1. CIP Specification Overview
Jason Wang

2. 1 What is CIP?
Fieldbus (or field bus) is the name of a family of industrial computer network protocols used for real-time distributed control, now standardized as IEC
IEC consists of the following parts, under the general title Digital data communications for measurement and control – Fieldbus for use in industrial control systems:
Part 1: Overview and guidance for the IEC series
Part 2: Physical Layer specification and service definition
Part 3: Data Link Service definition
Part 4: Data Link Protocol specification
Part 5: Application Layer Service definition
Part 6: Application Layer Protocol specification

3. 1 What is CIP? Twenty field bus protocols defined in IEC61158 V4：
TS CIP
PROFIBUS P-Net
FF HSE WORLDFIP
INTERBUS FF H1
PROFINET TCNET
ETHERCAT ETHERNET POWERLINK
EPA MODBUS-RTPS
SERCOS I, II VNET/IP
CC-LINK SERCOS III
HART SWIFTNET

4. 1 What is CIP? Devicenet，Controlnet and Ethernet/ip
Control Information Protocol and Common Industrial Protocol: History
The CIP is a media independent, connection-based, object-oriented protocol designed for automation applications.
The CIP is a peer to peer object oriented protocol that provides connections between industrial devices (sensors, actuators) and higher-level devices (controllers).
With media independence comes the ability to choose the CIP network best suited for each application.

5. 2 The CIP Overview 2.6 CIP Specification Structure
CIP Architecture and Related Specifications

6. 2 The CIP Overview 2.6 CIP Specification Structure
CIP Architecture and Related Specifications
Semi
Devices
Pneu
Valve AC
Drives
Position
Cntrllrs
Other
Profiles
Application Object Library
Application Layer
Explicit, I/O, Routing
DeviceNet
DLL
Transport
ControlNet
Future
ecapsulation
UPD
TCP IP
Physical
Layer
Ethernet
Application
User
and Data Link

7. 2 The CIP Overview 2.6 CIP Specification Structure
CIP Architecture and Related Specifications
Semi
Devices
Pneu
Valve AC
Drives
Position
Cntrllrs
Other
Profiles
Application Object Library
Application Layer
Explicit, I/O, Routing
DeviceNet
DLL
Transport
ControlNet
Future
encapsulation
UPD
TCP IP
Physical
Layer
Ethernet
Application
User

8. 2 The CIP Overview 2.6 CIP Specification Structure
CIP Architecture and Related Specifications
Semi
Devices
Pneu
Valve AC
Drives
Position
Cntrllrs
Other
Profiles
Application Object Library
Application Layer
Explicit, I/O, Routing
DeviceNet
DLL
Transport
ControlNet
Future
encapsulation
UPD
TCP IP
Physical
Layer
Ethernet
Application
User
and Data Link

9. 2 The CIP Overview 2.1 How to read CIP
Communication protocol : Mechanism and Message Format
Chapter 1 - Introduction to the Control and Information Protocol
Chapter 2 - Messaging Protocol
Chapter 3 - Communications Objects
Chapter 4 - How to Read Specifications in the Object Library
Chapter 5 - Object Library
Chapter 6 - Device Profiles
Chapter 7 - Electronic Data Sheets
Chapter 8 - Physical Layer
Chapter 9 - Indicators and Middle Layers
Chapter 10 - Bridging and Routing
Appendix A - Explicit Messaging Services
Appendix B - Status Codes
Appendix C - Data Management
Appendix D - Engineering Units

10. 2 The CIP Overview 2.2 The basic conception of CIP
CIP makes use of abstract object modeling to describe:
• The suite of communication services available
• The externally visible behavior of a CIP node
• A common means by which information within CIP products is accessed and exchanged

11. 2 The CIP Overview 2.2 The basic conception of CIP
A CIP node is modeled as a collection of Objects.
An Object provides an abstract representation of a particular component within a product. The realization of this abstract object model within a product is implementation dependent. In other words, a product internally maps this object model in a fashion specific to its implementation.

12. 2 The CIP Overview 2.2 The basic conception of CIP
A Class is a set of Objects that all represent the same kind of system component.
An Object Instance is the actual representation of a particular Object within a Class. Each Instance of a Class has the same set of attributes, but has its own particular set of attribute values.

13. 2 The CIP Overview 2.2 The basic conception of CIP
Attributes are characteristics of an Object and/or an Object Class. Typically, Attributes provide status information or govern the operation of an Object.
Services are invoked to trigger the Object/Class to perform a task.
The Behavior of an Object indicates how it responds to particular events.

