direct connection port For system
5009 1391H For system For system

APPX
424 Appendix 10 Port Numbers Used by Ethernet-equipped Module
Appendix 11 Operation Image and Data Structure of
Predefined Protocol
Operation image of each communication type of protocol
With the predefined protocol support function, data is communicated with the external device using the "Send Only", "Receive
Only", and "Send & Receive" communication types.
This section describes the operation images of each communication type.

For "Send Only" communication type

The specified packet is sent once.

Send data
Ethernet-equipped
module
Data Header External device

The operation image of "Send Only" is shown below.

■When the instruction completed successfully

ECPRTCL instruction

Completion device

Completion device + 1

Waiting time to send A

Ethernet-equipped module
Send packet

External device
Send packet

■When the instruction completed with an error at TCP/IP (timeout error)

An error has
ECPRTCL instruction occurred.

Completion device
The device
turns on upon
abnormal end.
Completion device + 1

Waiting time
to send t: TCP ULP timer

Ethernet-equipped module
Send packet

The packet cannot be sent or

no response is received from
External device the external device.

APPX
Appendix 11 Operation Image and Data Structure of Predefined Protocol 425
 For details on errors that occur when the communication completed abnormally, refer to the error code stored
in the buffer memory.
( Page 329 List of Error Codes)

For "Receive Only" communication type

When data is received from the external device, it is verified with the receive packet (expected packet). If it matches, the
receive processing ends. If the verification does not match, the received data is discarded.

Ethernet-equipped module Receive data 1

Not matched Header Data

Receive packet
(expected packet)
Discarded External device
Data Receive data 2

Matched Header Data

Sixteen receive packets
can be specified.

Received

The operation image of "Receive Only" is shown below.

■When the instruction completed successfully

ECPRTCL instruction

Completion device

Completion device + 1

Ethernet-equipped module
Receive data

The receive data matched

the receive packet
(expected packet).
External device
Receive data

APPX
426 Appendix 11 Operation Image and Data Structure of Predefined Protocol
■When the instruction completed with an error (timeout error)
An error has
ECPRTCL instruction occurred.

Completion device
The device
turns on upon
Completion device + 1 abnormal end.

t: waiting time to receive or the time specified

by the destination alive check timer*1
Ethernet-equipped module

The receive data

did not match the
receive packet
(expected packet).
External device
Receive data Receive data

*1 When the receive packet (expected packet) verification does not match before the reception wait time, or when other device existence
cannot be checked within the destination alive check time (time calculated from destination alive check start interval timer value,
destination alive check interval timer value, and destination alive check resend count).

• When variables are included in receive packet (expected packet) elements, variable data are not verified.
• Up to 16 receive packets (expected packets) can be specified.
• When multiple packets are specified, the received data is verified with the registered receive packet
(expected packet) in the order of registration. The receive processing is completed when a matching
receive packet (expected packet) is found, and the subsequent verification is canceled.
• The number of the matching received packet is stored in the control data of the ECPRTCL instruction and
the buffer memory.
A
• For details on errors that occur when the communication completed abnormally, refer to the error code
stored in the buffer memory. ( Page 329 List of Error Codes)

APPX
Appendix 11 Operation Image and Data Structure of Predefined Protocol 427
 For "Send & Receive" communication type
The packet is sent once. If the send completed successfully, the module shifts to the receiving standby state. When data is
received from the external device, it is verified with the receive packet (expected packet). If it matches, the receive processing
ends.

Ethernet-equipped module Send data

Data Header

Receive data 1

Not matched Header Data External device

Receive packet
(expected packet)
Discarded
Data Receive data 2

Matched Header Data

Sixteen receive packets
can be specified.

Received

The operation image of "Send & Receive" is shown below.

