TM SM Maximum Value for OEMs SM From Rockwell Automation Using Modbus Protocol with OEMax Products...

TM

SMMaximum Value for OEMsMaximum Value for OEMs

Maximum Value for OEMsSM

From Rockwell Automation

Using Modbus Protocol with OEMax Using Modbus Protocol with OEMax ProductsProducts

Feb 26 ~ Mar 2, 2007Feb 26 ~ Mar 2, 2007

K.J Kim

RAK OBB Strategic Marketing

K.J Kim

RAK OBB Strategic Marketing

2

What is Modbus ?What is Modbus ?Introduced by Modicon ,1979Modbus communication interface for a multidrop network based on a master/client architectureConnection Type: RS-232, RS-485, TCP/IPMessage based Communication

Coil : Discrete Output Value

Field Description

Device Address Address of Receiver

Function Code Code defining Message Type

Data Data Block with additional information

Error Check Numeric Check value to test for communication errors(LRC / CRC)

Modbus Communication StackModbus Communication Stack

3

Only, explain Modbus RS-232CIn this training

Modbus Network ArchitectureModbus Network Architecture

4

Modbus Serial Transmission ModesModbus Serial Transmission Modes

Two Modbus Serial ModesModbus/ASCII ASCII Code Format

Modbus/RTU (Remote Terminal Unit) Binary Format

5

Modbus/ASCII Modbus/RTU

Characters ASCII 0~9, A~F Binary 0 ~ 255

Error CheckLRC(Longitudinal Redundancy

Check)CRC(Cyclic Redundancy Check)

Frame Start Characters [:]

Frame End Characters [CR][LF]

Gaps in Message

1 Sec

Start Bit 1 1

Data Bits 7 8

Parity Even/Odd None Even/Odd None

Stop Bits 1 2 1 2

General Modbus FrameGeneral Modbus Frame

General Modbus Frame

6

Additional Address Function Code Data Error Check

PDU (Protocol Data Unit)

ADU (Application Data Unit)

Modbus AddressingModbus Addressing

Device and Modbus address ranges

All Registers will be assigned a number between 1 and 10000

Modbus message addresses are used a number between 0 and 9999

So, To access correctly, You must subtract -1 (or -10001 or -40001)

[Example] If you want to read Output coil 18, You must use value 17 in Modbus message

7

Device Address Modbus Address Description

1 … 10000 Address – 1 Coils (Outputs)

10001 … 20000 Address – 10001 Inputs

40001 …50000 Address - 40001 Holding Registers Maximum Value is device dependent.

Modbus Function CodeModbus Function Code

Common Modbus Function Code

8

Code Description Code Description

01 Read Coil Status 16 Preset Multiple Registers

02 Read Input Status 17 Report Slave ID

03 Read Holding Register 20 Read File Record

04 Read Input Register 21 Write File Record

05 Force Single Coil 22 Mask Write Register

06 Preset Single Register 23 Read/Write Multiple Registers

07 Read Exception Status 24 Read FIFO Queue

08 Diagnostics 43 Encapsulated Interface Transport

11 Get Comm. Event Counter 43/13 CANopen General Reference Request and Response

12 Get Comm Event Log 43/14 Read Device Identification

15 Force Multiple Coils

NX Series PLC supports these kinds of Functions which are blue color.

Function 01 : Read Coil StatusFunction 01 : Read Coil Status

9

Byte Value Description

1 1 … 247 Slave device address

2 1 Function Code

3 0 … 255 Starting address, High byte

4 0 … 255 Starting address, Low byte

5 0 … 255 Number of coils, High byte

6 0 … 255 Number of coils, Low byte

7(..8) LRC/CRC Error check value



2 1 Function Code

3 0 … 255 Number of data bytes N

4..N+3 0 … 255 Bit pattern of coil values

N+4(..N+5) LRC/CRC Error check value

Function 01 : Query Structure Function 01 : Answer Structure

This sample is “Read Coils 20 (0x14) to 56 (0x38) from device 17 ((0x11)”Field Name Example (Hex)

Slave Address 11

Function 01

Starting Address High 00

Starting Address Low 13

No. of Points High 00

No. of Points Low 25

Error Check --

Field Name Example (Hex)

Slave Address 11

Function 01

Byte Count 05

Data (Coil 27-20) CD

Data (Coil 35-28) 6B

Data (Coil 43-36) B2

Data (Coil 51-44) OE

Data (Coil 56-52) 1B

Error Check --The Address will be 0013H because 20-1=19=13H.