14. 2 The CIP Overview 2.3 Object Addressing
Why addressing
Media Access Control Identifier (MAC ID)
Class Identifier (Class ID)
Instance Identifier (Instance ID)
Attribute Identifier (Attribute ID)
Service Code
Address Ranges

15. 2 The CIP Overview 2.4 Connections
A CIPconnection provides a communication path between multiple end-points. The end-points of a connection are applications that need to share data.
A connection is some thing like that:
Exchanger B
Extension A
Extension B
Extension C
Extension D
Exchanger A
Room A
Phone line
Room B

16. 2 The CIP Overview 2.4 Connections
Transmissions associated with a particular connection are assigned an identification value when a connection is established. This identification value is called the Connection ID (CID).
Connection Objects model the communication characteristics of a particular Application-to-Application(s) relationship.

17. 2 The CIP Overview 2.4 Connections
CIP defines the following two types of connections :
• I/O Connections - Provide dedicated, special-purpose communication paths between a producing application and one or more consuming applications. Application-specific I/O data moves through these ports and is often referred to implicit messaging.
• Explicit Messaging Connections - Provide generic, multi-purpose communication paths between two devices. These connections often are referred to as just Messaging Connections. Explicit Messages provide the typical request/response-oriented network communications.

18. 2 The CIP Overview 2.4 Connections
I/O Messages are exchanged across I/O connections. An I/O Message consists of a Connection ID and associated I/O data. The meaning of the data within an I/O Message is implied by the associated Connection ID. The connection end-points are assumed to have knowledge of the intended use or meaning of the I/O Message.

19. 2 The CIP Overview 2.4 Connections
Explicit Messages are used to command the performance of a particular task and to report the results of performing the task.
CIP defines an Explicit Messaging protocol that states the meaning of the message. An Explicit Message consists of a Connection ID and associated messaging protocol information.

20. 2 The CIP Overview 2.5 The abstract object model of a CIP product.
A CIP product included are the following components:
• Unconnected Message Manager (UCMM) - Processes CIP Unconnected Explicit messages.
• Connection Class- Allocates and manages internal resources associated with both I/O and Explicit Messaging connections.
• Connection Object - Manages the communication-specific aspects associated with a particular application-to-application network relationship.
• Network-Specific Link Object - Provides the configuration and status of a physical CIP network connection (eg. DeviceNet and ControlNet objects).
• Message Router - Distributes Explicit Request Messages to the appropriate handler object.
• Application Objects - Implement the intended purpose of the product.

21. 2 The CIP Overview 2.5 The abstract object model of a CIP product.
• Unconnected Message Manager (UCMM) - Processes CIP Unconnected Explicit messages.
A CIP product included are the following components:
• Connection Class- Allocates and manages internal resources associated with both I/O and Explicit Messaging connections.
• Connection Object - Manages the communication-specific aspects associated with a particular application-to-application network relationship.
• Network-Specific Link Object - Provides the configuration and status of a physical CIP network connection (eg. DeviceNet and ControlNet objects).
• Message Router - Distributes Explicit Request Messages to the appropriate handler object.
• Application Objects - Implement the intended purpose of the product.

22. 2 The CIP Overview 2.6 CIP Specification Structure
CIP Architecture and Related Specifications

23. 3 Messaging Protocol 3.1 CID Specification
If the connection involves a bi-directional exchange, then two Connection ID values are assigned.
Explicit Messaging Connections are unconditionally point-to-point.
I/O connections can be either point-to-point or multicast. Multicast connections allow a single transmission to be heard by many nodes.
The definition and format of the connection ID is network dependent. For example, the connection ID for CIP connections over DeviceNet is based on the CAN Identifier Field.
The Client is the module that originates a transmission, and the Server is the module that reacts to that transmission.

24. 3 Messaging Protocol 3.2 Connection Establishment
Explicit Messaging and the UCMM
The Unconnected Message Manager (UCMM) is responsible for processing Unconnected Explicit Requests and Responses. This includes establishing both Explicit Messaging and I/O connections.

