EtherCAT Device Protocol

EtherCAT State Machine (ESM) Terminology use Download Write CoE Object Dictionary (OD) CoE Base Data Types (excerpt) Process Data Configuration based on CoE
The EtherCAT states define a step-by-step set-up of each individual slave and also reflect The OD basically builds upon CANopen® and provides a structure for all slave variables of any type. Each data structure, CoE means support a flexible Process Data Configuration. Individual variables (in case of MDP: obj0x7000 and obj0x6000) are structure in Mapping Objects (obj0x1600ff / obj0x1A00ff).
obj
0x1C12 obj
0x1A00 obj
0x7000 0x0001 BOOL/BIT 0x0003 INT
available functionality. Reflecting misconfiguration or local errors by changing to a state so called object, is addressed by a 16 bit index. Each object can have up to 255 entries, addressed by a 8 bit subindex (SI), To define which ones are transferred cyclically via SM2 and SM3 the Mapping Objects are assigned to the Assign Objects (obj0x1C12, obj0x1C13).
(RxPDO) (Outputs) 0x001E BYTE 0x0005 USINT

Master
which reflects available functionality and providing an error indication (error flag in AL e.g. obj0x7000:03. Objects can be of Object Code Type VARIABLE (only SI0), ARRAY (all entries have same data typen, Those means are used by complex (with µC) and simple (without µC, no OD) devices alike.

Slave
Status Register) and an error code (AL Status Code Register). Upload Read generic name) or RECORD (entries have different data types and names). For ARR or REC objects, SI0 describes the highest 0x001F WORD 0x0006 UINT
0x1C13 0x1600 0x6000 0x0020 DWORD 0x0008 REAL Example: Process Data grouped in Process Data Objects (PDO)
The state request, state response and error response is exchanged via the ESC AL Control obj obj obj subindex used and SI1 has an offset of 16 bit (in case of Complete Access).
RxPDO for SM2 (Outputs) TxPDO for SM3 (Inputs)
Register (reg0x0120)*, AL Status Register (reg0x0130)* and AL Status Code Register (TxPDO) (Inputs) 0x0002 SINT 0x0011 LREAL
OD Index Range OD Area 0x1C12:1 0x1C13:1
(reg0x0134). The ESM specifies the slaves behavior, while the master adopts it respectively. Reference: ETG.1020 – Base Data Types obj obj

0x1000-0x1FFF Communication Area 0x1600:1 0x1A00:1 0x1A00:2

The ESM description below describes the basic slave and master actions. CoE SDO (Service Data Object) Services SDO Command Specifier obj obj obj

0x1600-0x17FF RxPDO Mapping 0x7000

obj
0x6000
obj obj
0x6010

SDO Request/Response Request CoE Services (Number) 0x1A00-0x1BFF TxPDO Mapping configuration 1. configuration 2. configuration

INIT *(0x01) Only access to ESC registers allow to read/write CoE Response SDO Request (0x02) SDO Response (0x03) SDO Info (0x08) 0x1C12 SM RxPDO Assign
0x700:1 0x6000:1
(variable PDO mapping)
obj obj
0x00 Download Segmented Upload Segmented 0x1C13 SM TxPDO Assign
objects. SDO Info services Abort Bool = 1 INT = -3
0x01 Download Download Segmented Get OD List Req. 0x6000-0xBFFF Profile Area (Modules)
Master Master allow to read the Object

