The user protocol lets the PLC exchange data in byte layouts you define with devices that do not use Modbus, such as CO2 sensors, barcode and QR readers, inverters and temperature controllers that take ASCII commands, and numeric displays (V1.3.0 and later). In the User Protocol window, you define the layout of the bytes and when they are sent, and the PLC runs that communication together with the program. You do not have to handle bytes one at a time with PUT and GET in the ladder, and received values are stored in the memory you specify only after the whole frame, checksum included, matches.

• Frames and transactions: You can build a frame by lining up the bytes to exchange as chips, and group the frame to send, the frames to wait for and the start condition into a transaction.
• Four exchange patterns: Ask & receive, Receive only, Answer on receive and Send only can be used together on one port.
• Starting from the ladder: The UPTRIG function runs a transaction once at the moment you choose. You can check the result in the status word and the done bit.
• Checking tools: MP STUDIO 2 provides a preview of the bytes to send, decoding of received bytes, a search for the matching checksum variant, a virtual device in simulation, status and a traffic log during monitoring, and a direct PC test that exchanges data with a device through a COM port on the PC without a PLC.

The user protocol is set on the serial channels of the PLC (Comm Port 1 to Comm Port 3). The number of communication ports available depends on the model.

For the terminals of each communication port (RS-232, RS-485 and UART) and the connector diagrams, see the product pages: MPS-8A4R-S · MPS-8A4T-S · MPS-8A8R-S · MPS-8A8T-S · MPS-16A16R · MPS-8A8R · MPS-16A8R · MPS-16A8R8T · MPA Series. On the MPA series, Comm Port 1 is RS-232, Comm Port 2 is RS-485 and Comm Port 3 is UART.

• The baud rate, data bits, parity and stop bits must match the device. You can also use 7 data bits (for example 7-E-1), which are common on ASCII devices.
• The PLC switches the RS-485 terminals between sending and receiving, so the ladder does not need to handle this.
• On the MPA series, running the 7-segment function FINI switches off Comm Port 3 (Serial 3); see 7-Segment Display. When you also use a 7-segment display, set the user protocol on Comm Port 1 or Comm Port 2.

The user protocol is defined for each communication port with frames and transactions.

• Frame: The layout of one group of bytes that is sent or received. You build it by placing fields in order, such as fixed bytes, values from PLC memory, text, a length and a checksum.
• Transaction: Defines which frame is sent when, and which frame is awaited. For each transaction, you can set the exchange pattern, the start condition, the reply timeout, the retries, and the status word and done bit that receive the result.

On the PLC, the user protocol runs as follows.

• Each communication port runs one transaction at a time. When several transactions are due, they run in turn in the order of the transaction list, and answers for Answer on receive transactions are sent first.
• Received bytes are stored in memory all at once, only after the whole frame matches. If the checksum or a value format does not match, none of the values in that frame are stored. The ladder reads the received values from the next scan on.
• If the received bytes match no frame, the first byte is dropped and matching starts again. Even if noise bytes come before a reply, the reply is received as long as a matching frame follows.
• The user protocol is downloaded to the PLC together with the program. Changes made in the window reach the PLC only after you click OK and download again.

A serial channel used for the user protocol must be in User Protocol mode with Use this channel for download turned off.

1. Select Setting → Communication Port, and on the tab of the serial channel you use (for example Serial 1), set the baud rate, data bits, parity and stop bits to match the device. To use a baud rate other than 115200, first turn off Use this channel for download.
2. You can set the mode to User Protocol in this window or leave it as it is. When you click OK in the User Protocol window, a port in Normal mode changes to User Protocol, and download on that port is turned off.

• A port set to any mode other than Normal (for example Modbus RTU Slave) is not changed automatically. It changes only when you click Switch to User Protocol, which appears at the top of the User Protocol window.
• A communication port used by the Modbus device table cannot also have a user protocol. If both read the receive buffer of one port, neither works, so move one of them to another communication port.
• A port whose user protocol you deleted returns to Normal mode when you click OK.
• Each item of the Communication Setting window is described in Phase 6 · Communication Port.

• Select Setting → User Protocol… to open it.
• You can also open it with Open user protocol in the number cell of UPTRIG in the ladder (see below).
• When you click a cell used by the user protocol in the Inspector or the Used Data window, the window opens with the transaction, frame and field that use that cell selected.

