background image

APPENDIX / BASIC TCP/IP DESCRIPTION     A-3 

the Internet Protocol Address, the IP Address or the 

Internet Address.  These terns are interchangeable.  

Each  packet  sent  across  the  internet  contains  the  IP 

address of the source of the packet and the IP 
address of its destination. 

 

For routing efficiency, the IP address is considered in 

two parts: the prefix which identifies the physical 

network, and the suffix which identifies a computer on 

the network.  A unique prefix is needed for each 
network in an internet.  For the global Internet, 

network numbers are obtained from Internet Service 

Providers (ISPs).  ISPs coordinate with a central 

organization called the Internet Assigned Number 

Authority (IANA). 

 

2.3   IP Address Classes 

 

The first four bits of an IP address determine the class 

of the network.  The class specifies how many of the 
remaining bits belong to the prefix (aka Network ID) 

and to the suffix (aka Host ID).  The first three 

classes, A, B and C, are the primary network classes. 

 

Class 

First 4 

Bits 

Number 

of Prefix 

Bits 

Max # of 

Networks 

Number 

of Suffix 

Bits 

Max # of 

Hosts Per 

Network 

Range 

0000 to 

0xxx 7  128  24 

16,777,216 

127.255.255.255  
128.0.0.0 to 

10xx 14 16,384 16 65,536 

191.255.255.255  
192.0.0.0 to 

110x 21 

2,097,152 

8  256 

223.255.255.255  
224.0.0.0 to 

1110 Multicast 

 

 

 

239.255.255.255  

240.0.0.0 to 

1111 

Reserved for future use 

255.255.255 

 

When interacting with mere humans, software uses 

dotted decimal notation; each 8 bits is treated as an 

unsigned binary integer separated by periods.  IP 

reserves host address 0 to denote a network.  
140.211.0.0 denotes the network that was assigned 

the class B prefix 140.211. 

 

2.4   Netmasks 

 

Netmasks are used to identify which part of the 

address is the Network ID and which part is the Host 

ID.  This is done by a logical bitwise-AND of the IP 

address and the netmask.  For class A networks the 

netmask is always 255.0.0.0; for class B networks it is 
255.255.0.0 and for class C networks the netmask is 

255.255.255.0. 

 

2.5   Subnet Address 

 

All hosts are required to support subnet addressing.  

While the IP address classes are the convention, IP 

addresses are typically subnetted to smaller address 

sets that do not match the class system.  The suffix 

bits are divided into a subnet ID and a host ID.  This 

makes sense for class A and B networks, since no 

one attaches as many hosts to these networks as is 

allowed.  Whether to subnet and how many bits to 
use for the subnet ID is determined by the local 

network administrator of each network. 

 

If subnetting is used, then the netmask will have to 

reflect this fact.  On a class B network with 

subnetting, the netmask would not be 255.255.0.0.  
The bits of the Host ID that were used for the subnet 

would need to be set in the netmask. 

 

2.6   Directed Broadcast Address 

 
IP defines a directed broadcast address for each 

physical network as all ones in the host ID part of the 

address.  The network ID and the subnet ID must be 

valid network and subnet values.  When a packet is 

sent to a network’s broadcast address, a single copy 
travels to the network, and then the packet is sent to 

every host on that network or subnetwork. 

 

2.7   Limited Broadcast Address 

 
If the IP address is all ones (255.255.255.255), this is 

a limited broadcast address; the packet is addressed 

to all hosts on the current (sub)network.  A router 

will not forward this type of broadcast to other (sub) 

networks. 

 

2.8   ICMP 

 

Internet Control Message Protocol is a set of 

messages that communicate errors and other 
conditions that require attention.  ICMP messages, 

delivered in IP datagrams, are usually acted on by 

either IP, TCP or UDP.  Some ICMP messages are 

returned to application protocols. 

 

A common use of ICMP is “pinging” a host.  The Ping 
command (Packet INternet Groper) is a utility that 

determines whether a specific IP address is 

accessible.  It sends an ICMP echo request and waits 

for a reply.  Ping can be used to transmit a series of 

packets to measure average round-trip times and 

packet loss percentages. 
 

3.0   LINK LAYER 

 

3.1  ARP 

 

The Address Resolution Protocol is used to translate 

virtual addresses to physical ones.  The network 

Summary of Contents for DS Series

Page 1: ...PHOENIX AC DRIVE DX EX DS ES 3 TO 3500 HP MODBUS RTU PROTOCOL MODBUS TCP PROTOCOL MODBUS USD PROTOCOL MODBUS PROTOCOL ...