Master
0x700:2 0x6000:2 0x6010:1

Slave
obj obj obj
0x02 Upload Upload Get OD List Resp. 0x6000-0x6FFF Input Area
Assign: EEPROM control/status and adress (reg0x0500 ff.) Assign: EEPROM control/status and adress (reg0x0500 ff.) Dictionary structure and Transfer mode: Bool = 0 Bool = 0 STRING = “ETG”
0x03 Upload Segmented Download Get Object Description Req. 0x7000-0x7FFF Output Area
Clear: Mailbox SyncManager: SM0 (reg0x0800 ff.) Clear: Mailbox SyncManager: SM0 (reg0x0800 ff.) object entry. SDO Abort Expedited Data ≤ 4 Byte obj
0x700:3 obj
0x600:3 obj
0x6010:2
0x04 Abort Transfer Get Object Description Resp.
SM1 (reg0x0808 ff.) SM1 (reg0x0808 ff.) indicates a service error. Normal Data = Mbx size UINT = 42 STRING = “EtherCAT” UNSIGNED = 5
0x05 Get Entry Description Req.
Set: Fixed physical adress (reg0x0010 ff.) FMMU for mailbox bit reg0x80D.0 (reg0x0620) Segmented Data > Mbx size
0x06 Get Entry Description Resp.
Mailbox SyncManager: SM0 (reg0x0800 ff.) Slave
0x07 SDO Info Error Req.
SM1 (reg0x0808 ff.) Stop: Mailbox communication (STOP_MBX_HANDLER) Reference: ETG.1000.5 – CoE service specification
FMMU for mailbox bit reg0x80D.0 (reg0x0620) Reference: ETG.1000.6 – SDO
Slave Reference: ETG.1000.6 – CoE Coding (mandatory objects)
Verify: Mailbox SyncManager settings CoE SDO Abort Codes ETG.1020 – (optional objects)
Start: Mailbox communication (START_MBX_HANDLER)
0x06010001 Attempt to read to a write only object 0x06070012 length of service parameter too high

PREOP *(0x02) Mailbox communication available BOOT *(0x03) optional 0x06010002 Attempt to write to a read only object 0x06070013 length of service parameter too low
0x06010005 Object length exceeds mailbox size 0x06070011 Subindex does not exist

Master Master 0x06020000 The object does not exist in the object directory 0x06070031 Value of parameter written too high Synchronization Modes for application Master Task Task Task
Download: e.g. CoE cmds: PDO assign (out-/input) (obj0x1C12/13) Clear: Process Data SyncManager: SM2 (reg0x0810 ff.) 0x06070010 length of service parameter does not match 0x06070032 Value of parameter written too low MDP Device Mode-specific configuration via obj0x1C32/33:
PDO mapping (e.g. input) (obj0x1A00 ff.) SM3 (reg0x0818 ff.) EtherCAT Slave Module 0 Module 1 … Freerun: No use of DCs. Host controller Frames Frame Frame …
Communication Area (0x1000 – 0x1FFF)
Set: Process Data SyncManager: SM2 (reg0x0810 ff.) FMMUs for: Outputs (reg0x0600 ff.) application runs indepentent from EtherCAT cycle.

ESC
Host Controller
e.g. RxPDOs 0x1600 – 0x19FF 0x1600 0x1601 …
SM3 (reg0x0818 ff.) Inputs (reg0x0610 ff.) Modular Device Profile (MDP) SM-Synchronous: No use of DCs. Host controller IRQs SM2/3 SYNC0 SM2/3 SYNC0
e.g. TxPDOs 0x1A00 – 0x1BFF 0x1A00 0x1A01 …
FMMUs for: Outputs (reg0x0600 ff.) Slave The MDP provides a basis structure for any EtherCAT slave‘s data. For each type of data (input, application is started when Process Data are
Manufacture Specific Area (0x2000 – 0x5FFF) Free Run Application Application Application Application
Inputs (reg0x0610 ff.) Stop: Input update (STOP_INPUT_HANDLER) output, configuration, …) a specific index range is used (see Process Data Configuration example). written to the slave‘s output SyncManager Local Clock

Reference: ETG.1000.6 – AL state machine

Input Area 0x6000 – 0x6FFF 0x6000 – 0x600F 0x6010 – 0x601F …
Module Ident List (obj0xF020 ff.) Each index range is sub-structured into a defined number of objects (usually 16) per module. (“SM2-event”, ESC global IRQ line or polling

