Modbus TCP Overview, Words / 200 Bytes, 4000 | Emsa HS500E specification

C H A P T E R 6 : M O D B U S T C P P R O T O C O L

CHAPTER 6:

MODBUS TCP PROTOCOL

One of the most popular and well-proven industrial automation protocols in use today is Modbus. Modbus TCP allows the Modbus protocol to be carried over standard Ethernet networks.

6.1MODBUS TCP OVERVIEW

Under the Modbus TCP protocol, the HS500E acts as a Modbus Server and the Host or PLC is the Modbus Client. By utilizing Produce and Consume registers for mapping commands and responses, data produced by the HS500E is consumed by the Modbus Client and data produced by the Modbus Client is consumed by the HS500E.

NOTE:

The Modbus Client (Host or PLC) must connect to the Modbus Server (HS500E) on port 502.

Maximum number of words transferred to/from an RFID tag per read/write cycle:

100 Words / 200 Bytes

6 . 1 . 1 M o d b u s T C P C o m m a n d S t r u c t u r e

M A P P I N G N O D E 0 1 ( C O N S U M E R E G I S T E R S )

Consume Registers hold data destined for the HS500E. Modbus TCP commands must be placed in the holding registers of Device ID 1 (i.e. Node 01), starting at address 40001. Commands utilize at least six registers (double-byte values or words).

	Modbus	Read / Write		Register Description
	Address	Privilege
	(4xxxx /
	3xxxx)

	(4000) 1	R/W		2-byte HS500E Consume Data Overall Length
				(> 0 indicates that data is available; HS500E clears to
				0 after data is processed)

	2	R/W		MSB = Reader Type
				LSB = Command ID

	3	R/W		MSB = 0x00
				LSB = Node ID (0x01)


H S 5 0 0 E – O P E R A T O R ’ S M A N U A L				P / N : 1 7 - 1 3 0 5 R E V 0 2 ( 1 2 - 0 5 )
				P A G E 5 2 O F 8 2

Image 52

Emsa HS500E manual Modbus TCP Overview, O d b u s T C P C o m m a n d S t r u c t u r e, Words / 200 Bytes, 4000

