ProSoft Technology PLX30 Series User Manual Download Page 93

Page: 93 / 200

PLX30 Series

MBTCP Protocol

Ethernet and Serial Gateways

User Manual

ProSoft Technology, Inc.

Page 93 of 200

September 19, 2012

MBTCP Protocol

In This Chapter

6.1

MBTCP Functional Overview.......................................... 94

6.2

MBTCP Configuration ..................................................... 98

6.3

MBTCP Diagnostics ...................................................... 106

6.4

MBTCP Reference ........................................................ 109

This chapter contains information specific to PLX30-series gateways with a
Modbus TCP/IP (MBTCP) protocol driver.

Summary of Contents for PLX30 Series

Page 1: ...PLX30 Series Ethernet and Serial Gateways September 19 2012 USER MANUAL...

Page 2: ...uty of any such user or integrator to perform the appropriate and complete risk analysis evaluation and testing of the products with respect to the relevant specific application or use thereof Neither...

Page 3: ...LASS I DIV 2 WARNING EXPLOSION HAZARD WHEN IN HAZARDOUS LOCATIONS TURN OFF POWER BEFORE REPLACING OR WIRING GATEWAYS WARNING EXPLOSION HAZARD DO NOT DISCONNECT EQUIPMENT UNLESS POWER HAS BEEN SWITCHED...

Page 4: ......

Page 5: ...the Drivers 24 2 6 Using the CommonNet Data Map 27 2 7 Configuring an IP Address 29 2 8 Downloading the Project to the Gateway 30 2 9 Printing a Configuration File 32 3 Diagnostics and Troubleshooting...

Page 6: ...ecifics 81 5 4 3 ControlLogix and CompactLogix Processor Specifics 85 5 4 4 EIP Command Entry Form 92 6 MBTCP Protocol 93 6 1 MBTCP Functional Overview 94 6 1 1 General Specifications Modbus TCP IP 94...

Page 7: ...3 ASCII Diagnostics 165 8 3 1 PCB Diagnostics 165 8 3 2 ASCII Status Data in Upper Memory 165 9 SIE Protocol 167 9 1 SIE Functional Overview 168 9 1 1 General Specifications 168 9 1 2 Gateway Interna...

Page 8: ...Contents PLX30 Series User Manual Ethernet and Serial Gateways Page 8 of 200 ProSoft Technology Inc September 19 2012...

Page 9: ...Gateways User Manual ProSoft Technology Inc Page 9 of 200 September 19 2012 1 Start Here In This Chapter 1 1 System Requirements 10 1 2 Package Contents 11 1 3 Mounting the Gateway on a DIN rail 12 1...

Page 10: ...dware and software components Pentium II 450 MHz minimum Pentium III 733 MHz or better recommended 128 Mbytes of RAM minimum 256 Mbytes of RAM recommended 100 Mbytes of free hard disk space or more ba...

Page 11: ...PLX PLX30 series communication gateway 1 Ethernet cable RL CBL025 5 straight through cable 1 DB9 to Screw Terminal Adaptor 1454 9F DB9 to screw terminal adapter 1 RJ45 DB9M Serial Adapter Cable CABLE...

Page 12: ...Start Here PLX30 Series User Manual Ethernet and Serial Gateways Page 12 of 200 ProSoft Technology Inc September 19 2012 1 3 Mounting the Gateway on a DIN rail PLX30 Series of Gateways...

Page 13: ...ways User Manual ProSoft Technology Inc Page 13 of 200 September 19 2012 1 4 Connecting Power to the PLX30 Gateway WARNING Ensure that polarity is not reversed when applying power to the gateway This...

Page 14: ...Start Here PLX30 Series User Manual Ethernet and Serial Gateways Page 14 of 200 ProSoft Technology Inc September 19 2012...

Page 15: ...cts 23 2 5 Configuring the Drivers 24 2 6 Using the CommonNet Data Map 27 2 7 Configuring an IP Address 29 2 8 Downloading the Project to the Gateway 30 2 9 Printing a Configuration File 32 ProSoft Co...

Page 16: ...logy website 1 Open your web browser and navigate to http www prosoft technology com pcb 2 Click the link at the Current Release Version section to download the latest version of ProSoft Configuration...

Page 17: ...en the DVD menu as not all DVD ROM drives AutoRun Double click My Computer and navigate to your DVD ROM drive in the list of connected drives Double click the DVD Rom drive icon to open the DVD menu 2...

Page 18: ...roSoft Technology Inc September 19 2012 Note On the Main DVD menu screen the correct platform and product number must be selected through the dark drop down menus on the top right to be linked to the...

Page 19: ...ne Help Most of the information needed to help you use ProSoft Configuration Builder is provided in a Help System that is always available whenever you are running ProSoft Configuration Builder The He...

Page 20: ...ols before you will find the screen layout familiar ProSoft Configuration Builder s PCB s window consists of a tree view on the left and an information pane on the upper right side and a configuration...

Page 21: ...gy Inc Page 21 of 200 September 19 2012 To add the gateway to the project 1 Use the mouse to select DEFAULT MODULE in the tree view and then click the right mouse button to open a shortcut menu 2 On t...