You can edit the ladder while the window stays open. If a communication port has no definition, ＋ Create on this port and a list of templates are shown.

You can freely change the template names and cells (D100, M100 and so on) after adding a template. You can also add templates to a port that already has a definition with ＋ Load from a template…; if a name is already taken, a number is added to the end.

• ① Communication port tabs: Choose the communication port to define. A port with a definition shows User protocol and its line settings (for example 9600 · 8-N-1).
• ② Views: Choose Definition, Direct PC test or Traffic log. During simulation, Simulated device is added. Click Line settings… to open the Communication Setting window.
• ③ Transactions: Each transaction card shows the name, the exchange pattern, the start condition, the frame to send → the frame to receive, and the status word and done bit. During monitoring, it also shows the last result. Click ＋ Add transaction and choose an exchange pattern to add a transaction.
• ④ Frames: The frame list of this port. Each frame shows Send, Receive or unused and its number of bytes. Add a frame with ＋ Frame; select a frame to use Duplicate and Delete frame.
• ⑤ Port settings: Set Gaps between characters are OK (see below) and Comm log while monitoring (see below). Clear port deletes the whole definition of this port.
• ⑥ Transaction settings: Set the name, exchange pattern, start, reply timeout, retries, status word and done bit of the selected transaction (Transactions).
• ⑦ Chip strips: The frame the transaction sends (Send) and the frames it waits for (Receive and Error reply) are shown as chips (Frames).
• ⑧ Preview: Shows the bytes to send in hex, and decodes received bytes that you paste (see below).
• ⑨ Properties: Edit the properties of the selected chip (field). When no chip is selected, a description of the transaction or frame is shown.
• ⑩ RAM, flash and one exchange: The RAM and flash of the PLC used by the user protocol (as a percentage of the user area), and the calculated transmission time for one exchange of the selected transaction. The transmission time does not include the scan time or the processing time of the device. RAM and flash are not shown while there are items to fix.
• ⑪ Bottom bar: Shows the numbers of ports, transactions and frames, and the number of items to fix. Click OK to put the definition into the project, or Cancel to discard your changes. Save the project to keep them in the file.

• In a text box, Ctrl+Z undoes the typing in that box. Characters typed one after another in the same box are undone as one step.
• OK counts as one Undo step for the whole program. After clicking OK, you can restore the previous definition with Edit → Undo (Ctrl+Z).

A frame is made of chips (fields) placed in byte order. The byte positions (counting from 1) are shown under the chips, and when you select a checksum chip, the range it covers is highlighted on the strip. Click ＋ at the end of the chip strip and choose a field type to add a chip.

In the Bytes box, enter hex bytes, text in double quotes and control character names, separated by spaces. The actual bytes and the number of bytes are shown below.

One chip can hold up to 255 bytes. Characters outside ASCII must be written in hex. FF is read as the hex byte 0xFF, not as the control character name for form feed.

In PLC address, enter the cell that exchanges the value (for example D100) or a symbol name, and choose the Format.

• When ASCII decimal is received, leading and trailing spaces, + and -, and fewer decimal places than set (“12.3” → 1230) are accepted. If a non-digit character arrives, or more nonzero decimal places than set (“12.345”), nothing is stored and the status word becomes Value conversion failed (F4). With a variable number of digits, 1 to 12 characters are accepted when receiving.
• If a received value is too large for the PLC cell, nothing is stored and the status becomes F4. The chip shows a warning when the settings allow this.
• With 7 data bits, bytes above 0x7F lose their top bit. On a port with 7 data bits, a chip with a binary value or with a fixed byte above 0x7F turns red.

• Starting at PLC address (first cell), the characters are stored two to a word, low byte first (the low byte of D200 = the first character).
• Length: up to the end character · at most N receives up to N characters, until the fixed field that follows (for example CR LF) arrives. always N characters always takes exactly N characters. N is 1 to 255.
• Enter a word address in Cell for the received length to store the number of characters received. Fill for unused places (hex) is the byte that fills the remaining places when the text is shorter than N characters.

Set the Format (1-byte binary, 2-byte binary, ASCII decimal or ASCII hex) and the Counted range (from one field number to another). When sending, the number of bytes in that range is inserted; when receiving, it is checked against the actual number of bytes. If the device adds a fixed number to the byte count, enter that number in Adjustment (added).

