MODBUSr TCP for H0/H2/H4--ECOM100
Contents
1. 256 vo verr 40001 40256 Read ra Camex wine V Memory Data Words eae Refer to your PLC user manual for the correct memory mapping size of your PLC Some of the addresses shown above might not pertain to your particular CPU ou ip faa im H0 H2 ECOM100 Ethernet Communications Modules 3rd Edition Rev C 06 11 MODBUS TCP IP for H0 H2 H4 ECOM100 5 17 NOTE Your PC s Windows calculator can be used for number conversions i e decimal to octal The Windows calculator must be in Calculator gt View gt Scientific mode to enable number conversions capability Example 1 Calculating Word PLC Address Example 2 Calculating Discrete Input PLC Address Find the PLC address to use to target MODBUS address 41025 in a server device A Subtract the begining of the MODBUS word address range 40001 from the desired MODBUS address to target Convert decimal result into octal Add octal result to begining PLC range Input Output or Word Find the PLC address to use to target MODBUS address 12060 in a server device 1 Subtract the begining of the MODBUS Input address range 12049 from the desired MODBUS address to target Convert decimal result into octal Add octal result to begining PLC range Input Output or Word 1 41025 40001 1024 decimal 2 1024 decimal 2000 octal 3 VO octal 2000 octal V2000 octal 1 12060 12042. Dec Mode Address V2100 1088 decimal 1088 40001 41089 Appropriate hiode Address Timer Current Values V4 YO V7 0 127 3001 30007 Input Reg Counter Current Values V 128 1000 1177 512 639 3001 30001 Input Reg Y Memory user data 0 1024 v2000 3777 1024 2047 4001 40001 Hold Reg Example 2 Y20 Find the MODBUS address for output Y20 1 Find Y outputs in the table 2 Convert Y20 into decimal 16 3 Add the starting address for the range 2048 4 Add the MODBUS address for the mode 1 Outputs r Control Relays CR 256 CO C3 3072 imer Contacts Th Example 3 C54 C54 1 Find Control Relays in the table 2 Convert C54 into decimal 44 3 Add the starting address for the range 3072 4 Add the MODBUS address for the mode pays eer fT 1 ww PLC Addr Dec Start Address Mode Y20 16 decimal 16 2048 1 2065 CENA COE E TO T177 6144 6271 Find the MODBUS address for Control Relay PLC Addr Dec Start Address Mode C54 44 decimal 44 3072 1 3117 1 1 i control Rape C 268 co er or seat Cea To_ tir era ear ou op faa a H0 H2 ECOM100 Ethernet Communications Modules 3rd Edition Rev C 06 11 MODBUS TCP IP for H0 H2 H4 ECOM100 5 15 Network Client master Operation This section describes how the DL05 06 205 405 CPU can serve as a client on a
3. Timer Current Yalues M 128 VO Y177 0 12 WES Register Counter Current Walues w 128 w1000 Y11777 512 639 Input Register Y Memory user data Ah 1024 2000 v3777 1024 2047 Holding Register Find the MODBUS address for output Y20 PLC Addr Dec Start Addr Data Type 1 Find Y outputs in the table Y20 16 decimal 2 Convert Y20 into decimal 16 16 2049 Coil Coil 2065 3 Add the starting address for the range 2049 4 Usethe MODBUS data type from the table Control Relays CF CoO C7 3072 3551 Find the MODBUS address to obtain the PLC Address Dec Data Type current value from Timer T10 TA10 8 decimal 1 Find Timer Current Values in the table 8 Input Reg Input Reg 8 2 Convert T10 into decimal 8 3 Usethe MODBUS data type from the table Timer Current Values 0 YO w177 0 127 Input Register Counter Current Values tv i280 1000 1177 512 639 Input Register Find the MODBUS address for Control Relay PLC Addr Dec Start Addr Data Type Got C54 44 decimal 1 Find Control Relays in the table 44 3072 Coil Coil 3117 coin 3117 2 Convert C54 into decimal 44 3 Add the starting address for the range 3072 4 Use the MODBUS data type from the table A a Control Raye C jee 0 Garr awe Xa eh Ethernet Communications Modules 3rd Edition Rev C 06 11 ou ip faa im H0O H2 ECOM