Page 22: ...roSoft Technology Inc September 19 2012 3 In the Product Line Filter area of the dialog box select the PLX30 radio button 4 In the STEP 1 Select Module Type drop down list select the model number that...

Page 23: ...er 19 2012 2 4 Renaming PCB Objects The Default Project and Default Location folders may be renamed in the tree view Select the object and then click the right mouse button to open a shortcut menu Fro...

Page 24: ...ck the sign next to any icon to view gateway information and configuration options 3 Double click any icon to open an Edit dialog box To edit a parameter select the parameter name in the left hand pan...

Page 25: ...ur Gateway Ethernet and Serial Gateways User Manual ProSoft Technology Inc Page 25 of 200 September 19 2012 4 Double clicking any icon will open an Edit dialog box with a table To add a row to the tab...

Page 26: ...Edit dialog box where you can edit the row parameters 5 When configuration is complete download the configuration to the gateway For protocol specific configuration information see the Configuration s...

Page 27: ...can then be accessed by a remote device such as an HMI or processor Information about upper memory addresses where the gateway places protocol specific error and status data can be found in the Diagn...

Page 28: ...y one of the communication protocols running on the gateway Register Count 1 to 100 This parameter specifies the number of registers to copy Swap Code No Change Word Swap Word and Byte Swap Byte Swap...

Page 29: ...ur network administrator if necessary You will need the following information o IP address fixed IP required _____ _____ _____ _____ o Subnet mask _____ _____ _____ _____ o Gateway address _____ _____...

Page 30: ...oad copy the updated Project file from your PC to the gateway To download the project file 1 In the tree view in ProSoft Configuration Builder click once to select the gateway 2 Right click the Gatewa...

Page 31: ...he same IP address and network mask that you entered in the Ethernet configuration of the gateway Click OK The gateway will reboot 6 Close the ProSoft Discovery Service window to return to the Downloa...

Page 32: ...con and then click the right mouse button to open a shortcut menu 2 On the shortcut menu choose VIEW CONFIGURATION This action opens the View Configuration window 3 In the View Configuration window op...

Page 33: ...ators 33 3 2 Using Diagnostics in ProSoft Configuration Builder 36 3 1 LED Indicators Troubleshooting can be performed using several methods The first and quickest is to scan the LEDs on the gateway t...

Page 34: ...n detected and is occurring on one of the application ports Check configuration and troubleshoot for communication errors Solid Amber This error flag is cleared at the start of each command attempt Ma...

Page 35: ...ft Technology Inc Page 35 of 200 September 19 2012 3 1 3 Serial Port LEDs for Gateways with Serial Ports LED State Description RX Off No activity on the port FlashingGreen The port is actively receivi...

Page 36: ...you with diagnostics and troubleshooting You can use PCB to connect to your gateway and retrieve current status values configuration data and other valuable information Tip You can have a ProSoft Con...

Page 37: ...September 19 2012 This opens the Diagnostics window If there is no response from the gateway as in the example above follow these steps 1 Click the Setup Connection button In the Connection Setup dial...

Page 38: ...s Page 38 of 200 ProSoft Technology Inc September 19 2012 2 Click the Connect button Verify that the Ethernet is connected properly between your computer s communication port and the gateway If you ar...

Page 39: ...commands available will depend on the protocol combination of your gateway Caution Some of the commands available to you from this menu are designed for advanced debugging and system testing only and...

Page 40: ...nical support Data Map Displays the gateway s Data Map configuration Database View ASCII Displays the contents of the gateway s database in ASCII character format Decimal Displays the contents of the...

Page 41: ...lick the Log File button on the toolbar at the top of the Diagnostics window Click the button again to stop the capture 3 To view the log file created click the View Log File button The log file will...

Page 42: ...ork protocol analyzer available on the Internet such as Wireshark To use the Data Analyzer 6 Open the Diagnostics window in PCB 7 On the toolbar at the top of the window click the Setup Data Analyzer...

Page 43: ...Data Analyzer Click it again to stop it 11 The example below is part of a capture of standard Modbus data packets It is displayed in hexadecimal number format Data LEAVING the serial port is enclosed...

Page 44: ...tus Data in Upper Memory The following table describes the contents of the gateway s general status data area Register Address Description 4000 through 4001 Program Cycle Counter 4002 through 4004 Pro...

Page 45: ...tion Ethernet and Serial Gateways User Manual ProSoft Technology Inc Page 45 of 200 September 19 2012 4 Hardware Information In This Chapter 4 1 Hardware Specifications 46 4 2 Serial Port Cables for G...

Page 46: ...lass I or Class III Connection Status EtherNet IP Only Module Status MS Module Configuration Status EtherNet IP Only Ethernet Communication Port Link Activity and 100mbit Serial Communication Port Rec...

Page 47: ...ial Port Isolation 2500 Vrms port signal isolation per UL 1577 serial port communication signal uses RF Radio Frequency modulation signal as isolation media IC chip model is SiliconLabs Si844x Si8440...

Page 48: ...IP MBS gateway contains one serial communication port Each physical serial port has a RJ45 jack connector A six inch RJ45 to DB9Male adapter cable is provided for each serial port The DB9Male adapter...

