GFK2568

January 2010 GFK-2568

1

Additional Important Product Information for Release 3.83 This document is an addendum to GFK-2566A. It provides important information about features introduced in Micro PLC version 3.83.

Modbus/TCP Client Support The versions 3.83 and later of the Micro firmware and version 2.0 of the Ethernet Option Module provide Modbus TCP Client Support, which allows you to generate read or write requests to the Modbus TCP server device. To use this feature, the CPU’s Port 2 must be configured for Modbus RTU Slave. The Ethernet Option Board acts as Modbus RTU master on serial side. Because the Micro PLC is configured as RTU Slave, it cannot send the commands directly to the Ethernet Module. For this reason Micro updates the Modbus TCP request at a specified reference memory location, which is read by the Ethernet module to process the command sent.

The Ethernet module reads the Modbus command framed by the Micro PLC. The Ethernet module then communicates with the server device and updates the response back to the Micro PLC, along with the status. In the Ethernet module, one channel can be configured for Modbus TCP Client. The remaining channels are used for Modbus TCP Server. The server should not use the channel configured for client. Similarly the client should not reclaim the channels configured for server. Channels should not be switched between client/server dynamically until you reconfigure the Ethernet module.

To trigger the Modbus/TCP Client request, complete the following steps.

1. Hardware configuration in Machine Edition. This creates the Sequence and Command data address configurations.

2. Configure Modbus/TCP Client and serial parameters in TELNET.

3. Create logic in Machine Edition to process the Read/Write request.

Note: Please make sure that the MODBUS_TCP_RW function block is triggered in the logic only when %I00488 is on. (When the Ethernet Option Module is configured with the Modbus/TCP Client parameters, the %I00488 status bit is on.) Otherwise error “85B0H” will be output in the function block status.

1. Hardware Configuration In the CPU Settings, set Port 2 Configuration to Ethernet.

On the Port 2 (Ethernet) tab, set the parameters as follows: Port Mode: RTU Port Type: Slave Data Rate: Select data rate (Max:

175000bps). For details on data rates supported on Port 2, refer to “Enhanced Data Throughput” on page 11.

Modbus/TCP Client Support: Enabled Sequence Numbers Start Address:

Assign %R memory. Occupies 5 words

Command Data Start Address:

Assign %R memory. Occupies 12 words

Note: Sequence Number and Command Data addresses should not overlap or conflict with any other variables used in the logic.

2. Telnet Configuration a. Connect the PLC with Port 2 to the Ethernet Option

Module in the network.

b. Type TELNET <Ethernet Option Module IP: x.x.x.x> 9999 at the command prompt.

c. Configure the Modbus/TCP to RTU Bridge as follows.

July 2009 GFK-2568

2

Sample Modbus/TCP to RTU Bridge Setup

1) Network/IP Settings:

IP Address……………… <x.x.x.x>

Default Gateway ............ <x.x.x.x>

Netmask ................…..... <x.x.x.x>

SNMP is enabled

2) Serial & Mode Settings:

Protocol ...............Modbus/RTU,Slave(s) attached

Modbus/TCP Client .......... disabled

Serial Interface ........…….. 175000,8,O,1

4) Advanced Modbus Protocol settings:

Slave Addr/Unit Id Source: Modbus/TCP header

Modbus Serial Broadcasts ... .................................Disabled (Id=0 auto-mapped to 1)

MB/TCP Exception Codes ..... ........................................ Yes (return 00AH and 00BH)

Char, Message Timeout ...... .............................................. 00050msec, 05000msec

D)efault settings, S)ave, Q)uit without save

Select Command or parameter set (1..4) to change:...2

Attached Device (1=Slave 2=Master) ..........................1

Modbus/TCP Client Enabled (N) ................................ Y

Close Idle TCP sockets after (3-60 sec, 0=leave open) ..............................................................10 Press Enter

Serial Protocol (1=Modbus/RTU 2=Modbus/ASCII).....1 Press Enter

Enter serial parameters (38400,8,0,1) ..... 175000,8,O,1

Modbus/TCP to RTU Bridge Setup

After entering all the values, the Modbus/TCP to RTU Bridge Setup screen appears showing the configured values. To save the parameters, press S.