Function 02 : Read Input StatusFunction 02 : Read Input Status

10



2 2 Function Code








2 2 Function Code






Slave Address 11

Function 02


Starting Address Low C4



Error Check --


Slave Address 11

Function 02

Byte Count 03

Data (Inputs 10204~10197) AC

Data (Inputs 10212~10205) DB

Data (Inputs 10218~10213) 35

Error Check --

This sample is “Read Inputs 10197 ~ 10218 from device 17”

The Address will be 00C4H because 10197-10001=196 =C4H .

Function 03 : Read Holding RegistersFunction 03 : Read Holding Registers

11



2 3 Function Code








2 3 Function Code






Slave Address 11

Function 03


Starting Address Low 6B



Error Check --

This sample is “Read Register 40108 ~ 40110 from device 17”Field Name Example (Hex)

Slave Address 11

Function 03

Byte Count 06

Data High (Register 40108) 02

Data Low (Register 40108) 2B


Data Low (Register 40109) 00


Data Low (Register 40110) 64

Error Check --The Address will be 006BH because 40108-40001=107= 6BH.

Function 04 : Read Input RegistersFunction 04 : Read Input Registers

12



2 4 Function Code








2 4 Function Code





Slave Address 11

Function 04


Starting Address Low 08



Error Check --

This sample is “Read Register 30009 from device 17”Field Name Example (Hex)

Slave Address 11

Function 04

Byte Count 02


Data Low (Register 30009) 0A

Error Check --


The Address will be 0008H because 30009-30001=8.

Function 05 : Force Single CoilFunction 05 : Force Single Coil

13



2 5 Function Code








2 5 Function Code





Slave Address 11

Function 05

Coil Address High 00

Coil Address Low AC

Force Data High FF

Force Data Low 00

Error Check --

This sample is “Request to Force Coil 173 ON in Slave Device 17”Field Name Example (Hex)

Slave Address 11

Function 05

Coil Address High 00

Coil Address Low AC

Force Data High FF

Force Data Low 00

Error Check --


The Address will be 0xAC because 173-1=172=0xACFF00 ON, 0000OFF

Function 06 : Preset Single RegisterFunction 06 : Preset Single Register

14



2 6 Function Code








2 6 Function Code





Slave Address 11

Function 06

Register Address High 00

Register Address Low 01

Preset Data High 00

Preset Data Low 03

Error Check --

This sample is “Request to preset register 40002 to 00 03 in Slave Device 17”Field Name Example (Hex)

Slave Address 11

Function 06

Register Address High 00

Register Address Low 01

Preset Data High 00

Preset Data Low 03

Error Check --


The Address will be 0001H because 40002-40001=1.

Function 07 : Read Exception StatusFunction 07 : Read Exception Status

15



2 7 Function Code




2 7 Function Code

3 0 … 255 Coil Data



Slave Address 11

Function 07

Error Check --

This sample is “Request to Read Exception Status in Slave Device 17”Field Name Example (Hex)

Slave Address 11

Function 07

Coil Data 6D

Error Check --


Function 15 : Force Multiple CoilsFunction 15 : Force Multiple Coils

16



2 15 Function Code

3 0 … 255 Coil Address, High byte

4 0 … 255 Coil Address, Low byte

5 0 … 255 Quantity of coils, High byte

6 0 … 255 Quantity of coils, Low byte

7 0 … 255 Byte Count

8 0 … 255 Force Data, High Byte

9 0 … 255 Force Data, Low Byte




2 15 Function Code

3 0 … 255 Coil Address, High byte

4 0 … 255 Coil Address, Low byte

5 0 … 255 Quantity of Coils, High Byte

6 0 … 255 Quantity of Coils, Low Byte



Slave device address 11

Function Code 0F

Coil Address, High byte 00

Coil Address, Low byte 13

Quantity of coils, High byte 00

Quantity of coils, Low byte 0A

Byte Count 02

Force Data, High Byte CD

Force Data, Low Byte 01

Error check value --

This sample is “Request to Force 10 Coils starting at coil 20 in Slave Device 17”



Function Code 0F

Coil Address, High byte 00

Coil Address, Low byte 13

Quantity of Coils, High Byte 00

Quantity of Coils, Low Byte 0A



Function 16 : Preset Multiple RegistersFunction 16 : Preset Multiple Registers

17



2 16 Function Code

3 0 … 255 Starting Address, High byte

4 0 … 255 Starting Address, Low byte

5 0 … 255 No. of Registers, High byte

6 0 … 255 No. of Registers, Low byte


8 0 … 255 Data, High Byte

9 0 … 255 Data, Low Byte

10 0 … 255 Data, High Byte

11 0 … 255 Data, Low Byte




2 16 Function Code

3 0 … 255 Starting Address, High byte

4 0 … 255 Starting Address, Low byte

5 0 … 255 No. of Registers, High Byte

6 0 … 255 No. of Registers, Low Byte




Function Code 10

Starting Address, High byte 00

Starting Address, Low byte 01

No. of Registers, High byte 00

No. of Registers, Low byte 02

Byte Count 04

Data, High Byte 00

Data, Low Byte 0A

Data, High Byte 01

Data, Low Byte 02


This sample is “Request to preset two registers starting at 40002 to 00 0A and 01 02 in Device 17