Page 49: ...the gateway to a computer or field device communication port Note If the port is configured to use RTS CTS handshaking then a jumper is required between the RTS and the CTS line on the gateway connec...

Page 50: ...ommonly called a RS 485 half duplex 2 wire connection If you have RS 485 4 wire full duplex devices they can be connected to the gateway s serial ports by wiring together the TxD and RxD from the two...

Page 51: ...logy Inc Page 51 of 200 September 19 2012 5 EIP Protocol In This Chapter 5 1 EIP Functional Overview 52 5 2 EIP Configuration 54 5 3 EIP Diagnostics 70 5 4 EIP Reference 77 This chapter contains infor...

Page 52: ...ell as other software based solutions The following illustration shows the functionality of the EtherNet IP protocol The EIP driver supports the following connections Class Connection Type Number of C...

Page 53: ...of Clients Supported Connected Clients 2 Unconnected Clients 1 Command List Support for 100 commands per Client each configurable for command type IP address register to from addressing and word bit...

Page 54: ...ray Range for 4000 Element Database BOOL BOOLData 1 0 to 63999 Bit Array BITAData 4 0 to 1999 SINT SINTData 1 0 to 7999 INT INT_Data 2 0 to 3999 DINT DINTData 4 0 to 1999 REAL REALData 4 0 to 1999 The...

Page 55: ...cted Write X PLC 5 Command Set Functions Command Function Definition Supported in Server 0x0F 0x00 Word Range Write Binary Address X 0x0F 0x01 Word Range Read Binary Address X 0x0F Typed Range Read Bi...

Page 56: ...EDS from device Note RSLogix5000 may need to be restarted in order to complete the installation 4 Once RSLogix5000 has been restarted add a New Module under the EtherNet IP bridge in the I O tree 5 In...

Page 57: ...or output and 4 for configuration 5 A CIP Connection will need to be added and configured for each I O connection Configuring EIP Class 1 Connections in PCB There are four configurable parameters for...

Page 58: ...ain devices such as the AB Power Monitor 3000 series B support unconnected messaging Check your device documentation for further information about its Ethernet IP implementation Class 3 Client UClient...

Page 59: ...mpleted and then the polling process begins over again This section defines the EtherNet IP commands to be issued from the gateway to server devices on the network These commands can be used for data...

Page 60: ...conds Reg Count Specifies the number of data points to be read from or written to the target device Swap Code None Word swap Word and Byte swap Byte swap Specifies if the data from the server is to be...

Page 61: ...nual ProSoft Technology Inc Page 61 of 200 September 19 2012 Parameter Value Description file will be used Element Number Specifies the element in the file where the command will start Comment This fi...

Page 62: ...5 Specifies the minimum interval to execute continuous commands The parameter is entered in 1 10 of a second If a value of 100 is entered for a command the command executes no more frequently than eve...

Page 63: ...Number 1 Specifies the SLC 500 file number to be associated with the command If a value of 1 is entered for the parameter the field will not be used in the command and the default file will be used El...

Page 64: ...ommand executes no more frequently than every 10 seconds Reg Count Specifies the number of data points to be read from or written to the target device Swap Code None Word swap Word and Byte swap Byte...

Page 65: ...red for the parameter the field will not be used in the command and the default file will be used Element Number Specifies the element in the file where the command will start Sub Element Specifies th...

Page 66: ...e command executes no more frequently than every 10 seconds Reg Count Specifies the number of data points to be read from or written to the target device Swap Code None Word swap Word and Byte swap By...

Page 67: ...rotocol Ethernet and Serial Gateways User Manual ProSoft Technology Inc Page 67 of 200 September 19 2012 Parameter Value Description N10 300 Comment This field can be used to give a 32 character comme...

Page 68: ...f 100 is entered for a command the command executes no more frequently than every 10 seconds Reg Count Specifies the number of data points to be read from or written to the target device Swap Code Non...

Page 69: ...command executes no more frequently than every 10 seconds Reg Count Specifies the number of data points to be read from or written to the target device Swap Code None Word swap Word and Byte swap Byt...

Page 70: ...sses socket status and read and write counts EIP Class 3 Client UClient x Config Configuration settings for Class 3 Client UClient Connections Comm Status Status information for Class 3 Client UClient...

Page 71: ...f Command Errors 3 Number of Requests 4 Number of Responses 5 Number of Errors Sent 6 Number of Errors Received 7 Reserved 8 Current Error Code 9 Last Error Code EIP Client Command List Error Data A s...

Page 72: ...o error code indicates an error To interpret the status error codes refer to EIP Error Codes page 73 EIP Server Status Data The following table lists the addresses in upper memory that hold status dat...

Page 73: ...command fails use the error code to determine the cause of failure Note The gateway specific error codes not EtherNet IP PCCC compliant are returned from within the gateway and never returned from an...

Page 74: ...sent Code Int Code Hex Description 4096 0xF000 Not used 4095 0xF001 A field has an illegal value 4094 0xF002 Less levels specified in address than minimum for any address 4093 0xF003 More levels speci...