Sync Modes
Output Area 0x7000 – 0x7FFF 0x6000 – 0x600F 0x6010 – 0x601F …
Slave A module can be a software or a hardware module or channel of a slave. Categories are: of Event Register 0x0200ff.). SM-Synchronous Jitter: ~µs Application Application
Configuration Area 0x8000 – 0x8FFF 0x6000 – 0x600F 0x6010 – 0x601F …
Verify: Process Data SyncManager settings, PDO Assign/Mapping Fieldbus Gateways, where each connected station is represented by a module DC-Synchronous: Use of hardware-timer-based
Information Area 0x9000 – 0x9FFF 0x6000 – 0x600F 0x6010 – 0x601F …

Slave
Start: Input update (START_INPUT_HANDLER) Modular Devices, where each connected sub-device is represented as a module interupt signals (SYNC0/SYNC1) to trigger host DC-Synchronous Jitter: ~ns Application Application
Device Area (0xF000 – 0xFFFF)
Module Device, where each channel is represented as a module (e.g. 4 analog input channels) controller application.
SAFEOP *(0x04) Process Data available, Outputs stil in safe state Reference: ETG.5001 – Modular Device Profile

ETG.1000.4 – Distributed Clocks

Local Master
Distributed Clocks (hardware-based) Clock

ETG.1020 – Synchronization
Slave Slave DCs are based on a 64bit-nanosecond-based counter in the ESC. Slave 1
Verify: Synchrnisation with DC (if supported) Stop: Output update (STOP_OUTPUT_HANDLER) Slave structure and EtherCAT Slave Controler (ESC) Their synchronicity and simoultaneousness can be well below 100 ns.
Start: Output update (START_OUTPUT_HANDLER) The ESC provides serveral logic entities (like the auto Forward & Loopback and the EPU) to ensure fast Process Data comunication. A “complex” Delay (reg0x0928) and offset (reg0x0920) are determined by the Slave 2

ESC
EtherCAT slave has an application processed on a separate host controller/µC. A “simple” slave support digitial I/Os only, and has no host controller. EtherCAT master during start-up and written to each ESC. Typically,     1. Read system time (reg0x0910) Slave 2 Ref Clk
2. Read time at each port (reg0x0900)
OPERATIONAL *(0x08) Process Data available the first DC device after the master serves as a reference clock. The Slave 3

References:
3. Set system time offset (reg0x0920)

…
local clock drift of each DC slave is compensated by distribution of the 4. Set system delay (reg0x0928) Slave n
State transition/ PreopTimeout (3000ms) BackToSafeopTimeout (200ms) SafeopOPTimeout (10000ms) BackTolnitTimeout (5000ms) reference clock’s system time (reg0x0910) via a cyclic *RMW command. t
Slave n
Default timeout: AoE EoE CoE FoE SoE Initialization Drift Compensation
ESM Process Data

…
0x01 0x02 0x03 0x08 0x10

Frame Processing µC SyncManager (SM) FMMU

AL
The communication is always initiated by the master by sending Ethernet frames via its NIC. Those are processed Configuration and EPU SyncManagers ensure data consistency and control the DPRAM access The Fieldbus Memory Managemend Unit (FMMU) maps logical addressed raw data
on the fly by the ESC. Processing within the ESC works in a “roundabout” manner: After the EtherCAT Processing diagnosis registers:
PORT 3
No Link
Mailbox using a handshake (1 buffer, i.e. Mailbox SM) or buffered method bit wise to the corresponding DPRAM address and vise versa. The FMMU is configured
Unit (EPU) the frame is forwarded to the next open port (port 3 port 1), while the returning frame is sent back DL Control reg
0x0100 reg
0x0100 (3 buffers, Process Data SM). For complex devices (with µC) the order with a logical start address, lentgh, a logical start and end bit, with the corresponding
to the master via port 0. Port 0 shall always be the IN port of the slave. DL Status 0x0110 0x0110 and type of SMs are used as shown below. physical start address / bit and with the direction type as shown in Example 3.
PORT 1

