Prosoft PLX3x User Manual

Add to My manuals
218 Pages

advertisement

Prosoft PLX3x User Manual | Manualzz

PLX3x Series

Ethernet and Serial Gateways

USER MANUAL

August 12, 2015

Your Feedback Please

We always want you to feel that you made the right decision to use our products. If you have suggestions, comments, compliments or complaints about our products, documentation, or support, please write or call us.

How to Contact Us

ProSoft Technology

5201 Truxtun Ave., 3rd Floor

Bakersfield, CA 93309

+1 (661) 716-5100

+1 (661) 716-5101 (Fax) www.prosoft-technology.com [email protected]

Copyright © 2015 ProSoft Technology, Inc., All rights reserved.

PLX3x Series Ethernet and Serial Gateways User Manual

August 12, 2015

ProSoft Technology

®

, ProLinx

®

, inRAx

®

, ProTalk

®

, and RadioLinx

®

are Registered Trademarks of ProSoft

Technology, Inc. All other brand or product names are or may be trademarks of, and are used to identify products and services of, their respective owners.

ProSoft Technology

®

Product Documentation

In an effort to conserve paper, ProSoft Technology no longer includes printed manuals with our product shipments.

User Manuals, Datasheets, Sample Ladder Files, and Configuration Files are provided on the enclosed DVD in

Adobe

®

Acrobat Reader file format (.PDFs). These product documentation files may also be freely downloaded from our web site: http://www.prosoft-technology.com/

Literature Content Disclaimer

This documentation is not intended as a substitute for and is not to be used for determining suitability or reliability of these products for specific user applications. It is the duty of any such user or integrator to perform the appropriate and complete risk analysis, evaluation and testing of the products with respect to the relevant specific application or use thereof. Neither ProSoft Technology nor any of its affiliates or subsidiaries shall be responsible or liable for misuse of the information contained herein. Information in this document including illustrations, specifications and dimensions may contain technical inaccuracies or typographical errors. ProSoft Technology makes no warranty or representation as to its accuracy and assumes no liability for and reserves the right to correct such inaccuracies or errors at any time without notice. If you have any suggestions for improvements or amendments or have found errors in this publication, please notify us.

No part of this document may be reproduced in any form or by any means, electronic or mechanical, including photocopying, without express written permission of ProSoft Technology. All pertinent state, regional, and local safety regulations must be observed when installing and using this product. For reasons of safety and to help ensure compliance with documented system data, only the manufacturer should perform repairs to components. When devices are used for applications with technical safety requirements, the relevant instructions must be followed.

Failure to use ProSoft Technology software or approved software with our hardware products may result in injury, harm, or improper operating results. Failure to observe this information can result in injury or equipment damage.

© 2015 ProSoft Technology. All rights reserved.

Important Installation Instructions

Power, Input, and Output (I/O) wiring must be in accordance with Class I, Division 2 wiring methods, Article 501-4 (b) of the National Electrical Code, NFPA 70 for installation in the U.S., or as specified in Section 18-1J2 of the Canadian

Electrical Code for installations in Canada, and in accordance with the authority having jurisdiction. The following warnings must be heeded:

This Equipment is Suitable For Use in Class I, Division 2, Groups A, B, C, D or Non-Hazardous Locations Only

WARNING – Explosion Hazard – Substitution of Any Components May Impair Suitability for Class I, Division 2

WARNING – Explosion Hazard – Do Not Disconnect Equipment Unless Power Has Been Switched Off Or The Area is Known To Be Non-Hazardous

Agency Approvals and Certifications

CE Mark

UL/cUL Class I Div II

ATEX Zone 2

CB Safety

RoHS

PLX3x Series

Ethernet and Serial Gateways

Contents

User Manual

Contents

Your Feedback Please ........................................................................................................................ 2

How to Contact Us .............................................................................................................................. 2

ProSoft Technology ® Product Documentation .................................................................................... 2

Literature Content Disclaimer ............................................................................................................. 2

Important Installation Instructions ....................................................................................................... 3

Agency Approvals and Certifications .................................................................................................. 3

1 Start Here

1.1

1.2

1.3

1.4

1.5

1.6

9

System Requirements ............................................................................................... 9

Package Contents ................................................................................................... 10

Mounting the Gateway on a DIN-rail ....................................................................... 11

Jumper Settings ...................................................................................................... 12

SD Card ................................................................................................................... 12

Connecting Power to the PLX3x Gateway .............................................................. 13

2 Configuring Your Gateway

2.1

2.2

2.3

2.4

2.5

2.6

2.7

2.8

2.9

15

Installing ProSoft Configuration Builder Software ................................................... 16

Using the Online Help ............................................................................................. 17

Setting Up the Project ............................................................................................. 17

Renaming PCB Objects .......................................................................................... 20

Configuring the Drivers ............................................................................................ 21

Using the CommonNet Data Map ........................................................................... 25

Configuring an IP Address ...................................................................................... 27

Downloading the Project to the Gateway ................................................................ 29

Printing a Configuration File .................................................................................... 31

3 Diagnostics and Troubleshooting

3.1

3.1.1

3.1.2

3.1.3

3.2

3.2.1

3.2.2

3.2.3

3.3

3.3.1

3.3.2

33

LED Indicators ......................................................................................................... 34

Main Gateway LEDs ................................................................................................ 34

Ethernet Port LEDs ................................................................................................. 35

Serial Port LEDs (for Gateways with Serial Ports) .................................................. 35

Using Diagnostics in ProSoft Configuration Builder ................................................ 36

Diagnostics Menu .................................................................................................... 38

Capturing a Diagnostic Session to a Log File ......................................................... 40

Using the Data Analyzer (Serial Protocols Only) .................................................... 41

Gateway Status Data in Upper Memory .................................................................. 43

General Gateway Status Data in Upper Memory .................................................... 43

Protocol-Specific Status Data in Upper Memory ..................................................... 43

4 Hardware Information

4.1

4.1.1

4.2

45

Hardware Specifications.......................................................................................... 46

Serial Port Specifications ........................................................................................ 47

Serial Port Cables (for Gateways with Serial Ports) ............................................... 48

ProSoft Technology, Inc.

August 12, 2015

Page 5 of 218

Contents

User Manual

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

PLX3x Series

Ethernet and Serial Gateways

RS-232 - Null Modem (DTE with Hardware Handshaking) .................................... 48

RS-232 - Null Modem (DTE without Hardware Handshaking) ............................... 49

RS-232 - DTE to DCE Modem Connection ............................................................ 49

RS-422 Interface Connections ................................................................................ 50

RS-485 Interface Connections ................................................................................ 50

5 EIP Protocol

5.1

5.1.1

5.2

5.2.1

5.2.2

5.2.3

5.3

5.3.1

5.3.2

5.3.3

5.4

5.4.1

5.4.2

5.4.3

5.4.4

51

EIP Functional Overview ........................................................................................ 52

EtherNet/IP™ Client ............................................................................................... 53

EIP Configuration .................................................................................................... 54

EIP Class 3 Server Connection .............................................................................. 54

EIP Class 1 Connection .......................................................................................... 56

EIP Class 3 Client/UClient [x] Connection .............................................................. 58

EIP Diagnostics....................................................................................................... 70

PCB Diagnostics Menu ........................................................................................... 70

EIP Status Data in Upper Memory.......................................................................... 70

EIP Error Codes ...................................................................................................... 73

EIP Reference......................................................................................................... 77

SLC and MicroLogix Specifics ................................................................................ 77

PLC5 Processor Specifics ...................................................................................... 81

ControlLogix and CompactLogix Processor Specifics ............................................ 85

EIP Command Entry Form ...................................................................................... 92

6 MBTCP Protocol

6.1

6.1.1

6.2

6.1.2

6.2.1

6.2.2

6.3

6.2.3

6.3.1

6.3.2

6.4

6.3.3

6.4.1

93

MBTCP Functional Overview .................................................................................. 94

General Specifications - Modbus TCP/IP ............................................................... 94

Internal Database ................................................................................................... 95

MBTCP Configuration ............................................................................................. 98

MBTCP Servers ...................................................................................................... 98

MBTCP Client[x] ................................................................................................... 100

MBTCP Client[x] Commands ................................................................................ 102

MBTCP Diagnostics .............................................................................................. 105

PCB Diagnostics ................................................................................................... 105

MBTCP Status Data in Upper Memory ................................................................. 105

MBTCP Error Codes ............................................................................................. 108

MBTCP Reference ................................................................................................ 109

Modbus Protocol Specification ............................................................................. 109

7 MBS Protocol

7.1

7.1.1

7.1.2

7.1.3

7.2

7.2.1

7.3

7.2.2

7.3.1

7.3.2

7.3.3

121

MBS Functional Overview .................................................................................... 122

Modbus Serial Specifications ................................................................................ 122

Modbus Master/Slave Port Specifications ............................................................ 123

Gateway Internal Database .................................................................................. 124

MBS Configuration ................................................................................................ 125

MBS Port [x] .......................................................................................................... 125

MBS Port [x] Commands ...................................................................................... 129

MBS Diagnostics .................................................................................................. 132

PCB Diagnostics ................................................................................................... 132

MBS Status Data in Upper Memory ..................................................................... 132

Error/Status Codes ............................................................................................... 138

Page 6 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Contents

User Manual

7.4

7.4.1

MBS Reference ..................................................................................................... 139

Modbus Protocol Specification .............................................................................. 139

8 ASCII Protocol

8.1

8.1.1

8.1.2

8.1.3

8.2

8.2.1

8.3

8.3.1

8.3.2

151

ASCII Functional Overview ................................................................................... 152

General Specifications .......................................................................................... 152

Data Flow .............................................................................................................. 153

Modes of Operation ............................................................................................... 156

ASCII Configuration ............................................................................................... 161

ASCII Port [x] ......................................................................................................... 161

ASCII Diagnostics ................................................................................................. 163

PCB Diagnostics ................................................................................................... 163

ASCII Status Data in Upper Memory .................................................................... 163

9 SIE Protocol

9.1

9.1.1

9.2

9.1.2

9.2.1

9.2.2

9.3

9.3.1

9.4

9.3.2

9.4.1

165

SIE Functional Overview ....................................................................................... 166

General Specifications .......................................................................................... 166

Gateway Internal Database ................................................................................... 166

SIE Configuration .................................................................................................. 167

SIE Client x ............................................................................................................ 167

SIE Client x Commands ........................................................................................ 167

SIE Diagnostics ..................................................................................................... 181

Client Command Errors ......................................................................................... 181

SIE Error Codes .................................................................................................... 182

SIE Reference ....................................................................................................... 185

Maximum Register Counts .................................................................................... 185

10

PND Protocol

10.1

10.2

10.3

10.3.1

10.3.2

10.4

10.4.1

193

PND Functional Overview ..................................................................................... 194

PND Configuration ................................................................................................ 194

Step 7 Configuration .............................................................................................. 198

Monitoring Data in Step 7 ...................................................................................... 209

Creating a Variable Table to Display Floating Point Input Values ........................ 211

PND Diagnostics ................................................................................................... 213

Configuration Error Codes..................................................................................... 213

11

Support, Service and Warranty

11.1

11.2

215

Contacting Technical Support ............................................................................... 215

Warranty Information ............................................................................................. 216

Index 217

ProSoft Technology, Inc.

