G E 5 6 O F 8 | Emsa HS500E instruction

C H A P T E R 6 : M O D B U S T C P P R O T O C O L

6 . 2 . 2 M o d b u s T C P C o m m a n d , R e s p o n s e & H a n d s h a k i n g E x a m p l e

1The Host issues an RFID command to the HS500E, writing the command string to the holding registers for Device ID 1. An Overall Length value of 0x06 is written last to holding register 40001.

2The HS500E recognizes that the Overall Length value at holding register 40001 for Device ID 1 has changed, indicating that it has data waiting to be retrieved.

3The HS500E retrieves the data and clears the Overall Length holding register of Device ID 1 - setting it back to its default value of zero (0x00).

Note: when the value stored at register 40001 of Device ID 1 returns to 0x00, the Host can assume that the command was at least received and execution was attempted. The Host will also assume that it is now OK to write another command to the holding registers of Device ID 1.

4The HS500E, now having retrieved the pending data from the holding registers for Device ID 1, executes the command accordingly.

5As the HS500E finishes executing the given command, it generates a Host- bound command response. Response data is written to the holding registers for Device ID 33, the Overall Length value is, again, written last to holding register 40001.

Note: Host-bound data is always written to Device ID 33 by the HS500E.

6Because the holding register at 40001 (Overall Length value) of Device ID 33 now contains a non-zero length value, the Host recognizes that there is response data from the HS500E waiting to be retrieved.

7The Host imports the pending data from the holding registers of Device ID 33 and then clears (sets back to 0x00) the Overall Length value at register 40001.

Note: the clearing of register 40001 of Device ID 33 indicates to the HS500E that the Host has indeed received the command response and that it is now OK to write another response to the holding registers of Device ID 33.

This completes the Modbus TCP handshaking cycle.

