Modbus and Modbus TCP Client/Server communications protocol designed by Modicon in 1979 for use with...

Modbus and Modbus Modbus and Modbus TCPTCP Client/Server communications protocol designed Client/Server communications protocol designed

by Modicon in 1979 for use with its’ PLCsby Modicon in 1979 for use with its’ PLCs Openly published and free of royalties or licensing Openly published and free of royalties or licensing

feesfees The most common industrial communications The most common industrial communications

protocol in the US protocol in the US Used widely for Building Management Systems Used widely for Building Management Systems Passes raw words of bits without processing themPasses raw words of bits without processing them Originally a serial protocol very similar to RS-485, Originally a serial protocol very similar to RS-485,

it now has a TCP variantit now has a TCP variant Also available as Modbus Plus, which is proprietary Also available as Modbus Plus, which is proprietary

to Modicon and requires specialized hardwareto Modicon and requires specialized hardware

Modbus and Modbus Modbus and Modbus TCPTCP Basic Modbus protocol does not support floating Basic Modbus protocol does not support floating

point or ASCIIpoint or ASCII A MODBUS Request is the message sent on

the network by the Client to initiate a transaction A MODBUS Indication is the Request message

received on the Server side A MODBUS Response is the Response

message sent by the Server A MODBUS Confirmation is the Response

Message received on the Client side

Modbus TCPModbus TCP

Basic RequirementsBasic Requirements

The Ethernet physical interface must be present

The Modbus TCP firmware for the Ethernet processor must be installed

V 1.117 or newer PMAC or V1.941 or newer Turbo PMAC firmware must be installed

A user buffer of 256 or more words must have been defined with the DEFINE UBUFFER command

I67 must be set to a value greater than 0.

Modbus TCPModbus TCP

Basic Setup with PEWIN32 Basic Setup with PEWIN32 Pro2Pro2-Configure->Modbus Setup

-Set the start address - In the standard Turbo PMAC CPU/memory configuration (Option 5C0), this address will be $010700

-The software will automatically set I67 to the correct value The book says it will do so after setting it equal to any number > 0, then SAVE and $$$, but this does not always work

-You must choose the size of the buffer – default is 256 words

-Press Setup Modbus Buffer button

Modbus TCP SetupModbus TCP Setup

-Press Update PMAC button – this will SAVE and $$$

ACC-65ETHACC-65ETH

Set up the IP address of the ACC-65ETH as per the hardware Set up the IP address of the ACC-65ETH as per the hardware reference manual using the web browser and the default reference manual using the web browser and the default address of address of http://192.6.94.50

Go to the Modbus TCP configuration utility in PEWIN32 Pro2

Choose the next unused Active Socket. If you are not using a socket for PMAC interrupts, you may use Socket 1

Choose Modbus Client as the Active Mode Set Timer 1 to 50 (250 ms) Set the Server Address as per that set in the ACC-65ETH Set the Timer to 1 Set the FC Command Description to 23 (read/write

multiple words)

ACC-65ETHACC-65ETH

Set the Modbus Reference Number for the Write to 4Set the Modbus Reference Number for the Write to 4 Set the Modbus Reference Number for the Read to 0Set the Modbus Reference Number for the Read to 0 Set the PMAC Reference Number for the Write to 36Set the PMAC Reference Number for the Write to 36 Set the PMAC Reference Number for the Read to 32Set the PMAC Reference Number for the Read to 32 Set both Lengths to 4Set both Lengths to 4 Press the Update Command button, then the Update PMAC Press the Update Command button, then the Update PMAC

buttonbutton

This writes the command shown in the Command text box to This writes the command shown in the Command text box to memory in the PMAC. You can check this by pointing memory in the PMAC. You can check this by pointing MVARs to the Modbus Command memory space at the start MVARs to the Modbus Command memory space at the start of the Modbus Buffer space. of the Modbus Buffer space.

ACC-65ETHACC-65ETH

Data begins at i67+$80+$10 (PMAC Reference 32=16 words =$10)

Assuming i67=$10700:

X:$10790,0,16 Digital inputs 0-15 32

Y:$10790,0,16 24Vok input and digital inputs 16-23 33

X:$10791,0,12 ADC Input1 34

Y:$10791,0,12 ADC Input2 35

X:$10792,0,16 Digital Outputs 0-15 36

Y:$10792,0,16 RLY1, RLY2, Digital outputs 16-2337

X:$10793,0,12 DAC 138

Y:$10793,0,12 DAC 2 39

The PMAC Modbus/TCP-IP configuration & buffer memory format

Offset from I67

23 X Memory 0 23 Y Memory 0

0 Sock #0Mode(upper4 of 8 bits)

TBD (16 bits) TBD (8 bits) Client CmdListStrt(8bits)