■When the instruction completed successfully

ECPRTCL instruction

Completion device

Completion device + 1

Waiting time Waiting time

to send to receive

Ethernet-equipped module
Send packet Receive data

The receive data matched

the receive packet
(expected packet).
External device
Send packet Receive data

APPX
428 Appendix 11 Operation Image and Data Structure of Predefined Protocol
■When the instruction completed with an error (timeout error at sending)
An error has occurred.
ECPRTCL instruction

Completion device
The device turns on
upon abnormal end.
Completion device + 1

Waiting time
to send t: TCP ULP timer

Ethernet-equipped module
Send packet

The packet cannot be

sent or no response is Discarded
received from the
External device external device.
Receive data

■When the instruction completed with an error (timeout error of waiting time to receive)
An error has
ECPRTCL instruction occurred.

Completion device
The device
turns on upon
Completion device + 1 abnormal end.

Waiting time t: waiting time to receive or the time

to send specified by the destination alive check timer*1

Ethernet-equipped module
A
Send packet

External device
Send packet Receive data Receive data

The receive data did not

match the receive packet
(expected packet).

*1 When the receive packet (expected packet) verification does not match before the reception wait time, or when other device existence
cannot be checked within the destination alive check time (time calculated from destination alive check start interval timer value,
destination alive check interval timer value, and destination alive check resend count).

For details on errors that occur when the communication completed abnormally, refer to the error code stored
in the buffer memory.
( Page 329 List of Error Codes)

APPX
Appendix 11 Operation Image and Data Structure of Predefined Protocol 429
 Verification operation of receive packet
This section describes the receive packet (expected packet) verification operation for communication with an external device
when the protocol communication type contains reception.

When received data are matched with a receive packet (expected packet)
The received data is compared against the receive packet (expected packet), and the receive processing completes when the
verification matches.

Receive packet
(expected packet)

Matched

Receive data Received

When multiple receive packets (expected packets) are specified

Up to 16 receive packets (expected packets) can be registered with the predefined protocol support function. When the data
are received, the registered receive packet (expected packet) is verified in the order of registration. The receive processing
completes as soon as a matching receive packet (expected packet) is found.

Receive packets
(expected packets) No.1 No.2 No.3 No.16

Sixteen receive
Not matched Matched packets can be
registered.

Receive data Received

When received data does not match with all receive packet (expected packet)
If the received data does not match any of the registered receive packets (expected packets), the received data is discarded.

Receive packets When sixteen

(expected packets) No.1 No.2 No.16 receive packets
were registered

Not matched Not matched

Receive data Discarded

APPX
430 Appendix 11 Operation Image and Data Structure of Predefined Protocol
Example of packet element data
The element processing procedures that can be set for the packets, the actual data examples, and others are shown below.

Length
■Process procedure
The Ethernet-equipped module processes the length with the following procedure.
[During send]

Data flow

Forward direction
Sending
External device
30H

31H "3210" "0123"

32H 33H 32H 31H 30H

Length calculating result 33H

123H Reverse direction

Conversion to 33H
ASCII
32H "0123" "3210"
hexadecimal
31H 30H 31H 32H 33H
"0"(30H)
30H
"1"(31H)

"2"(32H)
Byte swap
"3"(33H)
31H

30H "2301" "1032"

33H 32H 33H 30H 31H

32H A
[During receive]

Data flow
Length calculation result
Forward direction

30H Conversion from ASCII hexadecimal to binary

31H
"0123" 123H
32H

33H
External device Sending

Reverse direction

33H
"0123"
32H
33H 32H 31H 30H "3210" 3210H
31H

30H

Byte swap

31H

30H
"1032" 1032H
33H

32H

APPX
Appendix 11 Operation Image and Data Structure of Predefined Protocol 431
 ■Data flow
Data flow is used to specify the order of send data and receive data.
The data flow can be specified in forward direction (upper byte  lower byte), reverse direction (lower byte  upper byte),
and byte swap (by word).
• Forward direction, reverse direction: Available when the data length is 2 bytes or more.
• Byte swap: Available only when the data length is 4 bytes.

■Calculating range
Examples of specifying the length calculating range are shown below.