Page 75: ...ta does not match requested byte count 20 0xFFEC DLE NAK received after request 21 0xFFEB DLE NAK sent after response 200 0xFF38 DLE NAK received after request TCP IP Interface Errors Error Int Error...

Page 76: ...52 0xFFCC Invalid version Forward Open Response Errors Error Int Error Hex Description 55 0xFFC9 Message length received not valid 56 0xFFC8 Status error reported PCCC Response Errors Error Int Error...

Page 77: ...read and write commands A discussion of each operation is provided in the following topics SLC5 05 Write Commands Write commands transfer data from the SLC processor to the gateway An example rung us...

Page 78: ...st be set to YES The MULTIHOP tab portion of the dialog box must be completed as displayed in the following window Set the IP address value to the gateway s Ethernet IP address The Insert key must be...

Page 79: ...ct theSETUP SCREEN area of the MSG object This displays the following dialog box The TARGET DEVICE DATA TABLE ADDRESS must be set to a valid file element such as N11 0 for SLC and PLC5 messages The MU...

Page 80: ...ionship of the file types accepted by the Gateway and the SLC file types File Type Description S Status B Bit T Timer C Counter R Control N Integer F Floating point Z String A ASCII The File Type Comm...

Page 81: ...to the gateway An example rung used to execute a write command is shown in the following diagram In order to complete the configuration of the MSG instruction select the SETUP SCREEN area of the MSG...

Page 82: ...s value to the gateway s Ethernet IP address The Insert key must be pressed to add the second line for ControlLogix Backplane and set the slot number to zero PLC5 Read Commands Read commands transfer...

Page 83: ...A TABLE ADDRESS must be set to a valid file element such as N11 0 for SLC and PLC5 messages For the PLC2 Unprotected Read message set the address to the database index such as 1000 to consider with th...

Page 84: ...ex data table For example to obtain the current accumulated value for a counter or timer the sub element field should be set to 2 The tables below show the sub element codes for PLC 5 complex data tab...

Page 85: ...nctions that can directly interface with the Controller Tag Database In order to interface with this database the table mapping feature provided by RSLogix 5000 must be used The software permits the a...

Page 86: ...transferred For PLC5 and SLC messages theDESTINATION ELEMENT should be an element in a data file such as N10 0 For the PLC2 Unprotected Write message the DESTINATION ELEMENT is the address in the gat...

Page 87: ...teway and the last element of the path 192 168 0 75 is the IP address of the gateway the target for the message More complex paths are possible if routing to other networks using multiple 1756 ENET ga...

Page 88: ...follows Verify that the CIP radio button is selected as the COMMUNICATION METHOD The PATH specifies the message route from the processor to the EIP gateway Path elements are separated by commas In th...

Page 89: ...g used to execute a write command is shown in the following diagram The MESSAGE CONFIGURATION dialog box must be completed to define the data set to be transferred from the processor to the gateway An...

Page 90: ...e example path shown the first element is Enet which is the user defined name given to the 1756 ENET gateway in the chassis the slot number of the ENET gateway can be substituted for the name the seco...

Page 91: ...nt for both the source and destination The DESTINATION TAG is a tag defined in the Controller Tag database The SOURCE ELEMENT is the tag element in the EIP gateway The gateway simulates a tag database...

Page 92: ...the 1756 ENET gateway and the last element of the path 192 168 0 75 is the IP address of the gateway the target for the message More complex paths are possible if routing to other networks using mult...

Page 93: ...nc Page 93 of 200 September 19 2012 6 MBTCP Protocol In This Chapter 6 1 MBTCP Functional Overview 94 6 2 MBTCP Configuration 98 6 3 MBTCP Diagnostics 106 6 4 MBTCP Reference 109 This chapter contains...

Page 94: ...their Quantum processor This open protocol is a modified version of the Modbus serial protocol The MBTCP protocol is an embedded Modbus protocol message in a TCP IP packet The gateway supports up to...

Page 95: ...to 160 Modbus commands one tag per command Status Data Error codes reported individually for each command High level status data available from Modbus TCP IP Client for example PLC Command List Polli...

Page 96: ...hing to the gateway using Client applications The server driver is able to support multiple concurrent connections from several Clients Up to five 5 Clients can simultaneously connect on Service Port...

Page 97: ...5000 45001 6000 46001 7000 47001 8000 48001 9000 49001 9999 50000 The MBTCP gateway must be correctly configured and connected to the network before any attempt is made to use it Use a network verific...

Page 98: ...s value will be considered floating point data requests This parameter is only used if the Float Flag is enabled For example if a value of 7000 is entered all requests for registers 7000 and above wil...

Page 99: ...r 150 in the database Holding Register Offset 0 to 3999 This parameter specifies the offset address in the internal Modbus database to with network requests for Modbus functions 3 6 or 16 commands For...

Page 100: ...ed from the addressed server The value to use depends on the type of communication network used and the expected response time of the slowest device on the network Retry Count 0 to 10 This parameter s...

Page 101: ...y registers 3000 and 3001 If the requested address was 47002 407002 the data will be returned from internal registers 3002 and 3003 If the requested address was 47101 407101 the data will be returned...