reg reg
PORT 0

PORT 1

The topology always forms a logical ring, by design neither frame collision nor congestions can occur. Hence, Invalid Fr. Cntr reg
0x0300 ESC reg
0x0302 FMMU0 is assigned to the output data, while FMMU1 is assigned to the input data.
the throughput time is constant and can be calculated precisely. Link Lost Cntr 0x0310 0x0311 PDI (Process Data Interface) LATCH SYNC SM0 SM1 SM2 SM3
reg reg
Registers
The light grey arrows describe the part of the frame. Mailbox In Mailbox Out Inputs Outputs Reference: ETG.1000.4 – FMMU
PORT 2
Link

Reference: Phys. Start 0x0800

reg reg
0x0808 0x0810
reg reg
0x0818
ETG.1000.3, Data-link Layer MBX_WRITE_ADDRESS MBX_READ_ADDRESS PD_WRITE_ADDRESS PD_READ_ADDRESS
Length 0x0802 0x080A 0x0812 0x081A
ETG.1000.4, Management
(EEPROM)

reg reg reg reg

Register DC MBX_SIZE MBX_SIZE PD_INPUT_SIZE PD_OUTPUT_SIZE

Process Data RAM
SII

reg
0x981 Control reg
0x0804 reg
0x080C reg
0x0814 reg
0x081C

ADO
0x1000
SLAVE SLAVE SLAVE
PA Example 1: Read / write access to registers 1 2 3
Reference: ETG.1000.4 – SM

SFD
Ethernet Header

Data

Value(s)
SLAVE
Destination 4 SM 0 SM 1 SM 2 SM 3
ESC reg
0x0800 reg
0x0808 reg
0x0810 reg
0x0818
Source Example 2: Mailbox communication Example 3: FMMU configuration

DL
(via SM0, SM1), CoE SDO Service Each Slave extracts and inserts its Process Data while the frame passes through the ESC.
EtherType (0x88A4) 16 Bit
FMMU 0 FMMU 1
Length 11 Bit Length 16 Bit 0x0600 0x0610 Slave 1 Slave 2 Slave 3
EtherCAT Header

reg reg
EtherCAT Processing Unit (EPU)
Configuration: reg0x0600 FMMU0 FMMU1 FMMU0 FMMU1 FMMU0
Reserved 1 Bit Address 32 Bit

Type (0x01) 4 Bit Channel 6 Bit Log. start Address reg+0x0: 0x1000000 0x1000004 0x1000008 0x100000E 0x1000004
Mailbox Header

Auto Forward & Loopback

References: ETG.1000.3

Length (Byte) reg+0x4: 0x02 0x04 0x06 0x04 0x04

Priority 2 Bit
Command 8 Bit Phy. start Address reg+0x8: 0x1600 0x1A00 0x1600 0x1A00 0x1600

Type (CoE: 0x03) 4 Bit

Type reg+0xB: 0x01 (read) 0x02 (write) 0x01 (read) 0x02 (write) 0x01 (read)
Index 8 Bit

Master

Slave
Address 32 Bit Count 3 Bit Port 0 (in) Port 1 (out) Port 2 (out) Port 3 (out)
Datagram Header
Ethernet frame (IEEE 802.3): 64 - 1518 Byte

Length 11 Bit Reserved 1 Bit

PL
Reserved 3 Bit Number 9 Bit
Protocol Header

Circulating 1 Bit Reserved 3 Bit LRW 0x1000000 BB BB AA AA CC CC CC CC CC CC DD DD DD DD WKC