4. Input Registers when addressing mode yes yes is 584 984 this function is used to access analog input registers 05 Force Single Output yes no 06 Preset Single Registers yes no 08 Loop back Maintenance yes no 15 Force Multiple Outputs yes yes 16 Preset Multiple Registers yes yes Ethernet Communications Modules 3rd Edition Rev C 06 11 MODBUS TCP IP for H0 H2 H4 ECOM100 5 5 Network Server slave Operation This section describes how other MODBUS TCP clients on a network can communicate with an HO H2 H4 ECOM100 that you have configured for MODBUS TCP protocol A network client must send a MODBUS function code and MODBUS address to specify a PLC memory location the DLO5 06 205 405 CPU No CPU ladder logic is required to support MODBUS TCP server operation MODBUS Function The HO H2 H4 ECOM100 supports the following MODBUS function codes when Codes Supported acting as a MODBUS TCP server MODBUS Function DLO5 06 205 405 Function Code Data Types Available 01 Read Output Table Y C T CT 02 Read Input Table X SP 03 Read Holding Registers when addressing V mode is 584 984 this function is used to ac cess analog output registers 04 Read Input Registers when addressing mode V is 584 984 this function is used to access analog input registers 05 Force Single Output Y C T CT 06 Preset Single Registers V 08 Loop back Maintenance 15 Force Multiple Outp
5. or 3 See page 2 7 and 2 8 about See page 3 10 or 6 4 about See page 2 7 and 2 9 about us slot numbers assigning a node number to a ing ECOMs in local expansion or server s IP address in remote I O bases ou E 09 faa im H0 H2 ECOM100 Ethernet Communications Modules 3rd Edition Rev C 06 11 Step 2 Load Number of Bytes to Transfer Step 3 Specify Master Memory Area Step 4 Specify Slave Memory Area MODBUS TCP IP for H0 H2 H4 ECOM100 5 19 The second Load LD instruction determines the number of bytes which will be transferred between the master and slave in the subsequent WX or RX instruction The value to be loaded is in BCD format decimal from 1 to 128 bytes The third instruction in the RX or WX sequence is a Load Address LDA instruction Its purpose is to load the starting address of the memory area to be transferred Entered as an octal number the LDA instruction converts it to hex and places the result in the accumulator For a WX instruction the CPU sends the number of bytes previously specified from its memory area beginning at the LDA address specified For an RX instruction the CPU reads the number of bytes previously specified from the server placing the received data into its memory area beginning at the LDA address specified 2 amp BCD L of bytes to transfer LD K128 4 O 6 0 0 octal
6. the recipient can verify that a message is finished For function codes where the MODBUS PDU has a fixed length the function code alone is sufficient For function codes carrying a variable amount of data in the request or response the data field includes a byte count e Protocol Identifier It is used for intra system multiplexing The MODBUS protocol is identified by the value 0 2 bytes The function code field of amessage contains 8 bits Valid function codes are in the range of 1 255 decimal The function code instructs the slave what kind of action to take Some examples are to read the status of a group of discrete inputs to read the data in a group of registers to write to an output coil or a group of registers or to read the diagnostic status of a slave When aslave responds to the master it uses the function code field to indicate either anormal response or that some type of error has occurred For a normal response the slave echoes the original function code In an error condition the slave echoes the original function code with its MSB set to a logic 1 The data field is constructed using sets of two hexadecimal digits in the range of 00 to FF According to the network s serial transmission mode these digits can be made of a pair of ASCII characters or from one RTU character The data field also contains additional information that the slave uses to execute the action defined by the function code This can include intern