Page 2: ...4 2 CRC Checking 3 5 4 0 MODBUS TCP PROTOCOL DESCRIPTIONS 4 1 4 1 Ethernet Frame 4 1 4 2 Modbus TCP Message Framing 4 1 4 3 Modbus TCP Header Description 4 1 4 4 Ethernet TCP Message Framing 4 2 5 0 MODBUS FUNCTION FORMATS 5 1 5 1 Field Contents in Modbus Messages 5 1 5 2 Function Codes 5 1 6 0 PHOENIX AC DRIVE FUNCTION 6 1 FORMATS 6 1 MODBUS USD Function Formats 6 1 6 2 MODBUS RTU Function Format...

Page 3: ...ed RS 422 485 Board 2 6 2 7 Installation of Removable USB RS 485 Isolated Communications Interface 2 7 4 1 Ethernet Frame 4 1 4 2 Encapsulation of Modbus RTU Frame 4 1 4 3 Encapsulation of Modbus RTU Frame In Ethernet Frame 4 2 APPENDIX FIGURES TITLE PAGE A 1 The Four Layers of the TCP IP Protocol Suite A 1 A 2 Two Hosts on a LAN Running TCP A 2 A 3 Various Protocols at Different Layers In the TCP...

Page 4: ...ncy Check protection in both directions The Phoenix drive defaults to 9600 Baud Rate No Parity 8 Bit Data and 2 Stop Bits Using an RS 485 serial interconnect up to 32 drives can be party lined to permit the host computer to setup and query any one of them With using the Ethernet Communications Card any host computer on a network can communicate to the Phoenix AC Drives The PHOENIX AC drive contain...

Page 5: ...1 2 INTRODUCTION END OF INTRODUCTION SECTION ...

Page 6: ...works at full duplex and is illustrated in Figure 2 2 2 3 RS 232 Operation The PHOENIX drive permits a direct RS 232 interface It is felt however that the differential transmission scheme offered by the RS 422 485 standard is much more suitable for an industrial environment Direct connection to a PC using the RS 232 scheme is not recommended for drives operating on the factory floor Those users th...

Page 7: ... 100 mbps The word Ethernet refers to hardware called out in IEEE specification 802 3 and has become an increasingly popular medium for communication in industrial environments The protocols are implementation of TCP and UDP transport used with Ethernet hardware This allows many different applications to run over the same network and the same cables Thus webservers and email run on the same physic...

Page 8: ...HARDWARE INTERFACE 2 3 Figure 2 3 Figure 2 2 Figure 2 1 ...

Page 9: ...2 4 HARDWARE INTERFACE Isolated Communication Card 3000 4135 1 Installation of Isolated RS 422 485 Board with Control Board 3000 4100 3000 4130 Figure 2 4 ...

Page 10: ...vable USB RS 485 Isolated Communications Interface with Cable P N 3000 4226 USB Installation of Removable USB RS 485 Isolated Communications Interface with Cable P N 3000 4226 USB with Control Board 3000 4100 3000 4130 Figure 2 5 ...

Page 11: ...2 6 HARDWARE INTERFACE Isolated Communication Card 3000 4135 Installation of Isolated RS 422 485 Board with Control Board 3000 4101 3000 4131 Figure 2 6 ...

Page 12: ...vable USB RS 485 Isolated Communications Interface with Cable P N 3000 4226 USB Installation of Removable USB RS 485 Isolated Communications Interface with Cable P N 3000 4226 USB with Control Board 3000 4101 3000 4131 Figure 2 7 ...

Page 13: ...2 8 HARDWARE INTERFACE END OF HARDWARE INTERFACE ...

Page 14: ...g the action taken any data to be returned and an error checking field If an error occurred in receipt of the message or if the slave is unable to perform the requested action the slave will construct an error message and send it as its response 3 1 2 The Query Response Cycle Master Slave Query Response Cycle The Query The function code in the query tells the addressed slave device what kind of ac...

Page 15: ...ce into a frame that has a known beginning and ending point This allows receiving devices to begin at the start of the message read the address portion and determine which device is addressed or all devices if the message is broadcast and to know when the message is completed Partial messages can be detected and errors can be set as a result 3 3 1 RTU Framing In RTU mode messages start with a sile...

Page 16: ...code field tells the slave what kind of action to perform Examples are to read the ON OFF states of a group of discrete coils or inputs to read the data contents of a group of registers to read the diagnostic status of the slave to write to designated coils or registers or to allow loading recording or verifying the program within the slave When the slave responds to the master it uses the functio...

Page 17: ... message Both the character check and message frame check are generated in the master device and applied to the message content before transmission The slave checks each character and the entire message frame during receipt The master is configured by the used to wait for a predetermined timeout interval before aborting the transaction This interval is set to be long enough for any slave to respon...

