Home

Modbus RTU

Contents

1. 12 5 OPERATION IN THE MODBUS NETWORK SLAVE 14 5 1 AVAILABLE FUNCTIONS AND RESPONSE 5 14 52 MEMORY 15 5 2 1 Reading System Marker SB WIW 9650 15 5 2 2 Command System Marker CW 15 5 23 Inputs IB 6 aAA hAnna 15 5 24 5 96 96 15 5 2 5 Network Inputs IB 96 56 16 5 2 6 Network Outputs QB QW 00 nnen nnna 16 5 2 7 Internal Marker
2. 7 2 1 2 2 2 deb 54444 2241414211434 41 151 7 2 1 3 Connection with the 5232 7 2 2 25485 4 3 8 4 01 84441 1 42442 4188 dna 7 2 2 1 RS485 Interface 7 2 2 2 55414854 24532451 544541 441245 451458155485452035 7 2 2 3 348388 4884888 4 453 58858848 8 2 2 4 Switches to Enable to Terminating 8 2 2 5 Connection with the RS485 8 INTERFACE 9 9 1 RS232 41 448444441 4444 4 3 44 4 11 8 4441 13845414 9 BAUD 45552 4 555522585 88 3 55425125538812 4 44 1 1 4 4411 454 52 44825 211 5 2 112 8 84814 48 248 9 54
3. 956 5 16 PLC300 3 Contents 53 DATA 16 6 DETAILED DESCRIPTION OF THE FUNCTIONS 20 6 1 FUNCTION 01 READ 5 1 41 1 20 6 2 FUNCTION 02 READ 20 6 3 FUNCTION 03 READ HOLDING 20 6 4 FUNCTION 04 READ INPUT 2 1 2171 1 7 14 4 4 21 6 5 05 5 1 21 6 6 FUNCTION 06 WRITE SINGLE REGISTER 22 6 7 FUNCTION 15 WRITE MULTIPLE 5 2 22 FUNCTION 16 WRITE MULTIPLE 5 65 2 2 1
4. Physical inputs representing the digital inputs 1 to 8 5000 5000 Register words byte low MB1 1 MD40004 variable created by the user with a size of four bytes Register Marker in volatile memory representing a global Holding 8000 11 bytes Register 5 words variable created by the user with a size of one byte Marker on retentive memory representing a global Holding 28000 4 bytes i 2 words 8005 byte high 28002 e 28003 PLC300 17 Operation the Modbus Network Slave Mode Similarly the access via binary data coils or input discretes also uses a base address plus the offset given by the number of the marker However since each byte has eight bits for each byte from the base address eight bits must be added to the address for access via binary data The data format and function in the memory area accessed though are not pre defined and depend on the programming done on the WPS software For example for the memory marker 0 it is possible to create the following variables on the WPS software byte marker it takes only one memory byte and it can represent an 8 bit integer with or without signal In the access via registers since the Modbus protocol allows the reading or writing access of at least 16 bits whenever this marker is read or written the bytes MBO and 1 are accessed word marker it takes two memory bytes and it can represen
5. 6 3 FUNCTION 03 READ HOLDING REGISTER It reads the content of a group of registers that must be necessarily numerical sequence This function has the following structure for the request and response telegrams each field represents a byte PLC300 20 E Detailed Description of the Functions i Datum 2 high POSS Example reading of the memory marker representing a float IEEE that takes four bytes of the memory Considering the float value equal to 1 0 3F800000h in representation of float IEEE Address 1 01h Initial register address 8000 1F40h Number of read registers 2 00021 6 4 FUNCTION 04 READ INPUT REGISTER NOTE Function 04 Read Input Register has exactly the same structure as function 03 Only the function code and accessible data are different 6 5 FUNCTION 05 WRITE SINGLE COIL This function is used to write a value for a single bit coil The value for the bit is represented using two bytes the value FFOOh represents the bit in 1 and the value 0000h represents the bit in O zero It has the following structure each field represents a byte Value for the bit byte high Value for the bit high byte Value for the bit byte low Value for the bit low byte CRC Example writing of the first bit of the output marker QBO mapped as coil from address 16000 Address 1 01h Bit number 16000 3E80h Bit value
6. uchCRCHi auchCRCLo uIndex return uchCRCHi lt lt 8 uchCRCLo PLC300 39 WEG Equipamentos El tricos S A Jaragua do Sul SC Brazil Phone 55 47 3276 4000 Fax 55 47 3276 4020 S o Paulo SP Brazil Phone 55 11 5053 2300 Fax 55 11 5052 4212 automacao weg net www weg net
7. 2 2 2 Connector pinout The RS485 interface is available at the connector with the following connections Table 2 2 RS485 connector pinout A Line RxD TxD negative B Line RxD TxD positive OV isolated from the RS485 circuit 1 The limit number of devices that can be connected to the network depends also on the used protocol PLC300 7 2 2 3 Indications Besides the system markers which provide different kinds of information about the 5485 interface the PLC300 programable controller has as bicolor LED green and red in the front part of the product used for Serial Interface indication Figure 2 1 Indication LED of the Serial interface During the initialization of the equipment both LEDs are On for test for a period of approximately 500 ms alternately After this period for the RS485 interface they will make the following indications Green LED turns on whenever a telegram is transmitted by the RS485 interface Red LED turns on whenever a byte is incorrectly received parity or frame error or CRC error is detected in the telegram received by the RS485 interface 2 2 4 Switches to Enable to Terminating resistor AC It is necessary to enable a terminating resistor at both ends of the main bus for each segment of the RS485 network There are switches S1 in the PLC300 programable controller that can be activated by placing both switches to ON to enable the terminating resistor 2 2
8. VAR IN insert a variable tag Types of data WORD Description Address of initial register O to 65535 lt arg3 gt NumberOfData VAR IN insert a variable tag Types of data BYTE Description Number of registers read starting with the initial address 1 to 16 lt arg4 gt Timeout VAR IN insert a constant Types of data WORD Description Waiting time for the arrival of the response by the slave starting with the sending by the master 20 to 5000 ms lt gt Offset VAR IN insert a constant Types of data BOOL Description It indicates if the address of the data programmed in InitialDataAddress has offset i e if the address of the data programmed in the block must be subtracted from 1 in order to send through the Modbus network FALSE Without Offset TRUE With Offset of 1 lt arg6 gt Active VAR OUT insert a variable tag Types of data BOOL Description Active block requisition for reading sent to the slave and awaiting response Note The variable must have writing permission lt 7 gt VAR OUT insert a variable tag Types of data BOOL Description Block enabled though resource is not available RS485 interface busy with another requisition waiting for release so that the request is sent by the block If the enabling input is removed while the block makes that indication the requisition is rejected Note The variable must have
9. 5 Slave returned error Note The variable must have writing permission NOTE Modbus RTU protocol using function 16 allows the writing of 16 bit registers only For the writing of data with more than 16 bits one REAL for instance it is possible to perform the writing of multiple registers and use a variable which size is bigger than 16 bits as data source It is important that the quantity of written registers is compatible with the size of the variable or the array where the data will be used 7 1 5 Master Control Status Control and Status of Modbus Master Block to control and monitor the master in the Modbus RTU network Whenever a Modbus RTU network is assembled with the as the network master it is recommended to use this block in order to obtain information on the communication state Execute MB MasterComtrolStatus Done DisableComm CommDisabled has an Execute block enabling input and a Done output which is activated after the end of the function s successful performance While the Execute enabling input is active the input data is used and the output data is updated In case the input is zeroed the input values are disregarded and the output arguments are zeroed Output Done reflects the value of the input Input lt argO gt DisableComm VAR IN insert a constant or a variable tag Types of data BOOL Description It allows to disable the Modbus master When