• Range start: Choose from byte 1 or from byte 2, or enter the byte number to start from. For a device that leaves the header byte (such as STX) out of the calculation, choose from byte 2.
• Range end: The default is up to just before the checksum. Frames with end characters after the checksum can also keep this default.
• Layout: 1 byte, 2 bytes (big-endian or little-endian), or 2 or 4 ASCII hex digits. For ASCII hex, you can choose upper or lower case for sending; case is ignored when receiving.

CRC-16 is calculated differently from device to device. When you choose a CRC-16 variant, the five boxes for the polynomial, initial value, reflect in, reflect out and final XOR are filled in, and the check value calculated from the string “123456789” is shown. Choose the variant whose check value matches the check value in the device manual. If you change any of the five boxes, the variant becomes Custom.

The default layout is little-endian for MODBUS and big-endian for every other variant.

Where a received frame ends follows from the layout of the frame, and is shown above the chip strip as end: ….

End quiet time (ms) appears in the properties on the right when you select a frame, and can be set from 20 to 10000 ms (leave it empty to not use it). A last field of unknown length is treated as finished when the line stays quiet for this time. When partly received bytes are left and the line stays quiet for 100 ms or more, those bytes are also dropped from the front.

The preview at the bottom of the window shows the bytes of the frame to send in hex (value cells as 0, length and checksum as calculated). Paste the bytes the device sent into the box below, one frame per line, and they are decoded as the frame to receive, with the value and result shown for each field. You can use both hex (FF 86 01) and fixed-byte notation such as STX “01” ETX.

Use this when the device manual does not describe the checksum method or the check value does not match. Paste two or more frames that the device actually sent. When the checksum does not match, MP STUDIO 2 automatically tries each checksum type, CRC-16 variant, layout and range start, and lists the combinations that fit every sample on the Find the matching variant line, each with a Change to “…” button. With only one sample, a combination can match by chance, so Change to “…” is enabled only when there are two or more samples. The change goes into the definition only when you click OK.

When you select a transaction in the transaction list, its settings appear at the top center, with the chip strips of the frame to send and the frame to receive below them.

• Choose the frame to send and the frame to receive from the list at the head of each chip strip. Choosing ＋ New frame creates an empty frame. You can set two or more frames to receive with ＋ Frame to receive.
• In Ask & receive, you can define the device's error reply frame with ＋ Error reply (NAK, etc.). When an error reply is received, the transaction ends with Error reply (F6).
• In Answer on receive, the Send frame is the answer. The values in the answer are read from PLC cells.

• Ask & receive: The transaction succeeds if a frame to receive arrives within the reply timeout after sending. If there is no reply, or only wrong replies arrive, the request is sent again after the full reply timeout, and the transaction fails once all retries are used. If the device sends only wrong replies, one transaction takes “reply timeout × (retries + 1)”. When an error reply arrives, the transaction ends at once without sending again.
• Send only: The transaction ends successfully when the whole frame has been sent.
• Receive only: In the scan in which a matching frame is received, the values are stored, success is written to the status word, the done bit turns on for one scan, and the received-count cell increases by 1.
• Answer on receive: The values are stored as in Receive only, and the answer frame is sent at once. If the received frame does not match (different header bytes or a wrong checksum), no answer is sent.

The status word is one word that shows the last result of the transaction.

• A failed transaction does not change the received-value cells. The values received earlier remain.
• If bytes were dropped before the reply timeout expired, the status records the reason, checked in the order F1 → F4 → F2. If no bytes were dropped, the status is F0.
• Each transaction must use its own status word. A warning is shown if the status word overlaps a received-value cell.

This is set for each port, and is on for a new port.

• On: Sends one byte per scan. The scan time does not grow, but a request goes out over as many scans as it has bytes (about 50 ms for 10 bytes at a 5 ms scan). Most ASCII devices accept gaps between characters.
• Off: Sends the whole frame in one go. That scan becomes longer by the time it takes to send the frame. It must be off for a device that discards requests with gaps between characters.

When you set the Start of a transaction to Ladder UPTRIG number, the UPTRIG function in the ladder runs that transaction. Use this to send a setting command only when a button is pressed, or to read a value only when you need it.

1. Set the Start of the transaction to Ladder UPTRIG number and enter the Number (1 to 255). If needed, also enter the done bit and the Status word.
2. Click OK.
3. Add an UPTRIG function to the ladder and enter the same number. Choose UPTRIG: Start User Protocol Trigger in the Serialport category of the Functions panel, or type UPTRIG 3 in the Insert Function window (Ctrl+E).