Page 18: ...ess begins of applying successive eight bits bytes of the message to the current contents of the register Only the eight bits of data in each character are used for generating the CRC Start and stop bits and the parity bit do not apply to the CRC During generation of the CRC each eight bit character is exclusive ORed with the register contents Then the result is shifted in the direction of the lea...

Page 19: ...3 6 MODBUS RTV PROTOCAL DESCRIPTION END OF MODBUS RTU PROTOCAL DESCRIPTION ...

Page 20: ...st Response transaction Initialized by the client Recopied by the server from the received request Byte 1 Usually 0 Byte 2 0 Protocol Identifier 2 Bytes 0 MODBUS protocol Initialized by the client Recopied by the server from the received request Byte 3 0 Byte 4 0 Length 2 Bytes Number of following bytes Initialized by the client request Initialized by the server Response Byte 5 Number of Bytes Uni...

Page 21: ...odbus RTU message frame start and stop is not included into the Ethernet TCP frame The format is as shown SLAVE ADDRESS FUNCTION D A T A CRC CHECK 8 BITS 8 BITS NX8BITS 2x8 BITS 16 BITS Figure 4 3 Encapsulation of Modbus RTU frame in Ethernet frame as Ethernet TCP Ethernet header IP header TCP header application data Ethernet trailer 14 20 20 4 Ethernet Frame 46 to 1500 bytes Modbus RTU Frame ...

Page 22: ...011 Error Check Trailer CRC 16 bits None Total Bytes 11 The master query is a Read Holding Registers request to slave device address 06 The message requests data from three holding registers 40108 40110 Note The message specifies the starting register address as 0107 006B hex The slave response echoes the function code indicating this is a normal response The Byte Count field specifies how many ei...

Page 23: ...5 2 MODBUS FUNCTION FORMATS END OF MODBUS FUNCTION FORMATS ...

Page 24: ...me for value of 1 The response is 9600 BAUD Function Code 03 Read Parameter Value This function reads the data value and decimal point position of the specified parameter on the Phoenix drive Broadcast is not supported Query Modbus Format Phoenix Format Example Slave Address Drive Address 01 Function Code Function Code 03 Starting Address Hi Menu Number 05 Starting Address Lo Parameter Number 09 N...

Page 25: ... Hi CRC Hi C4 Response Modbus Format Phoenix Format Example Slave Address Drive Address 01 Function Code Function Code 04 Byte Count Byte Count 10 Data 1 Hi Parameter Name Char 1 42 Data 1 Lo Parameter Name Char 2 41 Data 2 Hi Parameter Name Char 3 53 Data 2 Lo Parameter Name Char 4 45 Data 3 Hi Parameter Name Char 5 20 Data 3 Lo Parameter Name Char 6 4D Data 4 Hi Parameter Name Char 7 4F Data 4 L...

Page 26: ...ed on DS ES and LS series only 6 2 Modbus RTU Function Formats The Phoenix AC drive supports three Modbus functions The drive Modbus write function supports only one parameter per query The drive Modbus read function supports multiple parameters per query A query s a non existing function the response will be an error Code Modbus Function Phoenix Function 03 Read Multiple Register Read Parameter V...

Page 27: ...eter M05P09 Function Code 16 Write Parameter Value This function writes the data value to the specified parameter of the Phoenix Drive Broadcast is supported Query Modbus Format Phoenix Format Example Slave Address Drive Address 01 Function Code Function Code 10 Starting Address Hi Menu Number 05 Starting Address Lo Parameter Number 09 Number of Register Hi Number of Parameters Hi 00 Number of Reg...

Page 28: ... data value and decimal point position of the specified parameter on the Phoenix drive Broadcast is not supported Query Phoenix Format Example Drive Address 01 Function Code 43 Menu Number 05 Parameter Number 09 Don t Care 00 Don t Care 00 CRC Lo 94 CRC Hi CB Response Phoenix Format Example Drive Address 01 Function Code 43 Byte Count 03 Parameter Value Hi 02 Parameter Value Lo 58 Decimal Point Lo...

Page 29: ...6 6 PHOENIX AC DRIVE FUNCTION FORMATS END OF PHOENIX AC DRIVE FUNCTION FORMATS ...

Page 30: ...ception code Data Field In a normal response the slave may return data or statistics in the data field any information that was requested in the query In an exception response the slave returns an exception code in the data field This defines the slave condition that caused the exception Here is an example of a master query and slave exception response The field examples are shown in hexadecimal Q...

Page 31: ...7 2 EXCEPTION RESPONSE END OF EXCEPTION RESPONSE ...

Page 32: ... register putting the result in the CRC register Step 3 Shift the CRC register on bit to the right toward the LSB zerofilling the MSB Extract and examine the LSB Step 4 If the LSB is 0 repeat Step 3 another shift If the LSB is 1 Exclusive OR the CRC register with the polynomial value A001 hex 1010 0000 0000 0001 Step 5 Repeat Steps 3 and 4 until eight shifts have been performed When this is done a...

