Emsa HS500E manual G E 5 6 O F 8

Page 56

C H A P T E R 6 : M O D B U S T C P P R O T O C O L

6 . 2 . 2 M o d b u s T C P C o m m a n d , R e s p o n s e & H a n d s h a k i n g E x a m p l e

1The Host issues an RFID command to the HS500E, writing the command string to the holding registers for Device ID 1. An Overall Length value of 0x06 is written last to holding register 40001.

2The HS500E recognizes that the Overall Length value at holding register 40001 for Device ID 1 has changed, indicating that it has data waiting to be retrieved.

3The HS500E retrieves the data and clears the Overall Length holding register of Device ID 1 - setting it back to its default value of zero (0x00).

Note: when the value stored at register 40001 of Device ID 1 returns to 0x00, the Host can assume that the command was at least received and execution was attempted. The Host will also assume that it is now OK to write another command to the holding registers of Device ID 1.

4The HS500E, now having retrieved the pending data from the holding registers for Device ID 1, executes the command accordingly.

5As the HS500E finishes executing the given command, it generates a Host- bound command response. Response data is written to the holding registers for Device ID 33, the Overall Length value is, again, written last to holding register 40001.

Note: Host-bound data is always written to Device ID 33 by the HS500E.

6Because the holding register at 40001 (Overall Length value) of Device ID 33 now contains a non-zero length value, the Host recognizes that there is response data from the HS500E waiting to be retrieved.

7The Host imports the pending data from the holding registers of Device ID 33 and then clears (sets back to 0x00) the Overall Length value at register 40001.

Note: the clearing of register 40001 of Device ID 33 indicates to the HS500E that the Host has indeed received the command response and that it is now OK to write another response to the holding registers of Device ID 33.

This completes the Modbus TCP handshaking cycle.