August 12, 2015

Page 7 of 218

Contents

User Manual

PLX3x Series

Ethernet and Serial Gateways

Page 8 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Start Here

User Manual

1 Start Here

In This Chapter

System Requirements ........................................................................

9

Package Contents ............................................................................ 10

Mounting the Gateway on a DIN-rail ................................................. 11

Jumper Settings ................................................................................ 12

SD Card ............................................................................................ 12

Connecting Power to the PLX3x Gateway ........................................ 13

1.1 System Requirements

The ProSoft Configuration Builder configuration software for the gateway requires the following minimum hardware and software components:

• Pentium

®

II 450 MHz minimum. Pentium III 733 MHz (or better) recommended

• 128 Mbytes of RAM minimum, 256 Mbytes of RAM recommended

• 100 Mbytes of free hard disk space (or more based on application requirements)

• 256-color VGA graphics adapter, 800 x 600 minimum resolution (True Color

1024

× 768 recommended)

• DVD drive

Supported operating systems:

• Microsoft Windows 7 (32 bit)

• Microsoft Windows XP Professional with Service Pack 1 or 2

ProSoft Technology, Inc.

August 12, 2015

Page 9 of 218

Start Here

User Manual

1.2 Package Contents

PLX3x Series

Ethernet and Serial Gateways

The following components are included with your gateway, and are all required for installation and configuration. The quantity of cables provided depends on the specific protocol combination being used.

Important: Before beginning the installation, please verify that all of the following items are present.

Gateway with Ethernet Port

Qty.

Part Name

1

Ethernet cable

1

Mini screwdriver

1

Power connector

1

ProSoft Solutions

DVD

Part Number Part Description

RL-CBL025

5’ straight-through cable

HRD250

Tool for wiring and securing the power connector

J180

PLX3x gateway power connector

DVD-001

Contains sample programs, utilities, documentation and videos for the gateway

Gateway with Two Ethernet Ports

Qty.

Part Name

1

Ethernet cable

1

Mini screwdriver

1

Power connector

1

ProSoft Solutions

DVD

Part Number Part Description

RL-CBL025

5’ straight-through cable

HRD250

Tool for wiring and securing the power connector

J180

PLX3x gateway power connector

DVD-001

Contains sample programs, utilities, documentation and videos for the gateway

1

1

1

Gateway with Ethernet Port and Single Serial Port

Qty.

1

1

1

Part Name

Ethernet cable

Part Number Part Description

RL-CBL025

5’ straight-through cable

1454-9F

DB9 to screw terminal adapter DB9 to Screw

Terminal Adaptor

RJ45-DB9M Serial

Adapter Cable

CABLE14

Power Connector

J180

Mini screwdriver

HRD250

RJ45 to DB9 male serial adapter cable

PLX3x gateway power connector

Tool for wiring and securing the power connector

ProSoft Solutions

DVD

DVD-001

Contains sample programs, utilities, documentation and videos for the gateway

Gateway with Ethernet Port and Four Serial Ports

Qty.

1

4

4

1

1

1

Part Name

Ethernet cable

Part Number Part Description

RL-CBL025

5’ straight-through cable

DB9 to screw terminal adapter DB9 to Screw

Terminal Adaptor

RJ45-DB9M Serial

Adapter Cable

1454-9F

CABLE14

Power Connector

J180

Mini screwdriver

HRD250

ProSoft Solutions

DVD

DVD-001

RJ45 to DB9 male serial adapter cable

PLX3x gateway power connector

Tool for wiring and securing the power connector

Contains sample programs, utilities, documentation and videos for the gateway

Page 10 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

1.3 Mounting the Gateway on a DIN-rail

Start Here

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 11 of 218

Start Here

User Manual

1.4 Jumper Settings

PLX3x Series

Ethernet and Serial Gateways

There are three sets of jumper settings located on the back of the module.

MODE 1 - Development Mode Jumper: This is the top jumper, used for firmware updates only. The two pins should NOT be jumpered during normal operation.

MODE 2 – Default IP Jumper: This is the middle jumper. The default IP address of the ProLinx gateway is 192.168.0.250. Set this jumper to put the gateway's IP address back to the default.

MODE 3 - Reserved: This is the bottom jumper, reserved for internal ProSoft Technology use only. The firmware will not run when these pins are shorted.

1.5 SD Card

PLX3x products can be ordered with an optional SD card (Part Number SDI-1G).

In the event of a disaster, the SD card can be moved from one module to the next and resume operation. Below is a list of how the module will act - with and without an SD card.

Without an SD Card

• Configuration data is downloaded to the internal memory of the module.

• If a blank SD Card is inserted in to the module after the module has been configured, the configuration data will not be transferred to the SD card.

The configuration data would need to be downloaded to the module while the SD card is in place.

With an SD Card

• Configuration data is downloaded to the SD Card

• The configuration data is not transferred from the SD card to the internal memory of the module. If the SD card is removed and power is cycled to the module, the module will load the configuration data from the module’s memory. If there is no configuration data in the module’s memory, it will be restored to factory default.

Page 12 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

1.6 Connecting Power to the PLX3x Gateway

Start Here

User Manual

WARNING: Ensure that polarity is not reversed when applying power to the gateway. This will cause damage to the gateway’s power supply.

ProSoft Technology, Inc.

August 12, 2015

Page 13 of 218

User Manual

PLX3x Series

Ethernet and Serial Gateways

Page 14 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

2 Configuring Your Gateway

Configuring Your Gateway

User Manual

In This Chapter

Installing ProSoft Configuration Builder Software ............................. 16

Using the Online Help ....................................................................... 17

Setting Up the Project ....................................................................... 17

Renaming PCB Objects .................................................................... 20

Configuring the Drivers ..................................................................... 21

Using the CommonNet Data Map ..................................................... 25

Configuring an IP Addres .................................................................. 27

Downloading the Project to the Gateway .......................................... 29

Printing a Configuration FIle ............................................................. 31

ProSoft Configuration Builder (PCB) is a convenient and powerful software tool for managing your gateway configuration. Use PCB to configure a new project, or to transfer an existing project to a new device. You can also to use PCB to retrieve a configuration from a working gateway by uploading the configuration from the gateway.

ProSoft Technology, Inc.

August 12, 2015

Page 15 of 218

Configuring Your Gateway

User Manual

2.1 Installing ProSoft Configuration Builder Software

PLX3x Series

Ethernet and Serial Gateways

You must install the ProSoft Configuration Builder (PCB) software to configure the gateway. You can always get the newest version of ProSoft Configuration

Builder from the ProSoft Technology website.

To install ProSoft Configuration Builder from the ProSoft Technology website

1 Open your web browser and navigate to http://www.prosoft-

technology.com/pcb

2 Click the link at the Current Release Version section to download the latest version of ProSoft Configuration Builder.

3 Choose SAVE or SAVE FILE when prompted.

4 Save the file to your Windows Desktop, so that you can find it easily when you have finished downloading.

5 When the download is complete, locate and open the file, and then follow the instructions on your screen to install the program.

If you do not have access to the Internet, you can install ProSoft Configuration

Builder from the ProSoft Solutions DVD, included in the package with your gateway.

To Install ProSoft Configuration Builder from the DVD

1 Insert the ProSoft Solutions DVD into the DVD drive of your PC. Wait for the

DVD menu to appear.

2 On the startup screen, navigate to your product by selecting the proper

PLATFORM and PRODUCT.

3 Select PROSOFT CONFIGURAITON BUILDER. Follow the instructions on your screen to install the software on your PC.

Page 16 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

2.2 Using the Online Help

Configuring Your Gateway

User Manual

Most of the information needed to help you use ProSoft Configuration Builder is provided in a Help System that is always available whenever you are running

ProSoft Configuration Builder. The Help System does not require an Internet connection.

To view the help pages, start ProSoft Configuration Builder, open the HELP menu, and then choose CONTENTS.

2.3 Setting Up the Project

To begin, start ProSoft Configuration Builder (PCB). If you have used other

Windows configuration tools before, you will find the screen layout familiar.

ProSoft Configuration Builder’s (PCB's) window consists of a tree view on the left, and an information pane on the upper right side, and a configuration pane on the lower right side of the window. When you first start PCB, the tree view consists of folders for Default Project and Default Location, with a Default

Gateway in the Default Location folder. The following screen shows the PCB window with a new project.

ProSoft Technology, Inc.

August 12, 2015

Page 17 of 218

Configuring Your Gateway

User Manual

PLX3x Series

Ethernet and Serial Gateways

To add the gateway to the project

1 Use the mouse to select DEFAULT MODULE in the tree view, and then click the right mouse button to open a shortcut menu.

Page 18 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Configuring Your Gateway

User Manual

2 On the shortcut menu, select CHOOSE MODULE TYPE. This action opens the Choose Module Type dialog box.

3 In the Product Line Filter area of the dialog box, select the PLX30 radio button.

4 In the STEP 1: Select Module Type drop-down list, select the model number that matches your gateway, and then click OK to save your settings and return to the PCB Main window.

ProSoft Technology, Inc.

August 12, 2015

Page 19 of 218

Configuring Your Gateway

User Manual

2.4 Renaming PCB Objects

PLX3x Series

Ethernet and Serial Gateways

The Default Project and Default Location folders may be renamed in the tree view. Select the object, and then click the right mouse button to open a shortcut menu. From the shortcut menu, choose RENAME.

1 Type the name to assign to the object.

2 Click away from the object to save the new name.

Page 20 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

2.5 Configuring the Drivers

Configuring Your Gateway

User Manual

1 Click the [+] sign next to the Gateway icon to expand gateway information.

2 Click the [+] sign next to any icon to view gateway information and configuration options.

3 Double-click any icon to open an Edit dialog box.

4 To edit a parameter, select the parameter name in the left hand pane, then edit its corresponding field in the right hand pane.

Note: Depending on the parameter, the editable field will accept typed input in the form of text or a valid numerical value, or it will have a dropdown list with options to choose from.