Packet Packet Packet Packet Packet Packet

element 1 element 2 element 3 element 30 element 31 element 32

Packet format Non-conversion

Static data Length Static data Static data Static data
variable

Calculating
range for
the length
Example 1

Calculating range for the length

Example 2

Calculating range for the length

Example 3

Example 1:Calculating range when start of range is set as 3 and end is set as 3
Example 2:Calculating range when start of range is set as 3 and end is set as 30
Example 3:Calculating range when start of range is set as 1 and end is set as 32

Non-conversion Variable
■Process procedure
The Ethernet-equipped module processes the non-conversion variable element with the following procedure.
When unit of stored data is "Lower Byte + Upper Byte"
• When the data length of a send packet is an odd number, the upper byte (lower byte when bytes are swapped) of the end
device is not sent.
• When the data length of a receive packet is an odd number, the last data is stored with one byte of 00H.

Ex.
When sending data whose length is an odd number

External device
Send data
(Word) Specified device No byte swap

Data length storage area +0 0005H 06H 05H 04H 03H 02H 01H

Data storage area +1 0201H ↑

Sending Data are not sent.
+2 0403H ↓
+3 0605H 05H 06H 03H 04H 01H 02H

Byte swap

APPX
432 Appendix 11 Operation Image and Data Structure of Predefined Protocol
Ex.
When receiving data whose length is an odd number

(Word) Specified device No byte swap

Data length storage area +0 0005H

Data storage area +1 0201H
External device
+2 0403H
Send data
+3 0005H
Receiving 01H 02H 03H 04H 05H

(Word) Specified device Byte swap

Data length storage area +0 0005H
Data storage area +1 0102H
+2 0304H
+3 0500H

When unit of stored data is "Lower Byte Only"

• A size double the data length is occupied. For the upper data, the Ethernet-equipped module ignores the data at sending
and adds 00H to the data at receiving.

Non-verified reception
The usage examples for a non-verified reception element is shown below.

Ex.

Example of a packet format of the external device

Necessary information for users

Variable number of
1 byte 2 bytes 2 bytes 5 bytes 5 bytes 1 byte

STX
Identification Country Manufacturer Product
characters

EXT
A
code code code code

Reading data

When the information is unnecessary

for users and the data
(including the number of characters)
Non-verified reception is are variable
set in the elements.

Example of a packet setting

2 bytes 2 bytes Variable number of characters 1 byte

Non-conversion
Static data Non-verified reception (variable number of characters) Static data
variable

In the above type of packet format, the following operation can be executed by setting reception without verification.
• It is possible to store only the required information in the CPU module's device or buffer memory.
• Even if the received packet contains data that changes with each communication, it can be handled with one protocol
(packet).

APPX
Appendix 11 Operation Image and Data Structure of Predefined Protocol 433
 Appendix 12 Example of External Device Program
An example of the program in the external device connected to the same Ethernet as the Ethernet-equipped module is shown
below. Each program is the minimum required program for the communication. Change the IP address or port number
according to the system. When including process for errors, add it separately.

External device receiving process

An example of the external device receiving process is shown below.

Communication processing on the external device

Request message/send processing

Response message/receive processing

The TCP connection is closed.

Is the TCP connection open?

Receive the remaining

response messages.

Were the data

Timeout of the monitoring timer value
received within the monitoring
timer value?

The received data size

is insufficient.
Check the received data size.

If the response message to

the next request has been
Response message processing received

Have all the received messages

been processed?

End Error processing

When communicating with Ethernet, the TCP socket functions (socket functions) are used in the personal
computer. There is no concept of boundary with these functions. When the send side calls the send function
once and sends data, the receiving side must call the recv function once, twice, or depending on the
circumstance more times to read that data. (send and recv do not correspond one-on-one.) Thus, the external
device's program process must execute the receiving process as shown above.

APPX
434 Appendix 12 Example of External Device Program
Appendix 13 How to Turn Off ERR LED
If an error occurs in communications with the external device, the ERR LED turns on. Even though the error cause is
eliminated, the ERR LED does not turn off. This section describes how to turn off the ERR LED.