Page 102: ...s on the TCP IP network In order to interface the PLX30gateway with Modbus TCP IP server devices a command list must be constructed The commands in the list specify the server device to be addressed t...

Page 103: ...as a register level address Poll Interval 0 to 65535 Specifies the minimum interval between executions of continuous commands The value is in tenths of a second Therefore if a value of 100 is entered...

Page 104: ...bus Function 1 2 3 4 5 6 15 or 16 Specifies the Modbus Function Code to be executed by the command These function codes are defined in the Modbus protocol More information on the protocol is available...

Page 105: ...or 01101 11101 31101 or 41101 specify a value of 1100 o 01101 00001 1100 o 11101 10001 1100 o 31101 30001 1100 o 41101 40001 1100 Note If the documentation for a particular Modbus server device lists...

Page 106: ...a into the normal user data range of the gateway s database See Using the CommonNet Data Map page 27 Note that all the status values are initialized to zero 0 at power up cold boot and during warm boo...

Page 107: ...3 Number of Request Packets 4 Number of Response Packets 5 Errors Sent 6 Errors Received 7 Reserved 8 Current Error 9 Last Error Offsets 8 and 9 contain information about the most recent communication...

Page 108: ...r data area contains the status error code for the first command in the Client s Command List Each successive word in the Command Error List is associated with the next command in the Client Command L...

Page 109: ...35 Wrong message length in the response 36 MBTCP command response timeout same as 11 37 TCP IP connection ended before session finished Command List Entry Errors Code Description 40 Too few parameter...

Page 110: ...aximum quantity The coils are numbered from zero coil number 1 zero coil number 2 one coil number 3 two and so on The following table is a sample read output status request to read coils 0020 to 0056...

Page 111: ...supported with this function code In addition to the server address and function fields the message requires that the information field contain the initial input address to be read Starting Address an...

Page 112: ...gisters 4xxxx in the addressed server The registers can store the numerical values of associated timers and counters which can be driven to external devices The addressing allows up to 125 registers t...

Page 113: ...elow requests the contents of register 3009 in server number 11 Adr Func Data Start Reg Hi Data Start Reg Lo Data of Regs Hi Data of Regs Lo Error Check Field 11 04 00 08 00 01 CRC Response The addres...

Page 114: ...nd 16 are the only messages that will be recognized as valid for broadcast The example below is a request to server number 11 to turn ON coil 0173 Adr Func Data Coil Hi Data Coil Lo Data On off Ind Da...

Page 115: ...be recognized as valid for broadcast Adr Func Data Start Reg Hi Data Start Reg Lo Data of Regs Hi Data of Regs Lo Error Check Field 11 06 00 01 00 03 CRC Response The response to a preset single regis...

Page 116: ...ted Only Sub function 00 is supported by the gateway 00 Return Query Data The data passed in the request data field is to be returned looped back in the response The entire response message should be...

Page 117: ...Ethernet and Serial Gateways User Manual ProSoft Technology Inc Page 117 of 200 September 19 2012 The data fields in responses to other kinds of queries could contain error counts or other data reques...

Page 118: ...echoes the function code of the original request in the function code field of the response All function codes have a most significant bit MSB of 0 their values are all below 80 hexadecimal In an exce...

Page 119: ...ion program because the Modbus protocol is unaware of the significance of any particular value of any particular register 04 Slave Device Failure An unrecoverable error occurred while the server was a...

Page 120: ...the only messages other than Loopback Diagnostic Test that will be recognized as valid for broadcast The following example forces 10 coils starting at address 20 13 HEX The two data fields CD 1100 and...

Page 121: ...ny time The values are provided in binary up to the maximum capacity of the controller 16 bit for the 184 384 and 584 unused high order bits must be set to zero Note Function codes 5 6 15 and 16 are t...

Page 122: ...MBTCP Protocol PLX30 Series User Manual Ethernet and Serial Gateways Page 122 of 200 ProSoft Technology Inc September 19 2012...

Page 123: ...y Inc Page 123 of 200 September 19 2012 7 MBS Protocol In This Chapter 7 1 MBS Functional Overview 124 7 2 MBS Configuration 127 7 3 MBS Diagnostics 134 7 4 MBS Reference 141 This chapter contains inf...

Page 124: ...dress register to from addressing and word bit count Supported Modbus Function Codes 1 Read Coil Status 2 Read Input Status 3 Read Holding Registers 4 Read Input Registers 5 Force Write Single Coil 6...

Page 125: ...ating Point Data Floating point data movement supported including configurable support for Enron implementation Modbus Function Codes 1 Read Coil Status 2 Read Input Status 3 Read Holding Registers 4...

Page 126: ...ote Master applications HMI software Quantum processors etc to read from and write to the gateway s database When configured as a slave the internal database of the gateway is used as the source for r...

Page 127: ...sts with register values greater than or equal to this value will be considered floating point data requests This parameter is only used if the Float Flag is enabled For example if a value of 7000 is...

Page 128: ...time delay in milliseconds to be added to the 3 5 character time delay used by the module to recognize the end of a message Certain applications may require validation of Modbus messages with more th...

Page 129: ...or conditional writing which will cause the command to be executed whenever the values in the database registers associated with the command change Use the value of three 3 only for bit level write co...