ProSoft Technology, Inc.

August 12, 2015

Page 21 of 218

Configuring Your Gateway

User Manual

PLX3x Series

Ethernet and Serial Gateways

5 Double-clicking any icon will open an Edit dialog box with a table.

6 To add a row to the table, click the Add Row button.

Page 22 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Configuring Your Gateway

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 23 of 218

Configuring Your Gateway

User Manual

PLX3x Series

Ethernet and Serial Gateways

7 To edit the row, click the Edit Row button. This will open an Edit dialog box where you can edit the row parameters.

8 When configuration is complete, download the configuration to the gateway.

9 For protocol-specific configuration information, see the Configuration section in the appropriate protocol chapter of this manual:

EIP configuration (page 54)

MBTCP configuration (page 98)

MBS configuration (page125)

ASCII configuration (page 161)

SIE configuration (page 167)

PND configuration (page 194)

Page 24 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

2.6 Using the CommonNet Data Map

Configuring Your Gateway

User Manual

Note: This is an advanced configuration feature and is not required for the basic operation of the gateway.

The Data Map section allows data to be copied between areas in the gateway's internal database.

The Data Map is especially useful for copying protocol-specific error and status data from the gateway’s upper memory registers (address 4000 and up) to the user-accessible memory registers (addresses 0 to 3999). The error and status data copied into the user memory area can then be accessed by a remote device, such as an HMI or processor.

Information about upper memory addresses where the gateway places protocolspecific error and status data can be found in the Diagnostics section in the appropriate protocol chapter of this manual:

EIP diagnostics (page 70)

MBTCP diagnostics (page 105)

MBS diagnostics (page 132)

ASCII diagnostics (page 163)

SIE diagnostics (page 181)

PND diagnostics (page 213)

The Data Map can also be used to condense widely dispersed data into one contiguous data block, for simplified access.

A maximum of 100 registers per Data Map command can be copied, and a maximum of 200 separate copy commands can be configured.

The byte and/or word order can be rearranged during the copy process. For example, by rearranging byte or word order, floating-point values can be converted to the correct format for a different protocol.

ProSoft Technology, Inc.

August 12, 2015

Page 25 of 218

Configuring Your Gateway

User Manual

The following illustration shows an example Data Map.

PLX3x Series

Ethernet and Serial Gateways

The following table describes the parameters for configuring the Data Map.

Parameter

Value Description

From Address

0 to highest

Status Data address

This parameter specifies the beginning internal database register address for the copy operation. This address can be any valid address in the User Data Area or the Status Data

Area of the gateway.

To Address

0 to 3999

Register Count

Swap Code

1 to 100

No Change

Word Swap

Word and Byte

Swap

Byte Swap

This parameter specifies the beginning destination register address for the copy operation. This address must always be within the User Data registers area. A destination address must be specified that will not overwrite data that has been stored in memory by one of the communication protocols running on the gateway.

This parameter specifies the number of registers to copy.

The order of the bytes in the registers may need to be swapped during the copy process in order to change the alignment of bytes between dissimilar protocols. This parameter is helpful when dealing with floating-point or other multi-register values, as there is no standard method of storage of these data types in slave devices.

No change: No change is made in the byte ordering (1234 =

1234)

Word Swap: The words are swapped (1234=3412)

Delay Preset

Word and Byte Swap: The words are swapped, then the bytes in each word are swapped (1234=4321)

Byte Swap: The bytes in each word are swapped

(1234=2143)

This parameter sets an interval for each Data Map copy operation. The value that is specified for the Delay Preset is not a fixed amount of time. It is the number of firmware scans that must transpire between copy operations.

Page 26 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

2.7 Configuring an IP Address

Configuring Your Gateway

User Manual

Use this procedure to configure the Ethernet settings for your Gateway. You must assign an IP address, subnet mask and gateway address. After you complete this step, you can connect to the Gateway with an Ethernet cable.

Note: The PLX32 module contains two Ethernet ports. In this case, you would specify network settings for the first Ethernet protocol on Enet P1 and another set of settings for the second

Ethernet Protocol on Enet P2.

1 Determine the network settings for your Gateway, with the help of your network administrator if necessary. You will need the following information: o o o

IP address (fixed IP required) _____ . _____ . _____ . _____

Subnet mask _____ . _____ . _____ . _____

Gateway address _____ . _____ . _____ . _____

Note: The gateway address is optional, and is not required for networks that do not use a default gateway.

2 Double-click the ETHERNET CONFIGURATION icon. This action opens the

Edit dialog box. The IP address shown is the gateway default IP address.

3 Edit the values for my_ip, netmask (subnet mask) and gateway (default gateway).

ProSoft Technology, Inc.

August 12, 2015

Page 27 of 218

Configuring Your Gateway

User Manual

PLX3x Series

Ethernet and Serial Gateways

Note: If you are using a PLX32 module, you must specify values for both ports. My_ip is used to specify values for the first protocol. For example, if you are configuring a PLX32-EIP-MBTCP, you would specify the network values for the EIP protocol first. A second set of values are available for the second protocol; in this case, MBTCP.

4 When you are finished editing, click OK to save your changes and return to the ProSoft Configuration Builder window.

Page 28 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

2.8 Downloading the Project to the Gateway

Configuring Your Gateway

User Manual

For the gateway to use the settings you configured, you must download (copy) the updated Project file from your PC to the gateway.

To download the project file

1 In the tree view in ProSoft Configuration Builder, click once to select the gateway.

2 Right-click the Gateway icon to open a shortcut menu. From the shortcut menu, choose DOWNLOAD FROM PC TO DEVICE.

ProSoft Technology, Inc.

August 12, 2015

3 Click the BROWSE DEVICE(S) button to launch the ProSoft Discovery

Service window, which displays the ProSoft devices on the network and their

IP addresses.

Page 29 of 218

Configuring Your Gateway

User Manual

PLX3x Series

Ethernet and Serial Gateways

4 Right-click your PLX3x-series gateway and select IP Configuration from the shortcut menu.

5 Enter the same IP address and network mask that you entered in the

Ethernet configuration of the gateway. Click OK. The gateway will reboot.

6 Close the ProSoft Discovery Service window to return to the Download dialog box.

7 Click the DOWNLOAD button.

The gateway will perform a platform check to read and load its new settings.

When the platform check is complete, the status bar in the Download dialog box will display the message Module Running.

Page 30 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

2.9 Printing a Configuration File

Configuring Your Gateway

User Manual

1 Select the Gateway icon, and then click the right mouse button to open a shortcut menu.

2 On the shortcut menu, choose VIEW CONFIGURATION. This action opens the View Configuration window.

3 In the View Configuration window, open the FILE menu, and choose PRINT.

This action opens the Print dialog box.

4 In the Print dialog box, choose the printer to use from the drop-down list, select printing options, and then click OK.

ProSoft Technology, Inc.

August 12, 2015

Page 31 of 218

User Manual

PLX3x Series

Ethernet and Serial Gateways

Page 32 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Diagnostics and Troubleshooting

User Manual

3 Diagnostics and Troubleshooting

In This Chapter

LED Indicators .................................................................................. 34

Using Diagnostics in ProSoft Configuration Builder .......................... 36

Gateway Status Data in Upper Memory ........................................... 43

ProSoft Technology, Inc.

August 12, 2015

Page 33 of 218

Diagnostics and Troubleshooting

User Manual

3.1 LED Indicators

PLX3x Series

Ethernet and Serial Gateways

Troubleshooting can be performed using several methods.

The first and quickest is to scan the LEDs on the gateway to determine the existence and possibly the cause of a problem. The gateway’s LEDs provide valuable information such as

• The state of each port

• System configuration errors

• Application errors

• Fault indications

3.1.1 Main Gateway LEDs

LED

PWR

(Power)

FLT

(Fault)

CFG

(Configuration)

ERR

(Error)

NS

(Network

Status)

MS

(Module

Status)

State

Off

Solid Green

Off

Solid Red

Off

Solid Amber

Off

FlashingAmber

Solid Amber

Off

Solid Red

Solid Green

Flashing Red

Flashing Green

Alternating Red and Green Flash

Off

Solid Red

Solid Green

Flashing Red

Flashing Green

Alternating Red and Green Flash

Description

Power is not connected to the power terminals or source is insufficient to properly power the gateway (208 mA at 24 VDC is required).

Power is connected to the power terminals.

Normal operation.

A critical error has occurred. Program executable has failed or has been user-terminated and is no longer running. Press theResetbutton or cycle power to clear the error.

Normal operation.

The unit is in configuration mode. Either a configuration error exists, or the configuration file is currently being downloaded or read. After power-up, the configuration is read, and the unit implements the configuration values and initializes the hardware.

This occurs during power cycle or after the Reset button is pressed.

Normal operation.

An error condition has been detected and is occurring on one of the application ports. Check configuration and troubleshoot for communication errors.

This error flag is cleared at the start of each command attempt

(Master/Client) or on each receipt of data (slave/adapter/server); so, if this condition exists, it indicates a large number of errors are occurring in the application (due to bad configuration) or on one or more ports (network communication failures).

No power or noIP address

Duplicate IP address

Connected

Connection timeout

IP address obtained; no established connections

Self-test

No power

Major fault

Device operational

Minor fault

Standby

Self-test

Page 34 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

3.1.2 Ethernet Port LEDs

LED

LINK/ACT

State

Off

100 Mbit

Solid Green

Off

Flashing Amber

Diagnostics and Troubleshooting

User Manual

Description

No physical network connection is detected. No Ethernet communication is possible. Check wiring and cables.

Physical network connection detected. This LED must be

ON solid for Ethernet communication to be possible

No activity on the port.

The Ethernet port is actively transmitting or receiving data.

3.1.3 Serial Port LEDs (for Gateways with Serial Ports)

LED

RX

TX

State

Off

Flashing Green

Off

Flashing Amber

Description

No activity on the port.

The port is actively receiving data.

No activity on the port.

The port is actively transmitting data.

ProSoft Technology, Inc.

August 12, 2015

Page 35 of 218

Diagnostics and Troubleshooting

User Manual

3.2 Using Diagnostics in ProSoft Configuration Builder

PLX3x Series

Ethernet and Serial Gateways

ProSoft Configuration Builder (PCB) has many useful tools to help you with diagnostics and troubleshooting. You can use PCB to connect to your gateway and retrieve current status values, configuration data and other valuable information.

Tip: You can have a ProSoft Configuration Builder Diagnostics window open for more than one gateway at a time.

To connect to the gateway’s communication port

1 Start PCB, and then select the gateway. Click the right mouse button to open a shortcut menu.

2 On the shortcut menu, choose DIAGNOSTICS.

Page 36 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

This opens the Diagnostics window.