Method using a dedicated instruction

The ERR LED can be turned off by the ERRCLEAR instruction. Availability for turning off the LED depends on the firmware
version of the RJ71EN71. ( Page 436 Added and Enhanced Functions)
For details on the ERRCLEAR instruction, refer to the following.
 MELSEC iQ-R Programming Manual (Module Dedicated Instructions)

Method using I/O signals

When the network type is "Q Compatible Ethernet", the ERR LED can be turned off by the ERR LED off request (Y17). (
Page 354 When the network type is "Q Compatible Ethernet")

APPX
Appendix 13 How to Turn Off ERR LED 435
 Appendix 14 Added and Enhanced Functions
RJ71EN71, RnENCPU (network part)
The following table lists the added and enhanced functions in the RJ71EN71, RnENCPU (network part).
: Available (No version restriction), : Not available
Added and enhanced function Firmware version
RJ71EN71 RnENCPU (network
part)
Turning off the LED with the ERRCLEAR instruction "05" or later 
'State of receive buffer' (Un\G1900030)*1 "05" or later 
IP address change function "10" or later "10" or later
Redundant system function "12" or later 
Remote head module redundant system "12" or later 
Accessing to another station via the port 1 and port 2 using SLMP communications "18" or later 
Simple CPU communication function "35" or later "35" or later
MODBUS/TCP slave function "35" or later "35" or later
Simple CPU communication function for MELSEC iQ-F series "35" or later "35" or later
Simple CPU communication function "39" or later "39" or later
• Setting number of up to 512
• On-request communications
• MELSEC-A/AnS (Ethernet module) and MELSEC-FX3 (Ethernet block/adapter) as communication
destination
MODBUS/TCP slave function for redundant system "42" or later "42" or later
Simple CPU communication function "42" or later "42" or later
• Redundant system
• MELSEC iQ-L series, SIEMENS S7 series, Fuji Electric MICREX-SX series, and JTEKT
TOYOPUC series as communication destination
Discard received data at CPU STOP "42" or later "42" or later
Optional function to specify the module ID when using MODBUS/TCP in the simple CPU "47" or later "47" or later
communication function
Extension base unit in a redundant system with redundant extension base unit "50" or later 

*1 'Receive buffer full detection signal' (Un\G21056) can be used when the network type is set to "Q Compatible Ethernet".

APPX
436 Appendix 14 Added and Enhanced Functions
CPU module (built-in Ethernet port part)
The following table lists the added and enhanced functions in the CPU module (built-in Ethernet port part).
Rn: RnCPU, RnEN: RnENCPU, RnP(P): Process CPU (process mode), RnP(R): Process CPU (redundant mode), RnPSF:
SIL2 Process CPU, RnSF: Safety CPU
: Available (No version restriction), : Not available
Added and enhanced function Firmware version
Rn RnEN RnP(P) RnP(R) RnPSF RnSF
Redundant system function    "04" or later  
File transfer function (FTP client) "22" or "22" or later "13" or later "13" or later  
later*2
High-speed write mode (File transfer function (FTP server)) "23" or "23" or later    
later*2
Simple CPU communication function "35" or "35" or later    
later*3
Communications by network number/station number "40" or "40" or later    
later*4
Simple CPU communication function for MELSEC iQ-F series "40" or "40" or later    
later*4
CPU module built-in database access function from external device "28" or "28" or later    
later*1
Simple CPU communication function "46" or "46" or later    
• MELSEC iQ-L series as a communication destination later*5
Discard received data at CPU STOP "47" or "47" or later "25" or later "25" or later  
later*6
Simple CPU communication function "49" or "49" or later    
• MELSEC-Q (Ethernet module), MELSEC-L (Ethernet module), later*7
MELSEC-A/AnS (Ethernet module), and MELSEC-FX3 (Ethernet
block/adapter) as communication destination
iQ Sensor Solution  iQ Sensor Solution Reference Manual
FTP server function file path name switching "51" or "51" or later    
A
later*8
Simple CPU communication function "53" or "53" or later    
• Initial communication setting later*9