25. 3 Messaging Protocol 3.2 Connection Establishment
Establishing an Explicit Messaging Connection
Requester
Responder
Open Explicit Messaging Connection
UCMM
Connection class
UCMM
Open Explicit Messaging Connection
Creates and configures a Connection
Connection class
Finalizes the configuration of Connection
Link Producer
Link Consumer
Link Consumer
Link Producer
Explicit Messaging Connection
Explicit Messaging Connection

26. 3 Messaging Protocol 3.3 Message Router Request/Response Format
Message Router Request Format

27. 3 Messaging Protocol 3.3 Message Router Request/Response Format
Message Router Response Format

28. 4 Communication Object Classes 4.1 What is the communication object?
The CIP Communication Objects manage and provide the run-time exchange of messages.
Communication Object Classes include the following object:
Connection
Connection Manager
Link Producer
Link Consumer
Port Object

29. 4 Communication Object Classes 4
4 Communication Object Classes How to define a communication object
The Communication Object Classes are defined by describing:
• Object Class Attributes
• Object Class Services
• Object Instance Attributes
• Object Instance Services
• Object Instance Behavior
Each CIP connection is represented by a Connection Object (Class code 0x05).The creation of a CIP connection can be done in one of two ways:
• Use of the Create service (Service code 0x08) for the Connection Object
• Use of the Forward Open service for the Connection Manager Object

30. 4 Communication Object Classes 4
4 Communication Object Classes Link Producer Object and Link Consumer Object
The Link Producer Object is the component responsible for the low-level transmission of data.
NO externally visible interface to the Link Producer Class across Explicit
Messaging Connections exists. All services/attributes describe internal behavior. These services/attributes are accessed via attributes and services of the Connection Object
The services supported by the Link Producer Class are listed below.
• Create - Used internally to instantiate a Link Producer Object
• Delete - Used internally to deletes a Link Producer Object
Link Producer Instance attributes are listed below:
USINT state - The current state of the Link Producer instance. Possible states include: Non-existent/Running
UINT connection_id -The value placed within the CAN Identifier Field when this Link Producer is triggered to send. It is the same value in the connection produced_connection_id attribute.

31. 4 Communication Object Classes 4
4 Communication Object Classes Link Producer Object and Link Consumer Object
Link Producer Object Instance Services
The services supported by a Link Producer Object Instance are listed below.
• Send - Used internally to tell the Link Producer to transmit data onto the subnet.
• Get_Attribute - Used internally to read a Link Producer Object attribute
• Set_Attribute - Used internally to modify a Link Producer Object attribute
Behaviors

32. 4 Communication Object Classes 4
4 Communication Object Classes Link Producer Object and Link Consumer Object
The Link Consumer Object is the component responsible for the low-level reception of messages.
NO externally visible interface to the Link Consumer Class across Explicit
Messaging Connections exists. All services/attributes describe internal behavior. These services/attributes are accessed via attributes and services of the Connection Object.
The services supported by the Link Consumer Class are listed below.
• Create - Used internally to instantiate a Link Consumer Object
• Delete - Used internally to deletes a Link Consumer Object
The following list describes the Link Consumer Instance attributes.
• USINT state - The current state of the consumer instance. Possible states include: Non-existent/Running
UINT connection_id- It is the same value in the connection
consumed_connection_id attribute.

33. 4 Communication Object Classes 4
4 Communication Object Classes Link Producer Object and Link Consumer Object
The services supported by a Link Producer Object Instance are listed below.
• Send - Used internally to tell the Link Producer to transmit data onto the subnet.
• Get_Attribute - Used internally to read a Link Producer Object attribute
• Set_Attribute - Used internally to modify a Link Producer Object attribute
Behaviors

34. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
The Connection Class (Class Code: 5) allocates and manages the internal resources associated with both I/O and Explicit Messaging Connections.
A Connection Object within a particular module actually represents one of the end-points of a Connection. It is possible for one of the Connection end-points to be configured and “active” (e.g. transmitting) without the other end-point(s) being present.
A CIP Connection Object uses the services provided by a Link Producer and/or Link Consumer to perform low-level data transmission and reception functions.

35. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Service Code

36. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)

37. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)

38. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)

39. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)

40. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
transportClass_trigger Attribute - USINT data type
Defines whether this is a producing only, consuming only, or both producing and consuming connection. If this end point is to perform a data production, this attribute also defines the event that triggers the production. The eight (8) bits are divided as follows:

41. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)

42. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
A 16-bit sequence count value is prepended to all Class 1, 2, and 3 transports. This value is used to detect delivery of duplicate data packets. Sequence count values are initialized on the first message production and incremented on each subsequent new data production. A resend of old data shall not cause the sequence count to change, and a consumer shall ignore data when it is received with a duplicate sequence count. Consuming applications can use this mechanism to distinguish between new samples and old samples that were sent to maintain the
connection.

43. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)

44. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Server Transport Class 2 Connection Objec

45. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)

46. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Client Transport Class 0 and 1 Behavior: Cyclic

47. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Client Transport Classes 2 & 3 Behavior: Cyclic

48. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Client Transport Class 0 and 1 Behavior: Change-Of-State

49. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Client Transport Classes 2 & 3 Behavior: Change-Of-State

50. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Client Transport Class 0 and 1 Behavior: Application Object Triggered

51. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Client Transport Classes 2 & 3 Behavior: Application Object Triggered

52. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
UINT DeviceNet_produced_connection_id
Contains the DeviceNet Connection ID to be associated with transmissions sent across this connection (if any). This is the value that will be specified in the CAN Identifier Field when this Connection transmits. This value is loaded directly into the associated Link Producer’s connection_id attribute.The following values are defined:
UINT DeviceNet_consumed_connection_id
Contains the Connection ID, which identifies messages to be received across this connection (if any). This is the CAN Identifier Field value that is associated with messages this Connection Object receives. This value is loaded directly into the associated Link Consumer’s connection_id attribute.

53. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
USINT DeviceNet_initial_comm_characteristics Defines the Message Group(s) across which productions and consumptions associated with this Connection occur. This byte is divided into two nibbles

54. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
UINT DeviceNet_produced_connection_id
Contains the DeviceNet Connection ID to be associated with transmissions sent across this connection (if any). This is the value that will be specified in the CAN Identifier Field when this Connection transmits. This value is loaded directly into the associated Link Producer’s connection_id attribute.The following values are defined:
UINT DeviceNet_consumed_connection_id
Contains the Connection ID, which identifies messages to be received across this connection (if any). This is the CAN Identifier Field value that is associated with messages this Connection Object receives. This value is loaded directly into the associated Link Consumer’s connection_id attribute.

55. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
UINT produced_connection_size The meaning of this attribute is different for Explicit Messaging Connections than it is for I/O Connections.
For Explicit Messaging Connections:
This attribute signifies the maximum number of Message Body bytes that a module is able to transmit across this Connection (the Message Body begins with the Service Field and ends with the last Service Specific data byte).
Modules that do not support the transmission of the Fragmentation Protocol initialize this attribute to the value 7 (Message Header (1 byte) + Message Body (7 bytes) = 8 bytes

56. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
For I/O Connections:
If the transportClass_trigger indicates that this Connection instance is to produce, then this attribute defines the maximum amount of I/O data that may be produced as a single unit across this connection. The amount of I/O to be transmitted at any given point in time can be less than or equal to the connection_size attribute.
This attribute defaults to zero (0) within an I/O Connection. If this attribute is set to a value greater than eight (8) in an I/O Connection, then the Connection will break up the data into
multiple fragments.

57. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
UINT consumed_connection_size
The meaning of this attribute is different for Explicit Messaging Connections than it is for I/O Connections.
For Explicit Messaging Connections:
This attribute signifies the maximum number of Message Body bytes that this module is able to receive across this Connection (the Message Body begins with the Service Field and ends with the last Service Specific data byte).
Modules that do not support the reception of the Fragmentation Protocol initialize this to the value 7 (Message Header (1 byte) + Message Body (7 bytes) = 8 bytes

58. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
UINT consumed_connection_size
The meaning of this attribute is different for Explicit Messaging Connections than it is for I/O Connections.
For Explicit Messaging Connections:
This attribute signifies the maximum number of Message Body bytes that this module is able to receive across this Connection (the Message Body begins with the Service Field and ends with the last Service Specific data byte).
Modules that do not support the reception of the Fragmentation Protocol initialize this to the value 7 (Message Header (1 byte) + Message Body (7 bytes) = 8 bytes

59. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
For I/O Connections:
If the transportClass_trigger attribute indicates that this Connection is to consume, then this attribute defines the maximum amount of data that may be received as a single unit across this connection. The actual amount of I/O data received at any given time can be less than or equal to the connection_size attribute.
This attribute defaults to zero (0) within an I/O Connection. If this attribute is set to a value greater than eight (8) in an I/O Connection, then the Connection will process the fragmentation protocol.

60. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
This attribute is used to generate the values loaded into the Transmission Trigger Timer and the Inactivity/Watchdog Timer. The resolution of this attribute is in milliseconds.
When a Connection Object is in the Established state, any modifications to the expected_packet_rate attribute have immediate effect on the Inactivity/Watchdog Timer. The following steps are performed by a Connection Object in the Established state when a request is received to modify the expected_packet_rate attribute:
• the current Inactivity/Watchdog Timer is canceled
• a new Inactivity/Watchdog Timer is activated based on the new value in the expected_packet_rate attribute.
This attribute defaults to 2500 (2500 milliseconds) within Explicit Messaging Connections, and to zero (0) within an I/O Connection.

61. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
USINT watchdog_timeout_action
This attribute defines the action the Connection Object should perform when the Inactivity/Watchdog Timer expires.

62. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
This attribute is used to generate the values loaded into the Transmission Trigger Timer and the Inactivity/Watchdog Timer. The resolution of this attribute is in milliseconds.
When a Connection Object is in the Established state, any modifications to the expected_packet_rate attribute have immediate effect on the Inactivity/Watchdog Timer. The following steps are performed by a Connection Object in the Established state when a request is received to modify the expected_packet_rate attribute:
• the current Inactivity/Watchdog Timer is canceled
• a new Inactivity/Watchdog Timer is activated based on the new value in the expected_packet_rate attribute.
This attribute defaults to 2500 (2500 milliseconds) within Explicit Messaging Connections, and to zero (0) within an I/O Connection.

63. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
UINT produced_connection_path_length
UINT consumed_connection_path_length
EPATH produced_connection_path
EPATH consumed_connection_path
The format of these two bytes stream is specified in Appendix C, Abstract Syntax Encoding for Segment Types.
UINT production_inhibit_time This attribute is used to configure the minimum delay time between new data production. This is required for all I/O Client connections, except those with a production trigger of Cyclic. The Set_Attribute_Single service must be supported when this attribute is implemented. A value of zero (the default value for this attribute) indicates no inhibit time.

64. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Connection Timing
Three types of timers are involved in a connection:
• Transmission Trigger Timer
• Inactivity/Watchdog Timer
• Production Inhibit Timer

65. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
The Connection Object Instance supports the following CIP Common services:

66. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)

67. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Connection Instance Behavior

68. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
I/O Connection State Event Matrix

69. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
I/O Connection State Event Matrix

70. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Connection Instance Behavior

71. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Connection Instance Behavior

72. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Connection Instance Behavior

73. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
CIP Bridged Connection Instance Behavior

74. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
CIP Bridged Connection Instance Behavior

75. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
CIP Bridged Connection Instance Behavior

76. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
CIP Bridged Connection Instance Behavior

77. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Connection Instance Behavior
Explicit Messaging Connection Object State Transition Diagram

78. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Connection Instance Behavior

79. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Connection Instance Behavior

80. 4 Communication Object Classes 4.4 Connection Class (Class Code: 5)
Connection Instance Behavior

81. 4 Communication Object Classes 4.5 CONNECTION MANAGER OBJECT
CONNECTION MANAGER OBJECT CLASS DEFINITION
The Connection Manager Class allocates and manages the internal resources associated with both I/O and Explicit Messaging Connections. The specific instance generated by the Connection Manager Class is referred to as a Connection Instance or a Connection Object.
The Connection Manager Object Class is used to create or delete a connection across many subnet which may use different protocol.

82. 4 Communication Object Classes 4.6 Port Object
PORT OBJECT CLASS
PORT OBJECT CLASS
PORT OBJECT CLASS
Class Code: F4 hex
Class Code: F4 hex
Class Code: F4 hex
The Port Object enumerates the CIP ports present on the device. One instance exists for each CIP port.

83. 4 Communication Object Classes 4.6 Port Object
PORT OBJECT CLASS
Class Code: F4 hex

84. 4 Communication Object Classes 4.6 Port Object
PORT OBJECT CLASS
Class Code: F4 hex

85. 4 Communication Object Classes 4.6 Port Object
PORT OBJECT CLASS
Class Code: F4 hex

86. 5 THE OTHER PARTS OF CIP The CIP : mechanism and message format
If you want to know the format of the message on DeviceNet, ControlNet and Ethernet/IP you have to read the related protocols, which we will discuss later
All the object’s definition have to be implemented by your self
To read the other chapters as you need

87. THANKS