H S 5 0 0 E – O P E R A T O R ’ S M A N U A L	P / N : 1 7 - 1 3 0 5 R E V 0 2 ( 1 2 - 0 5 )
	P A G E 5 6 O F 8 2

Image 56

Emsa HS500E manual G E 5 6 O F 8

Contents

Page Industrial Ethernet Antenna 800 626-3993 toll free 831 438-7000 office 831 438-5768 fax HS500E FCC Compliance Notice FCC Part Table of Contents Syntax Errors RF Response Errors Modbus TCP Command Structure Modbus TCP Response StructureRAW TCP/IP Command Example RAW TCP/IP Response Example Html Server and OnDemand Overview Appendix B Ascii Chart Appendix C ETHERNET/IP Object Model Getting Started IntroductionO m pa n y B a c k g r o u n d F I D E r v i e w E X N o ta t i o n About this ManualH o S h o u l d R e a d t h i s M a n u a l ? Dimensions & Diagrams I m e n s i o n s To p V i e w Dimensions Side View I m e n s i o n s S i d e V i e w Dimensions Rear View Power & Ethernet E D D e s c r i p t i o n s LED Descriptions N t e n n a R e a d R a n g e F r o n t V i e w N t e n n a R e a d R a n g e S i d e V i e w Installation & Setup Installation P r e c a u t i o n s Install i n g t h e H S 5 0 0 E IP Configuration IP Address ConfigurationE Fault I P a d d r e s s Html Server Enter new IP address values in the fields provided Html Server IP ConfigurationHtml Server- Main Pinging the HS500E Ping IP Address T E Rfid CommandsCommand Structure See the .2.1 Rfid Command Table for Complete list M m a n d P a c k e t S t r u c t u r e Ta b l e06 + Seconds Command Echo is Byte RF Error CounterS p o n s e P a c k e t S t r u c t u r e Ta b l e Word, Node ID Echo Returned Data Bytes 3 Retry Counter in the MSBReturned Data Bytes 1 Rfid Commands I D C o m m a n d s Ta b l e Field Name Word Value Returned Data bytes 3,4 MSB = RF Retry Counter 0100 LSB = Reserved Total TimeReturned Data bytes 1 I T E D a T a 0006 0003 0101 Xxxx L L T a G 0006 0005 0101 Xxxx M M a N D F S T L E D S / G E T I N F O 0006 F100 0001 0000 Command F1 Test LEDs / Read Info Response Structure Applicable when word 2 is F203 Word Field NameWord Value Word # Field Name MSB = RF Retry Counter LSB = Reserved Total Time I T E I P a D D R E S S This example sets the IP address of the HS500E to Appendix a IP Address Reset HS500E Factory Default IP Address There is no response for this command S E T B a T T E R Y C O U N T E R Error Codes Error TypesY n t a x Error s F R e s p o n s e Error s What is Ethernet/IP? Chapter ETHERNET/IP Protocol Steps to Configure the HS500E HS500E Node Configurationƒ Configure the HS500E via OnDemand Node Configuration T M L S e r v e r a n d O n D e m a n d O v e r v i e w OnDemand Configuration OnDemand Node 01 Configuration Use this page to modify the settings for NodeController Settings Write Settings Read Settings Write Tag Name / Write File Address G E 4 4 O F 8 Configuring PLC Controller Tags O n t r o l l e r Ta g s S u m m a r y Checking Ondemand Status OnDemand Status Using the HS500E with Rslogix Screen shot of RSLogix T h e r n e t / I P H a n d s h a k i n g T h e r n e t / I P H a n d s h a k i n g E x a m p l e G E 4 9 O F 8 Write Tag where responses are written by the HS500E Html Server and Ondemand PLC Support Modbus TCP Overview O d b u s T C P C o m m a n d S t r u c t u r eWords / 200 Bytes 4000 Modbus TCP Command Structure 3277565536 Node 01 Memory Map Consume Registers O d b u s T C P R e s p o n s e S t r u c t u r e 40001Modbus TCP Response Structure Node 33 Memory Map Produce Registers Modbus TCP Handshaking O s t / H S 5 0 0 E M o d b u s T C P H a n d s h a k i n g G E 5 6 O F 8 Chapter RAW TCP/IP Protocol RAW TCP/IP Command & Response Examples LSB = Command ID 02 Read DataCommand AW T C P / I P C o m m a n d E x a m p l e AW T C P / I P R e s p o n s e E x a m p l e Appendix a IP Address Reset IP Address Reset Button Ascii Chart Appendix B G E 6 2 O F 8 Appendix C ETHERNET/IP Object Model Class Attributes Name Data Type Data Value Access Rule Instance Attributes Name Data Type Data Value Access RuleETHERNET/IP Required Objects D e n t i t y O b j e c t 0 x 0 1 1 I n s t a n c e Common Services Implemented for Service Name Code Status Word Bit Bit = Class Attributes Name Data Data Value Access Rule Type E s s a g e R o u t e r O b j e c t 0 x 0S s e m b l y O b j e c t 0 x 0 4 3 I n s ta n c e s Bitmap of Produce Instances with Data Produce Data Sequence Number Node 1 Serial Produce Data SizeNode 1 Serial Produce Data WORD100 All 0’s Node Serial Produce Data Size Node Serial Consume Data WORD100 All 0’s Consume Data Sequence NumberNode Serial Consume Data Size Yes SetAttributeSingle Instance 0x80 Attributes Configuration InstanceInstance 0x81 Attributes Heartbeat Instance Input Only O n n e c t i o n M a n a g e r O b j e c t 0 x 0 C P O b j e c t 0 x F 5 1 I n s ta n c e Interface Configuration Get Structure IP Address Network MaskGateway Address Name Server T h e r n e t L i n k O b j e c t 0 x F 6 1 I n s t a n c e Interface Speed100 Get Interface Flags Physical Address Usint Array6 Get Vendor Specific Objects 5 0 0 E C o n s u m e D a t a O b j e c t 0 x 6 4 3S t a n c e s Bit 0 Instance 1 … Bit 31 Instance Consume Data 8,000-8,249 Consume Data 9,000-9,249Consume Data 10,000-10,249 Consume Data 20,000-20,249 Yes Get Attribute Single Yes Set Attribute Single 5 0 0 E P r o d u c e D a t a O b j e c t 0 x 6 5 3 Produce Data 9,000-9,249 Produce Data 10,000-10,249Produce Data 20,000-20,249 122 Produce Data 30,000-30,249 G E 7 8 O F 8 D e m a n d O b j e c t 0 x 6 7 1 0 I n s ta n c e s Only Read Tag Name ControlLogix G E 8 1 O F 8 EMS Warranty