When you edit the number cell of UPTRIG, the trigger numbers defined in the user protocol are listed with their communication port and transaction name, and you can click one to choose it. Click Open user protocol in the same place to open the User Protocol window.

• Each time the input of UPTRIG changes from off to on, the transaction with that number runs once. Keeping the input on does not run it again.
• If the number is called several times before the transaction runs, it runs only once. If it is called while the transaction is running, the transaction runs once more after it finishes.
• The done bit turns on for one scan when the transaction ends, whether it succeeded or failed. You can check the reason for a failure in the status word.
• Transactions with the same number on the same communication port run together. The same number cannot be used for transactions on different communication ports.
• Transactions started by a trigger do not run automatically after the PLC is turned on or a program is downloaded.
• The UPTRIG number must be a constant from 1 to 255, and the user protocol must have a transaction started by that number. Otherwise the cell turns red and the program cannot be compiled. Conversely, if a transaction has a trigger number but there is no matching UPTRIG in the ladder, the warning “No UPTRIG cell calls trigger number 3, so this transaction never starts.” is shown.

The User Protocol window marks items to fix by turning chips and boxes red or orange, and shows the first message in the bar at the bottom of the window. Click a message to go to that place, or click N more to expand all messages. While there are red items to fix, N to fix — the program is not built until they are fixed is shown and you cannot download. OK still works while there are items to fix, so you do not lose a definition in progress.

The ladder and other features are checked for the following cases.

Cells used by the user protocol also appear in Find, Replace All, the Used at list of the Inspector and Used Data. When you change an address with Replace All, the user protocol cells change too.

During simulation, a virtual device is attached to the user protocol of each communication port, and the Simulated device view is added to the window. You can check the ladder's behavior and the status word and done bit without a device.

• Transactions — status cell · reply example: Choose a transaction and what the virtual device does (Reply, No response, Bad checksum or Error reply). For Reply, enter the values the PLC is to receive. Until a reply example is set, there is no reply (status word F0).
• Virtual device sends on its own — Receive only / Answer on receive: Enter the values of a frame to receive and click Put in to have the virtual device send that frame.
• Put raw bytes in (garbage / resync test): Puts the entered bytes in as they are, so you can check that noise bytes are dropped and matching starts again.
• Traffic log (virtual time): Shows the bytes sent by the PLC and the bytes sent by the virtual device, one line each.

Only definitions confirmed with OK are simulated. A definition with items to fix is not simulated. Line busy (F3) and receive buffer overflow (F5) are not simulated, and the scan time and the processing time of the device are not included. The virtual device settings are not saved.

If you open the User Protocol window during monitoring, the card of each transaction that has a status word shows the last result. Receive only and Answer on receive transactions also show the value of the received-count cell and the time since it last increased. Status is read only for the transactions of the selected communication port.

The card shows the same text as the “Shown as” column of the Status Word table. When the status shown cannot be trusted, the reason is shown in gray.

During simulation, the card also shows Virtual. A transaction that has not been confirmed with OK shows Not applied yet, and a stopped simulation shows Simulation stopped · ….

Turn on Comm log while monitoring for a port, click OK and download. During monitoring, the Traffic log view then shows the bytes the PLC sent and received on that communication port, one line each. Turning on the traffic log uses a little more RAM and flash on the PLC.

• ① Direction and time: → marks bytes the PLC sent, and ← bytes it received. Lines are in the order in which the PLC exchanged them, and the time is when the PC read the log.
• ② Bytes: The bytes exchanged. The line below shows the transaction and frame names and the decoded values (for example ✓ D100 = 410 · ✓ Checksum DF).
• ③ Result: The result of those bytes. A sent line shows Success, Waiting for reply, Resent N, Not sent or the reason for a failure, and a received line shows Reply, Receive, Error reply (F6), dropped and so on. dropped marks bytes that matched no frame.
• ④ Byte view: Choose Hex, Text or Both. In the text view, control characters are shown like ‹STX›.
• ⑤ Copy and Clear log: Copy the lines shown as text, or clear the log on the screen. While the view is scrolled to the bottom, it follows new lines.

• If the program on the PLC was downloaded with the traffic log off, or differs from this document, the log is not read and the reason is shown.
• If the PLC writes new records before the monitor reads them, “… N missed in between” is shown.
• During simulation, the same view shows the exchange with the virtual device in virtual time.