*1 For the R00CPU, R01CPU, and R02CPU, the functions cannot be used.
*2 For the R00CPU, R01CPU, and R02CPU, there are no restrictions on the version.
*3 For the R00CPU, R01CPU, and R02CPU, the functions can be used with the firmware version of "05" or later.
*4 For the R00CPU, R01CPU, and R02CPU, the functions can be used with the firmware version of "08" or later.
*5 For the R00CPU, R01CPU, and R02CPU, the functions can be used with the firmware version of "14" or later.
*6 For the R00CPU, R01CPU, and R02CPU, the functions can be used with the firmware version of "15" or later.
*7 For the R00CPU, R01CPU, and R02CPU, the functions can be used with the firmware version of "17" or later.
*8 For the R00CPU, R01CPU, and R02CPU, the functions can be used with the firmware version of "19" or later.
*9 For the R00CPU, R01CPU, and R02CPU, the functions can be used with the firmware version of "21" or later.

APPX
Appendix 14 Added and Enhanced Functions 437
 MEMO

APPX
438 Appendix 14 Added and Enhanced Functions
INDEX

A J
Active open . . . . . . . . . . . . . . . . . . . . . . . . . . 402 Jumbo frame . . . . . . . . . . . . . . . . . . . . . . . . . .270
Application data . . . . . . . . . . . . . . . . . . . . . . 80,99
Area for sending/receiving instructions . . . . . . . 375
L
Automatic negotiation . . . . . . . . . . . . . . . . . . . 271
Automatic response system . . . . . . . . . . . . . . . 288 Lock processing . . . . . . . . . . . . . . . . . . . . . . . .179
Auto-open UDP port . . . . . . . . . . . . . . . . . . . . 424 Logical address . . . . . . . . . . . . . . . . . . . . . . . . .98
Login name . . . . . . . . . . . . . . . . . . . . . . . . . . .272
C
M
Combination system . . . . . . . . . . . . . . . . . . . . 292
Command input monitoring timer . . . . . . . . . . . 272 MELSOFT direct connection port . . . . . . . . . . . .424
Communication data code . . . . . . . . . . . . . . . . 262 MELSOFT transmission port (TCP/IP) . . . . . . . .424
Communication method . . . . . . . . . . . . . . . . . . 265 MELSOFT transmission port (UDP/IP) . . . . . . . .424
Communication path determination status . . . . . 379 Module communication test . . . . . . . . . . . . 294,302
Communication status test . . . . . . . . . . . . . . . . 310 Module diagnostics . . . . . . . . . . . . . . . . . . . . . .300
Communications by network number/station number Module information list . . . . . . . . . . . . . . . . . . .301
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Connection status . . . . . . . . . . . . . . . . . . . . . . 308
Connection status storage area . . . . . 373,390,393
N
Creating the protocol setting data . . . . . . . . . . . . 35 Network number . . . . . . . . . . . . . . . . . . . . . . . .262
No procedure . . . . . . . . . . . . . . . . . . . . . . . . . . .69
D Number of retries . . . . . . . . . . . . . . . . . . . . . . .283

