Emsa HS500E manual Modbus TCP Overview, O d b u s T C P C o m m a n d S t r u c t u r e, 4000

Page 52

C H A P T E R 6 : M O D B U S T C P P R O T O C O L

CHAPTER 6:

MODBUS TCP PROTOCOL

One of the most popular and well-proven industrial automation protocols in use today is Modbus. Modbus TCP allows the Modbus protocol to be carried over standard Ethernet networks.

6.1MODBUS TCP OVERVIEW

Under the Modbus TCP protocol, the HS500E acts as a Modbus Server and the Host or PLC is the Modbus Client. By utilizing Produce and Consume registers for mapping commands and responses, data produced by the HS500E is consumed by the Modbus Client and data produced by the Modbus Client is consumed by the HS500E.

NOTE:

The Modbus Client (Host or PLC) must connect to the Modbus Server (HS500E) on port 502.

Maximum number of words transferred to/from an RFID tag per read/write cycle:

100 Words / 200 Bytes

6 . 1 . 1 M o d b u s T C P C o m m a n d S t r u c t u r e

M A P P I N G N O D E 0 1 ( C O N S U M E R E G I S T E R S )

Consume Registers hold data destined for the HS500E. Modbus TCP commands must be placed in the holding registers of Device ID 1 (i.e. Node 01), starting at address 40001. Commands utilize at least six registers (double-byte values or words).

 

Modbus

Read / Write

 

Register Description

 

 

Address

Privilege

 

 

 

 

(4xxxx /

 

 

 

 

 

3xxxx)

 

 

 

 

 

 

 

 

 

 

 

(4000) 1

R/W

 

2-byte HS500E Consume Data Overall Length

 

 

 

 

 

(> 0 indicates that data is available; HS500E clears to

 

 

 

 

 

0 after data is processed)

 

 

 

 

 

 

 

 

2

R/W

 

MSB = Reader Type

 

 

 

 

 

LSB = Command ID

 

 

 

 

 

 

 

 

3

R/W

 

MSB = 0x00

 

 

 

 

 

LSB = Node ID (0x01)

 

 

 

 

 

 

 

 

 

H S 5 0 0 E – O P E R A T O R ’ S M A N U A L

P / N : 1 7 - 1 3 0 5 R E V 0 2 ( 1 2 - 0 5 )

 

 

 

 

P A G E 5 2 O F 8 2

Page 51 Page 53
Image 52
Page 51 Page 53
Contents Page Industrial Ethernet Antenna 800 626-3993 toll free 831 438-7000 office 831 438-5768 faxHS500E FCC Compliance Notice FCC PartTable of Contents Syntax Errors RF Response Errors Modbus TCP Command Structure Modbus TCP Response StructureRAW TCP/IP Command Example RAW TCP/IP Response Example Html Server and OnDemand OverviewAppendix B Ascii Chart Appendix C ETHERNET/IP Object Model Getting Started IntroductionO m pa n y B a c k g r o u n d F I D E r v i e wH o S h o u l d R e a d t h i s M a n u a l ? About this ManualE X N o ta t i o n Dimensions & Diagrams I m e n s i o n s To p V i e wDimensions Side View I m e n s i o n s S i d e V i e wDimensions Rear View Power & Ethernet E D D e s c r i p t i o n s LED DescriptionsN t e n n a R e a d R a n g e F r o n t V i e w N t e n n a R e a d R a n g e S i d e V i e w Installation & Setup Installation P r e c a u t i o n sInstall i n g t h e H S 5 0 0 E IP Configuration IP Address ConfigurationE Fault I P a d d r e s s Html ServerHtml Server- Main Html Server IP ConfigurationEnter new IP address values in the fields provided Pinging the HS500E Ping IP AddressCommand Structure Rfid CommandsT E See the .2.1 Rfid Command Table for Complete list M m a n d P a c k e t S t r u c t u r e Ta b l e06 + SecondsCommand Echo is Byte RF Error CounterS p o n s e P a c k e t S t r u c t u r e Ta b l e Word, Node ID EchoReturned Data Bytes 1 Retry Counter in the MSBReturned Data Bytes 3 Rfid Commands I D C o m m a n d s Ta b l eField Name Word ValueReturned Data bytes 1 MSB = RF Retry Counter 0100 LSB = Reserved Total TimeReturned Data bytes 3,4 I T E D a T a 0006 0003 0101 Xxxx L L T a G 0006 0005 0101 XxxxM M a N D F S T L E D S / G E T I N F O 0006 F100 0001 0000Command F1 Test LEDs / Read Info Response Structure Applicable when word 2 is F203 Word Field NameWord ValueWord # Field Name MSB = RF Retry Counter LSB = Reserved Total TimeI T E I P a D D R E S S This example sets the IP address of the HS500E toAppendix a IP Address Reset HS500E Factory Default IP AddressThere is no response for this command S E T B a T T E R Y C O U N T E RError Codes Error TypesY n t a x Error s F R e s p o n s e Error sWhat is Ethernet/IP? Chapter ETHERNET/IP ProtocolSteps to Configure the HS500E HS500E Node Configurationƒ Configure the HS500E via OnDemand Node Configuration T M L S e r v e r a n d O n D e m a n d O v e r v i e wOnDemand Configuration OnDemand Node 01 Configuration Use this page to modify the settings for NodeController Settings Write SettingsRead Settings Write Tag Name / Write File AddressG E 4 4 O F 8 Configuring PLC Controller Tags O n t r o l l e r Ta g s S u m m a r yChecking Ondemand Status OnDemand StatusUsing the HS500E with Rslogix Screen shot of RSLogixT h e r n e t / I P H a n d s h a k i n g T h e r n e t / I P H a n d s h a k i n g E x a m p l eG E 4 9 O F 8 Write Tag where responses are written by the HS500E Html Server and Ondemand PLC Support Modbus TCP Overview O d b u s T C P C o m m a n d S t r u c t u r eWords / 200 Bytes 4000Modbus TCP Command Structure 3277565536 Node 01 Memory Map Consume RegistersO d b u s T C P R e s p o n s e S t r u c t u r e 40001Modbus TCP Response Structure Node 33 Memory Map Produce RegistersModbus TCP Handshaking O s t / H S 5 0 0 E M o d b u s T C P H a n d s h a k i n gG E 5 6 O F 8 Chapter RAW TCP/IP Protocol RAW TCP/IP Command & Response Examples LSB = Command ID 02 Read DataCommand AW T C P / I P C o m m a n d E x a m p l eAW T C P / I P R e s p o n s e E x a m p l e Appendix a IP Address Reset IP Address Reset ButtonAscii Chart Appendix BG E 6 2 O F 8 Appendix C ETHERNET/IP Object Model Class Attributes Name Data Type Data Value Access Rule Instance Attributes Name Data Type Data Value Access RuleETHERNET/IP Required Objects D e n t i t y O b j e c t 0 x 0 1 1 I n s t a n c eCommon Services Implemented for Service Name Code Status Word Bit Bit =Class Attributes Name Data Data Value Access Rule Type E s s a g e R o u t e r O b j e c t 0 x 0S s e m b l y O b j e c t 0 x 0 4 3 I n s ta n c e s Bitmap of Produce Instances with DataProduce Data Sequence Number Node 1 Serial Produce Data SizeNode 1 Serial Produce Data WORD100 All 0’s Node Serial Produce Data SizeNode Serial Consume Data Size Consume Data Sequence NumberNode Serial Consume Data WORD100 All 0’s Instance 0x81 Attributes Heartbeat Instance Input Only Instance 0x80 Attributes Configuration InstanceYes SetAttributeSingle O n n e c t i o n M a n a g e r O b j e c t 0 x 0 C P O b j e c t 0 x F 5 1 I n s ta n c eInterface Configuration Get Structure IP Address Network MaskGateway Address Name ServerT h e r n e t L i n k O b j e c t 0 x F 6 1 I n s t a n c e Interface Speed100 Get Interface Flags Physical Address Usint Array6 GetVendor Specific Objects 5 0 0 E C o n s u m e D a t a O b j e c t 0 x 6 4 3S t a n c e s Bit 0 Instance 1 … Bit 31 InstanceConsume Data 8,000-8,249 Consume Data 9,000-9,249Consume Data 10,000-10,249 Consume Data 20,000-20,249Yes Get Attribute Single Yes Set Attribute Single5 0 0 E P r o d u c e D a t a O b j e c t 0 x 6 5 3 Produce Data 9,000-9,249 Produce Data 10,000-10,249Produce Data 20,000-20,249 122 Produce Data 30,000-30,249G E 7 8 O F 8 D e m a n d O b j e c t 0 x 6 7 1 0 I n s ta n c e s OnlyRead Tag Name ControlLogix G E 8 1 O F 8 EMS Warranty
Top Page Image Contents