10. Next a function using programming language is presented which implements the CRC calculation for the Modbus RTU protocol The calculation uses two tables to supply pre calculated values of the necessary displacement for the calculation Table of CRC values for high order byte static unsigned char auchCRCHi 0x00 0 1 0x81 0x40 0x01 0 0 0x80 0x41 0x01 0 0 0x80 0x41 0x00 0 1 0x81 0x40 0x01 0 0 0x80 0x41 0x00 OxCl 0x81 0x40 0x00 OxCl 0x81 0x40 0x01 0 0 0x80 0x41 0x01 0 0 0x80 0x41 0x00 0 1 0x81 0x40 0x00 0 1 0x81 0x40 0x01 0 0 0x80 0x41 000 0 1 0 81 0x40 0 01 0 0 0x80 0 41 0 01 0 0 0x80 0x41 0x00 OxCl 0 81 0x40 0 01 0 0 0 80 0 41 0 00 OxCl 0 81 0 40 0 00 OxCl 0 81 0 40 0 01 0 0 0 80 0 41 0x00 0 1 0x81 0x40 0x01 0 0 0 80 0x41 0x01 0 0 0x80 0x41 0x00 0 1 0x81 0x40 0x00 0 1 0x81 0x40 0x01 0 0 0x80 0x41 0x01 0 0 0x80 0x41 0x00 0 1 0x81 0x40 0x01 0 0 0x80 0x41 0x00 0 1 0x81 0x40 0x00 OxCl 0x81 0x40 0x01 0 0 0x80 0x41 0 01 0 0 0 80 0 41 0x00 OxCl 0x81 0x40 0x00 OxCl 0x81 0 40 0x01 0 0 0 80 0x41 0x00 0 1 0x81 0x40 0x01 0 0 0x80 0x41 0x01 0 0 0x80 0x41 0x00 0 1 0x81 0x40 0x00 0 1 0x81 0x40 0x01 0 0 0x80 0
11. 3 9600 bit s 4 19200 bit s 5 38400 bit s 6 57600 bit s PLC300 36 E System Markers for RS232 and RS485 Configuration of the RS485 Interface set of writing markers to program the configurations of the RS485 interface They are also accessible through the Setup CB3068 Serial address slave modo 1 247 CB3069 Operation mode O Modbus RTU slave 1 Modbus master CB3070 Byte format parity 1 stop bit 1 odd parity 1 stop bit 2 even parity 1 stop bit 3 reserved 4 parity 2 stop bits 5 odd parity 2 stop bits 6 even parity 2 stop bits CB3071 Baud rate for RS485 O 1200 bit s 1 2400 bit s 2 4800 bit s 3 9600 bit s 4 19200 bit s 5 38400 bit s 6 57600 bit s Control of the Modbus Master RS485 set of writing markers for control of the Modbus master CW3100 Control of the Modbus master O Normal operation 1 Disable interface PLC300 37 Appendices I APPENDICES APPENDIX A ASCII TABLE Table 1 1 ASCII Characters 98 62 3 03 End of Text 99 63 36 04 68 09 6 17 21 pei Control 1 3 1 DC3 Device Control 3 56 38 25 19 End of Medium ul 39 3 89 59 Y 29 1D GS Group Separator 510 10 19 wu pita 5 4 H K lt N w to PLC300 38 meg Appendices APPENDIX B CRC CALCULATION USING TABLES
12. as slave of the network it provides functions for the reading and writing of the data and markers used in the configuration and programming in ladder of the product For further information about this operating mode refer to item 5 Master as network master the PLC300 provides blocks in ladder to send commands to the network slaves according to the configuration in these blocks In this mode it will not be possible to access the data and configurations of the PLC300 via RS485 interface Only one master can be configured to operate on the RS485 bus For further information about this operating mode refer to item 7 and the documentation of the WPS programming software PLC300 10 meg Interface CONFIGURATION SLAVE ADDRESS Range 110247 Default 1 Description It allows programming the slave address used for the PLC300 in the Modbus RTU network RS485 interface This address is only used if the interface is programmed in the slave mode it has no function if the PLC300 is programmed as network master PLC300 11 Weg RTU Protocol 4 MODBUS RTU PROTOCOL The Modbus RTU protocol was initially developed in 1979 Nowadays it is a widely spread open protocol used by several manufactures in many equipments 41 TRANSMISSION MODES Two transmission modes are defined in the protocol specification ASCII and RTU The modes define the way the message bytes are transmitted It is not possible to use the two transm
13. 1 so the value that must be written is PLC300 21 E Detailed Description of the Functions Bit number igh Bit number ow Value for the bit ng Value for the bit ow CRC Note that for this function the slave response is an identical copy of the request made by the master 6 6 FUNCTION 06 WRITE SINGLE REGISTER This function is used to write a value for a single register It has the following structure each field represents a byte Example writing of the writing system marker CB3000 Since the writing is always done by sending a 16 bit register the bytes mapped at addresses CB3000 and CB3001 will be written Address 1 O1h Initial register address 3000 OBB8h Marker value 50 00328 Request Master Field Value Slave Address Function Register high Register ow Value high CB3001 Value low CB3000 8 CRC Note that for this function the slave response is an identical copy of the request made by the master 0 0 gt 21125132 67 FUNCTION 15 WRITE MULTIPLE COILS This function allows writing values for a group of bits coils which must be in a numerical sequence It can also be used to write in a single bit each field represents a byte Bos TT e Goo GE TT eo PLC300 22 The value of each bit being written is placed in a position of the data bytes sent by the master The first byte receives the fi
14. 23 6 8 FUNCTION 43 READ DEVICE 24 6 9 COMMUNICATION 5 1 1 25 7 OPERATION IN THE MODBUS NETWORK MASTER MODE 27 7 1 BLOCKS TO PROGRAM 1 1 1 nnna 27 7 1 1 Read Binary Reading 5 27 7 1 2 Read Register Reading of 28 7 1 3 MB Write Binary Writing of 30 7 1 4 Write Register Writing of 5 31 7 1 5 Master Control Status Control and Status of Modbus RTU Master 33 7 1 6 Slave Status Modbus RTU Network Slave 5 34 8 SYSTEM MARKERS FOR RS232 AND 5485 2 2 2 2 4 1 1 1 4 4 36 8 1 READING SYSTEM MARKERS vivsciccisccscsescecctectesscavcccscecercavensccegradedede
15. 5 Connection with the RS485 Network The following points must be observed for the connection of the device using the RS485 interface t is recommended the use of a shielded cable with a twisted pair of wires 5 also recommended that the cable has one more wire for the connection of the reference signal GND In case the cable does not have the additional wire then the GND signal must be left disconnected cable must be laid separately and far away if possible from the power cables the network devices must be properly grounded preferably at the same ground connection The cable shield must also be grounded Enable the termination resistors only at two points at the extremes of the main bus even if there are derivations from the bus PLC300 8 Weg imterface CONFIGURATION 3 INTERFACE CONFIGURATION In order to configure the RS232 and RS485 interfaces the following menus are provided by the Setup of the PLC300 programmable controller 3 1 RS232 CONFIGURATION BAUD RATE Range 1200 bit s Default 4 1 2400 bit s 2 4800 bit s 3 9600 bit s 4 19200 bit s 5 38400 bit s 6 57600 bit s Description It allows programming the baud rate for the serial communication interface in bits per second This baud rate must be the same for all the devices connected to the network PARITY Range 0 parity Default 2 1 odd parity 2 even parity Description It allows programming the par
16. MODBUS ORG In order to obtain this documentation consult MODBUS ORG which is nowadays the organization that keeps publishes and updates the information related to the Modbus protocol PLC300 5 meg Introduction to Serial Communication 1 INTRODUCTION TO SERIAL COMMUNICATION In a serial interface the data bits are sent sequentially through a communication channel or bus Several technologies use the serial communication for data transfer including the RS232 and RS485 interfaces The directions that specify the RS232 and RS485 standards however do neither specify the character format nor its sequence for the data transmission and reception Therefore besides the interface it is also necessary to identify the protocol used for the communication Among the several existent protocols one used a lot in the industry is the Modbus RTU protocol In the sequence the characteristics of the RS232 and RS485 serial interfaces available for the product will be presented as well as the Modbus RTU protocol for the use of those interfaces PLC300 6 2 NETWORK CONNECTIONS The PLC300 programable controller has standard RS232 and RS485 interfaces Information about the connection and installation of the equipment to the network is presented bellow 2 1 RS232 2 1 1 RS232 Interface Characteristics interface follows the 232 standard It operates only as a slave in the Modbus network configured for network
