Download PLC Instructions

\documentclass[]{article}

%opening
\title{Maintenance Protocol download notes}
\author{System Controls Group}

\begin{document}

\maketitle

\section*{Summary of Successful PLC Program Download Implementation}

\subsection*{Overview}

This work established a verified method for downloading a compiled \texttt{.zld} user program into an IDEC FC6A PLC using the Maintenance Protocol over a USB CDC serial interface. The implementation was validated against packet captures and confirmed through execution on physical hardware.

The objective was to reliably transfer program memory, ensure integrity via checksum validation, and return the PLC to RUN mode.

\subsection*{Protocol Layers Identified}

Two related but behaviorally distinct protocol modes were identified:

\subsubsection*{Maintenance Protocol (Documented)}

The Maintenance Protocol, described in \texttt{fc4a\_protocol\_im.pdf}, is used for general-purpose commands such as:

\begin{itemize}
    \item Writing individual bits (e.g., \texttt{M8000})
    \item Reading PLC status (\texttt{RS})
\end{itemize}

Frame format:

\[
\texttt{ENQ (0x05) + ASCII body + BCC + CR}
\]

Reply format:

\[
\texttt{ACK (0x06) or NAK (0x15) + ASCII body + BCC + CR}
\]

\subsubsection*{USB Download Dialect (Observed)}

Packet captures from Q3Download revealed a specialized download sequence used for program transfer. Although framing is structurally similar to Maintenance Protocol, behavioral differences exist in sequencing and data handling.

Download commands include:

\begin{itemize}
    \item \texttt{Ri} (initialization)
    \item \texttt{WPn} (segment declaration)
    \item Hex-encoded data blocks
    \item \texttt{W;n} (final segment declaration)
    \item \texttt{Ru} (status polling / finalize)
\end{itemize}

\subsection*{Checksum (BCC) Rule Variations}

Correct interpretation of the BCC (Block Check Character) was critical.

\subsubsection*{Maintenance Request BCC}

Maintenance requests exhibited two possible checksum modes:

\begin{itemize}
    \item XOR over ASCII body only
    \item XOR over ENQ + ASCII body
\end{itemize}

The correct mode was determined dynamically by detecting NAK responses (error code \texttt{10}) and retrying with the alternate rule.

\subsubsection*{PLC Reply BCC}

For all observed PLC replies (both maintenance and download dialect):

\[
\textbf{BCC = XOR(start byte + ASCII body)}
\]

The start byte (ACK or NAK) must be included in the XOR calculation.

Failure to include the start byte caused false BCC mismatch errors during early testing.

\subsection*{NAK Interpretation}

NAK frames (start byte 0x15) return structured error bodies.

Example:

\[
\texttt{01010}
\]

The final two digits represent communication error codes. Code \texttt{10} indicates a data format or checksum mismatch.

NAK responses were essential for diagnosing:

\begin{itemize}
    \item Incorrect BCC calculation
    \item Incorrect command format
    \item Missing required sequence steps
\end{itemize}

\subsection*{Verified Download Sequence}

Successful program transfer required the following ordered procedure:

\begin{enumerate}
    \item Stop PLC execution (\texttt{M8000 = 0})
    \item Read status (\texttt{RS}) for verification
    \item Send \texttt{Ri} initialization command
    \item Send \texttt{WPn} with segment 1 length
    \item Transmit hex-encoded data blocks (736 bytes each)
    \item Poll using \texttt{Ru} until ready
    \item Send \texttt{W;n} for final segment
    \item Transmit final segment (340 bytes)
    \item Final \texttt{Ru}
    \item Restart PLC (\texttt{M8000 = 1})
\end{enumerate}

\subsection*{Program Data Observations}

\begin{itemize}
    \item The first 72 bytes of the \texttt{.zld} file represent container/header data and are not transmitted.
    \item PLC instructions are 2-byte words.
    \item Full transfer blocks are 736 bytes (0x2E0).
    \item Final segment size observed: 340 bytes (0x0154).
\end{itemize}

\subsection*{Conclusion}

Successful implementation required:

\begin{itemize}
    \item Distinguishing Maintenance Protocol behavior from download dialect behavior.
    \item Implementing correct BCC rules for both request and reply directions.
    \item Using NAK error codes to guide protocol correction.
    \item Reproducing the exact sequencing observed in packet captures.
\end{itemize}

The system now reliably writes a ZLD user program into PLC memory and restores operational state. This establishes a validated foundation for formal documentation and future automation.




\end{document}