Client CmdListEnd(8bits)

1 IP future IP future Server IP0 Server IP1 Server IP2 Server IP3

2 Future Spare Future Spare

4-0xB

Repeat above for Sockets 1-3 Repeat above for Sockets 1-3

0xC TBD(8 bits)

TBD (8 bits)

Period Timer 4(8 bits)




0xD TBD TBD

0xE TBD TBD

0xF TBD TBD

0x100x69

Start of 1st Client Modbus Cmd List Start of 1st Client Modbus Cmd List

0x80

Start of 16 bit Client/Server Modbus Buffer Start of 16 bit Client/Server Modbus Buffer

The PMAC Modbus/TCP-IP configuration & buffer memory format

The The Socket ModeSocket Modes ( upper 4 of 8 bits):s ( upper 4 of 8 bits): 0 - Socket NOT ACTIVE0 - Socket NOT ACTIVE 1 - Server TCP, PMAC ASCII protocol.1 - Server TCP, PMAC ASCII protocol.

– IP Address = 0.0.0.0IP Address = 0.0.0.0 2 - Server TCP, PMACtoClient Interrupt ASCII string. 2 - Server TCP, PMACtoClient Interrupt ASCII string.

IP Address = 0.0.0.0 Only available on IP Address = 0.0.0.0 Only available on Turbo UMACs.Turbo UMACs.

3 - Server Modbus/TCP-IP. IP Address not used.3 - Server Modbus/TCP-IP. IP Address not used. 4 - Client Modbus/TCP-IP. IP Address of Server.4 - Client Modbus/TCP-IP. IP Address of Server.

The The IP Address 192.6.94.5IP Address 192.6.94.5 is stored as: is stored as:

– IP0=192, IP1=6, IP2=94, IP3=5IP0=192, IP1=6, IP2=94, IP3=5

M6704=IP address 192.168.0.50

M6703=first digit=4 for Client

M6716=start of FC23 for Socket 1

M6717=end of FC23 for Socket 1

M6710 – M6715 are commands for PMAC ASCII on Socket 0

Modbus Client Command List Memory Format

X:23 - 16 X:15 - 0 Y:23 - 16 Y:15 - 0

Timer (3 bits)/Function Code (5 bits)

Modbus Reference # (16 bits)

Count (length) (8 bits)

PMAC Reference # (16 bits)

$370000040020,$000004040024

$37 = Timer 1, FC 23$0000 = Modbus Reference Number = 0

$04 = Length = 4$0020 = PMAC Reference Number = $20

$0004 = Modbus Reference Number = 0$04 = Length = 4

$0024 = PMAC Reference Number = $20

$00 = no function for FC 23

First Word = Read Data

Second Word = Write Data

Reference NumbersReference Numbers

The PMAC one is the offset into the PMAC The PMAC one is the offset into the PMAC Modbus Server/Client buffer where the Modbus Server/Client buffer where the Modbus data is read from or written to. Modbus data is read from or written to.

The Modbus one is sent over The Modbus one is sent over Modbus/TCP-IP with the data. Modbus/TCP-IP with the data. Note the Note the PMAC & Modbus reference numbers PMAC & Modbus reference numbers are actual offsets and do not abide are actual offsets and do not abide by the standard Modbus reference by the standard Modbus reference number where you subtract one from number where you subtract one from it to get the offset into memory. We it to get the offset into memory. We start at zero and not one.start at zero and not one.

Memory AllocationMemory Allocation

PMAC Modbus/TCP Client/Server Buffer SizePMAC Modbus/TCP Client/Server Buffer Size is fixed is fixed at 128 x 32 bits.at 128 x 32 bits.

Length for FC23 is fixed in 2 x Modbus Bytes = 16 bitsLength for FC23 is fixed in 2 x Modbus Bytes = 16 bits Length for FC2 and FC15 is in bitsLength for FC2 and FC15 is in bits Always use all 32 bits of one Modbus memory location Always use all 32 bits of one Modbus memory location

for one type – do not use 16 bits for inputs and 16 for for one type – do not use 16 bits for inputs and 16 for outputs outputs

Wago Modular I/OWago Modular I/O

Setting up a Wago 750-342 Modbus Setting up a Wago 750-342 Modbus TCP module and rack with a 753-512 TCP module and rack with a 753-512 (2 DO), a 753-502 ( 4 DI), 753-4011 (2 DO), a 753-502 ( 4 DI), 753-4011 (2 AO), and a 753-403 (2 AI)(2 AO), and a 753-403 (2 AI)