Diagnostics and Troubleshooting

User Manual

If there is no response from the gateway, as in the example above, follow these steps:

1 Click the Setup Connection button. In the Connection Setup dialog box, select ETHERNET from the Select Connection Type dropdown menu. Type in the gateway’s IP address in the Ethernet field.

2 Click the Connect button. Verify that the Ethernet is connected properly between your computer’s communication port and the gateway.

If you are still not able to establish a connection, contact ProSoft Technology for assistance.

ProSoft Technology, Inc.

August 12, 2015

Page 37 of 218

Diagnostics and Troubleshooting

User Manual

3.2.1 Diagnostics Menu

PLX3x Series

Ethernet and Serial Gateways

The Diagnostics menu is arranged as a tree structure, with the Main menu at the top of the tree, and one or more submenus for each menu command.

The menu commands available will depend on the protocol combination of your gateway.

Caution: Some of the commands available to you from this menu are designed for advanced debugging and system testing only, and can cause the gateway to stop communicating with the processor or with other devices, resulting in potential data loss or other communication failures.

Use these commands only if you fully understand their potential effects, or if you are specifically directed to do so by ProSoft Technology Technical Support Engineers.

Page 38 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Diagnostics and Troubleshooting

User Manual

The following menu commands are common to all PLX3x-series gateways:

Menu

Command

Module

Submenu

Command

Version

Description

Database

View

Data Map

ASCII

Decimal

Hex

Float

Displays the gateway’s current software version and other important values. You may be asked to provide this information when calling for technical support.

Displays the gateway’s Data Map configuration.

Displays the contents of the gateway’s database in ASCII character format.*

Displays the contents of the gateway’s database in decimal number format.*

Displays the contents of the gateway’s database in hexadecimal number format.*

Displays the contents of the gateway’s database in floating-point number format.*

* Use the scroll bar on the right edge of the window to navigate through the database. Each page displays 100 words of data. The total number of pages available depends on your gateway’s configuration.

ProSoft Technology, Inc.

August 12, 2015

Page 39 of 218

Diagnostics and Troubleshooting

User Manual

3.2.2 Capturing a Diagnostic Session to a Log File

PLX3x Series

Ethernet and Serial Gateways

You can capture anything you do in a Diagnostics session to a log file. This feature can be useful for troubleshooting and record-keeping purposes, and for communication with ProSoft Technology’s technical support team.

1 Open a Diagnostics window.

2 To log a Diagnostics session to a text file, click the Log File button on the toolbar at the top of the Diagnostics window. Click the button again to stop the capture.

3 To view the log file created, click the View Log File button. The log file will open as a text file, which can be renamed and saved to a different location.

4 To email the log file to ProSoft Technology’s technical support team, click the

Email Log File button. (For this to work, Microsoft Outlook must be installed on your PC.)

5 If you do multiple sequential captures, PCB will append data from a new capture to the end of the previously captured data. If you want previous data to be cleared from the log file each time you start a new capture, click the

Clear Data button.

Page 40 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Diagnostics and Troubleshooting

User Manual

3.2.3 Using the Data Analyzer (Serial Protocols Only)

The Data Analyzer is an extremely valuable troubleshooting tool available in

PCB. It allows you to “see” the data packets entering and leaving the serial ports on the gateway. You can also capture this data to a log file.

Note: The PCB Data Analyzer is for serial ports only. To analyze data traffic on an Ethernet port, we recommend using a network protocol analyzer available on the Internet, such as Wireshark.

To use the Data Analyzer

1 Open the Diagnostics window in PCB.

2 On the toolbar at the top of the window, click the Setup Data Analyzer button.

3 In the Data Analyzer Setup dialog box, specify the time tick interval, the serial port number, and whether the data packet contents should be displayed in hexadecimal number or ASCII character format. Click OK.

Note: The time tick is a symbol (_TT_) displayed on the Data Analyzer screen that allows you to estimate time intervals during a Data Analyzer session. The time tick will print at the time interval you specify in the Data Analyzer Setup dialog box. For example, if you select 10 mS Ticks, it will print every 10 milliseconds.

ProSoft Technology, Inc.

August 12, 2015

Page 41 of 218

Diagnostics and Troubleshooting

User Manual

PLX3x Series

Ethernet and Serial Gateways

4 If you wish to capture the Data Analyzer session to a log file, click the Log

File button.

5 Click the Start Data Analyzer button to start the Data Analyzer. Click it again to stop it.

6 The example below is part of a capture of standard Modbus data packets. It is displayed in hexadecimal number format.

7 Data LEAVING the serial port is enclosed in angle brackets <>.

8 Data ENTERING the port is enclosed in square brackets [ ].

9 Each set of brackets holds one word (2 bytes) of data.

For Modbus protocol users: To interpret the data packets, refer to the Modbus Protocol

Specification, which can be found in this manual (page 139) or at

www.modbus.org

.

Page 42 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

3.3 Gateway Status Data in Upper Memory

Diagnostics and Troubleshooting

User Manual

The gateway places useful status data in dedicated upper memory locations in its internal database. The Data Map functionality of the gateway can be used to map this data into the normal user data range of the gateway’s database (registers 0 through 3999). It can be accessed by remote devices, such as HMIs or

processors. See Using the CommonNet Data Map (page 25).

3.3.1 General Gateway Status Data in Upper Memory

The following table describes the contents of the gateway’s general status data area.

Register Address

4000 through 4001

4002 through 4004

4005 through 4009

4010 through 4014

4015 through 4019

Description

Program Cycle Counter

Product Code (ASCII)

Product Revision (ASCII)

Operating System Revision (ASCII)

OS Run Number (ASCII)

3.3.2 Protocol-Specific Status Data in Upper Memory

The gateway also has upper memory locations for protocol-specific status data.

Information about upper memory addresses where the gateway places status data for its protocol drivers can be found in the Diagnostics sections of the protocol chapters:

EIP diagnostics (page 70)

MBTCP diagnostics (page 105)

MBS diagnostics (page 132)

ASCII diagnostics (page 163)

SIE diagnostics (page 181)

PND diagnostics (page 213)

ProSoft Technology, Inc.

August 12, 2015

Page 43 of 218

User Manual

PLX3x Series

Ethernet and Serial Gateways

Page 44 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

4 Hardware Information

In This Chapter

Hardware Specifications ................................................................... 46

Serial Port Cables (for Gateways with Serial Ports).......................... 48

Hardware Information

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 45 of 218

Hardware Information

User Manual

4.1 Hardware Specifications

PLX3x Series

Ethernet and Serial Gateways

Specification

Power Supply

Current Load

Description

24 VDC nominal

10 VDC to 36 VDC allowed

Positive, Negative, GND Terminals

208mA normal @ 24 VDC normal

300 mA maximum @ 36 VDC maximum

Operating Temperature -25°C to 70°C (-13°F to 158°F)

Storage Temperature

-40°C to 80°C (-40°F to 176°F)

Relative Humidity

5% to 95% RH with no condensation

Dimensions

(Height x Width x

Depth)

Standard: 5.38 in x 1.99 in x 4.38 in

(13.67 cm x 5.05 cm x 11.13 cm)

LED Indicators

(On all gateways)

Configuration (CFG) and Error (ERR) Communication

Status

Power (PWR) and Hardware Fault (FLT)

Network Status (NS) EtherNet/IP™ Class I or Class III

Connection Status (EtherNet/IP Only)

Module Status (MS) Module Configuration Status

(EtherNet/IP Only)

Ethernet Communication Port Link/Activity and 100mbit

Serial Communication Port Receive (RX) and Transmit

(TX)

Ethernet Port (S)

10/100Mbit full-duplex RJ45 Connector Electrical Isolation

1500 Vrms at 50 Hz to 60 Hz for 60 seconds, applied as specified in section 5.3.2 of IEC 60950: 1991

Ethernet Broadcast Storm Resiliency = less than or equal to 5000 [ARP] frames-per-second and less than or equal to

5 minutes duration

Serial Port Isolation

2500 Vrms port signal isolation per UL 1577 serial port communication signal uses RF(Radio

Frequency) modulation signal as isolation media, IC chip model is Silicon Labs Si844x(Si8440,Si8441,Si8442).

Shipped With Each Unit 2.5 mm screwdriver

ProSoft Solutions DVD

J180 Power Connector

(1 to 4) RJ45-DB9M Serial Adapter Cable (serial protocol only)

(1 to 4) DB9 to Screw Terminal Adapter (serial protocol only)

Page 46 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

4.1.1 Serial Port Specifications

Hardware Information

User Manual

Type

Serial Port Isolation

Serial Port Protection

Specifications

2500 Vrms port signal isolation per UL 1577 serial port communication signal uses RF(Radio

Frequency) modulation signal as isolation media, IC chip model is Silicon Labs Si844x

(Si8440,Si8441,Si8442).

RS-485/422 port interface lines TVS diode protected at +/- 27V standoff voltage.

RS-232 port interface lines fault protected to +/- 36V power on, +/- 40V power off.

ProSoft Technology, Inc.

August 12, 2015

Page 47 of 218

Hardware Information

User Manual

4.2 Serial Port Cables (for Gateways with Serial Ports)

PLX3x Series

Ethernet and Serial Gateways

This section contains information on the cable and pin assignments for the

PLX3x gateway's serial ports (RS-232/422/485). The PLX3x gateway may come with one or four serial ports, depending on the configuration purchased.

Example: The PLX31-EIP-MBS4 gateway contains four serial communication ports

The PLX31-EIP-MBS gateway contains one serial communication port.

Each physical serial port has a RJ45 jack connector. A six-inch RJ45 to DB9Male adapter cable is provided for each serial port. The DB9Male adapter cable provides connections for RS-232, wired as Data Terminal Equipment (DTE), RS-

422 and RS-485.

4.2.1 RS-232 - Null Modem (DTE with Hardware Handshaking)

This type of connection is used when the device connected to the gateway requires hardware handshaking (control and monitoring of modem signal lines).

To enable hardware handshaking, set the port configuration to use RTS/CTS handshaking. (For MBS protocol, set the Use CTS Line parameter to Yes. For

ASCII protocol, set the Handshaking parameter to Yes.)

Page 48 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Hardware Information

User Manual

4.2.2 RS-232 - Null Modem (DTE without Hardware Handshaking)

This type of connection can be used to connect the gateway to a computer or field device communication port.

Note: If the port is configured to use RTS/CTS handshaking, then a jumper is required between the

RTS and the CTS line on the gateway connection.

4.2.3 RS-232 - DTE to DCE Modem Connection

This type of connection is required between the gateway and a modem or other communication device.

For most modem applications, RTS/CTS handshaking should be enabled in the port configuration.

ProSoft Technology, Inc.

August 12, 2015

Page 49 of 218

Hardware Information

User Manual

4.2.4 RS-422 Interface Connections

PLX3x Series

Ethernet and Serial Gateways

The following illustration applies when the RS-422 interface is selected.

4.2.5 RS-485 Interface Connections

The following illustration applies when the RS-485 interface is selected.

NOTE: This type of connection is commonly called a RS-485 half-duplex, 2-wire connection. If you have RS-485 4-wire, full-duplex devices, they can be connected to the gateway's serial ports by wiring together the TxD+ and RxD+ from the two pins of the full-duplex device to Pin 1 on the gateway and wiring together the TxD- and RxD- from the two pins of the full-duplex device to Pin 8 on the gateway. As an alternative, you could try setting the gateway to use the RS-422 interface and connect the full-duplex device according to the RS-422 wiring diagram. For additional assistance, please contact ProSoft Technical Support.

Page 50 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

5 EIP Protocol

In This Chapter

EIP Functional Overview .................................................................. 52

EIP Configuration.............................................................................. 54

EIP Diagnostics ................................................................................ 70

EIP Reference .................................................................................. 77

This chapter contains information specific to the PLX3x-series gateway

EtherNet/IP (EIP) protocol driver.

EIP Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 51 of 218

EIP Protocol

User Manual

5.1 EIP Functional Overview

PLX3x Series

Ethernet and Serial Gateways

The PLX3x-series EIP gateway can be used to interface many different protocols into the Rockwell Automation family of processors as well as other software-based solutions.

The following illustration shows the functionality of the EtherNet/IP protocol.

The EIP driver supports the following connections:

Class

Connection Type

Class 1

I/O

Number of Connections

Depends on the gateway model:

PLX31-EIP-MBTCP - 2 connections

PLX31-EIP-MBS - 2 connections

PLX31-EIP-MBS4 - 8 connections

PLX31-EIP-ASCII - 1 connection

PLX31-EIP-ASCII4 - 4 connections

PLX31-EIP-SIE – 2 connections

Class 3

Connected Client

Unconnected Client

2

1

Server 5

Page 52 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

5.1.1 EtherNet/IP™ Client

EIP Protocol

User Manual

In Client mode, the gateway controls the read/write data transfer between the gateway and other EtherNet/IP devices.

Number of Clients Supported

Command List

Polling of Command List

Other Configurable Parameters

Connected Clients: 2

Unconnected Clients: 1

Support for 100 commands per Client, each configurable for command type, IP address, register to/from addressing and word/bit count.

User-configurable polling of commands, including disabled, continuous and on change of data (write only).

Number of Commands (up to 100 per Client)

Min Command Delay

Response Timeout

Retry Count

Command Error Pointer

ProSoft Technology, Inc.

August 12, 2015

Page 53 of 218

EIP Protocol

User Manual

5.2 EIP Configuration

PLX3x Series

Ethernet and Serial Gateways

5.2.1 EIP Class 3 Server Connection

The EIP Class 3 Server Connection is used when the gateway is acting as a server (slave) device responding to message instructions initiated from a Client

(Master) device such as an HMI, DCS, or PLC5.

Configuring EIP Class 3 Server Connections in PCB

The PLX3x Server connection file size is user selectable for 100 or 1000 integers. If a value of 100 is selected valid registers will be from N10:0 to N10:99.

If a value of 1000 is selected valid registers will be from N10:0 to N10:999.

Data Type

BOOL

Bit Array

SINT

INT

DINT

REAL

Accessing the Gateway’s Internal Memory

Tag Name

BOOLData[ ]

BITAData[ ]

SINTData[ ]

INT_Data[ ]

DINTData[ ]

REALData[ ]

2

4

4

Length of Each Element in

CIP Message

1

4

1

Array Range for 4000

Element Database

0 to 63999

0 to 1999

0 to 7999

0 to 3999

0 to 1999

0 to 1999

The following tables define the relationship of the gateway’s internal database to the addresses required in the MSG instructions:

Database

Address

0

999

1000

1999

2000

MSG Instruction Type - CIP

CIP Integer CIP Boolean

Int_data[0]

Int_data[999]

BoolData[0]

CIP Bit Array

BitAData[0]

BoolData[15984]

CIP Byte CIP DINT

SIntData[0]

SIntData[1998]

DIntData[0]

CIP Real

RealData[0]

Int_data[1000] BoolData[16000] BitAData[500] SIntData[2000] DIntData[500] RealData[500]

Int_data[1999] BoolData[31984] SIntData[3998]

Int_data[2000] BoolData[32000] BitAData[1000] SIntData[4000] DIntData[1000] RealData[1000]

2999

3000

3999

Int_data[2999] BoolData[47984] SIntData[5998]

Int_data[3000] BoolData[48000] BitAData[1500] SIntData[6000] DIntData[1500] RealData[1500]

Int_data[3999]

BoolData[63999] SIntData[9998]

Page 54 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MSG Instruction Type - PCCC

Database Address File size 100 Database Address File size 100

0

999

1000

N10:0

N19:99

N20:0

0

999

1000

N10:0

N19:99

N20:0

1999

2000

N29:99

N30:0

1999

2000

N29:99

N30:0

EIP Protocol

User Manual

EtherNet/IP Explicit Messaging Server Command Support

The following commands are supported in the PLX3x gateway.

Basic Command Set Functions

Command

Function Definition

0x00

N/A Protected Write

0x01

N/A Unprotected Read

0x02

N/A Protected Bit Write

0x05

N/A Unprotected Bit Write

0x08

N/A Unprotected Write

Supported in Server

X

X

X

X

X

PLC-5 Command Set Functions

Command

Function Definition

0x0F

0x0F

0x0F

0x00

0x01

Word Range Write (Binary Address)

Word Range Read (Binary Address)

Typed Range Read (Binary Address)

0x0F

Typed Range Write (Binary Address)

0x0F

0x0F

0x0F

0x0F

0x26

0x00

0x01

0x26

Read-Modify-Write (Binary Address)

Word Range Write (ASCII Address)

Word Range Read (ASCII Address)

Read-Modify-Write (ASCII Address)

X

X

X

Supported in Server

X

X

X

SLC-500 Command Set Functions

Command

0x0F

0x0F

0x0F

0x0F

0x0F

Function Definition

0xA1

0xA2

0xA9

0xAA

0xAB

Protected Typed Logical Read With Two

Address Fields

Supported in Server

X

Protected Typed Logical Read With Three

Address Fields

Protected Typed Logical Write With Two

Address Fields

X

X

Protected Typed Logical Write With Three

Address Fields

X

Protected Typed Logical Write With Mask (Three Address Fields)

ProSoft Technology, Inc.

August 12, 2015

Page 55 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

5.2.2 EIP Class 1 Connection

The EIP Class 1 Connection is used when the gateway acts as an EIP adapter transferring data to and from a PLC (the EIP scanner), using a direct I/O connection. Direct I/O connections can be used to transfer large amounts of data quickly.

The PLX3x-series EIP gateway can handle up to eight I/O connections

(depending on the model), each with 248 words of input data and 248 words of output data. Rockwell Automation customers running RSLogix 5000 v.20 and higher can take advantage of premier integration with an Add-on profile.

Adding the Gateway to RSLogix5000 v.20

1. Open up RSLinx and browse to the PLX3x gateway.

2. Open up a short cut window by right clicking on the gateway.

3. Select Upload EDS from device.

Note: RSLogix5000 may need to be restarted in order to complete the installation.

4. Once RSLogix5000 has been restarted, add a New Module under the

EtherNet/IP bridge in the I/O tree.

5. In the Module Type Vendor Filters window set the filter options to ProSoft

Technology.

6. Select the corresponding PLX3x gateway and click Create

7. In the next window set the IP address to the address of the PLX3x gateway. To add I/O connections click the Change button.

8. Here up to eight I/O connections can be added. The I/O connections have a fixed size of 496 bytes of input data and 496 bytes of output data. When finished click ok.

9. In the Module properties window each I/O connection can be configured with its own RPI time.

Adding the Gateway to RSLogix5000 v.19 and Below

1. Add a New Module under the EtherNet/IP bridge in the I/O tree.

2. Click Find and search for Generic EtherNet Bridge click Create.

3. Set the IP address to the gateway. This creates the communication path from the processor to the PLX3x gateway

Page 56 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

EIP Protocol

User Manual

4. Next add a New Module under the Generic EtherNet Bridge and add a

CIP-Connection. Here the parameters for the I/O connection are specified. The input and output sizes need to match the input and output sizes configured in PCB. The Address field value represents the connection number in PCB. By default all of the connections have 248

Input words, 248 Output words, and 0 Configuration words. The Comm format should be set to Data type INT, and the Assembly instances should be "1" for input, "2" for output, and "4" for configuration.

5. A CIP Connection will need to be added and configured for each I/O connection.

Configuring EIP Class 1 Connections in PCB

There are four configurable parameters for each I/O connection in PCB.

Parameter

Input Data

Address

Input Size

Output Data

Address

Output Size

Value Range

0-3999

0-248

0-3999

0-248

Description

This parameter specifies the starting address within the gateway’s virtual database for data transferred from the

PLC to the module

This parameter specifies the number of Integers being transferred to the PLC's input image (248 integers max)

This parameter specifies the starting address within the gateway’s virtual database for data transferred from the module to the PLC

This parameter specifies the number of integers being transferred to the PLC's output image (248 integers max)

ProSoft Technology, Inc.

August 12, 2015

Page 57 of 218

EIP Protocol

User Manual

5.2.3 EIP Class 3 Client/UClient [x] Connection

PLX3x Series

Ethernet and Serial Gateways

The PLX3x gateway supports two connected Clients and one unconnected Client

(most devices use connected Clients; be sure refer to the user manual of the target device for verification).

The EIP Class 3 Client [x] Connections are used when the gateway is acting as a

Client/Master initiating message instructions to the server/slave devices. The

PLX3x EIP protocol supports three Connected Client Connections. Typical applications include SCADA systems, and SLC communication.

The EIP Class 3 UClient Connection is used when the gateway is acting as a

Client/Master initiating message Instructions to the server/slave devices. The

PLX3x EIP protocol supports one Unconnected Client Connection. Unconnected messaging is a type of Ethernet/IP explicit messaging that uses TCP/IP implementation. Certain devices, such as the AB Power Monitor 3000 series B, support unconnected messaging. Check your device documentation for further information about its Ethernet/IP implementation.

Class 3 Client/UClient [x]

This section specifies the configuration for the EIP Client (Master) device on the network port.

Parameter

Value Description

Minimum

Command

Delay

0 to 65535 milliseconds

This parameter specifies the number of milliseconds to wait between the initial issuances of a command. This parameter can be used to delay all commands sent to servers to avoid

"flooding" commands on the network. This parameter does not affect retries of a command as they will be issued when failure is recognized.

Response

Timeout

Retry Count

0 to 65535 milliseconds

0 to 10

This parameter specifies the amount of time in milliseconds that a Client will wait before re-transmitting a command if no response is received from the addressed server. The value to use depends on the type of communication network used, and the expected response time of the slowest device connected to the network.

This parameter specifies the number of times a command will be retried if it fails.

Page 58 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

EIP Protocol

User Manual

Class 3 Client/UClient[x] Commands

There is a separate command list for each of the different message types supported by the protocol. Each list is processed from top to bottom, one after the other, until all specified commands are completed, and then the polling process begins over again.

This section defines the EtherNet/IP commands to be issued from the gateway to server devices on the network. These commands can be used for data collection and/or control of devices on the TCP/IP network.

In order to interface the virtual database with Rockwell Automation

Programmable Automation Controllers (PACs), Programmable Logic Controllers

(PLCs), or other EtherNet/IP server devices, you must construct a command list.

The following tables describe the command list parameters for each message type.

ProSoft Technology, Inc.

August 12, 2015

Page 59 of 218

EIP Protocol

User Manual

Class 3 Client/UClient [x] Commands SLC500 2 Address Fields

Parameter

Enable

Internal

Address

Poll Interval

Reg Count

Swap Code

IP Address

Slot

Func Code

File Type

File Number

Value

Enable

Disable

Conditional Write

0 to 3999

0-65535

None

Word swap

Word and Byte swap

Byte swap xxx.xxx.xxx.xxx

-1

501

509

Binary

Counter

Timer

Control

Integer

Float

ASCII

String

Status

-1

PLX3x Series

Ethernet and Serial Gateways

Description

Specifies if the command should be executed and under what conditions.

Enable - The Command is executed each scan of the command list

Disable- The command is disabled and will not be executed

Conditional Write - The Command executes only if the internal data associated with the command changes

Specifies the database address in the modules internal database to be associated with the command. If the command is a read function, the data received in the response message is placed at the specified location. If the command is a write function data used in the command is sourced from specified data area.

Specifies the minimum interval to execute continuous commands. The parameter is entered in 1/10 of a second.

If a value of 100 is entered for a command the command executes no more frequently than every 10 seconds.

Specifies the number of data points to be read from or written to the target device.

Specifies if the data from the server is to be ordered differently than it was received. This parameter is typically used when dealing with floating-point or other multiregister values.

None - No change is made (abcd)

Word swap - The words are swapped (cdab)

Word and Byte swap - The words and bytes are swapped (dcba)

Byte swap - The bytes are swapped (badc)

Specifies the IP address of the target device to be addressed by this command

Use a value of -1 when interfacing to an SLC 5/05. These devices do not have a slot parameter. When addressing a processor in a ControlLogix or CompactLogix rack, the slot number corresponds to the slot in the rack containing the controller being addressed.

Specifies the function code to be used in the command.

501 – Protected Typed Read

509 – Protected Typed Write

Specifies the file type to be associated with the command.

Specifies the PLC-5 file number to be associated with the command. If a value of -1 is entered for the parameter, the field will not be used in the command, and the default

Page 60 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Parameter

Value

Element

Number

Comment

EIP Protocol

User Manual

Description

file will be used.

Specifies the element in the file where the command will start.

This field can be used to give a 32 character comment to the command.

ProSoft Technology, Inc.

August 12, 2015

Page 61 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Class 3 Client/UClient [x] Commands SLC500 3 Address Fields

This command is typically used when accessing data in a Timer or Counter. I.e.

T.1.1.2 is the address of the accumulator in Timer 1.

Parameter

Enable

Internal Address

0 to 3999

Poll Interval

Reg Count

Swap Code

IP Address

Slot

Func Code

Value

Enable

Disable

Conditional Write

0 to 65535

None

Word swap

Word and Byte swap

Byte swap xxx.xxx.xxx.xxx

-1

502

510

511

Description

Specifies if the command should be executed and under what conditions.

Enable - The Command is executed each scan of the command list

Disable- The command is disabled and will not be executed

Conditional Write - The Command executes only if the internal data associated with the command changes

Specifies the database address in the modules internal database to be associated with the command. If the command is a read function, the data received in the response message is placed at the specified location. If the command is a write function data used in the command is sourced from specified data area.

Specifies the minimum interval to execute continuous commands. The parameter is entered in 1/10 of a second. If a value of 100 is entered for a command the command executes no more frequently than every 10 seconds.

Specifies the number of data points to be read from or written to the target device.

Specifies if the data from the server is to be ordered differently than it was received. This parameter is typically used when dealing with floating-point or other multi-register values.

None - No change is made (abcd)

Word swap - The words are swapped (cdab)

Word and Byte swap - The words and bytes are swapped (dcba)

Byte swap - The bytes are swapped (badc)

Specifies the IP address of the target device to be addressed by this command

Use a value of -1 when interfacing to an SLC 5/05.

These devices do not have a slot parameter. When addressing a processor in a ControlLogix or

CompactLogix, the slot number corresponds to the slot in the rack containing the controller being addressed.

Specifies the function code to be used in the command.

502 - Protected Typed Read

510 - Protected Typed Write

511 - Protected Typed Write w/Mask

Page 62 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Parameter

File Type

File Number

Value

Binary

Counter

Timer

Control

Integer

Float

ASCII

String

Status

-1

Element

Number

Sub Element

Comment

Description

Specifies the file type to be associated with the command.

EIP Protocol

User Manual

Specifies the SLC 500 file number to be associated with the command. If a value of -1 is entered for the parameter, the field will not be used in the command, and the default file will be used.

Specifies the element in the file where the command will start.

Specifies the sub-element to be used with the command. Refer to the AB documentation for a list of valid sub-element codes.

This field can be used to give a 32 character comment to the command.

ProSoft Technology, Inc.

August 12, 2015

Page 63 of 218

EIP Protocol

User Manual

Class 3 Client/UClient [x] Commands PLC5 Binary

Parameter

Enable

Poll Interval

Reg Count

Swap Code

IP Address

Slot

Func Code

File Type

Value

Enable

Disable

Conditional Write

Internal Address

0 to 3999

0 to 65535

None

Word swap

Word and Byte swap

Byte swap xxx.xxx.xxx.xxx

-1

100

101

102

Binary

Counter

Timer

Control

Integer

Float

ASCII

String

Status

-1

PLX3x Series

Ethernet and Serial Gateways

Description

Specifies if the command should be executed and under what conditions.

Enable - The Command is executed each scan of the command list

Disable- The command is disabled and will not be executed

Conditional Write - The Command executes only if the internal data associated with the command changes

Specifies the database address in the modules internal database to be associated with the command. If the command is a read function, the data received in the response message is placed at the specified location. If the command is a write function data used in the command is sourced from specified data area.

Specifies the minimum interval to execute continuous commands. The parameter is entered in 1/10 of a second. If a value of 100 is entered for a command the command executes no more frequently than every 10 seconds.

Specifies the number of data points to be read from or written to the target device.

Specifies if the data from the server is to be ordered differently than it was received. This parameter is typically used when dealing with floating-point or other multi-register values.

None - No change is made (abcd)

Word swap - The words are swapped (cdab)

Word and Byte swap - The words and bytes are swapped (dcba)

Byte swap - The bytes are swapped (badc)

Specifies the IP address of the target device to be addressed by this command

Use a value of -1 when interfacing to a PLC5 These devices do not have a slot parameter. When addressing a processor in a ControlLogix or CompactLogix, the slot number corresponds to the slot in the rack containing the controller being addressed.

Specifies the function code to be used in the command.

100 - Word Range Write

101 - Word Range Read

102 - Read-Modify-Write

Specifies the file type to be associated with the command.

Specifies the PLC5 file number to be associated with

File Number

Page 64 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Parameter

Value

Element

Number

Sub Element

Comment

EIP Protocol

User Manual

Description

the command. If a value of -1 is entered for the parameter, the field will not be used in the command, and the default file will be used.

Specifies the element in the file where the command will start.

Specifies the sub-element to be used with the command. Refer to the AB documentation for a list of valid sub-element codes.

This field can be used to give a 32 character comment to the command.

ProSoft Technology, Inc.

August 12, 2015

Page 65 of 218

EIP Protocol

User Manual

Class 3 Client/UClient [x] Commands PLC5 ASCII

Parameter

Enable

Poll Interval

Reg Count

Swap Code

IP Address

Slot

Func Code

File Type

Value

Enable

Disable

Conditional Write

Internal Address

0 to 3999

0 to 65535

None

Word swap

Word and Byte swap

Byte swap xxx.xxx.xxx.xxx

-1

150

151

152

Binary

Counter

Timer

Control

Integer

Float

ASCII

String

Status

PLX3x Series

Ethernet and Serial Gateways

Description

Specifies if the command should be executed and under what conditions.

Enable - The Command is executed each scan of the command list

Disable- The command is disabled and will not be executed

Conditional Write - The Command executes only if the internal data associated with the command changes

Specifies the database address in the modules internal database to be associated with the command. If the command is a read function, the data received in the response message is placed at the specified location. If the command is a write function data used in the command is sourced from specified data area.

Specifies the minimum interval to execute continuous commands. The parameter is entered in 1/10 of a second. If a value of 100 is entered for a command the command executes no more frequently than every 10 seconds.

Specifies the number of data points to be read from or written to the target device.

Specifies if the data from the server is to be ordered differently than it was received. This parameter is typically used when dealing with floating-point or other multi-register values.

None - No change is made (abcd)

Word swap - The words are swapped (cdab)

Word and Byte swap - The words and bytes are swapped (dcba)

Byte swap - The bytes are swapped (badc)

Specifies IP address of the target device to be addressed by this command

Use a value of -1 when interfacing to a PLC5 These devices do not have a slot parameter. When addressing a processor in a ControlLogix or CompactLogix, the slot number corresponds to the slot in the rack containing the controller being addressed.

Specifies the function code to be used in the command.

150 - Word Range Write

151 - Word Range Read

152 - Read-Modify-Write

Specifies the file type to be associated with the command.

Specifies the PLC-5 Address as a string. For example

File String

Page 66 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Parameter

Value

Comment

EIP Protocol

User Manual

Description

N10:300

This field can be used to give a 32 character comment to the command.

ProSoft Technology, Inc.

August 12, 2015

Page 67 of 218

EIP Protocol

User Manual

Class 3 Client/UClient [x] Commands Controller Tag Access

Parameter

Enable

Internal Address

0 to 3999

Poll Interval

Reg Count

Swap Code

IP Address

Slot

Func Code

Data Type

Tag Name

Value

Enable

Disable

Conditional Write

0 to 65535

None

Word swap

Word and Byte swap

Byte swap xxx.xxx.xxx.xxx

-1

332

333

Bool

SINT

INT

DINT

REAL

DWORD

Specifies the controller tag in the target PLC.

PLX3x Series

Ethernet and Serial Gateways

Description

Specifies if the command should be executed and under what conditions.

Enable - The Command is executed each scan of the command list

Disable- The command is disabled and will not be executed

Conditional Write - The Command executes only if the internal data associated with the command changes

Specifies the database address in the modules internal database to be associated with the command. If the command is a read function, the data received in the response message is placed at the specified location. If the command is a write function data used in the command is sourced from specified data area.

Specifies the minimum interval to execute continuous commands. The parameter is entered in 1/10 of a second. If a value of 100 is entered for a command the command executes no more frequently than every 10 seconds.

Specifies the number of data points to be read from or written to the target device.

Specifies if the data from the server is to be ordered differently than it was received. This parameter is typically used when dealing with floating-point or other multi-register values.

None - No change is made (abcd)

Word swap - The words are swapped (cdab)

Word and Byte swap - The words and bytes are swapped (dcba)

Byte swap - The bytes are swapped (badc)

Specifies the IP address of the target device to be addressed by this command

Use a value of -1 when interfacing to a PLC5 These devices do not have a slot parameter. When addressing a processor in a ControlLogix or CompactLogix, the slot number corresponds to the slot in the rack containing the controller being addressed.

Specifies the function code to be used in the command.

332 - CIP Data Table Read

333 - CIP Data Table Write

Specifies the data type of the target controller tag name.

Page 68 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Class 3 Client/UClient [x] Commands Basic

Parameter

Enable

Internal

Address

Poll Interval

Reg Count

Swap Code

IP Address

Slot

Func Code

Word Address

Comment

ProSoft Technology, Inc.

August 12, 2015

EIP Protocol

User Manual

Page 69 of 218

EIP Protocol

User Manual

5.3 EIP Diagnostics

PLX3x Series

Ethernet and Serial Gateways

5.3.1 PCB Diagnostics Menu

The best way to troubleshoot the EIP driver is to use ProSoft Configuration

Builder to access the diagnostic capabilities of the gateway through the Ethernet

debug port. For instructions on how to access Diagnostics, see Using

Diagnostics in ProSoft Configuration Builder

(page 36).

The following table summarizes the status information available in PCB for the

EIP driver.

Connection Type

EIP Class 1

EIP Class 3 Server

EIP Class 3

Client/UClient [x]

Submenu Item Description

Config

Status

Config

Comm Status

Config

Comm Status

Commands

Cmd Errors

(Decimal)

Cmd Errors

(Hex)

Configuration settings for Class 1 Connections.

Status of the Class 1 Connections: Displays any configuration error present, as well as the number of

Class 1 Connections.

Configuration settings for Class 3 Server Connections.

Status information for each Class 3 Server Connection:

Displays port numbers, IP addresses, socket status, and read and write counts.

Configuration settings for Class 3 Client/UClient

Connections.

Status information for Class 3 Client/UClient [x] commands. Displays a summary of all the errors resulting from Class 3 Client/UClient [x] commands.

Configuration for the Class 3 Client/UClient [x] command list.

Displays current error codes for each command on the

Class 3 Client/UClient [x] command list in decimal number format. A zero means there is currently no error for the command.

Displays current error codes for each command on the

Class 3 Client/UClient [x] command list in hexadecimal number format. A zero means there is currently no error for the command.

5.3.2 EIP Status Data in Upper Memory

The EIP driver has an associated status data area located in the gateway’s upper memory. The Data Map functionality of the gateway can be used to map this data

into the normal user data range of the gateway’s database. See Using the

CommonNet Data Map (page 25).

Note that all the status values are initialized to zero (0) at power-up, cold boot and during warm boot.

Page 70 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

EIP Protocol

User Manual

EIP Client Status Data

The following table lists the addresses in upper memory where general error and status data for each EIP connected and unconnected Client can be found.

4

5

6

7

8

9

Offset

0

1

2

3

EIP Client

Connected Client 0

Connected Client 1

Unconnected Client 0

Address Range

7900 through 7909

8100 through 8109

12800 through 12809

The content of each Client’s status data area is structured the same. The following table describes the content of each register in the status data area.

Description

Number of Command Requests

Number of Command Responses

Number of Command Errors

Number of Requests

Number of Responses

Number of Errors Sent

Number of Errors Received

Reserved

Current Error Code

Last Error Code

EIP Client Command List Error Data

A status/error code is held in upper memory for each command in each EIP

Client’s command list.

The following table lists the addresses in upper memory that hold command list error data for each EIP Client.

EIP Client

Connected Client 0

Connected Client 1

Unconnected Client 0

Address Range

7910 through 8009

8110 through 8209

12810 through 12909

The first word in each Client’s command list error data area contains the status/error code for the first command in the Client’s command list. Each successive word in the command error list is associated with the next command in the list. Therefore, the size of the command list error data area depends on the number of commands defined.

ProSoft Technology, Inc.

August 12, 2015

Page 71 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

The structure of the command list error data area (which is the same for all

Clients) is displayed in the following table.

.

.

.

97

98

99

Offset

0

1

2

3

4

Description

Command #1 Error Code

Command #2 Error Code

Command #3 Error Code

Command #4 Error Code

Command #5 Error Code

.

.

.

Command #98 Error Code

Command #99 Error Code

Command #100 Error Code

A non-zero error code indicates an error. To interpret the status/error codes, refer

to EIP Error Codes (page 73).

EIP Server Status Data

The following table lists the addresses in upper memory that hold status data for each EIP server.

2

3

4

EIP Server

0

1

Address Range

8900 through 8915

8916 through 8931

8932 through 8947

8948 through 8963

8964 through 8979

The content of each server’s status data area is structured the same. The following table describes the content of each register in the status data area.

Offset

0 through 1

2 through 3

4 through 5

6 through 7

8 through 15

Description

Connection State

Open Connection Count

Socket Read Count

Socket Write Count

Peer IP

Page 72 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

5.3.3 EIP Error Codes

EIP Protocol

User Manual

The gateway error codes are listed in this section. Error codes returned from the command list process are stored in the command list error memory region. A word is allocated for each command in the memory area. The error codes are formatted in the word as follows: The least-significant byte of the word contains the extended status code and the most-significant byte contains the status code.

Use the error codes returned for each command in the list to determine the success or failure of the command. If the command fails, use the error code to determine the cause of failure.

Note: The gateway specific error codes (not EtherNet/IP/PCCC compliant) are returned from within the gateway and never returned from an attached EtherNet/IP/PCCC slave device. These are error codes that are part of the EtherNet/IP/PCCC protocol or are extended codes unique to this gateway. The most common errors for the EtherNet/IP/PCCC protocol are shown in the following tables:

Local STS Error Codes

Code (Int)

Code (Hex) Description

0

0x0000 Success, no error

256

0x0100 DST node is out of buffer space

512

768

1024

0x0200

0x0300

0x0400

Cannot guarantee delivery (Link Layer)

Duplicate token holder detected

Local port is disconnected

1280

0x0500 Application layer timed out waiting for response

1536

1792

0x0600

0x0700

Duplicate node detected

Station is offline

2048

0x0800 Hardware fault

ProSoft Technology, Inc.

August 12, 2015

Page 73 of 218

EIP Protocol

User Manual

Remote STS Error Codes

Code (Int)

Code (Hex) Description

0

0x0000 Success, no error

4096

0x1000 Illegal command or format

8192

12288

0x2000

0x3000

Host has a problem and will not communicate

Remote node host is missing, disconnected or shut down

16384

20480

0x4000

0x5000

Host could not complete function due to hardware fault

Addressing problem or memory protect rungs

24576

26872

0x6000

0x7000

Function not allowed due to command protection selection

Processor is in Program mode

-32768

-28672

0x8000

0x9000

Compatibility mode file missing or communication zone problem

Remote node cannot buffer command

-24576

0xA000 Wait ACK (1775-KA buffer full)

-20480

-16384

0xB000

0xC000

Remote node problem due to download

Wait ACK (1775-KA buffer full)

-12288

-8192

0xD000

0xE000

Not used

Not used

0xF0nn Error code in the EXT STS byte (nn contains EXT error code)

PLX3x Series

Ethernet and Serial Gateways

-4079

-4078

-4077

-4076

-4075

-4074

-4073

-4072

-4071

-4086

-4085

-4084

-4083

-4082

-4081

-4080

Code (Int)

-4096

-4095

-4094

-4093

-4092

-4091

-4090

-4089

-4088

-4087

Errors When EXT STS Is Present

0xF010

0xF011

0xF012

0xF013

0xF014

0xF015

0xF016

0xF017

0xF018

0xF019

Code (Hex) Description

0xF000

0xF001

Not used

A field has an illegal value

0xF002

0xF003

0xF004

0xF005

0xF006

0xF007

0xF008

Less levels specified in address than minimum for any address

More levels specified in address than system supports

Symbol not found

Symbol is of improper format

Address does not point to something usable

File is wrong size

Cannot complete request

Data or file is too large

0xF009

0xF00A

0xF00B

0xF00C

0xF00D

0xF00E

0xF00F

Transaction size plus word address is too large

Access denied, improper privilege

Condition cannot be generated - resource is not available

Condition already exists - resource is already available

Command cannot be executed

Histogram overflow

No access

Illegal data type

Invalid parameter or invalid data

Address reference exists to deleted area

Command execution failure for unknown reason

Data conversion error

Scanner not able to communicate with 1771 rack adapter

Type mismatch

1171 Gateway response was not valid

Duplicate label

Page 74 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Code (Int)

-4070

-4069

-4068

-4067

-4066

-4065

Code (Hex) Description

0xF01A File is open; another node owns it

0xF01B

0xF01C

0xF01D

0xF01E

0xF01F

Another node is the program owner

Reserved

Reserved

Data table element protection violation

Temporary internal problem

Gateway Specific Error (not EIPCompliant)

Code (Int)

-1

-2

-10

-11

-12

-20

-21

-200

Code (Hex) Description

0xFFFF CTS modem control line not set before transmit

0xFFFE

0xFFF6

0xFFF5

0xFFF4

0xFFEC

0xFFEB

0xFF38

Timeout while transmitting message

Timeout waiting for DLE-ACK after request

Timeout waiting for response after request

Reply data does not match requested byte count

DLE-NAK received after request

DLE-NAK sent after response

DLE-NAK received after request

TCP/IP Interface Errors

Error (Int) Error (Hex) Description

-33 0xFFDF Failed to connect to target

-34

-35

-36

-37

0xFFDE

0xFFDD

0xFFDC

0xFFDB

Failed to register session with target (timeout)

Failed forward open response timeout

PCCC/Tag command response timeout

No TCP/IP connection error

Common Response Errors

-44

-45

-46

-47

-48

-49

Error (Int) Error (Hex) Description

-40

-41

-42

-43

0xFFD8

0xFFD7

0xFFD6

0xFFD5

Invalid response length

CPF item count not correct

CPF address field error

CPF packet tag invalid

0xFFD4

0xFFD3

0xFFD2

0xFFD1

0xFFD0

0xFFCF

CPF bad command code

CPF status error reported

CPF incorrect connection ID value returned

Context field not matched

Incorrect session handle returned

CPF not correct message number

ProSoft Technology, Inc.