7. 100 MODBUS TCP for HO H2 H4 ECOM100 If the Host Software Some MODBUS TCP clients do not allow you to specify the MODBUS datatype and address or Client Requires an Instead you specify an address only This method requires another step to determine the Address ONLY address but it is not difficult Basically MODBUS also separates the data types by address ranges as well This means an address alone can actually describe the type of data and location This is often referred to as adding the offset The actual equation used to calculate the address depends on the type of PLC data you are using The PLC memory types are split into two categories for this purpose e Discrete X GX SP Y CR S T C contacts e Word V Memory Timer current value Counter current value In either case you basically convert the PLC octal address to decimal and add the appropriate MODBUS starting address as required The following tables show the exact range used for each group of data NOTE For an automated MODBUS Koyo address conversion utility download the file modbus_conversion xls from the www automationdirect com website Discrete Data Types PLC Memory Type PLC Range MODBUS Address QTY Dec Octal Range Global Inputs GX Inputs GX 2048 GX0 GX1746 10001 10999 Read GX1747 GX3777 11000 12048 oniy a cs E Read Outputs a C a A C 00 Refer to your PLC user manual for the correct memory mapping size o
8. 3 LDA 040600 RX Vo Depending on which slot the ECOM is in it has two Special Relay contacts associated with it see page 4 11 to 4 12 for special relays One indicates Port busy and the other indicates Port Communication Error The example above shows the use of these contacts for an ECOM that is in slot 1 The Port Busy bit is on while the PLC communicates with the slave When the bit is off the program can initiate the next network request The Port Communication Error bit turns on when the PLC has detected an error Use of this bit is optional When used it should be ahead of any network instruction boxes since the error bit is reset when an RX or WX instruction is executed If you are using multiple reads and writes in the RLL program you have to interlock the routines to make sure all the routines are executed If you don t use the interlocks then the CPU will only execute the first routine This is because each port can only handle one transaction at a time In the example to the right after the RX instruction is executed CO is set When the port has finished the communication task the second routine is executed and CO is reset If youre using RLLP LUS Stage Programing you can put each routine in a separate program stage to ensure proper execution and switch from stage to stage allowing only one of them to be active at a time Ethernet Communications Modules 3rd Edition Re
9. 9 11 decimal 2 11 decimal 13 octal 3 XO octal 13 octal X13 octal Ethernet Communications Modules 3rd Edition Rev C 06 11 5 18 MODBUS TCP for H0 H2 H4 ECOM100 Building the For network communications you build the LD Read RX or Read RX or Write WX instructions into a Aaaa Write WX routine which requires the four instructions Routine you see to the right They must be used in the LD sequence shown The following step by step Aaaa procedure will provide you the information necessary to set up your ladder program to LDA receive data from a network server O aaa RX or WX Aaaa Step 1 Identify ECOM Slot The first Load LD instruction accepts either a constant or a variable Location and Use a K to designate the number as a constant Use a V if you are Server Node entering the address of a register The contents of that register perform the same function as the constant shown below For example you could use V2000 in place of K0114 If the contents of V2000 is the number 114 the function would be the same Using a variable allows changing parameters while the program is running Upper Byte Lower Byte LD et Fei K114 Initiating PLC ECOM Responding Client KO 1 1 4 device Server ee Se Base Number ECOM Slot Number Server Node midis Base 0 Initiating PLC Responding Device on Network pansion Base 1 2