Page 130: ...ed requesting Input Register address 0 virtual Modbus address 30001 or 300001 the data returned in the response will be the value at register 500 in the gateway s database Output Offset 0 TO 3998 Spec...

Page 131: ...ation for data brought in by a read command or as the source for data to be sent out by a write command The database address is interpreted as a bit address or a 16 bit register word address depending...

Page 132: ...uted by the command These function codes are defined in the Modbus protocol More information on the protocol is available from www modbus org The following function codes are supported by the gateway...

Page 133: ...11101 31101 or 41101 specify a value of 1100 o 01101 00001 1100 o 11101 10001 1100 o 31101 30001 1100 o 41101 40001 1100 Note If the documentation for a particular Modbus server device lists data add...

Page 134: ...data range of the gateway s database See Using the CommonNet Data Map page 27 General Modbus Error and Status Data The following table lists the starting addresses in upper memory where general error...

Page 135: ...Number of Command Responses 4402 2 Number of Command Errors 4403 3 Number of Requests 4404 4 Number of Responses 4405 5 Number of Errors Sent 4406 6 Number of Errors Received 4407 7 Configuration Erro...

Page 136: ...M STATE you must repeatedly call the screen by pressing the appropriate menu key to have the screen refreshed Depending on the refresh timing you may or may not see a change in the displayed values ev...

Page 137: ...he same for each port The start address for each port is given in the previous section Internal Database Address Example Offset Description 4410 0 Command 1 Error Code 4411 1 Command 2 Error Code 4412...

Page 138: ...contains the current poll status of each slave device on a Master port Slaves attached to a Master port can have one of three states 0 The slave has not defined in the command list for the Master por...

Page 139: ...a command in the list is scanned that has the address of a suspended slave the delay counter value for that slave will be decremented When the value reaches zero the slave state will be set to 1 This...

Page 140: ...specific error codes are also returned from the command polling process and stored in the Command Error List memory area Code Description 1 CTS modem control line not set before transmit 2 Timeout wh...

Page 141: ...imum quantity The coils are numbered from zero coil number 1 zero coil number 2 one coil number 3 two and so on The following table is a sample read output status request to read coils 0020 to 0056 fr...

Page 142: ...s shown 1B HEX 0001 1011 Binary contains the status of only 5 coils 52 to 56 instead of 8 coils The 3 left most bits are provided as zeros to fill the 8 bit format Read Input Status Function Code 02 Q...

Page 143: ...te Input 10197 to 10204 Data Discrete Input 10205 to 10212 Data Discrete Input 10213 to 10218 Error Check Field 11 02 03 AC DB 35 CRC The status of inputs 10197 to 10204 is shown as AC HEX 10101 1100...

Page 144: ...smissions will be made using register content from sequential scans In the example below the registers 40108 to 40110 have the decimal contents 555 0 and 100 respectively Adr Func ByteCnt Hi Data Lo D...

Page 145: ...sequential scans In the example below the register 3009 contains the decimal value 0 Adr Func Byte Count Data Input Reg Hi Data Input Reg Lo Error Check Field 11 04 02 00 00 E9 Force Single Coil Funct...

Page 146: ...mming Coils that are reprogrammed in the controller logic program are not automatically cleared upon power up Thus if such a coil is set ON by function Code 5 and even months later an output is connec...

Page 147: ...ce in the data field of a normal response In general issuing a diagnostic function to a remote device does not affect the running of the user program in the remote device Device memory bit and registe...

Page 148: ...tion code of zero 00 00 hex in the two byte field The data to be returned is sent in the two byte data field A5 37 hex Request Response Field Name Hex Field Name Hex Function 08 Function 08 Sub functi...

Page 149: ...choes the function code of the original request in the function code field of the response All function codes have a most significant bit MSB of 0 their values are all below 80 hexadecimal In an excep...

Page 150: ...on program because the Modbus protocol is unaware of the significance of any particular value of any particular register 04 Slave Device Failure An unrecoverable error occurred while the server was at...

Page 151: ...he only messages other than Loopback Diagnostic Test that will be recognized as valid for broadcast The following example forces 10 coils starting at address 20 13 HEX The two data fields CD 1100 and...

Page 152: ...y time The values are provided in binary up to the maximum capacity of the controller 16 bit for the 184 384 and 584 unused high order bits must be set to zero Note Function codes 5 6 15 and 16 are th...

Page 153: ...Soft Technology Inc Page 153 of 200 September 19 2012 8 ASCII Protocol In This Chapter 8 1 ASCII Functional Overview 154 8 2 ASCII Configuration 163 8 3 ASCII Diagnostics 165 This chapter contains inf...

Page 154: ...rts One to four serial communication ports to receive and or transmit data Receive buffer size 255 bytes Receive termination Stream mode termination character s message timeout inter character delay o...

Page 155: ...this signals the end of the message When the receive driver observes this character in the input stream it takes all received characters and places them in the internal database In both receive and tr...

Page 156: ...age count 6 Transmit State 0 Waiting for data to send 1 RTS on 2 RTS timeout 3 Sending data 4 Waiting for RTS off 5 RTS turned off 30 Intercharacter delay 31 Intercharacter delay 32 Intercharacter del...