Drive name (drive No.). . . . . . . . . . . . . . . . . . . 123

O
E Offline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .294
Online . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .294
Enable/disable online change . . . ........... 262 Open completion signal . . . . . . . . . . . . . . . . . . .386
End codes . . . . . . . . . . . . . . . . ........... 351 Open request signal . . . . . . . . . . . . . . . . . . . . .386
Error information . . . . . . . . . . . . ........... 300 Opening method . . . . . . . . . . . . . . . . . . . . . . . .262
Ethernet diagnostics . . . . . . . . . ........... 304 Own node operation status storage area . . . 374,391
Existence confirmation. . . . . . . . ........... 266 Own node setting status storage area . . . . . . . . .372 I
F P
Fixed buffer send/receive setting . . . . . . . . . . . 265 Pairing open. . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Forced connection invalidation setting area Passive open . . . . . . . . . . . . . . . . . . . . . . . . . .403
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376,392 Password setting . . . . . . . . . . . . . . . . . . . . . . .272
Fullpassive . . . . . . . . . . . . . . . . . . . . . . . . . . . 403 Physical address . . . . . . . . . . . . . . . . . . . . . . . . 98
PING test . . . . . . . . . . . . . . . . . . . . . . . . . . . . .309
G Predefined protocol library . . . . . . . . . . . . . . . . . . 37
Procedure exist . . . . . . . . . . . . . . . . . . . . . . . . .69
Gateway IP address . . . . . . . . . . . . . . . . . . . . 285
R
H
Remote head module . . . . . . . . . . . . . . . . . . . .415
Header . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80,98 Remote password check operation . . . . . . . . . . .179
Remote password lock status storage area
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375,391
I
Response monitoring timer . . . . . . . . . . . . . . . .273
Initial error code . . . . . . . . . . . . . . . . . . . .... 386
Initial status . . . . . . . . . . . . . . . . . . . . . . .... 386 S
IP address . . . . . . . . . . . . . . . . . . . . . . . .... 262
IP address calculation system . . . . . . . . . .... 289 Searching modules on the network . . . . . . . . . . . .23
IP address duplication status storage area Send frame . . . . . . . . . . . . . . . . . . . . . . . . . . .270
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374,391 SLMP commands . . . . . . . . . . . . . . . . . . . . . . . .32
IP filter function . . . . . . . . . . . . . . . . . . . . . . . . 176 Socket/fixed buffer reception status signal . . . . . .386
IP filter settings . . . . . . . . . . . . . . . . . . . . . . . . 284 State of receive buffer . . . . . . . . . . . . . . . . . . . .387
Station number . . . . . . . . . . . . . . . . . . . . . . . . .262
Status for each protocol. . . . . . . . . . . . . . . . . . .307

439
 Status of each connection . . .............. 306
Status of each protocol . . . . .............. 373
Structure of the module label .............. 352
Subnet address . . . . . . . . . .............. 285
Subnet mask pattern . . . . . . .............. 292

T
Table conversion system . . . . . . . . . . . . . . . . . 290
Transient transmission group number . . . . . . . . 262

U
Unlock processing . . . . . . . . . . . . . . . . . . . . . . 179
Unpassive . . . . . . . . . . . . . . . . . . . . . . . . . . . 403