17. Slave Address Function Function Initial register address high byte Initial register address high byte Initial register address low byte Initial register address low byte Number of registers high byte Number of registers high byte Number of registers low byte Number of registers low byte Byte count number of data bytes CRC Response Slave Slave Address Datumi dow 7 Datum 2 high pT 4 Go GG Example writing of the writing memory marker representing 32 bit integer value 4 bytes the memory Considering the value to be written equal to 16909060 decimal 01020304h Address 1 O1h Initial register address 8000 1F40h Number of registers 2 0002h PLC300 23 E Detailed Description of the Functions Field Slave Address Function intial register igh Initial register 0 Number of registers high Number of registers high Number of registers low Number of registers low Byte Count Value for the integer low high Value for the integer low low Value for the integer high high Value for the integer high low CRC CRC 6 8 FUNCTION 43 READ DEVICE IDENTIFICATION It is an auxiliary function that allows the reading of the product manufacturer model and firmware version It has the following structure Request Master ode oF J Be ofthe frst object SSCS Nae oF the first object bytes SS J of the secondobiect 1
18. address 1 alows communication baud rates from 1200 up to 57600 Kbit s allows the connection between the device and the network master point to point Maximum distance between devices 10 meters 2 1 2 Connector pinout The 5232 interface is available at the connector with the following connections Table 2 1 RS232 connector pinout Function Data transmission connected to the master RX master TX Reference for RS282 circuit EIA Data reception connected to the 2 1 3 Connection with the RS232 Network The slave RX and TX signals must be connected to the master TX and RX besides the connection of the reference signal GND The 5232 interface is very susceptible to interferences For this reason the cable used for communication must be as short as possible always shorter than 10 meters and must be laid separately from the power cables that supply other devices 2 2 RS485 2 2 1 RS485 Interface Characteristics The interface follows the EIA TIA 485 standard operates as a slave or master in the Modbus network It allows communication baud rates from 1200 up to 57600 kbit s interface is electrically isolated and with differential signal which grants more robustness against electromagnetic interference allows the connection of up to 32 devices to the same segment More devices can be connected by using repeaters maximum bus length of 1000 meters
19. disabling the master the Modbus master s status counters and markers are also zeroed 0 Master in performance 1 Disables master Output PLC300 33 E 7 1 6 Operation in the Modbus Network Master Mode lt argt gt CommDisabled VAR OUT insert a variable tag Types of data BOOL Description It indicates if the master is disabled or not It may occur by user request or in case the interface is programmed to operate as the network slave O Master Enabled 1 Master disabled Note The variable must have writing permission lt arg2 gt TxCounter VAR OUT insert a variable tag Types of data WORD or UINT Description Counter of requests sent by the network master to the slaves It is zeroed whenever the equipment is disconnected or the master is disabled O to 65535 Note The variable must have writing permission lt arg3 gt RxCounter VAR OUT insert a variable tag Types of data WORD or UINT Description Counter of telegrams received by the network master It is zeroed whenever the equipment is disconnected or the master is disabled O to 65535 Note The variable must have writing permission lt arg4 gt NoAnswerCounter VAR OUT insert a variable tag Types of data WORD or UINT Description Counter of requests by the master that were not responded by the slaves It is zeroed whenever the equipment is disconnected or the master is disabled O to 6
20. of data and the value of registers are always represented in 16 bits Therefore it is necessary to transmit those fields using two bytes superior high and inferior low telegrams for request as well as for response cannot exceed 64 bytes 6 1 FUNCTION 01 READ COILS reads the content of a group of bits coils that must be necessarily a numerical sequence This function has the following structure for the request and response telegrams each field represents a byte Request Master Response Slave Each response bit is placed in a position the data bytes sent by the slave The first byte receives the eight first bits from the initial address indicated by the master The other bytes keep the sequence if the number of reading bits is greater than eight If the number of read bits is not a multiple of eight the remaining bits of the last byte must be filled in with zero Example reading of the eight bits of the output marker 2000 mapped as coil from address 24000 considering this marker with value 100 64h Address 1 O1h Number of the initial bit 24000 5DCOh Number of read bits 8 00088 ntl bit WGA Dh initial bit ow Number of bits igh Number of bits low CRC 62 FUNCTION 02 READ INPUT DISCRETE NOTE 7 Function 02 Read Input Discrete has exactly the same structure as function 01 Only the function code and accessible data are different
21. of those errors the slave must send a message to the master indicating the type of error that occurred The error messages sent by the slave have the following structure Request Master Response Slave _Slave Address 004 Slave Address Slave Address Function Function with the most significant bit in 1 Data Error code _Error code o CRC CRC Example the master requests to the slave at the address 1 the writing in the register 2900 nonexistent register PLC300 25 E Detailed Description of the Functions Register igh Register ow Value 181 Value ow CRC CRC sen PLC300 26 Operation the Modbus Network Master Mode 7 OPERATION IN THE MODBUS NETWORK MASTER MODE Besides the operation as a slave the PLC300 programmable controller also allows operation as a master for the Modbus RTU network For this operation it is necessary to observe the following points Only interface RS485 allows operation as a network master t is necessary to program in product configurations the operation mode as Master besides the communication rate parity and stop bits which must be the same for the whole equipment in the network Modbus RTU network master does not have an address so the address configured in the PLC300 is not used Sending and receiving telegrams RS485 interface using the Modbus protocol is programmed by using blocks in lad
22. 0 J Be ofthe second object 0 8 Vatu oF the second object 0 EO Ro EO Di etc This function allows the reading of three information categories Basic Regular and Extended and each category is formed by a group of objects Each object is formed by a sequence of characters For the PLC300 programable controller only basic information formed by three objects is available Objeto 00h VendorName represents the product manufacturer Objeto 01h ProductCode formed by the product code PLC300 Objeto 02h MajorMinorRevision it indicates the product firmware version in the format The reading code indicates what information categories are read and if the objects are accessed in sequence or individually The PLC300 supports the codes 01 basic information in sequence and 04 individual access to the objects The other fields are specified by the protocol and for the PLC300 they have fixed values Example reading of basic information in sequence starting from the object 02h from at address 1 PLC300 24 E Detailed Description of the Functions Doo 08 In this example the value of the objects was not represented hexadecimal but using the corresponding ASCII characters instead E g for the object 02h the value 1 00 was transmitted as being five ASCII characters which in hexad
23. 26 0 22 OxE2 OxE3 0x23 1 0x21 0x20 OxEO 0 0 0x60 0x61 OxAl 0x63 OxA3 0 2 0x62 0x66 OxA6 OxA7 0x67 OxA5 0x65 0x64 OxA4 0 6 OxAC OxAD Ox6D Ox6F Ox6E OxAA Ox6A 0 6 OxAB 0x69 OxA9 OxA8 0x68 0x78 0xB8 0 9 0x79 0 7 0 7 OxBE 0 7 0 7 OxBF 0 7 OxBD OxBC Ox7C OxB4 0x74 0 75 0 5 0 77 0 7 0 6 0x76 0 72 OxB2 0xB3 0x73 0 1 0x71 0x70 0 0 0x50 0x90 0x91 0 51 0x93 0x53 0x52 0 92 0x96 0x56 0 57 0 97 0x55 0x95 0x94 0x54 0 9 0 5 0x5D Ox9D 0 5 Ox9F Ox9E Ox5E Ox5A 0 9 0x9B Ox5B 0x99 0x59 0x58 0x98 0x88 0x48 0x49 0x89 0x4B Ox8B Ox8A 0x4A 0 4 Ox8E 0 8 0 4 0x8D 0x4D Ox4C Ox8C 0x44 0x84 0x85 0x45 0x87 0x47 0x46 0x86 0x82 0x42 0x43 0x83 0x41 0x81 0x80 0x40 1 The function returns the CRC as a unsigned short type unsigned short CRC16 puchMsg usDataLen unsigned char puchMsg message to calculate CRC upon unsigned short usDataLen quantity of bytes in message unsigned char uchCRCHi high byte of CRC initialized unsigned char uchCRCLo OxFF low byte of CRC initialized unsigned will index into CRC lookup table while usDataLen pass through message buffer uIndex uchCRCLo puchMsgg calculate the CRC uchCRCLo uchCRCHi auchCRCHi