Page 157: ...l when new transmit data is available Word 1 of the block may optionally contain the number of characters processed in the last receive message Word 2 of the message is used to pace the characters dur...

Page 158: ...ive mode Receive Only Mode A port on the gateway configured to function in receive only mode is set up to only receive data from some sort of ASCII device In this mode the PLX30gateway will never tran...

Page 159: ...the gateway s internal database it transmits this data out to the port The sequence number used in the block will be different that that of the previous block and therefore signals that the packet is...

Page 160: ...m the ASCII device is stored in the gateway s internal database until ready to be sent to an external device Data received by an external device is also stored in the gateway s internal database until...

Page 161: ...apped type field of the gateway object The following illustration shows the bit map used for this parameter Termination Type Field Bit s 4 to 7 3 2 1 0 Bit Value 8 4 2 1 Definition Reserved Packet siz...

Page 162: ...G Comment After the A character is received on the port the message timeout is started The characters ABCDE will be sent to the controller in one block The characters FG will follow in the second bloc...

Page 163: ...ion on Rx data structure Tx DB Start 1 OR 0 TO 3896 This parameter specifies the starting location in the internal database where the transmit data will be stored The buffer holds 130 words however th...

Page 164: ...rmination characters is set in the Rx Term Count parameter Rx Packet Length 0 TO 200 Used when the Rx Termination Type is PACKET SIZE This parameter sets the length of data required to be received on...

Page 165: ...ta into the normal user data range of the gateway s database See Using the CommonNet Data Map page 27 The following table lists the starting addresses in upper memory where the status data for each AS...

Page 166: ...PLX30 Series User Manual Ethernet and Serial Gateways Page 166 of 200 ProSoft Technology Inc September 19 2012...

Page 167: ...age 167 of 200 September 19 2012 9 SIE Protocol In This Chapter 9 1 SIE Functional Overview 168 9 2 SIE Configuration 169 9 3 SIE Diagnostics 183 9 4 SIE Reference 187 This chapter contains informatio...

Page 168: ...Ethernet Communication port Actively reads data from and writes data to Siemens Industrial Ethernet devices using Siemens Industrial Ethernet protocol Siemens Industrial Ethernet data types overlap i...

Page 169: ...st polls Siemens Industrial Ethernet server devices attached to the Siemens Industrial Ethernet Client port The gateway supports numerous commands This permits the module to interface with a wide vari...

Page 170: ...that will be supported will also depend on the server device and what it can support Below are examples of S7 200 S7 300 and S7 1200 functions that are supported by the gateway S7 300 Data Block Addr...

Page 171: ...ta Type Flag READ BOOL Write BOOL READ BYTE Write BYTE READ DINT Write DINT READ REAL Write REAL READ INT Write INT READ TIME Write TIME READ Count Write Count Output Address Type Function Data Type O...

Page 172: ...Gateways Page 172 of 200 ProSoft Technology Inc September 19 2012 Input Address Type Function Data Type Input READ BOOL Write BOOL READ BYTE Write BYTE READ DINT Write DINT READ REAL Write REAL READ...

Page 173: ...Write BOOL READ BYTE Write BYTE READ DINT Write DINT READ REAL Write REAL READ INT Write INT Flag Address Type Function Data Type Flag READ BOOL Write BOOL READ BYTE Write BYTE READ DINT Write DINT RE...

Page 174: ...al Ethernet and Serial Gateways Page 174 of 200 ProSoft Technology Inc September 19 2012 Input Address Type Function Data Type Input READ BOOL Write BOOL READ BYTE Write BYTE READ DINT Write DINT READ...

Page 175: ...unction Data Type DB READ BOOL Write BOOL READ BYTE Write BYTE READ DINT Write DINT READ REAL Write REAL READ INT Write INT READ TIME Write TIME READ COUNT Write COUNT Flag Address Type Function Data...

Page 176: ...ata Type Output READ BOOL Write BOOL READ BYTE Write BYTE READ DINT Write DINT READ REAL Write REAL READ INT Write INT READ TIME Write TIME READ Count Write Count Input Address Type Function Data Type...

Page 177: ...f continuous commands The value is in tenths of a second Therefore if a value of 100 is entered the command will execute no more frequently than once every 10 seconds Reg Count Command dependent Speci...

Page 178: ...S7 1200 Func Type Read Write This parameter can either be Read or Write Data Type BOOL BYTE DINT REAL INT TIME COUNT This parameter can be BOOL BYTE DINT REAL INT TIME or COUNT Address Type INPUT OUT...

Page 179: ...0011_0110 2 1100_0110 DB1 DBW0 DB1 DBW2 The gray area above represents the byte memory locations being overlapped when word address is used consecutively DB1 DBW0 DB1 DBW1 DB1 DBW2 etc If DB1 DBW0 is...

Page 180: ...locations in the processor Note Incorrect memory location addressing can cause the data to be overwritten Below is a graphical representation of the addressing of the processor s memory locations DB1...

Page 181: ...m the gateway If the data is broken up and displayed in binary format it can be seen that the binary data stored in the first byte of DB1 DBW 0 is identical to that stored in byte address DB1 DBB 0 Th...