440
REVISIONS
*The manual number is given on the bottom left of the back cover.
Revision date *Manual number Description
June 2014 SH(NA)-081257ENG-A First edition
July 2014 SH(NA)-081257ENG-B Error correction
November 2014 SH(NA)-081257ENG-C ■Added or modified parts
Section 2.2, 3.1, 3.2, 3.5, 3.7, Appendix 1, 2
April 2015 SH(NA)-081257ENG-D ■Added models
R08PCPU, R16PCPU, R32PCPU, R120PCPU
■Added or modified parts
Section 1.3, 1.5, 2.3, 3.5, Appendix 2, 4, 11
August 2015 SH(NA)-081257ENG-E ■Added models
R04ENCPU, R08ENCPU, R08SFCPU, R16ENCPU, R16SFCPU, R32ENCPU, R32SFCPU,
R120ENCPU, R120SFCPU
■Added functions
Automatic detection of connected device, communication setting reflection, and sensor parameter read/
write of the CPU module
■Added or modified parts
INTRODUCTION, RELEVANT MANUALS, TERMS, Section 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.10,
1.11, 2.1, 2.2, 2.3, 3.1, 3.2, 3.3, 3.4, 3.5, Appendix 1, 2, 3, 4, 7, 8
January 2016 SH(NA)-081257ENG-F ■Added or modified parts
RELEVANT MANUALS, TERMS, Section 1.1, 1.3, 1.5, 1.8, 1.10, 3.4, 3.5, Appendix 3, 4, 8, 11
May 2016 SH(NA)-081257ENG-G ■Added functions
File transfer function (FTP client), redundant system function
■Added or modified parts
INTRODUCTION, RELEVANT MANUALS, TERMS, Section 1.1, 1.3, 1.5, 1.9, 1.11, 1.12, 1.13, 2.2, 2.3,
3.2, 3.4, 3.5, 3.6, 3.7, Appendix 3, 4, 6, 7, 8, 9, 12
October 2016 SH(NA)-081257ENG-H ■Added function
High-speed write mode (File transfer function (FTP server))
■Added or modified parts
Section 1.8, 2.2
April 2017 SH(NA)-081257ENG-I ■Added function
Improvements on Ethernet diagnostics
■Added or modified parts
RELEVANT MANUALS, TERMS, Section 1.2, 1.9, 2.3, 3.3, Appendix 12
October 2017 SH(NA)-081257ENG-J ■Added models
R00CPU, R01CPU, R02CPU, R08PSFCPU, R16PSFCPU, R32PSFCPU, R120PSFCPU
■Added or modified parts
SAFETY PRECAUTIONS, TERMS, Section 1.3, 1.9, 2.3, Appendix 4, 12
April 2018 SH(NA)-081257ENG-K ■Added functions
Web server function and simple CPU communication function (CPU module (built-in Ethernet port part))
■Added or modified parts
Section 1.11, 1.13, 2.3, Appendix 3, 12
October 2018 SH(NA)-081257ENG-L ■Added functions
MODBUS/TCP slave function, simple CPU communication function (RJ71EN71, RnENCPU (network
part)), and connection by specifying the network number and station number (CPU module (built-in
Ethernet port part))
■Added or modified parts
Section 1.1, 1.7, 1.14, 1.15, 1.16, 2.2, 2.3, Appendix 3, 9
April 2019 SH(NA)-081257ENG-M ■Added function
Enhancements of the simple CPU communication function (RJ71EN71, RnENCPU (Network Part))
■Added or modified parts
TERMS, GENERIC TERMS AND ABBREVIATIONS, Section 1.15, 2.3, 3.4, 3.5, Appendix 3, 13
August 2019 SH(NA)-081257ENG-N Error correction
October 2019 SH(NA)-081257ENG-O ■Added functions
Redundant system supported (RJ71EN71) of the MODBUS/TCP slave function, redundant system
supported (RJ71EN71) of the simple CPU communication function and external device enhancement
(RJ71EN71, RnENCPU (network part)), discard received data at CPU STOP (RJ71EN71, RnENCPU
(network part))
■Added or modified parts
TERMS, GENERIC TERMS AND ABBREVIATIONS, Section 1.7, 1.14, 1.15, 1.17, 1.18, 2.3, Appendix
13

441
 Revision date *Manual number Description
February 2020 SH(NA)-081257ENG-P ■Added function
Discard received data at CPU STOP (built-in Ethernet port)
■Added or modified parts
Appendix 3, 13
May 2020 SH(NA)-081257ENG-Q ■Added functions
Extension of the simple CPU communication function (built-in Ethernet port), optional function for
specifying the module ID when using MODBUS/TCP in the simple CPU communication function
■Added or modified parts
Section 1.1, 1.14, 1.15, 2.2, 2.3, Appendix 13
July 2020 SH(NA)-081257ENG-R ■Added or modified parts
SAFETY PRECAUTIONS, CONDITIONS OF USE FOR THE PRODUCT
October 2020 SH(NA)-081257ENG-S ■Added functions
Directory delimiter switching setting (FTP server), extension base unit in a redundant system with
redundant extension base unit
■Added or modified parts
SAFETY PRECAUTIONS, RELEVANT MANUALS, TERMS, Section 1.1, 1.5, 1.9, 1.14, 1.17, 2.3, 3.5,
Appendix 9, 13

Japanese manual number: SH-081253-U

This manual confers no industrial property rights or any rights of any other kind, nor does it confer any patent licenses. Mitsubishi Electric Corporation cannot
be held responsible for any problems involving industrial property rights which may occur as a result of using the contents noted in this manual.