10. MODBUS TCP for HO H2 H4 ECOM100 In This Chapter MODBUS TCP Supported MODBUS Function Codes Network Server Operation Network Client Operation H0 H2 H4 ECOM100 System Memory 5 2 MODBUS TCP for H0 H2 H4 ECOM100 ou op faa a H0 H2 ECOM100 MODBUS TCP MODBUS TCP is essentially the serial MODBUS RTU protocol encapsulated in a TCP IP wrapper MODBUS RTU is used for serial communications between a master and slave s devices MODBUS TCP is used for TCP IP communications between client and server devices on an Ethernet network The TCP version of MODBUS follows the OSI Network Reference Model Client Server The MODBUS messaging service provides a Client Server communication Model between devices connected on an Ethernet TCP IP network This client server model is based on four type of messages MODBUS Request the message sent on the network by the Client to initiate a transaction MODBUS Confirmation the Response Message received on the Client side MODBUS Indication the Request message received on the Server side MODBUS Response the Response message sent by the Server Client Server Model Request Indication Client ooo The HO H2 ECOM100 can oe Server act as a Client or Server Confirmation Response O Protocol A typical MODBUS TOP frame consists of the following fields Description TCP HEADER MBAP HEADER FUNCTION DATA The MBAP header MODB
11. MODBUS TCP network using the HO H2 H4 ECOM100 This section discusses how to design the required ladder logic for network client operation Client MODBUS TCP Servers Slave 1 Slave 2 Slave 3 MODBUS TCP Protocol When using the ECOM100 as a client on the network you use simple RLL instructions to initiate the requests The WX instruction initiates network write operations and the RX instruction initiates network read operations Before executing either the WX or RX poses commands we need to load data related to E the read or write operation onto the CPU s accumulator stack When the WX or RX WX write gt instruction executes it uses the information RX read on the stack combined with data in the Te instruction box to completely define the task Network Client MODBUS Function The H0 H2 H4 ECOM100 supports the following MODBUS function codes when Codes Supported acting as a MODBUS TOP client MODBUS Function DL05 06 205 405 Function Code Data Types Available 01 Read Output Table Y C T CT 02 Read Input Table X SP 03 Read Holding Registers when addressing V mode is 584 984 this function is used to ac cess analog output registers 15 Force Multiple Outputs Y C T CT 16 Preset Multiple Registers V j NOTE The H0O H2 H4 ECOM100 as a client master does not suppor
12. US Application Protocol header is seven bytes long It consists of the following fields Transaction Identifier It is used for transaction pairing the MODBUS server copies in the response the transaction identifier of the request 2 bytes Protocol Identifier It is used for intra system multiplexing The MODBUS protocol is identified by the value 0 2 bytes Length The length field is a byte count of the following fields including the Unit Identifier and data fields 2 bytes Unit Identifier This field is used for intra system routing purpose It is typically used to communicate to a MODBUS or a MODBUS serial line slave through a gateway between an Ethernet TCP IP network and a MODBUS serial line This field is set by the MODBUS Client in the request and must be returned with the same value in the response by the server 1 byte This header provides some differences compared to the MODBUS RTU application data unit used on serial line Ethernet Communications Modules 3rd Edition Rev C 06 11 MODBUS TCP IP for HO H2 H4 ECOM100 5 3 e The MODBUS slave address field usually used on MODBUS Serial Line is replaced by a single byte Unit Identifier within the MBAP Header The Unit Identifier is used to communicate via devices such as bridges routers and gateways that use a single IP address to support multiple independent MODBUS end units e All MODBUS requests and responses are designed in such a way that