24. 445 4354544314 58544444 14584 24514 24 441411154044144 44 441444441444 844414 585448 9 STOP 9 3 2 RS485 10 BAUD er a rar 85588581 10 EE EE A E E E E E E E E O AA A T TT 644 4814 4 444444 uns 10 STOP 10 OPERATION MODE sissivsicsceccccascansccveswateiecsencainewiasscninnuassessecsdssacwaebicuaasutenscudues Ranina 10 SLAVE ADDRESS 11 4 lt 25 aros ud aa 12 4 1 TRANSMISSION 8 12 4 2 MESSAGE STRUCTURE FOR 12 4 2 1 12 4 2 2 Function nna 12 4 2 3 4 1 8888 12 4 24 45414413 044484454 dan di ada nda 12 4 2 5 Time Between
25. 5535 Note The variable must have writing permission lt 5 gt ErrorResponseCounter VAR OUT insert a variable tag Types of data WORD UINT Description Counter of requests by the master that the slaves responded with some error response The error code may be obtained in the marker that indicates the code of the last detected error It is zeroed whenever the equipment is disconnected or the master is disabled O to 65535 Note The variable must have writing permission lt arg6 gt LastErrorSlaveAddress VAR OUT insert a variable tag Types of data BYTE or USINT Description It indicates the address of the slave in which the last communication error was detected It is zeroed whenever the equipment is disconnected or the master is disabled O to 247 Note The variable must have writing permission LastErrorResult VAR OUT insert a variable tag Types of data BYTE or USINT Description It indicates the operation result timeout or error response conforming to the block s ERROR ID for the slave in which the last communication error was detected It is zeroed whenever the equipment is disconnected or the master is disabled 0 Without detected error 4 Timeout in the response by the slave 5 Slave retumed error Note The variable must have writing permission lt arg8 gt LastErrorCode VAR OUT insert a variable tag Types of data BYTE or USINT Descrip
26. Device Identification Description identification of the device model Function code 43 The response time from the end of transmission of the master until the response of the slave varies from the minimum time between bytes in the Modbus RTU communication to the equipment scan cycle value 2 Programmable address only for the RS485 interface for the RS232 interface the address is fixed in 1 PLC300 14 Operation the Modbus Network Slave Mode 5 2 MEMORY MAP The programable controller has different types of data accessible through the Modbus communication These data are mapped at data addresses and access functions as described in the following items NOTE The WPS programming software has lists that allow the viewing of all types of markers available for the In these lists there is a field for indication of the address of the Modbus register to access the marker 5 2 1 Reading System Marker SB SW SD The reading system markers represent the data of the PLC300 used for indication of status and monitoring of the equipment functions Access read only Data type input register or input discrete Modbus access functions 02 and 04 Modbus address range for access via input register 3000 4999 Modbus address range for access input discrete 0 15999 The system markers related to the serial communication available for the PLC300 are described in item 8
27. For the description of other markers available and function of each marker refer to the user s manual of the PLC300 5 2 2 Command System Marker CW CD The writing system markers represent the data of the PLC300 used to configure and control the equipment functions Access read write Data type holding register or coil Modbus access functions 01 03 05 06 15 and 16 Modbus address range for access via holding register 3000 4999 Modbus address range for access via coil 0 15999 The system markers related to the serial communication available for the PLC300 are described in item 8 For the description of other markers available and function of each marker refer to the user s manual of the PLC300 5 2 3 Inputs IB IW ID Markers that represent the data related to the physical analog and digital inputs available on the hardware of the PLC300 Access read only Data type input register or input discrete Modbus access functions 02 and 04 Modbus address range for access via input register 5000 5999 Modbus address range for access via input discrete 16000 23999 For the precise description of which markers are available and function of each marker refer to the user s manual of the PLC300 5 2 4 Outputs QW QD Markers that represent the data related to the physical analog and digital outputs available in hardware of the PLC300 Access read write Da
28. MD General purposes markers for programming in ladder of the PLC300 They represent the global variables dynamically created during the development of the program on the WPS software Access read write Data type holding register or coil Modbus access functions 01 03 05 06 15 and 16 Volatile markers Modbus address range for access via holding register 8000 27999 Modbus address range for access coil 40000 49999 Retentive markers Modbus address range for access via holding register 28000 47999 Modbus address range for access via coil 50000 59999 The quantity of markers available in this area depends on the markers created on the PLC300 programming software In order to be able to access the desired marker first it is necessary to create this marker and download the user s program using the programming software NOTE The quantity of data accessible via coils and input discretes do not correspond to the entire memory area accessible via registers For example if it is created a quantity of markers on memory greater than the quantity accessible via coil 10000 bits 1250 bytes the additional markers can only be accessed via holding registers 5 3 DATA ACCESS Each of the memory regions described above is distributed in bytes The Modbus protocol though allows the access to be performed only by bits of by registers of 16 bits In order to access these memory regions it is nece
29. Motors Automation Energy Transmission amp Distribution Coatings Modbus RTU User s Manual EDER San Modbus RTU User s Manual Series PLC300 Language English Document Number 10002233450 00 Publication Date 04 2013 Contents CONTENTS CONTENTS sews goede 3 ABOUT THIS 5 ABBREVIATIONS AND 5 NUMERICAL REPRESENTATION 5 DOCUMENTS arnee 5 1 INTRODUCTION TO SERIAL 6 2 NETWORK 6 7 21 1 5232 454 4 54 214884 1644 2482 1 4 4 4 1 21 3 22211 1 2 02 4212022112012 022110220 012200442 sa 148 281 3 7 2 1 1 RS232 Interface
30. a BYTE Description Number of bits written in sequence starting with the initial address 1 to 128 lt arg4 gt Timeout VAR IN insert a constant Types of data WORD Description Waiting time for the arrival of the response by the slave starting with the sending by the master 20 to 5000 ms lt gt Offset VAR IN insert a constant Types of data BOOL Description It indicates if the address of the data programmed in InitialDataAddress has offset i e if the address of the data programmed in the block must be subtracted from 1 in order to send through the Modbus network FALSE Without Offset TRUE With Offset of 1 lt arg6 gt Value VAR IN insert a variable tag Types of data 128 Description Variable or array with the data to be written in the slave lt arg gt Active VAR OUT insert a variable tag Types of data BOOL Description Active block requisition for reading sent to the slave and awaiting response Note The variable must have writing permission lt arg8 gt VAR OUT insert a variable tag Types of data BOOL Description Block enabled though resource is not available RS485 interface busy with another requisition waiting for release so that the request is sent by the block If the enabling input is removed while the block makes that indication the requisition is rejected Note The variable must have writing permi
