PKW: Encapsulated Acyclic Accesses in DP V0

Overview

Some PROFIBUS DP primaries (masters) do not provide DP V1 services. The PKW feature is implemented to allow acyclic read or write access in DP V0.

This feature is enabled in the PROFIBUS DP configuration tool by selecting the appropriate module. For each module, a second entry with PKW exists.

The PKW data is added to the cyclic data.

Read/Write Registers

With the PKW data, you can read or write any register. The 8 bytes are interpreted as a request telegram or a response telegram encapsulated in IN data and OUT data.

PKW OUT Data

PKW OUT Data request (PROFIBUS DP Master → LTMR) are mapped in modules supporting PKW.

To access a register, you must select 1 of the following function codes:

R_REG_16 = 0x25 to read 1 register
R_REG_32 = 0x26 to read 2 registers
W_REG_16 = 0x2A to write 1 register
W_REG_32 = 0x2B to write 2 registers.

Register numbers are given in Register Map (Organization of Communication Variables).

Word 1	Word 2			Word 3	Word 4
Register address	Toggle bit (bit 15)	Function bits (bits 8 to 14)	Not used (bits 0 to 7)	Data to write
Register number	0/1	R_REG_16 Code 0x25	0x00	_	_
		R_REG_32 Code 0x26		_	_
		W_REG_16 Code 0x2A		Data to write in register	_
		W_REG_32 Code 0x2B		Data to write in register 1	Data to write in register 2

Depending on the PLC platform used, refer to the tables describing PKW OUT in Little and Big endian formats in the section Cyclic Data Description to know the positioning of each field inside each word.

Any changes in the function field will trigger the handling of the request (except if Function code = 0x00).

The toggle bit must change at each consecutive request. This mechanism allows the request initiator to detect that a response is ready by polling the toggle bit in response. When this bit in the OUT data becomes equal to the response emitted toggle bit in the IN data, then the response is ready.

PKW IN Data

PKW IN Data Response (LTMR → PROFIBUS DP Master) is mapped in modules supporting PKW. The LTMR echoes the same register address and function code or eventually a detected error code:

Word 1	Word 2			Word 3	Word 4
Register address	Toggle bit (bit 15)	Function bits (bits 8 to 14)	Not used (bits 0 to 7)	Data to write
Same register number as in request	Same as request	DETECTED ERROR Code 0x4E	0x00	Detected error code
		R_REG_16 Code 0x25		Data read in register	_
		R_REG_32 Code 0x26		Data read in register 1	Data read in register 2
		W_REG_16 Code 0x2A		_	_
		W_REG_32 Code 0x2B		_	_

Depending on the PLC platform used, refer to the tables describing PKW IN in Little and Big endian formats in the section Cyclic Data Description to know the positioning of each field inside each word.

If the initiator tries to write a TeSys T object or register to an unauthorized value, or tries to access an inaccessible register, a detected error code is answered (Function code = toggle bit + 0x4E). The exact detected error code can be found in words 3 and 4. The request is not accepted and the object or register remains at the old value.

If you want to re-trigger exactly the same command, you must:

Reset the Function code to 0x00,
Wait for the response frame with the function code equal to 0x00, then
Set it again to its previous value.

This is useful for a limited primary (master) like an HMI.

Another way of re-triggering exactly the same command is to:

Invert the toggle bit in the function code byte.

The response is valid when the toggle bit of the response is equal to the toggle bit written in the answer (this is a more efficient method, but it requires higher programming capabilities).

PKW Detected Error Codes

Detected Write Errors

Detected Error Code	Detected Error Name	Explanation
1	FGP_ERR_REQ_STACK_FULL	external request: sends back a detected error frame
3	FGP_ERR_REGISTER_NOT_FOUND	register not managed (or the request needs super user access rights)
4	FGP_ERR_ANSWER_DELAYED	external request: answer postponed
7	FGP_ERR_NOT_ALL_REGISTER_FOUND	one or both registers cannot be found
8	FGP_ERR_READ_ONLY	register not authorized to be written
10	FGP_ERR_VAL_1WORD_TOOHIGH	written value not in the range of the register (word value is too high)
11	FGP_ERR_VAL_1WORD_TOOLOW	written value not in the range of the register (word value is too low)
12	FGP_ERR_VAL_2BYTES_INF_TOOHIGH	written value not in the range of the register (MSB value is too high)
13	FGP_ERR_VAL_2BYTES_INF_TOOLOW	written value not in the range of the register (MSB value is too low)
16	FGP_ERR_VAL_INVALID	written value not a valid value
20	FGP_ERR_BAD_ANSWER	external request: sends back a detected error frame

Detected Read Errors

Detected Error Code	Detected Error Name	Explanation
1	FGP_ERR_REQ_STACK_FULL	external request: sends back a detected error frame
3	FGP_ERR_REGISTER_NOT_FOUND	register not managed (or the request needs super user access rights)
4	FGP_ERR_ANSWER_DELAYED	external request: answer postponed
7	FGP_ERR_NOT_ALL_REGISTER_FOUND	one or both registers cannot be found