13. al addresses quantity of items to be handled etc The data field of a response from a slave to a master contains the data requested if no error occurs If an error occurs the field contains an exception code that the master uses to determine the next action to be taken The data field can be nonexistent in certain types of messages Ethernet Communications Modules 3rd Edition Rev C 06 11 5 4 MODBUS TCP for HO H2 H4 ECOM100 NOTE ModScan32 is a Windows based application program that can be used as a MODBUS master to access and change data points in a connected device HO H2 H4 ECOM100 The utility is ideally suited for quick and easy testing of MODBUS TCP network slave devices Visit www win tech com to download a free ModScan32 trial demo and for more information on ModScan32 Supported MODBUS Function Codes ou op fan im H0 H2 ECOM100 The following MODBUS function codes are supported by the HO H2 H4 ECOM100 Not all function codes are supported when the ECOM100 serves as a network client The Network Client Operation section later in this chapter lists the function codes that are supported in client mode MODBUS Function Server Client Function Code Mode _ Mode 01 Read Output Table yes yes 02 Read Input Table yes yes 03 Read Holding Registers when addressing yes yes mode is 584 984 this function is used to ac cess analog output registers 04 Read
14. ays SP np Outputs TY Coi 56 Timer Contacts S Control Relays C 3072 3583 Coil T Coil Counter Contacts CT Coil Stage Status Bis Cai For Word Data Types Convert PLC Addr to Dec Data Type Courter Curent Values WV V Memory user data V ou ip faa im H0O H2 ECOM100 Ethernet Communications Modules 3rd Edition Rev C 06 11 5 7 MODBUS TCP IP for H0 H2 H4 ECOM100 Dec Octal Address Range Data Type For Discrete Data Types Convert PLC Addr to Dec Start of Range Data Type me For Word Data Ta Convert PLC Addr to Dec Data Type Courier Curent Values a Cre EEE Memory user data V 256 V400 V677 256 511 Holding Register 3072 V1400 V7377 768 3839 4096 V10000 V17777 4096 8191 DL240 Memory Type QTY PLC Range MODBUS MODBUS Dec Octal Address Range Data Type For Discrete Data Types Convert PLC Addr to Dec Start of Range Data Type Special Relays SP 144 SPO SP137 3072 3167 Input For Word Data i Convert PLC Addr to Dec Data Type V Memory user data V 256 V4000 V4377 2048 2303 Holding Register non volatile V Memory system V 106 V7620 V7737 3984 4063 Holding Register V7746 V7777 4070 4095 Ethernet Communications Modules 3rd Edition Rev C 06 11 MODBUS TCP H0O H2 ECOM100 MODBUS TCP for HO H2 H4 ECOM100 DL250 1 Memory Type QTY PLC Range MODBUS MODBUS Dec Octal Add
15. f your PLC Some of the addresses shown above might not pertain to your particular CPU Ethernet Communications Modules 3rd Edition Rev C 06 11 MODBUS TCP IP for H0 H2 H4 ECOM100 Word Data Types Read ie V Memory 128 V40000 V40177 416385 416512 316385 316512 Read Remote Inputs only V Memory 128 V40200 V40377 416513 416640 316513 316640 Read Remote Outputs Write V Memory 64 V40400 V40477 416641 416704 316641 316704 Read Input Points only V Memory 64 V40500 V40577 416705 416768 316705 316768 Read Output Points Write V Memory 128 V40600 V40777 416769 416896 316769 316896 Control Relays V Memory 16 V41100 V41117 416961 416976 316961 316976 Timers Status Bits V Memory 16 V41140 V41157 416993 417008 316993 317008 Counter Status Bits V Memory 32 V41200 V41237 417025 417056 317025 317056 Read Special Relays only Refer to your PLC user manual for the correct memory mapping size of your PLC Some of the addresses shown above might not pertain to your particular CPU Ethernet Communications Modules 3rd Edition Rev C 06 11 MODBUS TCP for HO H2 H4 ECOM100 Find the MODBUS address for User V location V2100 1 Find V Memory in the table 2 Convert V2100 into decimal 1088 3 Addthe MODBUS starting address forthe mode 40001 For Word Data Types Example 1 V2100 PLC Address Dec PLC Address
16. ia Starting address of client transfer area LDA 040600 MSB V40600 LSB 15 0 MSB V40601 LSB 15 0 NOTE Since V memory words are always 16 bits you may not always use the whole word For example if you only specify to read 3 bytes you will only get 24 bits of data In this case only the 8 least significant bits of the last word location will be modified The remaining 8 bits are not affected The last instruction in our sequence is the WX or RX instruction itself Use WX to write to the server and RX to read from the server All four of our instructions are shown to the right In the last instruction you must specify the starting address and a valid data type for the server SP122 LD v K114 LD K128 LDA 040600 RX Vo Ethernet Communications Modules 3rd Edition Rev C 06 11 5 20 MODBUS TCP for H0 H2 H4 ECOM100 ai op faa a H0 H2 ECOM100 Communications froma Ladder Program Multiple Read and Write Interlocks Typically network communications will last longer than 1 scan The program must wait for the communications to finish before starting the next transaction ECOM Communication Error SP123 v1 SET SP122 LD K114 N LD ECOM Port Busy K
17. it 1 7 Reserved 5 Reboot Count LSW Read Only 6 Reboot Count MSW Read Only 7 20 Reserved 418021 419250 Reserved For clients that only support function code 3 to read word data Ethernet Communications Modules 3rd Edition Rev C 06 11
18. o Dec Start of Range Data Type pus 2048 2867 Special Relays SP 288 SPO SP137 3072 3167 Input SP320 SP617 3280 3471 Oups T 20e 267 Control Relays CR Co C737 3072 3583 Timer Contacts T TO T177 6144 6271 Counter Contacts CT CTO CT177 6400 6527 Stage Status Bits S SO 577 5120 5503 Global I O GX GXO GX777 0 511 For Word Data Types Convert PLC Addr to Dec Data Type Timer Current Values 128 VO V177 Input Register Counter Current Values V V1000 V1177 512 639 Input Register V V Memory user data V V1400 V7377 768 3839 Holding Register V Memory system V V7400 V7777 3840 4095 Holding Register DL440 Memory Type QTY PLC Range MODBUS MODBUS Dec Octal Address Range Data Type Decimal For Discrete Data Types Convert PLC Addr to Dec Start of Range Data Type Inputs X 320 XO X477 2048 2367 Input 320 Special Relays SP 352 SPO SP137 3072 3167 Input SP320 SP717 3280 3535 320 256 56 To arr aia a0 fear Counter Contacts CT Coil S0 0 Outputs Y SP Control Relays CR T Timer Contacts Stage Status Bis S Col Global I O GX GX GX1777 Input For Word Data Types Convert PLC Addr to Dec Data Type Timer Current Values V VO V377 0 255 Input Register 88 Counter Current Values V V1000 V1177 512 639 Input Register V Memory user data V 3072 V1400 V7377 768 3839 Holding Regis
19. ress Range Data Type For Discrete Data ee se PLC Addr to Dec Start of Range Data Type SPO SP137 3072 3167 Input SP320 SP777 3280 3583 Control GLA o 3072 4095 For Word Data i Convert PLC Addr to Dec Data Type eet ee ee a E a Memory user data V EN V1400 V7377 768 3839 Holding Register 4096 V10000 V17777 4096 8191 V Memory system V 256 V7400 V7777 3840 4095 Holding Register DL260 Memory Type QTY PLC Range MODBUS MODBUS Dec Octal Address Range Data Type For Discrete Data Types Convert PLC Addr to Dec Start of Range Data Type Special Relays SP 512 SPO SP137 3072 3167 Input SP320 SP717 3280 3535 Control Relays C Co C3777 3072 5119 Timer Contacts T TO T377 6144 6399 Counter Contacts CT CTO CT377 6400 6655 Stage Status Bits S SO S1777 5120 6143 Global pus GN o GKOTTT Global Outputs GY evo over For Word Data daa Convert PLC Addr to Dec Data Type Counter Current a sre V1377 512 767 Input Register V Memory user data V V400 V777 256 511 Holding Register V1400 V7377 768 3839 V10000 35777 4096 15359 V Memory system V 256 V7600 V7777 3968 4095 Holding Register V36000 V37777 15360 16383 Ethernet Communications Modules 3rd Edition Rev C 06 11 MODBUS TCP IP for H0 H2 H4 ECOM100 DL430 Memory Type PLC Range MODBUS MODBUS Octal Address Range Data Type Decimal For Discrete Data Types Convert PLC Addr t
20. t function code 4 Thus 30001 address ranges cannot be read from a server slave device Ethernet Communications Modules 3rd Edition Rev C 06 11 MODBUS TCP for HO H2 H4 ECOM100 PLC Memory Supported for p The actual equation used to calculate the address depends on the type of PLC data you are Client Operation using The PLC memory types are split into three categories for this purpose e Discrete X GX SP e Discrete Y CR S T C e Word Timer current value Counter current value Data Words In either case you basically take the MODBUS address you are trying to target subtract the starting MODBUS of that range convert the result to octal and add the octal number to the begining PLC address in the appropriate PLC range See the conversion examples on the following page The following tables show the exact range used for each group of data NOTE For an automated MODBUS Koyo address conversion utility download the file modbus_conversion xls from the www automationdirect com website Discrete Data Types O o Discrete Data Types OO O irae areae rent Range gt noooss QTY Dec Octal Range Global Inputs GX 2048 Read Special Relays SP SP0 SP777 13073 13584 Global Outputs GY GY0 GY3777 1 2048 Write Reserved A T0000 Word Data Types poor Datatypest O OOOO O Wows orvoney oean Range o accoss QTY Dec Octal Range V Memory Timers