31. cescdeieceseacdedesnaveusscoss 36 8 2 WRITING SYSTEM 85 nn 36 k APPENDICES iine 38 ASCII TABLE uniana an anandan uwana 4115145 444 41 54444454485 8 38 APPENDIXB CRC CALCULATION USING 5 2 2 39 PLC300 4 ABOUT THIS MANUAL This manual supplies the necessary information for the operation of the PLC300 programable controller using the Modbus RTU protocol This manual must be used together with the PLC300 user manual ABBREVIATIONS AND DEFINITIONS ASCIl American Standard Code for Information Interchange CRC Cycling Redundancy Check EIA Electronic Industries Alliance TIA Telecommunications Industry Association RTU Remote Terminal Unit NUMERICAL REPRESENTATION Decimal numbers are represented by means of digits without suffix Hexadecimal numbers are represented with the letter h after the number Binary numbers are represented with the letter b after the number DOCUMENTS The Modbus RTU protocol was developed based on the following specifications and documents Document Version Source MODBUS Application Protocol Specification December V1 1b MODBUS ORG 28th 2006 MODBUS Protocol Reference Guide June 1996 MODICON MODBUS over Serial Line December 20th 2006
32. d remaining active while the input is active In case of error in the requisition performance the Error output is enabled and the error code is put to Input Output lt argO gt SlaveAddress VAR IN insert a variable tag Types of data BYTE Description Address of destination slave 1 to 247 lt arg1 gt Function VAR IN insert a constant Types of data BYTE Description Writing function code 6 Write Single Register 16 Write Multiple Registers lt arg2 gt InitialDataAddress VAR IN insert a variable tag Types of data WORD Description Address of initial register O to 65535 lt arg3 gt NumberOfData VAR IN insert a variable tag Types of data BYTE Description Number of registers written starting with the initial address 1 to 16 lt arg4 gt Timeout VAR IN insert a constant Types of data WORD Description Waiting time for the arrival of the response by the slave starting with the sending by the master 20 to 5000 ms lt gt Offset VAR IN insert a constant Types of data BOOL Description It indicates if the address of the data programmed in InitialDataAddress has offset i e if the address of the data programmed in the block must be subtracted from 1 in order to send through the Modbus network FALSE Without Offset TRUE With Offset of 1 lt arg6 gt Value VAR IN insert a variable tag Type
33. der programming language It is necessary to Know the available blocks and the ladder programming software in order to be able to program the network master following functions are available for the sending of requisitions by the Modbus master Function 01 Read Coils Function 02 Read Discrete Inputs Function 03 Read Holding Registers Function 04 Read Input Registers Function 05 Write Single Coil Function 06 Write Single Register Function 15 Write Multiple Coils Function 16 Write Multiple Registers 7 1 BLOCKS TO PROGRAM THE MASTER In order to control and monitor the Modbus communication using the PLC300 programmable controller the following blocks were developed and they must be used when programming in ladder 7 1 1 MB Read Binary Reading of Bits Block for the reading of bits It allows the reading of up to 128 sequential bits of the destination slave using functions 1 Read Coils and 2 Read Discrete Inputs in the Modbus lt inst gt Execute MB ReadBinary lt arg SlaveAddress lt argl gt Function lt arg2 gt InitialDataAddress lt arg3 gt NumberOfData lt 4 gt lt arg5 gt has an Execute block enabling input and a Done output which is activated after the end of the function s successful performance After the positive transition of Execute a new telegram is sent by the Modbus master when the RS485 serial interface is free At the operation successful end res
34. e or the array where the data will be stored MB Write Binary Writing of Bits Block for the writing of bits It allows the writing of up to 128 bits using functions 5 Write Single Coil and 15 Write Multiple Coils in the Modbus Execute MB WriteBinary SlaveAddress has an Execute block enabling input and a Done output whichis activated after the end of the function s successful performance After the positive transition of Execute a new telegram is sent by the Modbus RTU master when the RS485 serial interface is free At the operation successful end response received from the slave the Done output is activated remaining active while the input is active In case of error in the requisition performance the Error output is enabled and the error code is put to ErrorlD Input lt argO gt SlaveAddress VAR_IN insert a variable tag Types of data BYTE Description Address of destination slave 1 to 247 lt arg1 gt Function VAR IN insert a constant Types of data BYTE Description Writing function code 5 Write Single Coil 15 Write Multiple Coils lt arg2 gt InitialDataAddress VAR IN insert a variable tag Types of data WORD Description Address of initial bit O to 65535 PLC300 30 E Output 7 1 4 Operation in the Modbus Network Master Mode lt arg3 gt NumberOfData VAR IN insert a variable tag Types of dat
35. e slave s read data will be stored Note The variable must have writing permission MB Read Register Reading of Registers Block for the reading of 16 bit registers It allows the reading of up to 16 sequential registers of the destination slave using functions 3 Read Holding Registers and 4 Read Input Registers in the Modbus PLC300 28 E Operation in the Modbus Network Master Mode Execute MB ReadRegister SlaveAddress Function Initia iDataAddress NumberOfData has an Execute block enabling input and Done output which is activated after the end of the function s successful performance After the positive transition of Execute a new telegram is sent by the Modbus RTU master when the RS485 serial interface is free At the operation successful end response received from the slave the Done output is activated remaining active while the input is active and the received data is copied to Value In case of error in the requisition performance the Error output is enabled and the error code is put to Input Output lt argO gt SlaveAddress VAR IN insert a variable tag Types of data BYTE Description Address of destination slave 1 to 247 lt arg1 gt Function VAR IN insert a constant Types of data BYTE Description Reading function code 3 Read Holding Registers 4 Read Input Registers lt arg2 gt InitialDataAddress
36. ecimal have the values 56h V 31h 119 2Eh 30h 0 and 30h 0 6 9 COMMUNICATION ERRORS Communication errors may occur in the transmission of telegrams as well as in the contents of the transmitted telegrams Depending on the type of error the slave may or not send a response to the master When the master sends a message for an inverter configured in a specific network address the product will not respond to the master if the following occurs Parity bit error CRC error Timeout between the transmitted bytes 3 5 times the transmission time of a byte In those cases the master must detect the occurrence of the error by means of the timeout while waiting for the slave response In the event of a successful reception during the treatment of the telegram the slave may detect problems and send an error message indicating the kind of problem found Invalid function Error code 1 The requested function has not been implemented for the equipment Invalid datum address Error code 2 the datum address does not exist Invalid datum value Error code 3 It occurs in the following situations The value is out of the permitted range An attempt to write a datum that cannot be changed reading only register bit NOTE It is important that it be possible to identify at the master what type of error occurred in order to be able to diagnose problems during the communication In the event of any
37. he 0 NOTE The 232 RS485 USB and Ethemet interfaces for using the same functions to access the data and programming of the equipment must not be used simultaneously to perform program download or on line monitoring functions of the programmable controller PLC300 because conflicts may occur during the simultaneous access to the data 5 1 AVAILABLE FUNCTIONS AND RESPONSE TIMES In the Modbus specification are defined the functions used to access different types of data In the PLC300 in order to access those data the following services or functions have been made available Read Coils Description reading of bit blocks of the coil type Function code 01 Read Discrete Inputs Description reading of bit blocks of the discrete input type Function code 02 Read Holding Registers Description reading of register blocks of the holding register type Function code 03 Read Input Registers Description reading of register blocks of the input register type Function code 04 Write Single Coil Description writing in a single bit of the coil type Function code 05 Write Single Register Description writing in a single register of the holding type Function code 06 Write Multiple Coils Description writing in bit blocks of the coil type Function code 15 Write Multiple Registers Description writing in register blocks of the holding register type Function code 16 Read
38. imit or the interface is disabled SW3108 Counter of responses received with error Counter incremented whenever the slave returns an error response to a request made by the Modbus RTU master It is reset whenever it reaches the maximum limit or the interface is disabled Whenever this error is detected the data for the slave address error type and error code will be saved on the markers SB3110 to SB3112 96583110 Last error occurred slave address 96583111 Last error occurred error type O error 4 Timeout at the response 5 Slave returned error response is reset whenever the interface is disabled is reset whenever the interface is disabled Status of the Modbus slave RS485 set of reading markers that indicate the quantity of telegrams sent and received by the Modbus RTU slave 965 3120 Number of received telegrams Specific for the slave mode SW31 22 Number of transmitted telegrams Specific for the slave mode 8 2 WRITING SYSTEM MARKERS Configuration of the 232 Interface set of writing markers to program the configurations of the RS232 interface They are also accessible through the Setup menu CB3060 CB3061 CB3062 Byte format O no parity 1 stop bit 1 odd parity 1 stop bit 2 even parity 1 stop bit 3 reserved 4 no parity 2 stop bits 5 odd parity 2 stop bits 6 even parity 2 stop bits CB3063 Baud rate for RS232 O 1200 bit s 1 2400 bit s 2 4800 bit s
39. ission modes in the same network The programable controller uses only the RTU mode for the telegram transmission The bytes are transmitted in hexadecimal format and its configuration depends on the programming done by means of setup menu 4 2 MESSAGE STRUCTURE FOR RTU MODE The Modbus RTU structure uses a master slave system for message exchange It allows up to 247 slaves but only one master Every communication begins with the master making a request to a slave which answers to the master what has been asked In both telegrams request and answer the used structure is the same Address Function Code Data and CRC Only the data field can have a variable size depending on what is being requested Master request telegram Address Function Request Data CRC 1 byte 1 byte n bytes 2 bytes Slave response telegram Address Function Response Data CRC 1 byte 1 byte n bytes 2 bytes 4 2 1 Address The master initiates the communication sending a byte with the address of the slave to which the message is destined When sending the answer the slave also initiates the telegram with its own address The master can also send a message to the address 0 zero which means thatthe message is destined to all the slaves in the network broadcast In that case no slave will answer to the master 4 2 2 Function Code This field also contains a single byte where the master specifies the kind of service or function
40. ity of the serial interface bytes This configuration must be identical for all the devices connected to the network STOP BITS Range 0 1 stop bit Default 0 1 2 stop bits Description It allows programming the stop bits of the serial interface bytes This configuration must be identical for all the devices connected to the network NOTE The address of the Modbus RTU slave via RS282 interface is fixed in 1 PLC300 9 E Interface CONFIGURATION 3 2 RS485 CONFIGURATION BAUD RATE Range O 1200 bit s Default 4 1 2400 bit s 2 4800 bit s 3 9600 bit s 4 19200 bit s 5 38400 bit s 6 57600 bit s Description allows programming the baud rate for the serial communication interface in bits per second This baud rate must be the same for all the devices connected to the network PARITY Range O no parity Default 2 1 odd parity 2 even parity Description It allows programming the parity of the serial interface bytes This configuration must be identical for all the devices connected to the network STOP BITS Range 0 1 stop bit Default 0 1 2 stop bits Description It allows programming the stop bits of the serial interface bytes This configuration must be identical for all the devices connected to the network OPERATION MODE Range 0 slave Default 1 1 master Description Via RS485 interface the PLC300 features two operating modes the Modbus RTU network Slave
41. ll assume that the telegram has reached its end when after receiving the telegram elements this time has elapsed again If during the transmission of a telegram the time between the bytes is longer than this minimum time the telegram will be considered invalid because the programable controller will discard the bytes already received and will mount a new telegram with the bytes that were being transmitted For communication rates higher than 19200 bits s the used times are the same as for that rate The next table shows us the times for different communication transmission rates Tas Thetween bytes Tas a Transmission Signal Time T11 bits e 7 Telegram Table 4 1 Communication rates and the time periods involved in the telegram transmission T11 bits Tais Time for transmitting one byte of the telegram bytes Time between bytes Tsx Minimum interval to indicated beginning and end of a telegram 8 5 x 111045 PLC300 13 Operation the Modbus Network Slave Mode 5 OPERATION IN THE MODBUS NETWORK SLAVE MODE The programable controller has the following characteristics when operated as a slave in Modbus RTU network Network connection via RS232 RS485 serial interface Address communication rate and byte format defined by means of setup of the equipment Itallows accessing all the markers and data used in the ladder program of t
42. nsert a variable tag lt arg9 gt Slave4Offine VAR OUT insert a variable tag Types of data BOOL Description Output activated in case the quantity of sequential communication errors for the slaves indicated the respective inputs reaches the value programmed in ErrorsToSetOffline Note The variable must have writing permission PLC300 35 8 SYSTEM MARKERS 232 AND RS485 For 5232 and RS485 serial interfaces the following reading system markers 905 and writing system markers C were provided for control and monitoring 8 1 READING SYSTEM MARKERS Modbus Master Status RS485 reading marker set that indicates the Modbus master status besides information for network diagnosis Description SB3100 Status of the Modbus master O Normal operation 1 Mater disabled SB3101 Reserved 965 3102 Counter of requests made by the master Counter incremented every time a new telegram is sent by the Modbus RTU network master It is reset whenever it reaches the maximum limit 965 3104 Counter of successfully received responses Counter incremented every time the master receives a successful response from a network slave is reset whenever it reaches the maximum limit 965 3106 Counter of requests without response timeout Counter incremented every time a timeout occurs for arequest made by the Modbus RTU network master to a slave It is reset whenever it reaches the maximum l
43. ponse received from the slave the Done output is activated remaining active while the input is active and the received data is copied to Value In case of error in the requisition performance the Error output is enabled and the error code is put to Input lt argO gt SlaveAddress VAR IN insert a variable tag Types of data BYTE Description Address of destination slave 1 to 247 lt arg1 gt Function VAR IN insert a constant Types of data BYTE Description Reading function code 1 Read Coils 2 Read Discrete Inputs PLC300 27 E Output 7 1 2 Operation in the Modbus Network Master Mode lt arg2 gt InitialDataAddress VAR IN insert a variable tag Types of data WORD Description Address of initial bit O to 65535 lt arg3 gt NumberOfData VAR IN insert a variable tag Types of data BYTE Description Number of bits read in sequence starting with the initial address 1 to 128 lt arg4 gt Timeout VAR IN insert a constant Types of data WORD Description Waiting time for the arrival of the response by the slave starting with the sending by the master 20 to 5000 ms lt gt Offset VAR IN insert a constant Types of data BOOL Description It indicates if the address of the data programmed in InitialDataAddress has offset i e if the address of the data programmed in the block must be sub