Page 182: ...1 2 0101_0111 DB1 DBB0 DB1 DBB1 DB1 DBB2 Note To access the first address of Data Block Flag Input Output Timer and Counter memory locations in the S7 300 and S7 1200 processors use the following addr...

Page 183: ...range of the gateway s database See Using the CommonNet Data Map page 27 The following table lists the starting addresses in upper memory where the status data for each Client can be found Client Gate...

Page 184: ...vailable in the PLC 200 family 5 0x0005 The desired address is beyond limit for this PLC 6 0x0006 The CPU does not support reading a bit block of length 1 7 0x0007 Write data size error 10 0x000a The...

Page 185: ...1 Block name syntax error 11774 0xd202 Syntax error function parameter 11773 0xd203 Syntax error block type 11772 0xd204 No linked block in storage medium 11771 0xd205 Object already exists 11770 0xd2...

Page 186: ...command 34 0xffde Failed to create a socket 36 0xffdc SIE command response timeout same as 11 37 0xffdb TCP IP connection ended before session finished Command List Entry Error Codes Decimal Hex Descr...

Page 187: ...k Address Type Function Data Type Max Reg Cnt Max Reg Cnt DB READ BOOL 1 Write BOOL 1 READ BYTE 164 Write BYTE 164 READ DINT 41 Write DINT 41 READ REAL 41 Write REAL 41 READ INT 82 Write INT 82 READ T...

Page 188: ...YTE 222 Write BYTE 212 READ DINT 55 Write DINT 53 READ REAL 55 Write REAL 53 READ INT 111 Write INT 106 READ TIME 111 Write TIME 53 READ Count 111 Write Count 106 Output Address Type Function Data Typ...

Page 189: ...Page 189 of 200 September 19 2012 Input Address Type Function Data Type Max Reg Cnt Max Reg Cnt Input READ BOOL 1 Write BOOL 1 READ BYTE 128 Write BYTE 128 READ DINT 32 Write DINT 32 READ REAL 32 Writ...

Page 190: ...1 READ BYTE 30 Write BYTE 30 READ DINT 7 Write DINT 7 READ REAL 7 Write REAL 7 READ INT 15 Write INT 15 READ TIME 15 Write TIME 15 READ COUNT 15 Write COUNT 15 Flag Address Type Function Data Type Max...

Page 191: ...TE 212 Write BYTE 212 READ DINT 53 Write DINT 53 READ REAL 53 Write REAL 53 READ INT 106 Write INT 106 READ TIME 105 Write TIME 105 READ Count 111 Write Count 106 Input Address Type Function Data Type...

Page 192: ...on Data Type Max Read Max Write DB READ BOOL 1 Write BOOL 1 READ BYTE 222 Write BYTE 212 READ DINT 55 Write DINT 53 READ REAL 55 Write REAL 53 READ INT 111 Write INT 106 Flag Address Type Function Dat...

Page 193: ...a Type Max Reg Cnt Max Reg Cnt Output READ BOOL 1 Write BOOL 1 READ BYTE 16 Write BYTE 16 READ DINT 4 Write DINT 4 READ REAL 4 Write REAL 4 READ INT 8 Write INT 8 Input Address Type Function Data Type...

Page 194: ...SIE Protocol PLX30 Series User Manual Ethernet and Serial Gateways Page 194 of 200 ProSoft Technology Inc September 19 2012...

Page 195: ...and Warranty Ethernet and Serial Gateways User Manual ProSoft Technology Inc Page 195 of 200 September 19 2012 10 Support Service and Warranty In This Chapter 10 1 Contacting Technical Support 196 10...

Page 196: ...details If the issue is hardware related we will also need information regarding 1 Gateway configuration and associated ladder files if any 2 Gateway operation and any unusual behavior 3 Configuratio...

Page 197: ...0 5 34 36 87 20 E mail support EMEA prosoft technology com Languages spoken include French English Europe location in Dubai UAE Tel 971 4 214 6911 E mail mea prosoft technology com Languages spoken in...

Page 198: ...tember 19 2012 10 2 Warranty Information For complete details regarding ProSoft Technology s TERMS CONDITIONS OF SALE WARRANTY SUPPORT SERVICE AND RETURN MATERIAL AUTHORIZATION INSTRUCTIONS please see...

Page 199: ...h 4 72 Diagnostics Function Code 08 115 147 Diagnostics Menu 39 Downloading the Project to the Gateway 30 E EIP Client Command List Error Data 71 EIP Command Entry Form 92 EIP Functional Overview 52 E...

Page 200: ...Error List Layout 137 Port 1 Slave List Status Layout 138 Preset Multiple Registers Function Code 16 121 152 Preset Single Register Function Code 06 115 146 Printing a Configuration File 32 ProLinx Pr...

Search results

Summary of Contents for PLX30 Series

Reviews:

Related manuals for PLX30 Series

Brands by name

Popular brands

ProSoft Technology PLX30 Series, User Manual

Search results

Summary of Contents for PLX30 Series

Reviews:

Related manuals for PLX30 Series

Brands by name

Popular brands