 2014 MITSUBISHI ELECTRIC CORPORATION

442
WARRANTY
Please confirm the following product warranty details before using this product.
1. Gratis Warranty Term and Gratis Warranty Range
If any faults or defects (hereinafter "Failure") found to be the responsibility of Mitsubishi occurs during use of the product
within the gratis warranty term, the product shall be repaired at no cost via the sales representative or Mitsubishi Service
Company.
However, if repairs are required onsite at domestic or overseas location, expenses to send an engineer will be solely at
the customer's discretion. Mitsubishi shall not be held responsible for any re-commissioning, maintenance, or testing
on-site that involves replacement of the failed module.
[Gratis Warranty Term]
The gratis warranty term of the product shall be for one year after the date of purchase or delivery to a designated place.
Note that after manufacture and shipment from Mitsubishi, the maximum distribution period shall be six (6) months, and
the longest gratis warranty term after manufacturing shall be eighteen (18) months. The gratis warranty term of repair
parts shall not exceed the gratis warranty term before repairs.
[Gratis Warranty Range]
(1) The range shall be limited to normal use within the usage state, usage methods and usage environment, etc., which
follow the conditions and precautions, etc., given in the instruction manual, user's manual and caution labels on the
product.
(2) Even within the gratis warranty term, repairs shall be charged for in the following cases.
1. Failure occurring from inappropriate storage or handling, carelessness or negligence by the user. Failure caused
by the user's hardware or software design.
2. Failure caused by unapproved modifications, etc., to the product by the user.
3. When the Mitsubishi product is assembled into a user's device, Failure that could have been avoided if functions
or structures, judged as necessary in the legal safety measures the user's device is subject to or as necessary by
industry standards, had been provided.
4. Failure that could have been avoided if consumable parts (battery, backlight, fuse, etc.) designated in the
instruction manual had been correctly serviced or replaced.
5. Failure caused by external irresistible forces such as fires or abnormal voltages, and Failure caused by force
majeure such as earthquakes, lightning, wind and water damage.
6. Failure caused by reasons unpredictable by scientific technology standards at time of shipment from Mitsubishi.
7. Any other failure found not to be the responsibility of Mitsubishi or that admitted not to be so by the user.
2. Onerous repair term after discontinuation of production
(1) Mitsubishi shall accept onerous product repairs for seven (7) years after production of the product is discontinued.
Discontinuation of production shall be notified with Mitsubishi Technical Bulletins, etc.
(2) Product supply (including repair parts) is not available after production is discontinued.
3. Overseas service
Overseas, repairs shall be accepted by Mitsubishi's local overseas FA Center. Note that the repair conditions at each FA
Center may differ.
4. Exclusion of loss in opportunity and secondary loss from warranty liability
Regardless of the gratis warranty term, Mitsubishi shall not be liable for compensation to:
(1) Damages caused by any cause found not to be the responsibility of Mitsubishi.
(2) Loss in opportunity, lost profits incurred to the user by Failures of Mitsubishi products.
(3) Special damages and secondary damages whether foreseeable or not, compensation for accidents, and
compensation for damages to products other than Mitsubishi products.
(4) Replacement by the user, maintenance of on-site equipment, start-up test run and other tasks.
5. Changes in product specifications
The specifications given in the catalogs, manuals or technical documents are subject to change without prior notice.

443
 TRADEMARKS
Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or
other countries.
Oracle and JavaScript are registered trademarks of Oracle and/or its affiliates.
The company names, system names and product names mentioned in this manual are either registered trademarks or
trademarks of their respective companies.
In some cases, trademark symbols such as '' or '' are not specified in this manual.

444 SH(NA)-081257ENG-S
SH(NA)-081257ENG-S(2010)MEE
MODEL: R-ETHER-U-OU-E
MODEL CODE: 13JX16

HEAD OFFICE : TOKYO BUILDING, 2-7-3 MARUNOUCHI, CHIYODA-KU, TOKYO 100-8310, JAPAN
NAGOYA WORKS : 1-14 , YADA-MINAMI 5-CHOME , HIGASHI-KU, NAGOYA , JAPAN

When exported from Japan, this manual does not require application to the
Ministry of Economy, Trade and Industry for service transaction permission.

Specifications subject to change without notice.