1) Network/IP Settings:

IP Address ......................................... 3.212.218.12

Default Gateway .......................... 003.212.218.001

Netmask ...................................... 255.000.000.000

SNMP is enabled

2) Serial & Mode Settings:

Protocol ..................Modbus/RTU,Slave(s) attached

Modbus/TCP Client .................................... enabled

Serial Interface .................................. 175000,8,O,1

4) Advanced Modbus Protocol settings:

Slave Addr/Unit Id Source ...... Modbus/TCP header

Modbus Serial Broadcasts ... Disabled (Id=0 auto-mapped to 1)

MB/TCP Exception Codes ..... Yes (return 00AH and 00BH)

Char, Message Timeout ....00050msec, 05000msec

D)efault settings, S)ave, Q)uit without save

Select Command or parameter set (1..4) to change: .................................................................................. S

3. Logic to Process Read/Write Requests The MODBUS_TCP_RW function block is used to process read/write requests.

July 2009 GFK-2568

3

Parameters of MODBUS_TCP_RW

Parameter Data Type,

Memory Area

Description

Inputs

???? DWord, R Control word. Requires two bytes in %R memory. Do not write or clear this memory during operation of the MODBUS_TCP_RW function.

Enable Flow When the function is enabled, the operation is performed.

EX Flow Execute. A low to high transition starts command processing.

CH Word, Constant

Channel number on which the request will be processed. Should be 1.

FC Word, AI, AQ, R, Constant

Function code. Modbus RTU function to be carried out. See page 3 for valid function codes.

LMR Word, AI, AQ, R, Constant

Segment selector for Local reference memory type. Destination memory type for a Read operation; Source memory type for a Write operation.

LMR Value

Description

18 %Q discrete output memory (Byte mode)

72 %Q discrete output memory (Bit mode) 8 %R register memory (Word mode)

LMO Word, AI,

AQ, R, Constant

Local PLC reference memory address for Modbus/TCP Client device’s location. Destination for a read operation; Source for a write operation.

RMO Word, AI, AQ, R, Constant

Remote PLC reference memory address for Modbus/TCP Server device’s location. Source for a read operation this memory; Destination for a write operation.

DL Word, AI, AQ, R, Constant

For valid lengths refer to the comments in the table “Modbus/TCP Function Codes Supported by VMNM PLCs” on page 3.

IP Word, AI, AQ, R

IP Start address. This is the IP Address of the Server device. Starting from this address, four words would contain four octets of the IP.

UI Word, AI, AQ, R, Constant

Unit Identifier. A control code used in a Modbus/TCP message. This value is 1 for most Modbus/TCP devices except for an Ethernet to Serial bridge used to multi-drop to Modbus RTU devices. Valid values: 0—255

ParameterData Type,

Memory Area

Description

Outputs

ENO Flow Enable output. CMPL Bool, I, Q,

M, G, T Complete. Set when the read or write operation has been successfully completed.

BUSY Bool, I, Q, M, G, T

Busy. Set when the read or write process is in operation and has not been completed.

ERR Bool, I, Q, M, G, T

Error. Set when an error is identified during operation.

STS Word, AI, AQ, R

Status. May include the following: Remote Server exceptions Function block parameter errors Client application errors

For a list of status/error codes, refer to page 4.

MODBUS/TCP Function Codes Supported by VersaMax Micro PLCs

Function Function Code

Server Reference Memory

Type

Data Unit Size

Comments

Read Coils

1 Coils Bit Read up to 2,000 bits

Read Input Discrete

2 Discrete Inputs

Bit Read up to 2,000 bits

Read Multiple Registers

3 Register Register (16-bit word)

Read up to 125 words

Read Analog Input Registers

4 Analog Input Registers

Register (16-bit word)

Read up to 125 words

Write Coil 5 Coil Bit Write one bit

Write Single Register


Write one word

Read Exception Status

7 -NA- Byte -NA-

Write Multiple coils

15 Coil Bit Write multiple bits, up to 2000

Write Multiple Registers


Write to a maximum of 100 words

July 2009 GFK-2568

4

Status/Error Codes Status codes are reported in the following format:

00 00

Minor status code (high byte)

Major status code(low byte)

Major Status Codes Error Status

(Hex) Major Status Description

01H Successful completion. No minor status code (value can be ignored.)

91H Modbus TCP Status codes at the server. An error was detected at the Modbus TCP server. See the table on page 4 for the associated Minor Status Codes.

B0H Client Application Error. See the table on page 4 for the associated Minor Status Codes.

B1H Serial link error codes between Micro and Ethernet Module. See the table on page 5 for the associated Minor Status Codes.

Minor Status Codes for Major Status 91H The following table lists minor status codes that can be reported for status code 91H, Remote Server Device error.

Error Status (Hex)

Error Description

0191H Illegal Function. The function code received in the request is not allowed for the server. Causes may be: The function code is not implemented in

the unit selected. For example, it may be a function that applies only to newer controllers.

The server is in the wrong state to process a request of this type, for example because it was not configured and is being asked to return register status. Modbus exception code 01H.

0291H Illegal data address. The data address received in the query is not an allowable address for the server. More specifically, the combination of reference number and transfer length is invalid. MODBUS exception code 02.

0391H Illegal data value. A value contained in the query data field is not an allowable value for server. This indicates a fault in the structure of the remainder of a complex request, such as that the implied length is incorrect. It specifically does NOT mean that a data item submitted for storage in a register has a value outside the expectation of the application program, since the MODBUS protocol is unaware of the significance of any particular value of any particular register. MODBUS exception code 03.

Error Status(Hex)

Error Description

0491H Slave Device Failure. An unrecoverable error occurred while the server was attempting to perform the requested action.

0691H Slave Device Busy. Server service request queue full. MODBUS exception code 06.

0791H Negative Acknowledge. Internal server error occurred. MODBUS exception code 07

Minor Status Codes for Major Status B0H The following table lists minor status codes that can be reported for status code B0H, Client Application Error.

Error Status (Hex)

Error Description

85B0H Client device not yet ready to send the request.

86B0H Server unit data size of zero is not allowed. The data unit size for read/write operations should be greater than zero.

87B0H Server unit data size is too large. The data unit size for read/write operations should not cross the maximum value. Example: If the data length specified for Read/Write coil is greater than 1, this error code is returned.

88B0H Invalid Channel Number 8BB0H This error will be triggered when the server

reference memory address is zero, which is not allowed.

8CB0H Invalid Client Memory Type. This error is triggered when the specified client reference memory type is invalid. Refer to page 3 for valid memory types.

8EB0H Invalid IP address integer. All four octets of the IP address should be in the range 0 to 255.

8FB0H Invalid IP address class. 90B0H Insufficient TCP connection resources to

perform request. 91B0H Zero local starting address is not allowed,

The starting address of the client PLC memory location should be greater than zero.

95B0H Internal Error. This problem may occur due to the Ethernet Interface being asked to perform beyond its capacity.

96B0H Underlying TCP connection aborted (reset) by server end point. The server is not responding within the timeout value.

97B0H Underlying TCP connection aborted (reset) by Client end point.

9CB0H Invalid frame format. Data response did not arrive in a proper order.

9DB0H Data response had unexpected size. For example received more data than expected.

9FB0H Invalid Client PLC Memory reference address.

July 2009 GFK-2568

5

Error Status (Hex)

Error Description

B6B0H Unrecognized Function code. The Client device does not support the function code or operation.

B7B0H Invalid Unit Identifier. A0B0H Invalid Server Reference Memory Address. A2B0H Failed to update the Micro reference memory.

Ethernet Module was unable to write to the Client memory specified in the command data.

A7B0H Unable to connect to remote device after successful channel establishment.

AAB0H An attempt to establish a TCP connection with a remote server failed. This error can be caused by the following conditions:

Server is not turned on Cables are not properly connected If using a switch, switch is not turned on

This error can occur while establishing the connection with the server device.

ACB0H A protocol error occurred while communicating with the local PLC. This error can occur when a break in the frame or check sum error occurred.

ADB0H A TCP timeout occurred while communicating with the remote PLC.

Minor Status Codes for Major Status B1H The following table lists the minor status codes that can be reported for the major status code B1H, which indicates a Serial Link error in the communications between the Ethernet module and the Micro PLC.

If communication between the Ethernet Module and the Micro CPU is not functional, the Ethernet Module indicates the problem by LED blink patterns and through the TELNET connection. If the error codes reported by the Ethernet Module, by LEDs or through TELNET, are different, the Serial Link error code has the highest priority.

Error Status (Hex)

Error Description

01B1H Unable to read the Sequence Number Data Structure.

02B1H Unable to read the Command Data Structure 03B1H Unable to read/write Client PLC reference

memory (segment selector/offset specified in command data structure).

04B1H Unable to update the response status/sequence number

05B1H Serial Communication error (Parity, Baud rate, framing, Over run etc.) with the Micro CPU.

July 2009 GFK-2568

6

Examples for MODBUS_TCP_RW For the following examples:

1. The IP address is stored as integer values in the four words starting at %R1001.

4. When %I00488 is on, the MODBUS_TCP_RW function block is executed on the rising transition of %T0001. For parameter definitions, refer to page 3.

Function Sample Rung

Reading Coils (FC=1) Reads a coil at offset 10 (RMO=10) in the remote Modbus TCP server and store the value at the location %Q10 (LMR=72, LMO=10).

Reading Discrete Inputs (FC=2) Read nine discrete inputs from offset 5 (RMO=5) in the remote Modbus TCP server and store the values in bit mode at %Q3 (LMR=72, LMO=3).