H S 5 0 0 E – O P E R A T O R ’ S M A N U A L	P / N : 1 7 - 1 3 0 5 R E V 0 2 ( 1 2 - 0 5 )
	P A G E 5 6 O F 8 2

Image 56

Contents Page Industrial Ethernet Antenna 800 626-3993 toll free 831 438-7000 office 831 438-5768 faxHS500E FCC Compliance Notice FCC PartTable of Contents Syntax Errors RF Response Errors Modbus TCP Command Structure Modbus TCP Response StructureRAW TCP/IP Command Example RAW TCP/IP Response Example Html Server and OnDemand OverviewAppendix B Ascii Chart Appendix C ETHERNET/IP Object Model Getting Started IntroductionO m pa n y B a c k g r o u n d F I D E r v i e wE X N o ta t i o n About this ManualH o S h o u l d R e a d t h i s M a n u a l ? Dimensions & Diagrams I m e n s i o n s To p V i e wDimensions Side View I m e n s i o n s S i d e V i e wDimensions Rear View Power & Ethernet E D D e s c r i p t i o n s LED DescriptionsN t e n n a R e a d R a n g e F r o n t V i e w N t e n n a R e a d R a n g e S i d e V i e w Installation & Setup Installation P r e c a u t i o n sInstall i n g t h e H S 5 0 0 E IP Configuration IP Address ConfigurationE Fault I P a d d r e s s Html ServerEnter new IP address values in the fields provided Html Server IP ConfigurationHtml Server- Main Pinging the HS500E Ping IP AddressT E Rfid CommandsCommand Structure See the .2.1 Rfid Command Table for Complete list M m a n d P a c k e t S t r u c t u r e Ta b l e06 + SecondsCommand Echo is Byte RF Error CounterS p o n s e P a c k e t S t r u c t u r e Ta b l e Word, Node ID EchoReturned Data Bytes 3 Retry Counter in the MSBReturned Data Bytes 1 Rfid Commands I D C o m m a n d s Ta b l eField Name Word ValueReturned Data bytes 3,4 MSB = RF Retry Counter 0100 LSB = Reserved Total TimeReturned Data bytes 1 I T E D a T a 0006 0003 0101 Xxxx L L T a G 0006 0005 0101 XxxxM M a N D F S T L E D S / G E T I N F O 0006 F100 0001 0000Command F1 Test LEDs / Read Info Response Structure Applicable when word 2 is F203 Word Field NameWord ValueWord # Field Name MSB = RF Retry Counter LSB = Reserved Total TimeI T E I P a D D R E S S This example sets the IP address of the HS500E toAppendix a IP Address Reset HS500E Factory Default IP AddressThere is no response for this command S E T B a T T E R Y C O U N T E RError Codes Error TypesY n t a x Error s F R e s p o n s e Error sWhat is Ethernet/IP? Chapter ETHERNET/IP ProtocolSteps to Configure the HS500E HS500E Node Configurationƒ Configure the HS500E via OnDemand Node Configuration T M L S e r v e r a n d O n D e m a n d O v e r v i e wOnDemand Configuration OnDemand Node 01 Configuration Use this page to modify the settings for NodeController Settings Write SettingsRead Settings Write Tag Name / Write File AddressG E 4 4 O F 8 Configuring PLC Controller Tags O n t r o l l e r Ta g s S u m m a r yChecking Ondemand Status OnDemand StatusUsing the HS500E with Rslogix Screen shot of RSLogixT h e r n e t / I P H a n d s h a k i n g T h e r n e t / I P H a n d s h a k i n g E x a m p l eG E 4 9 O F 8 Write Tag where responses are written by the HS500E Html Server and Ondemand PLC Support Modbus TCP Overview O d b u s T C P C o m m a n d S t r u c t u r eWords / 200 Bytes 4000Modbus TCP Command Structure 3277565536 Node 01 Memory Map Consume RegistersO d b u s T C P R e s p o n s e S t r u c t u r e 40001Modbus TCP Response Structure Node 33 Memory Map Produce RegistersModbus TCP Handshaking O s t / H S 5 0 0 E M o d b u s T C P H a n d s h a k i n gG E 5 6 O F 8 Chapter RAW TCP/IP Protocol RAW TCP/IP Command & Response Examples LSB = Command ID 02 Read DataCommand AW T C P / I P C o m m a n d E x a m p l eAW T C P / I P R e s p o n s e E x a m p l e Appendix a IP Address Reset IP Address Reset ButtonAscii Chart Appendix BG E 6 2 O F 8 Appendix C ETHERNET/IP Object Model Class Attributes Name Data Type Data Value Access Rule Instance Attributes Name Data Type Data Value Access RuleETHERNET/IP Required Objects D e n t i t y O b j e c t 0 x 0 1 1 I n s t a n c eCommon Services Implemented for Service Name Code Status Word Bit Bit =Class Attributes Name Data Data Value Access Rule Type E s s a g e R o u t e r O b j e c t 0 x 0S s e m b l y O b j e c t 0 x 0 4 3 I n s ta n c e s Bitmap of Produce Instances with DataProduce Data Sequence Number Node 1 Serial Produce Data SizeNode 1 Serial Produce Data WORD100 All 0’s Node Serial Produce Data SizeNode Serial Consume Data WORD100 All 0’s Consume Data Sequence NumberNode Serial Consume Data Size Yes SetAttributeSingle Instance 0x80 Attributes Configuration InstanceInstance 0x81 Attributes Heartbeat Instance Input Only O n n e c t i o n M a n a g e r O b j e c t 0 x 0 C P O b j e c t 0 x F 5 1 I n s ta n c eInterface Configuration Get Structure IP Address Network MaskGateway Address Name ServerT h e r n e t L i n k O b j e c t 0 x F 6 1 I n s t a n c e Interface Speed100 Get Interface Flags Physical Address Usint Array6 GetVendor Specific Objects 5 0 0 E C o n s u m e D a t a O b j e c t 0 x 6 4 3S t a n c e s Bit 0 Instance 1 … Bit 31 InstanceConsume Data 8,000-8,249 Consume Data 9,000-9,249Consume Data 10,000-10,249 Consume Data 20,000-20,249Yes Get Attribute Single Yes Set Attribute Single5 0 0 E P r o d u c e D a t a O b j e c t 0 x 6 5 3 Produce Data 9,000-9,249 Produce Data 10,000-10,249Produce Data 20,000-20,249 122 Produce Data 30,000-30,249G E 7 8 O F 8 D e m a n d O b j e c t 0 x 6 7 1 0 I n s ta n c e s OnlyRead Tag Name ControlLogix G E 8 1 O F 8 EMS Warranty