Run BootPServer, and Edit BootPTabRun BootPServer, and Edit BootPTab If using no Proxy server then edit the line that starts with KeinProxy:

Wago1NoProxy:ht=1:ha=0030DE00B6DF:ip=192.168.0.52: If using proxy then edit the line that starts with Hamburg:

Wago1Proxy:ht=1:ha=0030DE00B6DF:ip=192.168.0.52:T3=0A.01.FE.01:

NOTE: IP address of the proxy server is in Hex NOTE: ha parameter must match the MAC address of your 750-342


When addressing, first of all the more complex modules (modules occupying 1 or more bytes) are taken into account in accordance with their physical order behind the field bus coupler. As such, they occupy the addresses starting with word 0.

Following this, the data of the other modules (modules occupying less than 1 byte) follow, grouped into bytes. In accordance with the physical byte-wise order this data is used to fill up the bytes. As soon as a full byte is occupied by the bit-oriented modules, the next byte is automatically started.


FC23, PMAC refs 40, 44, Modbus FC23, PMAC refs 40, 44, Modbus ref 0,4ref 0,4

Note that Wago documentation Note that Wago documentation starts with 0, not 1starts with 0, not 1

DO found at i67+$95DO found at i67+$95 AO found at i67+$94AO found at i67+$94 DI found at i67+$97DI found at i67+$97 AI found at i67+$96AI found at i67+$96


Data width >= 1 word/channelAnalog input modulesAnalog output modulesInput modules for thermal elementsInput modules for resistance sensorsPulse width output modulesInterface moduleUp/down counterI/O modules for angle and path measurement


Data width = 1 Bit / channel Digital input modules Digital output modules Digital output modules with diagnosis

(2 Bit / channel) Power supply modules with fuse holder

/ diagnosis Solid State power relay Relay output modules

Automation Direct GS Automation Direct GS Series VFDSeries VFD

Set IP Address using DIP switchSet IP Address using DIP switch Set SW2 and SW3 to RS-485Set SW2 and SW3 to RS-485 Parameters to set using IE or keypad:Parameters to set using IE or keypad:

– P 3.00: 03 (keypad stop ena) 04 P 3.00: 03 (keypad stop ena) 04 (keypad stop disabled)(keypad stop disabled)

– P 4.00: 05 (frequency determined by P 4.00: 05 (frequency determined by RS485 interface)RS485 interface)

– P 4.04: 01 (states is to enable reverse command from P 4.04: 01 (states is to enable reverse command from analog but when = 0 the remote RUN command dead)analog but when = 0 the remote RUN command dead)

– P 9.00: xx (unique communication address 1-254)P 9.00: xx (unique communication address 1-254)– P 9.01: 01 (9600 baud data transmission rate)P 9.01: 01 (9600 baud data transmission rate)– P 9.02: 05 (MODBUS RTU mode - 8 data bits, odd parity, 1 P 9.02: 05 (MODBUS RTU mode - 8 data bits, odd parity, 1

stop bit)stop bit)

Automation Direct GS Automation Direct GS Series VFDSeries VFD download NetEdit3 from Automation Direct at: download NetEdit3 from Automation Direct at:

http://www.hosteng.com/SW-Products/NetEdit3http://www.hosteng.com/SW-Products/NetEdit3.zip.zip

Insure that NWLink IPX/SPX/NetBios compatible Insure that NWLink IPX/SPX/NetBios compatible protocol is loaded on your PC by going to the protocol is loaded on your PC by going to the properties of your Ethernet connectionproperties of your Ethernet connection

Run NetEdit 3 and select TC/PIP as typeRun NetEdit 3 and select TC/PIP as type Press the Scan Network Button. If this is the Press the Scan Network Button. If this is the

first time you have talked to this device you first time you have talked to this device you will see the address 255.255.255.0. Click on will see the address 255.255.255.0. Click on this address and set to the desired network this address and set to the desired network address. This address should be in the same address. This address should be in the same range as that of the PMAC.range as that of the PMAC.

Now you must power the drive down and back Now you must power the drive down and back up. If you open NetEdit again you should now up. If you open NetEdit again you should now see the drive type listed in the address.see the drive type listed in the address.