Page 33: ...d short CRC16 puchMsg usDataLen unsigned char puchMsg message to calculate CRC upon unsigned short usDataLen quantity of bytes in message unsigned char uchCRCHi 0xFF high CRC byte initialized unsigned char uchCRCLo 0xFF low CRC byte initialized unsigned uIndex will index into CRC lookup while usDataLen pass through message buffer uIndex uchCRCHi puchMsg calculate the CRC uchCRCHi uchCRCLo auchCRCH...

Page 34: ...0 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x01 0xC0 0x80 0x41 0x00 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x00 0xC1 0x81 0x40 0x00 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x01 0xC0 0x80 0x41 0x00 0xC1 0x81 0x40 0x00 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x00 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x01 0xc0 0x80 0x41 0x00 0xC1 0x81 0x40 0x00 0xC1 0x81 0x40 0x01 0xC0 0x80 0x41 0x01 0xC0 0x80 0x41 0x00 0xC1 0x81 0x40 0x0...

Page 35: ... 0xE8 0xE9 0x29 0xEB 0x2B 0x2A 0xEA 0xEE 0x2E 0x2F 0xEF 0x2D 0xED 0xEC 0x2C 0xE4 0x24 0x25 0xE5 0x27 0xE7 0xE6 0x26 0x22 0xE2 0xE3 0x23 0xE1 0x21 0x20 0xE0 0xA0 0x60 0x61 0xA1 0x63 0xA3 0xA2 0x62 0x66 0xA6 0xA7 0x67 0xA5 0x65 0x64 0xA4 0x6C 0xAC 0xAD 0x6D 0xAF 0x6F 0x6E 0xAE 0xAA 0x6A 0x6B 0xAB 0x69 0xA9 0xA8 0x68 0x78 0xB8 0xB9 0x79 0xBB 0x7B 0x7A 0xBA 0xBE 0x7E 0x7F 0xBF 0x7D 0xBD 0xBC 0x7C 0xB4...

Page 36: ...number 5 decimal is converted into a one byte two digit representation 05 hexadecimal Modbus Format Phoenix Format Example Register Address Hi Menu Number 0C Register Address Lo Parameter Number 05 9 2 Parameter to Register Address Conversion The US Drives Phoenix two digit Menu number and Parameter number sometimes needs to be converted to a register address in third party software programs The c...

Page 37: ...9 2 PARAMETER CONVERSION END OF PARAMETER CONVERSION ...

Page 38: ...he link layer sometimes called the data link layer or network interface layer normally includes the device driver in the operating system and the corresponding network interface cad in the computer Together they handle all the hardware details of physically interfacing with the cable or whatever type of media is being used 2 The network layer sometimes called the internet layer handles the movemen...

Page 39: ... TCP IP TCP and IP are only two of the protocols An alternative name is the Internet Protocol Suite The purpose of the network interface layer and the application layer are obvious the former handles the details of the communication media Ethernet ring etc while the latter handles one specific user application FTP Telnet etc This figure shows some layers and protocols in the TCP IP protocol suite ...

Page 40: ... netmask is 255 255 255 0 2 5 Subnet Address All hosts are required to support subnet addressing While the IP address classes are the convention IP addresses are typically subnetted to smaller address sets that do not match the class system The suffix bits are divided into a subnet ID and a host ID This makes sense for class A and B networks since no one attaches as many hosts to these networks as...

Page 41: ...ific and unique place in the domain name space DNS makes it possible for us to use identifiers such as zworld com to refer to an IP address on the Internet Name servers contain information on some segment of the DNS and make that information available to clients who are called resolvers 6 0 ETHERNET FRAME 6 1 Ethernet Frame The term Ethernet generally refers to a standard published in 1982 by Digi...

Page 42: ...te the layer to which the data belongs IP handles this by storing an 8 bit value in its header called the protocol field A value of 1 is for ICMP 2 is for IGMP 6 indicates TCP and 17 is for UDP Similarly many different applications can be using TCP or UDP at any one time The transport layer protocols store an identifier in the headers they generate to identify the application Both TCP and UDP use ...

Page 43: ...A 6 APPENDIX BASIC TCP IP DESCRIPTION THIS PAGE INTENTIONALLY LEFT BLANK ...

Page 44: ...R DESIGN EXPERTS US Drives Inc 2221 Niagara Falls Boulevard P O Box 281 Niagara Falls NY 14304 0281 Tel 716 731 1606 Fax 716 731 1524 Visit us at www usdrivesinc com Products Designed And Manufactured In The United States Of America MODP0917 Printed in U S A ...

Reviews: