Can I do an explicit MSG from my ControlLogix PLC to the 6500?

Find attached a copy of simple code to read/write using an explicit msg to the HI 6500 EIP unit. 

If you need to use the MSG command, then each explicit message will give you the input/output table you are using for the command being used. The length of the table is twelve (12) 32 bit registers so the data tags used for the reads and writes would need to be set to this length.  The program attached uses UDTs (User Defined Tags) set up to match (as close as possible) the data for each command. 
The target address would be the I/P address of the unit.

The table registers are defined as:

Output Table:
Command - command being sent to the unit.
Command Aux data - if additional data needed for command.
Parameter ID - ID number of parameter to read/write.
Parameter Value - new value to write to selected parameter.
Reserved
Reserved
Reserved
Parameter RD1 ID - parameter ID to read in this location.
Parameter RD2 ID - parameter ID to read in this location.
Parameter RD3 ID - parameter ID to read in this location.
Parameter RD4 ID - parameter ID to read in this location.
Parameter RD5 ID - parameter ID to read in this location.

Input Table:
Command Echo - echo of command sent to unit.
Command Status - status return for the command sent.
Parameter ID - echo of parameter ID
Parameter Value - value of parameter specified.
Instrument Status - status word of the instrument
Net Weight
Gross Weight
Parameter RD1 value - value of parameter specified in output table Parameter RD1 ID
Parameter RD2 value - value of parameter specified in output table Parameter RD2 ID
Parameter RD3 value - value of parameter specified in output table Parameter RD3 ID
Parameter RD4 value - value of parameter specified in output table Parameter RD4 ID
Parameter RD5 value - value of parameter specified in output table Parameter RD5 ID

Parameter IDs and command numbers can be found in the HI 6500 users guide.

For explicit msg command the parameters settings you need are:

SET_ATTRIBUTE-SINGLE 10 hex
GET_ATTRIBUTE_SINGLE 0E hex
ASSEMBLY CLASS Class # 4
INSTANCE 64 hex (input); 70 hex (output)
ATTRIBUTE # 3

Doing the command to GET_ATTRIBUTE_SINGLE will read you all the bytes as set up in the unit. This command will not distinguish between the types of data selected to read into these locations. It will give you all bytes, regardless of whether they are integer or float format. The user would need to keep track of what data and what type of data was to which location.  (NOTE:  Using the UDT, the user can set up the registers for the type of data they expect in each location.)

The SET_ATTRIBUTE_SINGLE will write data to the unit. Again, the user would need to keep track of what data and what data type would be needed in each of the write locations.