21. ter 4096 V10000 V17777 4096 8191 V Memory system V 2 V700 V737 448 479 Holding Register V7400 V7777 3840 4095 Ethernet Communications Modules 3rd Edition Rev C 06 11 MODBUS TCP for HO H2 H4 ECOM100 DL450 Memory Type QTY PLC Range MODBUS MODBUS Dec Octal Address Range Data Type Decimal For Discrete Data men a PLC Addr to Dec Start of Range Data Type SPO SP137 3072 3167 Input SP320 SP717 3280 3535 Control GLAN CR 3072 5119 For Word Data on Convert PLC Addr to Dec Data Type Timer Current Values V V377 0 255 Input Register Counter Ses ze vio V1377 512 767 Input Register V Memory user data V 3072 V1400 V7377 768 3839 Holding Register 12288 V10000 V37777 4096 16383 V Memory system V V700 V777 448 768 Holding Register V7400 V7777 3840 4095 aii op fan im H0 H2 ECOM100 Ethernet Communications Modules 3rd Edition Rev C 06 11 Example 1 V2100 Example 2 Y20 Example 3 T10 Current Value Example 4 C54 MODBUS TCP IP for HO H2 H4 ECOM100 The following examples show how to generate the MODBUS address and data type for hosts which require this format Find the MODBUS address for User V PLC Address Dec Data Type pester vee V2100 1088 decimal gt AEG v Memo INE able 1088 Hold Reg Holding Reg 1089 2 Convert V2100 into decimal 1089 3 Use the MODBUS data type from the table
22. uts Y C T CT 16 Preset Multiple Registers V Determining the There are typically two ways that most MODBUS addressing conventions allow you MODBUS Address to specify a PLC memory location These are e By specifying the MODBUS data type and address e By specifying a MODBUS address only Ethernet Communications Modules 3rd Edition Rev C 06 11 5 6 MODBUS TCP for HO H2 H4 ECOM100 If Your Host Software Many MODBUS TCP clients allow you to specify the MODBUS data type and the or Client Requires MODBUS address that corresponds to the PLC memory location This is the easiest ns Type and method but not all packages allow you to do it this way a The actual equation used to calculate the address depends on the type of PLC data you are using The PLC memory types are split into two categories for this purpose e Discrete X SP Y C S T contacts CT contacts e Word V memory Timer current value Counter current value In either case you basically convert the PLC octal address to decimal and add the appropriate MODBUS starting address as required The following tables show the exact range used for each group of data NOTE For an automated MODBUS Koyo address conversion utility download the file modbus_conversion xls from the www automationdirect com technical support website Dec Octal Address Range Data Type For Discrete Data Types Convert PLC Addr to Dec StartofRange Data Type inputs ipa Special Rel
23. v C 06 11 interlocking Relay SP122 C100 I A Ki14 LD K3 LDA 040600 RX Interlocking Vo Relay C100 sE SP122 C100 LD 1 K114 LD K3 LDA 040400 WX vo C100 R87 MODBUS TCP IP for H0 H2 H4 ECOM100 H0O H2 H4 ECOM100 System Memory HO H2 H4 ECOM100 Modbus Addressing Words Word Descriptions Access Range Decimal 16 bit Module Version 317501 317506 6 1 OS Major Version Read Information 417501 417506 2 OS Minor Version only 3 OS Build Version 4 Booter Major Version 5 Booter Minor Version 6 Booter Build Version 317507 317510 Reserved 417507 417510 Device Data 317511 317600 90 1 Version of Device Read 417511 417600 2 Family only 3 Processor 4 Module Type 5 Status Code 6 8 Ethernet Address 9 RAM Size 10 Flash Size 11 Batt RAM Size 12 DIP Settings 13 Media Type 14 15 EPF Count if supported 16 Run Relay State if supported 17 Batt Low if supported 18 Model Number 19 Ethernet Speed 20 90 Reserved 317601 318500 Reserved 417601 418500 Dynamic 418001 418020 20 1 3 Reserved Read Module Data 4 Flags Write Bit 0 If 1 module has rebooted since this bit was cleared a write to the Flags word with this bit set will clear this reboot bit B
Download Pdf Manuals
Related Search