The direct PC test exchanges data directly with a device through a COM port on the PC (through a USB-RS485 or USB-RS232 converter, for example) instead of the PLC. Use it to check that the frames and checksum are right before you connect the device to the PLC. The test uses the definition as edited in the window, before OK, and is available only in the desktop app.

• ① PC COM port: The list of COM ports on the PC. USB devices are shown with the device name, as in COM10 — USB Serial Port, and Bluetooth ports are shown as COM23 (Bluetooth). At first, (Pick a port) is shown; if a COM port was opened for this communication port last time, it is selected in advance. Refresh reads the list again.
• ② Open and Close: Opens the selected COM port. The line uses the communication settings of that communication port as they are (baud rate, data bits, parity and stop bits). Switching to another view or closing the window closes the port.
• ③ One transaction — Ask & receive / Send only: Choose a transaction on the left, enter the values to send (sample values) and click Send once. The PC makes one exchange, with the reply timeout and retries handled the same way as on the PLC, and shows the result.
• ④ Listen — Receive only / Answer on receive (what the device sends): Click Start listening to receive and decode the bytes the device sends. Use it to see exactly what a barcode reader sends. For an Answer on receive transaction, the PC answers with the sample values entered in ③.
• ⑤ Traffic log: The bytes exchanged are shown in the same form as in the Traffic log view. When a reply arrives with a wrong checksum, the Find the matching variant line shows the checksum candidates that fit; once two or more such replies have been collected, you can click Change to “…”.

• A COM port in use by monitoring or download is marked “— in use by monitoring/download” and cannot be opened. Open it after monitoring or download has ended.
• The download COM port in the communication settings is marked “— download port”, and choosing it shows a notice that the port may be connected to the PLC.
• The direct PC test checks the PC-side line and the device. Check any behavior that depends on the scan time again on the PLC.

In the examples below, the three templates are set on Comm Port 1 to Comm Port 3 of MPS-8A8R, one template per port. On other models, you can follow the same steps with only the communication port numbers changed.

In this example, a CO2 sensor connected to Comm Port 1 (9600 · 8-N-1) is read every second for its concentration, and a button input sends the zero command.

1. In Setting → Communication Port, set Serial 1 to a baud rate of 9600, 8 data bits, no parity and 1 stop bit.
2. In Setting → User Protocol…, select the Comm Port 1 tab and click the template CO2 / gas sensor — ask every second.
3. Click OK. Comm Port 1 changes to User Protocol mode.
4. Add a rung to the ladder that sends the zero command.

When the sensor sends FF 86 01 9A 00 00 00 00 DF, D100 becomes 410 (ppm), the status word D101 becomes 0001 (1 in decimal), and the done bit M100 turns on for one scan.

In this example, a barcode reader is connected to Comm Port 2 (9600 · 8-N-1), and the scanned text is received starting at D200.

1. Set Serial 2 to 9600 · 8-N-1.
2. On the Comm Port 2 tab of the User Protocol window, choose the template Barcode / QR reader and click OK.

When the reader sends ILOGICS-1234 followed by CR LF, D190 becomes 12, and the characters are stored from D200 on, two per word (D200 = I and L). M101 turns on for one scan, and D191 increases by 1. An empty line (only CR LF) is received as a frame with 0 characters.

In this example, an ASCII command device with station number 01 is connected to Comm Port 3 (9600 · 7-E-1), and the value at address 100 is read into D11 every 0.5 seconds.

1. Set Serial 3 to a baud rate of 9600, 7 data bits, even parity and 1 stop bit.
2. On the Comm Port 3 tab of the User Protocol window, choose the template Inverter / temperature controller (ASCII station commands) and click OK.
3. Add a rung to the ladder that sets the address to read.

The transaction “Read station” is Ask & receive, with a period of 500 ms, a reply timeout of 300 ms, 3 retries and the status word D12. In this template, Gaps between characters are OK is off, so the request is sent in one go.

• An .mpx project that uses the user protocol or UPTRIG cannot be opened in V1.2.0 or earlier.
• Set up the ladder so that it only reads the received-value cells.

• Phase 6 · Communication Port
• Phase 7 · Monitoring and the Data Table
• Phase 8 · Simulation
• Modbus Device Table
• Phase 4 · Functions

← Back to the MP STUDIO 2 User Manual