Automation Direct GS Automation Direct GS Series VFDSeries VFD Connect to the drive using IE to set Connect to the drive using IE to set

drive parametersdrive parameters Calculating Modbus Reference for the Calculating Modbus Reference for the

GS-EDRVGS-EDRV– Take the GS parameter number (for Take the GS parameter number (for

example, 6.31 is the current error code)example, 6.31 is the current error code)– Take the digits after the decimal place and Take the digits after the decimal place and

convert to hex (for 6.31 this will be $1F)convert to hex (for 6.31 this will be $1F)– Multiply the digit(s) before the decimal by Multiply the digit(s) before the decimal by

$100 and add to the results of the $100 and add to the results of the previous calculation (for 6.31 this will yield previous calculation (for 6.31 this will yield $61f$61f

– Convert this to decimal ($61f -> 1567) Convert this to decimal ($61f -> 1567) and this is your Modbus Referenceand this is your Modbus Reference


Command Data LocationCommand

Type Modbus ReferencePMAC Reference

Count (length)

read frequency command

M1660 (base+$80) FC3 2330 1 1

set frequency command - NOTE - divide by 10 to get freq - so 500 = 50.0 m1661 FC16 2330 2 1

read run command m1662 FC3 2331 3 1

set run command m1663 FC16 2331 4 1

read direction command m1664 FC3 2332 5 1

set direction command m1665 FC16 2332 6 1

read current error code m1666 FC3 1567 7 1

read last error code m1667 FC3 1568 8 1


Read/Write Hex Modbus Speed Reference 091AH 42331 Run Command 091BH 42332 Direction 091CH 42333 External Fault 091DH 42334 Fault reset 091EH 42335 Jog 091FH 42336 Status 2101H 48450 Frequency cmd 2102H 48451 Output frequency 2103H 48452 Output current 2104H 48453 DC-bus voltage 2105H 48454 Output voltage 2106H 48455 Motor RPM 2107H 48456 Scale freq (low) 2108H 48457 Scale freq (high) 2109H 48458 % Load 210BH 48460 Firmware Version 2110H 48465

$91a=2330

4 is used as a holder

Modbus Reference start with 1, not 0

The correct Modbus Reference for us is 2330, not 2331

Phoenix FL IL BK Phoenix FL IL BK Modbus I/OModbus I/O

In the demo this is a client In the demo this is a client at 192.168.2.80 on Socket at 192.168.2.80 on Socket 33

FC3 with Modbus Ref 0, FC3 with Modbus Ref 0, PMAC Ref 6, Count 1, and PMAC Ref 6, Count 1, and FC6 with Modbus Ref 384, FC6 with Modbus Ref 384, PMAC Ref 24, Count 1PMAC Ref 24, Count 1 Demo has 16 digital inputs mapped to M839 Demo has 16 digital inputs mapped to M839

and 16 and 16 digital outputs mapped to M1digital outputs mapped to M1

Demo is being set output values by the PMAC, Demo is being set output values by the PMAC, and and the QTERM is reading input the QTERM is reading input valuesvalues

Phoenix FL IL BK Phoenix FL IL BK Modbus I/OModbus I/O Base configuration at the module Base configuration at the module

can be done with IEcan be done with IE

QTermQTerm

Acting as a client in the demoActing as a client in the demo PLCs running on PMAC interpreting PLCs running on PMAC interpreting

command words from the clientcommand words from the client M844 – Feedrate overrideM844 – Feedrate override M841 – Command WordM841 – Command Word M846 – Rotary Position AM846 – Rotary Position A M847 – Rotary Position BM847 – Rotary Position B

QTermQTerm

M841M841 FunctionFunction

11 Axis SelectAxis Select

22 FeedholdFeedhold

44 Cycle StartCycle Start

88 HomeHome

1616 EstopEstop

3232 Program SetProgram Set

40964096 J+J+

81928192 J-J-

1638416384 J=J=

Exor Uniop TerminalExor Uniop Terminal

Client mode Client mode or Server or Server modemode

Basic HMI Basic HMI with with developmendevelopment packaget package

Exor Uniop TerminalExor Uniop Terminal

Modbus TCP Software Modbus TCP Software Control PanelControl Panel Allows command of the PMAC with no Allows command of the PMAC with no

code on the PMAC exactly as the DPR code on the PMAC exactly as the DPR Control Panel doesControl Panel does

I69 enables (firmware 1.942 and up)I69 enables (firmware 1.942 and up) Typically set to $80 to set the start of Typically set to $80 to set the start of

the panel memory space $80 long the panel memory space $80 long words after the start of Modbus words after the start of Modbus memorymemory

Reserves 26 long wordsReserves 26 long words

PMAC/TURBO Firmware Modbus (I69) Memory Map

PMAC Address (I69 +)