Function Code 10

Starting Address, High byte 00

Starting Address, Low byte 01

No. of Registers, High Byte 00

No. of Registers, Low Byte 02



Function 17 : Report Slave IDFunction 17 : Report Slave ID

18



2 17 Function Code




2 17 Function Code


4 0 … 255 Slave ID

5 Run Indicator Status 0x00=OFF, 0xFF=ON

6 Additional Data Device Specific

N+7(..N+8)

LRC/CRC Error check value


Slave Address 11

Function 11

Error Check --

This sample is “Request to Report ID and Status of Slave Device 17”Field Name Example (Hex)


Function Code 11

Byte Count Device Specific

Slave ID Device Specific

0x00=OFF, 0xFF=ON 0x00 or 0xFF

Device Specific Additional Data



SamplesSamples

19

Master Query with ASCII/RTU Framing

Slave Response with ASCII/RTU Framing

CommunicationCommunication with NX Series PLCwith NX Series PLC

To operate Modbus RTU, Must Enable F12.2 (Port1) or F12.9 (Port2)

Addresses Map for Modbus

NX7(S) : Port 1 – Slave , Port2 – Slave & Master

20

Register

Range Bit Address Word Address Remark

R R0 ~ R127 , 128 Words 0000 ~ 2047 0 ~ 127 External Relay Contact

L L0 ~ L63 , 64 Words 2048 ~ 3071 128 ~ 191 Link Register

M M0 ~ M127 , 128 Words 3072 ~ 5119 192 ~ 319 Internal Register

K K0 ~ K127 , 128 Words 5120 ~ 7167 320 ~ 447 Keep Register

F F0 ~ F15 , 16 Words 7168 ~ 7423 448 ~ 463 Flag Register

TC TC0 ~ TC255 , 256 Bits 7424 ~ 7679 464 ~ 511 Timer/Counter Contact

W W0 ~W2047 , 2048 Words Not Available 512 ~ 2559 Word Register

SV SV0 ~ SV255 , 256 Words Not Available 2560 ~ 2817 Timer/Counter Setting Value

PV PV0 ~ PV255 , Words Not Available 2818 ~3071 Timer/Counter Current Value

SR SR0 ~ SR511 , 512 Words Not Available 3072 ~ 3583 System Register

Communication with NX Series PLCCommunication with NX Series PLC

Let’s see Modbus/RTU Communication Sample Program which is programmed by Visual Basic.Net 2005.

21

Configuration Flag in NX Series PLCConfiguration Flag in NX Series PLC

22

When F12.2 or F12.9 are set, Port1 or 2 of CPU will be configured to support Modbus RTU slave protocol.

Communication System RegisterCommunication System Register

Special Register (SR298 ~ SR373) is provided for holding the data transmitted and received

23

System Registers Description Explanation

SR298 ~ SR333 Transmit Data Buffer Holds up to 36 words of data to be transmitted

SR334 ~ SR369 Receive Data Buffer Holds up to 36 words of received data

SR370 Transmit Data Length Number of Bytes to be transmitted

SR371 Receive Data Length Number of Bytes that have been received

SR372 Start Code Start code for ASCII Comm.– one byte, high byte unused

SR373 End Code End code for ASCII Comm. – one byte, high byte unused

24

Calculation CRCCalculation CRCSlave

AddressFunction

CodeData CRC L CRC H

CRC Calculation Scope 2 Byte CRC

CRC = 65535For i = 0 To PL - 1 CRC = Int(CRC / 256) Xor CRCTable((CRC Xor DATABLOCK(i)) And 255)Next i

CRC : Cyclic Redundancy Check

Communication with NXIO-MNA/232Communication with NXIO-MNA/232

25

Communication with AC Drive MSDCommunication with AC Drive MSD

26

27

TM

Maximum Value for OEMsSM

TM SM Maximum Value for OEMs SM From Rockwell Automation Using Modbus Protocol with OEMax Products...

Documents

Transcript of TM SM Maximum Value for OEMs SM From Rockwell Automation Using Modbus Protocol with OEMax Products...