44. r Type Modbus Byte Word Y MW Double MD 8000 40000 40015 MWO Value signf MDO Value signf Value signt 2 Uni i Uni 8001 40016 40031 Value signf Uni i Uni Value signf Value signf 8002 40032 40047 MW4 Value signf MD4 Value signf Value signt 8003 40048 40063 MW6 Value signf Since the Modbus protocol defines that in order to transmit 16 bit register the most significant byte must be transmitted first when accessing any register the following memory address is transmitted first Therefore if four registers are read in a row from the register 8000 the content of each register will be transmitted the following way 15 Register 8000 2 Register 8001 3 Register 8002 4 Register 8003 80 83 82 MB5 86 PLC300 18 Operation the Modbus Network Slave Mode NOTE For the PLC300 programmable controller the maximum size of each telegram including address function data field and CRC must not exceed 67 bytes PLC300 19 6 DETAILED DESCRIPTION OF THE FUNCTIONS A detailed description of the functions available in the PLC300 programable controller for the Modbus RTU is provided in this section In order to elaborate the telegrams it is important to observe the following The values are always transmitted in hexadecimal The address of a datum the number
45. red offline The following is considered communication error every request reading or writing a master sent to a slave and did not receive a response the received response had CRC error lt arg1 gt AddressSlave1 VAR IN insert a constant lt arg2 gt AddressSlave2 VAR IN insert a constant lt arg3 gt AddressSlave2 VAR IN insert a constant lt arg4 gt AddressSlave2 VAR IN insert a constant Types of data BYTE Description It allows programming the address of up to 4 slaves which quantity of communication errors will be monitored in order to make known if they are online or offline In case the quantity of sequential communication errors detected in the reading and writing blocks via Modbus reaches the value programmed in ErrorsToSetOffline the respective output is activated In case it is desired to monitor a smaller number of slaves any of the inputs may be set in zero O Ignores input 1 to 247 lt arg5 gt GeneralOffine VAR OUT insert a variable tag Types of data BOOL Description If any of the outputs of the indicated slaves is activated this output will also be activated It works as OR logic between the 4 outputs of slave indication O to 65535 Note The variable must have writing permission lt arg6 gt Slave1Offine VAR OUT insert a variable tag lt 7 gt Slave2Offine VAR OUT insert a variable tag lt arg8 gt Slave3Offine VAR OUT i
46. requested to the slave reading writing etc According to the protocol each function is used to access a specific type of data For the available list of supported functions refer to item 5 4 2 3 Data Field It is a variable size field The format and contents of this field depend on the used function and the transmitted value This field is described together with the function description refer to item 5 4 2 4 CRC The last part of the telegram is the field for checking the transmission errors The used method is the CRC 16 Cycling Redundancy Check This field is formed by two bytes where first the least significant byte is transmitted CRC and then the most significant CRC The CRC calculation form is described in the specification however information for its implementation is also supplied in the Appendix B 4 2 5 Time Between Messages In the RTU mode there is no specific character that indicates the beginning or the end of a telegram The indication of when a new message begins or when it ends is done by the absence of data transmission in the network for a minimum period of 3 5 times the transmission time of a data byte 11 bits Thus in case a PLC300 12 weg Modbus RTU Protocol telegram has initiated after the elapsing of this minimum time the network elements will assume that the first received character represents the beginning of a new telegram And in the same mamner the network elements wi
47. rst eight bits from the initial address indicated by the master The other bytes if the number of written bits is greater than eight continue the sequence If the number of written bits is not multiple of eight the remaining bits of the last byte must be filled in with zero Example writing of 16 bits from output marker QWO mapped as coil from address 16000 Address 1 O1h Number of the first bit 16000 Quantity of bits 16 0010h Value for the bits O to 7 10 OAh Value for bits 8 to 15 20 14h Value Slave Address Slave Address Function Function initial bit high Initial bit high Initial bit ow Initial bit ow Number of bits high Number of bits high Number of bits ow Number of bits ow Byte count CRC Value for bits 0 to 7 14h 4h Value for bits 8 to 15 14h CRC CRC Value SlaveAddress SlaveAddress 00 Function Function Initial bitig Initial 0 Numberofbits figh Number of bits figh h Number of bits 09 Number of bits 100 Byte count ORCA Value for bits O t07 1005 Value for bits 8 to 15 FUNCTION 16 WRITE MULTIPLE REGISTERS This function allows writing values for a group of registers which must be in a numerical sequence It can also be used to write in a single register each field represents a byte Request Master
48. s of data 32 USINT 1 32 SINT 1 32 16 16 16 DWORD 1 8 UDINT 1 8 DINT 1 8 or 8 Description Variable or array with the data to be written in the slave lt arg gt Active VAR OUT insert a variable tag Types of data BOOL Description Active block requisition for reading sent to the slave and awaiting response Note The variable must have writing permission PLC300 32 E Operation in the Modbus Network Master Mode lt arg8 gt VAR OUT insert a variable tag Types of data BOOL Description Block enabled though resource is not available RS485 interface busy with another requisition waiting for release so that the request is sent by the block If the enabling input is removed while the block makes that indication the requisition is rejected Note The variable must have writing permission lt arg9 gt Error VAR OUT insert a variable tag Types of data BOOL Description error during requisition performance Note The variable must have writing permission lt argt0 gt ErrorlD VAR OUT insert a variable tag Types of data BYTE or USINT Description In case of requisition error the type of error occurred will be indicated Possible results 0 Successfully performed 1 Some input data invalid example Master disabled 4 Timeout in the response by the slave
49. ssary to establish the relationship between the type and numbering of the data on the PLC300 with the PLC300 16 meg Operation in the Modbus RTU Network Slave Mode Modbus address type The following tables show how the relationship between the numbering of the data on the PLC300 and the address of the Modbus registers that access these data is done Reading System Markers Marker Number Register Address input register PLC300 Modbus SB3001 SB3000 3000 96883003 96883002 96583101 96583100 3050 Command System Markers Marker Number Register Address holding register PLC300 Modbus CB3001 CB3000 3000 CB3003 CB3002 CB3101 CB3100 3050 Marker Number Register Address input register PLC300 Modbus IBO 5000 IB3 IB2 9082001 9082000 6000 Marker Number Register Address holding register PLC300 Modbus 5000 95083 55082 QB2001 QB2000 6000 Internal markers volatile and retentive Marker Number Register Address holding register PLC300 Modbus MBO 8000 MB3 2 MB40001 MB40000 28000 The following table illustrates how the Modbus address is calculated with access via registers for different types of data available for the PLC300 SW3002 type address offset Reading system marker which represents the scan Input 3000 2 bytes 3001 cycle time Register 1 word Modbus address CW3030 Writing system marker to set the hour of the RTC Holding 3000 30 bytes 3015 Register 15 words
50. ssion lt arg9 gt Error VAR OUT insert a variable tag Types of data BOOL Description error during requisition performance Note The variable must have writing permission lt 10 gt ErrorlD VAR OUT insert a variable tag Types of data BYTE or USINT Description In case of requisition error the type of error occurred will be indicated Possible results 0 Successfully performed 1 Some input data invalid example Master disabled 4 Timeout in the response by the slave 5 Slave returned error Note The variable must have writing permission MB Write Register Writing of Registers Block for the writing of registers It allows the writing of up to 16 sequential registers using function 6 Write Holding Register or 16 Write Multiple Registers in the Modbus PLC300 31 Operation the Modbus Network Master Mode Execute MB_WriteRegiste lt arg0 gt 4 SlaveAddress Function lt arg2 gt InitialiDataAddress lt arg3 gt 4 NumberOfData sarg4 gt lt arg5 gt has an Execute block enabling input and Done output which is activated after the end the function s successful performance After the positive transition of Execute a new telegram is sent by the Modbus RTU master when the RS485 serial interface is free At the operation successful end response received from the slave the Done output is activate
51. t a 16 bit integer with or without signal In this case the bytes MBO and 96 1 are reserved for this marker MDO double marker it takes four memory bytes and it can represent 32 bit integer with or without signal In this case the bytes and are reserved for this marker In the access by registers it is necessary to read or write two registers in a row withthe least significant value in the first register so that the four bytes will be accessed Table 5 1 Example of data addressing for volatile markers on the PLC300 Marker Type Byte Word Double MB MW MD Modbus addr Register bit 8000 40000 40015 8001 40016 40031 8002 40032 40047 8003 40048 40063 Similarly it is possible to access the data using the bit access functions In this case a bit can be accessed individually or in a group of bits that represents a marker For example if it is defined on the WPS software a word marker in address 8000 it is possible to access this marker by using the functions of multiple coil reading or writing using the bits 40000 to 40015 At the memory addresses of the PLC300 variables with size above one byte are always stored with the least significant byte first Thus the available soace on memory for Byte Word or Double values follows the description of the following table Table 5 2 Example of data addressing for volatiles markers on the PLC300 Marke
52. ta type holding register or coil PLC300 15 Operation the Modbus Network Slave Mode Modbus access functions 01 03 05 06 15 and 16 Modbus address range for access via holding register 5000 5999 Modbus address range for access coil 16000 23999 For the precise description of which markers are available and function of each marker refer to the user s manual of the PLC300 5 2 5 Network Inputs IB IW ID Markers that represent data related to values received through the PLC300 network interfaces They have the same terminology as the physical inputs but their numbering begins from marker 2000 example IB2000 Access read only Data type input register or input discrete Modbus access functions 02 and 04 Modbus address range for access via input register 6000 7999 Modbus address range for access via input discrete 24000 39999 5 2 6 Network Outputs QW QD Markers that represent data related to values transmitted through the PLC300 network interfaces They have the same nomenclature as the physical outputs but their numbering begins from marker 2000 example 2000 Access read write Data type holding register or coil Modbus access functions 01 03 05 06 15 and 16 Modbus address range for access via holding register 6000 7999 Modbus address range for access via coil 24000 39999 5 2 7 Internal Marker MB MW
53. tion It indicates the error code in case the master receives an error response from some slave It is zeroed whenever the equipment is disconnected or the master is disabled O to 255 Note The variable must have writing permission NOTE The data accessed through the use of this block is also available through reading and writing system markers as described in item 8 MB Slave Status Modbus RTU Network Slave Status Block to monitor the slaves in the Modbus RTU network It must be used in case it is desired to identify problems in the communication between the master and some slave in the Modbus RTU network PLC300 34 E Operation in the Modbus Network Master Mode Execute MB SiaveStatus Done ErrorsToS Offiine GeneralOfiine AddressSiavel Slave10ffline AddressSiave2 AddressSlaves AddressSlaved SiavedOfiine has an Execute block enabling input and Done output which is activated after the end of the function s successful performance While the Execute enabling input is active the input data is used and the output data is updated at every performance of the block Output Done reflects the value of the input Input Output lt argO gt ErrorsToSetOffline VAR IN insert a constant Types of data BYTE Description It allows programming for this block the quantity of communication errors which the master must identify until the communication with a network slave is conside
54. tracted from 1 in order to send through the Modbus network FALSE Without Offset TRUE With Offset of 1 lt arg6 gt Active VAR OUT insert a variable tag Types of data BOOL Description Active block requisition for reading sent to the slave and awaiting response Note The variable must have writing permission lt 7 gt VAR OUT insert a variable tag Types of data BOOL Description Block enabled though resource is not available RS485 interface busy with another requisition waiting for release so that the request is sent by the block If the enabling input is removed while the block makes that indication the requisition is rejected Note The variable must have writing permission lt arg8 gt Error VAR OUT insert a variable tag Types of data BOOL Description error during requisition performance Note The variable must have writing permission lt arg9 gt VAR OUT insert a variable tag Types of data BYTE or USINT Description In case of requisition error the type of error occurred wil be indicated Possible results 0 Successfully performed 1 Some input data invalid example Master disabled 4 Timeout in the response by the slave 5 Slave returned error Note The variable must have writing permission lt arg10 gt Value VAR OUT insert a variable tag Types of data 128 Description Variable or array where th
55. writing permission PLC300 29 meg 7 1 3 Operation in the Modbus RTU Network Master Mode lt arg8 gt Error VAR OUT insert a variable tag Types of data BOOL Description error during requisition performance Note The variable must have writing permission lt arg9 gt ErrorlD VAR OUT insert a variable tag Types of data BYTE or USINT Description In case of requisition error the type of error occurred will be indicated Possible results 0 Successfully performed 1 Some input data invalid example Master disabled 4 Timeout in the response by the slave 5 Slave returned error Note The variable must have writing permission lt 10 gt Value VAR OUT insert a variable tag Types of data 32 SINT 1 32 USINT 1 32 16 16 16 DWORD 1 8 UDINT 1 8 DINT 1 8 or REALI 8 Description Variable or array where the slave s read data will be stored Note The variable must have writing permission NOTE Modbus RTU protocol using functions and 4 allows the reading of 16 bit registers only for the reading of data with more than 16 bits a REAL for instance it is possible to perform the reading of multiple registers and store the value in a variable which size is bigger than 16 bits It is important that the quantity of read registers is compatible with the size of the variabl
56. x41 0x01 0 0 0x80 0x41 0x00 OxCl 0x81 0x40 0 01 0 0 0 80 0 41 0 00 0 1 0x81 0 40 0 00 OxCl 0x81 0 40 0x01 0 0 0x80 0x41 0 00 0 1 0 81 0 40 0 01 0 0 0 80 0 41 0 01 0 0 0 80 0 41 0 00 OxCl 0 81 0 40 0 01 0 0 0 80 0 41 0 00 OxCl 0 81 0 40 0 00 OxCl 0x81 0 40 0 01 0 0 0 80 0x41 0 01 0 0 0x80 0 41 0x00 OxCl 0x81 0 40 0 00 OxCl 0 81 0x40 0 01 0 0 0x80 0 41 0 00 0 1 0 81 0 40 0 01 0 0 0 80 0x41 0 01 0 0 0x80 0 41 0 00 0 1 0 81 0 40 16 Table of CRC values for low order byte static char auchCRCLo 0x00 0 0 0 1 0 01 OxC3 0x03 0 02 OxC2 OxC6 0x06 0 07 0 7 0 05 0 5 OxC4 0x04 0 0x0C 0 0 OxCD 0 0 OxCF OxCE 0 0 0 0 OxCA OxCB 0 0 0 9 0x09 0 08 0 8 OxD8 0x18 0x19 OxD9 0x1B OxDB OxDA 0 1 0 1 OxDE OxDF 0 1 OxDD 0 1 0 1 OxDC 0 14 0 4 OxD5 0 15 0 7 0 17 0 16 OxD6 OxD2 0x12 0x13 OxD3 0 11 0 01 0 00 0x10 OxFO 0 30 0 31 0 1 0x33 OxF3 OxF2 0x32 0x36 OxF6 OxF7 0 37 OxF5 0x35 0x34 OxF4 0 3 OxFC OxFD 0x3D Ox3F Ox3E OxFE OxFA 0 3 0x3B OxFB 0x39 OxF9 OxF8 0x38 0x28 OxE8 0 9 0x29 0x2B 0 2 0 2 Ox2F OxEF 0x2D OxED OxEC 0x2C OxE4 0x24 0x25 OxE5 0x27 0 7 OxE6 0

Download Pdf Manuals

Related Search

Related Contents

matériel photo futur 6è  Mode d`emploi - Promac www.promac.ch  Manuel d'utilisation        Beschreibung der Leistungseinheiten - Software  Manual de instruções    Administration, maintenance and troubleshooting  

Copyright © All rights reserved. Failed to retrieve file