July 2009 GFK-2568

7


Reading Multiple Registers (FC=3) Read 125 registers from the remote server device. The Remote server reference address is %R0101 (LMR=8, LMO=101). The Client or Local PLC reference memory address is %R5001 (LMR=8, RMO=5001).

Reading Analog Inputs (FC=4) Read nine analog input registers at offset 200 (RMO=200) in the remote Modbus TCP device and store the values in the Client PLC memory location %R0020 (LMR=8, LMO=20).

July 2009 GFK-2568

8


Writing a Coil (FC=5) Write the value at %Q4 (LMR=72, LMO=4) in the Client PLC memory location to coil %Q5 (RMO=5) in the remote Modbus TCP device.

Writing a Single Register (FC=6) Write one register from %R10 (LMR=8, LMO=10) to a holding register at offset 200 (RMO=200) in the remote Modbus TCP server.

July 2009 GFK-2568

9


Reading Status (FC=7) Read the Status from the remote Modbus TCP server and store the Status data in bit mode at location %Q4 (LMR=72, LMO=4).

Writing Multiple Coils (FC=15) Write the eight values starting from %Q1 (LMR=72, LMO=1) in the Client reference memory to eight coils starting at offset 1 (RMO=1) in the Remote Modbus TCP device.

July 2009 GFK-2568

10


Writing Multiple Registers (FC=16) Write 100 registers from the Client reference memory address %R5001 (LMR=8, LMO=5001) to the remote server reference address %R101 (RMO=101).

July 2009 GFK-2568

11

Enhanced Data Throughput The versions 3.83 of Micro and versions 2.0 and later of the Ethernet Option Module firmware provide Enhanced Data Throughput on Port 2 of the Ethernet Option Board. The following are the changes:

Data rates supported for the Ethernet Option Module are: 19,200bps, 38,400bps and 175,000bps. Earlier firmware releases supported data rates 300bps through 38,400 on Ethernet Module. This release removes support for 300bps through 9,600bps data rates and adds support for a higher data rate of 175,000bps.

There is no change in the data rates supported for RS-232/USB and RS-485 option modules.

When Ethernet Module is connected, the data rate of 175000bps can also be configured using the port configuration COMMREQ, described in “Serial I/O/SNP/RTU Protocols” in the VersaMax Nano and Micro PLCs User’s Manual, GFK-1645. The Data Rate parameter for 175,000bps is 10.

When 175,000bps data rate is selected, a value of 2ms is automatically selected internally for SNP T1 timer value (default T1 value is 5 ms). This will result in increased throughput for communication with SNP protocol.

The default data rate for Port 2 with the Ethernet Option module is 175,000bps. This is the data rate for which the Micro Port 2 will be configured during auto-configuration with Ethernet module connected.

As the hardware ID of the RS 232 and USB Option modules are the same as that of Ethernet Module, auto-configuration with these option modules connected will result in Port 2 configured to 175000bps (which is unsupported data rate for these option modules). To configure Port 2 to a valid data rate, connect to Port 1 and download a configuration with a valid data rate for Port 2.

Since there is no difference in Hardware ID between Ethernet, RS 232 and USB option boards, there will not be any “Mismatch” fault generated in the fault table even if “Ethernet” is selected for the Port 2 configuration (with 175,000 data rate), but RS 232 or USB option module is actually connected to the Micro.

The following are the version 2.0 Ethernet drivers (Ethernet Module firmware upgrade):

GE SRTP: 82A1587-MS10-000-B0.zip Modbus TCP: 82A1588-MS10-000-B0.zip Tunneling(PassThru): 82A1589-MS10-000-B0.zip

Security Settings for the Ethernet Option Module Two security settings are supported for the Ethernet Option Module (firmware version 2.0 and later): Password support for Telnet configuration and SNMP (Enable/Disable) configuration.

These security settings options are present in the "Network/IP Settings" menu for Modbus TCP and SRTP protocols. For Tunneling (Passthrough), these security settings are present in "basic parameters/server" menu.

Security settings are provided for the three protocols: SNP/SRTP, Modbus TCP and Tunneling.

By default, there is no password and Simple Network Management Protocol (SNMP) is enabled.

Disabling or Enabling the SNMP is configurable.

The maximum password length is 16 characters. These characters can be alphanumeric or special characters. The password requires a minimum length of 8 characters.

A password set on a particular protocol’s firmware remains in effect if the firmware is changed to that of a different protocol. For example, if a password is set on Modbus TCP firmware and later the firmware is changed to SNP/SRTP, the same password set on Modbus TCP firmware will still apply.

If the password is set, it will be required before entering to the Telnet configuration Setup Mode. After prompting for password, if the password is not entered within 30 seconds, the Telnet session will expire.

Documents

GFK2568