Contents

Page Industrial Ethernet Antenna 800 626-3993 toll free 831 438-7000 office 831 438-5768 fax HS500E FCC Compliance Notice FCC Part Table of Contents Syntax Errors RF Response Errors Modbus TCP Command Structure Modbus TCP Response StructureRAW TCP/IP Command Example RAW TCP/IP Response Example Html Server and OnDemand Overview Appendix B Ascii Chart Appendix C ETHERNET/IP Object Model Getting Started IntroductionO m pa n y B a c k g r o u n d F I D E r v i e w H o S h o u l d R e a d t h i s M a n u a l ? About this ManualE X N o ta t i o n Dimensions & Diagrams I m e n s i o n s To p V i e w Dimensions Side View I m e n s i o n s S i d e V i e w Dimensions Rear View Power & Ethernet E D D e s c r i p t i o n s LED Descriptions N t e n n a R e a d R a n g e F r o n t V i e w N t e n n a R e a d R a n g e S i d e V i e w Installation & Setup Installation P r e c a u t i o n s Install i n g t h e H S 5 0 0 E IP Configuration IP Address ConfigurationE Fault I P a d d r e s s Html Server Html Server- Main Html Server IP ConfigurationEnter new IP address values in the fields provided Pinging the HS500E Ping IP Address Command Structure Rfid CommandsT E See the .2.1 Rfid Command Table for Complete list M m a n d P a c k e t S t r u c t u r e Ta b l e06 + Seconds Command Echo is Byte RF Error CounterS p o n s e P a c k e t S t r u c t u r e Ta b l e Word, Node ID Echo Returned Data Bytes 1 Retry Counter in the MSBReturned Data Bytes 3 Rfid Commands I D C o m m a n d s Ta b l e Field Name Word Value Returned Data bytes 1 MSB = RF Retry Counter 0100 LSB = Reserved Total TimeReturned Data bytes 3,4 I T E D a T a 0006 0003 0101 Xxxx L L T a G 0006 0005 0101 Xxxx M M a N D F S T L E D S / G E T I N F O 0006 F100 0001 0000 Command F1 Test LEDs / Read Info Response Structure Applicable when word 2 is F203 Word Field NameWord Value Word # Field Name MSB = RF Retry Counter LSB = Reserved Total Time I T E I P a D D R E S S This example sets the IP address of the HS500E to Appendix a IP Address Reset HS500E Factory Default IP Address There is no response for this command S E T B a T T E R Y C O U N T E R Error Codes Error TypesY n t a x Error s F R e s p o n s e Error s What is Ethernet/IP? Chapter ETHERNET/IP Protocol Steps to Configure the HS500E HS500E Node Configurationƒ Configure the HS500E via OnDemand Node Configuration T M L S e r v e r a n d O n D e m a n d O v e r v i e w OnDemand Configuration OnDemand Node 01 Configuration Use this page to modify the settings for NodeController Settings Write Settings Read Settings Write Tag Name / Write File Address G E 4 4 O F 8 Configuring PLC Controller Tags O n t r o l l e r Ta g s S u m m a r y Checking Ondemand Status OnDemand Status Using the HS500E with Rslogix Screen shot of RSLogix T h e r n e t / I P H a n d s h a k i n g T h e r n e t / I P H a n d s h a k i n g E x a m p l e G E 4 9 O F 8 Write Tag where responses are written by the HS500E Html Server and Ondemand PLC Support Modbus TCP Overview O d b u s T C P C o m m a n d S t r u c t u r eWords / 200 Bytes 4000 Modbus TCP Command Structure 3277565536 Node 01 Memory Map Consume Registers O d b u s T C P R e s p o n s e S t r u c t u r e 40001Modbus TCP Response Structure Node 33 Memory Map Produce Registers Modbus TCP Handshaking O s t / H S 5 0 0 E M o d b u s T C P H a n d s h a k i n g G E 5 6 O F 8 Chapter RAW TCP/IP Protocol RAW TCP/IP Command & Response Examples LSB = Command ID 02 Read DataCommand AW T C P / I P C o m m a n d E x a m p l e AW T C P / I P R e s p o n s e E x a m p l e Appendix a IP Address Reset IP Address Reset Button Ascii Chart Appendix B G E 6 2 O F 8 Appendix C ETHERNET/IP Object Model Class Attributes Name Data Type Data Value Access Rule Instance Attributes Name Data Type Data Value Access RuleETHERNET/IP Required Objects D e n t i t y O b j e c t 0 x 0 1 1 I n s t a n c e Common Services Implemented for Service Name Code Status Word Bit Bit = Class Attributes Name Data Data Value Access Rule Type E s s a g e R o u t e r O b j e c t 0 x 0S s e m b l y O b j e c t 0 x 0 4 3 I n s ta n c e s Bitmap of Produce Instances with Data Produce Data Sequence Number Node 1 Serial Produce Data SizeNode 1 Serial Produce Data WORD100 All 0’s Node Serial Produce Data Size Node Serial Consume Data Size Consume Data Sequence NumberNode Serial Consume Data WORD100 All 0’s Instance 0x81 Attributes Heartbeat Instance Input Only Instance 0x80 Attributes Configuration InstanceYes SetAttributeSingle O n n e c t i o n M a n a g e r O b j e c t 0 x 0 C P O b j e c t 0 x F 5 1 I n s ta n c e Interface Configuration Get Structure IP Address Network MaskGateway Address Name Server T h e r n e t L i n k O b j e c t 0 x F 6 1 I n s t a n c e Interface Speed100 Get Interface Flags Physical Address Usint Array6 Get Vendor Specific Objects 5 0 0 E C o n s u m e D a t a O b j e c t 0 x 6 4 3S t a n c e s Bit 0 Instance 1 … Bit 31 Instance Consume Data 8,000-8,249 Consume Data 9,000-9,249Consume Data 10,000-10,249 Consume Data 20,000-20,249 Yes Get Attribute Single Yes Set Attribute Single 5 0 0 E P r o d u c e D a t a O b j e c t 0 x 6 5 3 Produce Data 9,000-9,249 Produce Data 10,000-10,249Produce Data 20,000-20,249 122 Produce Data 30,000-30,249 G E 7 8 O F 8 D e m a n d O b j e c t 0 x 6 7 1 0 I n s ta n c e s Only Read Tag Name ControlLogix G E 8 1 O F 8 EMS Warranty