PMAC/Modbus Ref. #

X: Memory Parameter Y: Memory Parameter

$0 0/1 Coordinate System Feed Pot Override Enable

Motor/Coordinate System Enable

$1 2/3 Coordinate 1 System Feed Pot Override Motor/Coordinate System 1 Request








$9 18/19 Reserved Reserved

$A 20/21 Reserved Reserved

$B 22/23 Reserved Reserved

$C 24/25 Reserved Reserved

$D 26/27 Reserved Reserved

$E 28/29 Reserved Reserved

$F 30/31 Reserved Reserved

Bit Format of Control Panel Motor/Coordinate System Enable Word (Y:I69)

BIT Control Panel Motor/Coordinate System Enable Mask(Set bit to enable; PMAC clears on taking action)

0 Motor/Coordinate System # 1 + Mtr/CS offset




4 Motor/Coordinate System # 5 + Mtr/ CS offset




15 – 8 Turbo Mtr/CS offset is limited to 31 (PMAC not used)

Bit Format of Coordinate System (CS) Feed Pot Override Enable Word (X:I69)

BIT Set bit to enable Override, clear bit to disable

0 Coordinate System # 1 + CS offset








15 – 8 Turbo CS offset is limited to 8 (PMAC not used)

Bit Format of Motor/Coordinate System Words (Y:I69+1 to 8)

BIT REQUEST (1 = action requested; 0 = no action requested)

0-7 (Reserved for Delta Tau Future Use)

8 Jog-Minus (Motor Only) *

9 Jog-Plus (Motor Only) *

10 Pre-Jog - J= (Motor Only)

11 Start (RUN) (Coord. Sys. Only)

12 Step (STEP/QUIT) (Coord. Sys. Only)

13 Stop (ABORT) (Coord. Sys. Only)

14 Home (Motor Only)

15 Feed Hold (HOLD) (Coord. Sys. Only)

* When both Jog-Minus and Jog-Plus are set, motor will stop

New Features (1.943+, New Features (1.943+, 1.117+)1.117+) Add eight more direct control bits Add eight more direct control bits

commandscommands::BB,, K K,, J:* J:*,, J^* J^*,, J=* J=*,, > >,, < <, and , and ^K^K

Read/Write anRead/Write an ASCII (PMAC Modbus ASCII (PMAC Modbus Address 0xF000)Address 0xF000)

Read/Write PMAC In (PMAC Modbus Read/Write PMAC In (PMAC Modbus Address 0x1000-0x3FFF)Address 0x1000-0x3FFF), , Mn (PMAC Mn (PMAC Modbus Address 0x4000-0x7FFF)Modbus Address 0x4000-0x7FFF), , Pn Pn (PMAC Modbus Address 0x8000-(PMAC Modbus Address 0x8000-0xBFFF)0xBFFF) and and QnQn (PMAC Modbus (PMAC Modbus Address 0xC000-0xEFFF) Address 0xC000-0xEFFF) using a using a Modbus 32 bit float data type. Modbus 32 bit float data type.

New Features (1.943+, New Features (1.943+, 1.117+)1.117+) Read/Write PMAC Qn C.S. # Read/Write PMAC Qn C.S. #

(PMAC Modbus Address 0xF500)(PMAC Modbus Address 0xF500) Read & Clear PMAC Modbus Read & Clear PMAC Modbus

Command Error Status word Command Error Status word (PMAC Modbus Address 0xF100)(PMAC Modbus Address 0xF100)

Read/Write PMAC Modbus Read/Write PMAC Modbus Registers relative to I69 (PMAC Registers relative to I69 (PMAC Modbus Address 0xF200-0xF2FF)Modbus Address 0xF200-0xF2FF)

Read/Write PMAC Modbus Coils Read/Write PMAC Modbus Coils relative torelative to I69I69 (PMAC Modbus (PMAC Modbus Address 0xF300-0xF4FF)Address 0xF300-0xF4FF)

GotchasGotchas

With a non-Turbo PMAC do not do power on With a non-Turbo PMAC do not do power on phasing as it turns off background processing phasing as it turns off background processing long enough for the Ethernet processor to long enough for the Ethernet processor to initialize without the main processor initializing initialize without the main processor initializing the i67 socketsthe i67 sockets

Make sure that server Port 502 is not being Make sure that server Port 502 is not being blocked by firewall softwareblocked by firewall software

Make sure that firewall software is not blocking Make sure that firewall software is not blocking client ports (>1024, exact port dependent on client ports (>1024, exact port dependent on device, but different port for every open client device, but different port for every open client socketsocket

Server vs Client in 3d party documentationServer vs Client in 3d party documentation Addressing in 3d party documentationAddressing in 3d party documentation

Modbus and Modbus TCP Client/Server communications protocol designed by Modicon in 1979 for use with...

Documents

Transcript of Modbus and Modbus TCP Client/Server communications protocol designed by Modicon in 1979 for use with...