Data

NEXT 1 Bit Service (0x02) 4 Bit

Example 1: Read/write ESM related registers & ESM interaction Example 2: CoE SDO (Service Data Object) interaction
IRQ 16 Bit Size indicator 1 Bit State changes are requested by the Data Link Layer Service (DL-Service) which addresses the slave‘s registers by its fixed physical address (ADP) SDO Services are used to access the Object Dictionary (OD). This example shows an SDO download of 0x1C12:01 with a Download
WKC+5
EtherCAT Data
Ethernet Data

and its DPRAM address offset (ADO) to write/read data. With each successfull operation, the working counter (WKC) is incremented. Response (case 1) and an Abort Service (case 2).
Transfer type 1 Bit
Mailbox Service Data

Data set size 2 Bit datagram Slave (ADP0x03E9) datagram Slave (ADP0x03E9)
Datagrams

ESC µC
Complete Access 1 Bit
Command Address (position | offset) Value(s) WKC Command Address (position | offset) WKC ESC
Command
Command Specificer 3 Bit
State request to PREOP AL Control AL Status AL Status Code
Type Service Specifier Index SI Data µC
0x00 NOP No operation 0x08 BWR Broadcast write
Index 16 Bit 0x0120 0x0130 0x0134
FPWR 0x03E9 | ADO0x0120 0x02 0x0000 reg reg reg
ADP 0x01 APRD Auto increment physical read 0x09 BRW Broadcas read write
0x01 Upload Request
Subindex 8 Bit MBX_Main() 0x02 APWR Auto increment physical write 0x0A LRD Logical memory read
Data

0x02 0x01 0x0000

Reference: ETG.1000.6 – Protocol State Machine

FPWR ADP
0x03E9 | ADO0x1000 CoE Req. Upload 0x1c12 0x01 0x0000 0x03 APRW Auto increment physical read write 0x0B LWR Logical memory write
Complete size Req. PREOP INIT state No error
WKC+1 MailboxServiceInd() 0x04 FPRD Configured address physical read 0x0C LRW Logical memory read write
Master

Check MbxSM

Data 32 Bit COE_ServiceInd() 0x05 FPWR Configured address physical write 0x0D ARMW Auto increment physical read multiple write
Case: 1 Successful
Master

WKC+1 0x06 FPRW Configured address physical read write 0x0E FRMW Configured address physical read multiple write
SDOS_Sdolnd()
FPRD 0x03E9 | ADO0x0130 0x0000
settings

ADP 0x07 BRD Broadcast read

Example 3: Process data exchange 0x02 Case: 1 Download Response OBJ_Read()
Check Mbx SM settings

(via SM2, SM3) 0x02 0x0000 Reference: ETG.1000.4 – EtherCAT DLPDU Struct.
FPRD ADP
0x03E9 | ADO0x1080 0x0000
PREOP state No error OK
0x02, 0x0000 WKC+1
Data range 1 SdoRes()
Case: 2 Unsuccessful OK AL Status Code
WKC 16 Bit Data range 2 CoE Resp. Download 0x1C12 0x01 Object data WKC+1
Data

FPRD 0x03E9 | ADO0x0130 0x0000

ADP
0x01 0x11 0x0016 Case: 2 Abort Transfer 0x00D Invalid Output config. 0x0036 DC SYNC0 Cycle Time
PAD …
INIT state, Invalid mailbox 0x001E Invalid Input config. 0x001B SyncManager Watchdog
FPRD 0x03E9 | ADO0x1080 0x0000
FSC 32 Bit Data range n Error indication configuration Not OK
ADP 0x0024 Invalid Input mapping 0x001A Synchronisation error
0x11, 0x0016 WKC+1
SdoRes() 0x0025 Invalid Output mapping 0x0033 DC SYNC IO Error

Not OK 0x0030 Invalid DC SYNC config.

WKC+1
CoE Req. Abort 0x1C12 0x01 0x06090011 WKC+1
Reference: ETG.1000.4 – Frame structure Reference: ETG.1020 – AL Status

ETG Specification: www.ethercat.org/etg<Spec.Number (4 digits)> Knowlegde Base: www.ethercat.org/kb Developers’ Forum: www.ethercat.org/forum
EtherCAT Device Protocol Poster