August 12, 2015

EIP Protocol

User Manual

Page 75 of 218

EIP Protocol

User Manual

Register Session Response Errors

Error (Int) Error (Hex) Description

-50 0xFFCE Message length received not valid

-51

-52

0xFFCD

0xFFCC

Status error reported

Invalid version

Forward Open Response Errors

Error (Int)

Error (Hex) Description

-55 0xFFC9 Message length received not valid

-56 0xFFC8 Status error reported

PCCC Response Errors

Error (Int) Error (Hex) Description

-61

-62

-63

-64

-65

0xFFC3

0xFFC2

0xFFC1

0xFFC0

0xFFBF

Message length received not valid

Status error reported

CPF bad command code

TNS in PCCC message not matched

Vendor ID in PCCC message not matched

-66

0xFFBE Serial number in PCCC message not matched

PLX3x Series

Ethernet and Serial Gateways

Page 76 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

5.4 EIP Reference

5.4.1 SLC and MicroLogix Specifics

Messaging from a SLC 5/05

The gateway can be used to receive messages from a SLC 5/05 containing an

Ethernet interface. The gateway supports both read and write commands. A discussion of each operation is provided in the following topics.

SLC5/05 Write Commands

Write commands transfer data from the SLC processor to the gateway. An example rung used to execute a write command is shown in the following diagram:

EIP Protocol

User Manual

Set the READ/WRITE parameter to WRITE. The gateway supports a TARGET

DEVICE parameter value of 500CPU or PLC5. In order to complete the configuration of the MSG instruction, select the SETUP SCREEN area of the

MSG object. This displays the following dialog box.

ProSoft Technology, Inc.

August 12, 2015

Page 77 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

The TARGET DEVICE DATA TABLE ADDRESS must be set to a valid file element (such as, N11:0) for SLC and PLC5 messages. The MULTIHOP option must be set to YES. The MULTIHOP tab portion of the dialog box must be completed as displayed in the following window:

Set the IP address value to the gateway’s Ethernet IP address. The "Insert" key must be pressed to add the second line for ControlLogix Backplane and set the slot number to zero.

SLC5/05 Read Commands

Read commands transfer data to the SLC processor from the gateway. An example rung used to execute a read command is shown in the following diagram:

Page 78 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Set the READ/WRITE parameter to READ. The gateway supports a TARGET

DEVICE parameter value of 500CPU or PLC5. In order to complete the configuration of the MSG instruction, select the SETUP SCREEN area of the

MSG object. This displays the following dialog box.

EIP Protocol

User Manual

The TARGET DEVICE DATA TABLE ADDRESS must be set to a valid file element (such as, N11:0) for SLC and PLC5 messages. The MULTIHOP option must be set to YES.

Fill in the MULTIHOP tab portion of the dialog box as shown in the following illustration.

Set the IP address value to the gateway’s Ethernet IP address. The "Insert" key must be pressed to add the second line for ControlLogix Backplane and set the slot number to zero.

ProSoft Technology, Inc.

August 12, 2015

Page 79 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

C

R

N

F

Z

A

File Type

S

B

T

SLC File Types

This section contains information specific to the SLC and MicroLogix processor based family when used with the PCCC command set. The SLC and MicroLogix processor commands support a file type field entered as a single character to denote the data table to interface with in the command. The following table defines the relationship of the file types accepted by the Gateway and the SLC file types.

Description

Status

Bit

Timer

Counter

Control

Integer

Floating-point

String

ASCII

The File Type Command Code is the ASCII character code value of the File Type letter. This is the value to enter into the "File Type" parameter of the PCCC

Command configurations in the data tables in the ladder logic.

Additionally, the SLC specific functions (502, 510 and 511) support a subelement field. This field selects a sub-element field in a complex data table. For example, to obtain the current accumulated value for a counter or timer, the subelement field should be set to 2.

Page 80 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

5.4.2 PLC5 Processor Specifics

Messaging from a PLC5

The gateway can be used to receive messages from a PLC5 containing an

Ethernet interface. The gateway supports both read and write commands. A discussion of each operation is provided in the following topics:

PLC5 Write Commands

Write commands transfer data from the PLC5 processor to the gateway. An example rung used to execute a write command is shown in the following diagram:

EIP Protocol

User Manual

In order to complete the configuration of the MSG instruction, select the SETUP

SCREEN area of the MSG object. This displays the following dialog box.

Select the COMMUNICATION COMMAND to execute from the following list of supported commands.

♦ PLC5 Type Write

♦ PLC2 Unprotected Write

♦ PLC5 Typed Write to PLC

♦ PLC Typed Logical Write

The TARGET DEVICE DATA TABLE ADDRESS must be set to a valid file element (such as, N11:0) for SLC and PLC5 messages. For the PLC2

Unprotected Write message, set the address to the database index (such as,

1000) to consider with the command.

ProSoft Technology, Inc.

August 12, 2015

Page 81 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

The MULTIHOP option must be set to YES. The MULTIHOP tab portion of the dialog box must be completed as shown in the following window:

Set the IP address value to the gateway’s Ethernet IP address. The "Insert" key must be pressed to add the second line for ControlLogix Backplane and set the slot number to zero.

PLC5 Read Commands

Read commands transfer data to the PLC5 processor from the gateway. An example rung used to execute a read command is shown in the following diagram:

In order to complete the configuration of the MSG instruction, select the SETUP

SCREEN area of the MSG object. This displays the following dialog box.

Page 82 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Select the COMMUNICATION COMMAND to execute from the following list of supported commands.

♦ PLC5 Type Read

♦ PLC2 Unprotected Read

♦ PLC5 Typed Read to PLC

♦ PLC Typed Logical Read

The TARGET DEVICE DATA TABLE ADDRESS must be set to a valid file element (such as, N11:0) for SLC and PLC5 messages. For the PLC2

Unprotected Read message, set the address to the database index (such as,

1000) to consider with the command.

The MULTIHOP option must be set to YES. The MULTIHOP tab portion of the dialog box must be completed as shown in the following window:

EIP Protocol

User Manual

Set the IP address value to the gateway’s Ethernet IP address. The "Insert" key must be pressed to add the second line for ControlLogix Backplane and set the slot number to zero.

ProSoft Technology, Inc.

August 12, 2015

Page 83 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

PLC-5 Sub-Element Fields

This section contains information specific to the PLC-5 processor with relation to the PCCC command set. The commands specific to the PLC-5 processor contain a sub-element code field. This field selects a sub-element field in a complex data table. For example, to obtain the current accumulated value for a counter or timer, the sub-element field should be set to 2. The tables below show the subelement codes for PLC-5 complex data tables.

Timer / Counter

Code

0

1

2

Description

Control

Preset

Accumulated

Control

Code

0

1

2

Description

Control

Length

Position

PD*

Code

Description

0

2

4

6

Control

SP

Kp

Ki

8

26

Kd

PV

*All PD values are floating point values, so they are two words long.

BT

Code

0

1

2

3

4

5

MG

Code

0

1

2

3

Description

Control

RLEN

DLEN

Data file #

Element #

Rack/Grp/Slot

Description

Control

Error

RLEN

DLEN

Page 84 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

5.4.3 ControlLogix and CompactLogix Processor Specifics

In order to exchange data between a Control/CompactLogix processor and the gateway, the MSG instruction is used. There are two basic methods of data transfer supported by the gateway when using the MSG instruction:

Encapsulated PCCC messages and CIP Data Table messages. Either method can be used.

EIP Protocol

User Manual

Encapsulated PCCC Messages

This section contains information specific to the Control/CompactLogix processor when used with the PCCC command set. The current implementation of the

PCCC command set does not use functions that can directly interface with the

Controller Tag Database. In order to interface with this database, the tablemapping feature provided by RSLogix 5000 must be used. The software permits the assignment of Controller Tag Arrays to virtual PLC 5 data tables. The ProSoft gateway using the PLC 5 command set defined in this document can then reach this controller data.

PLC5 and SLC5/05 processors containing an Ethernet interface use the encapsulated PCCC message method. The gateway simulates these devices and accepts both read and write commands. The following topics describe the support for the read and write operations.

Encapsulated PCCC Write Message

Write commands transfer data from the processor to the gateway. The following encapsulated PCCC commands are supported:

♦ PLC2 Unprotected Write

♦ PLC5 Typed Write

♦ PLC5 Word Range Write

♦ PLC Typed Write

An example rung used to execute a write command is shown in the following diagram:

ProSoft Technology, Inc.

August 12, 2015

Page 85 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

The MESSAGE CONFIGURATION dialog box must be completed to define the data set to be transferred from the processor to the gateway. An example of the dialog box follows:

Complete the dialog box for the data area to be transferred. For PLC5 and SLC messages, the DESTINATION ELEMENT should be an element in a data file

(such as, N10:0). For the PLC2 Unprotected Write message, the DESTINATION

ELEMENT is the address in the gateway’s internal database and cannot be set to a value less than ten. This is not a limitation of the gateway but of the RSLogix software. For a PLC2 unprotected write or read function, the database address should be entered in octal format. The COMMUNICATION information must also be configured. The following is an example of the dialog box.

Page 86 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

EIP Protocol

User Manual

Verify that the CIP radio-button is selected as the COMMUNICATION METHOD.

The PATH specifies the message route from the processor to the EIP gateway.

Path elements are separated by commas. In the example path shown, the first element is "Enet", which is the user-defined name given to the 1756-ENET gateway in the chassis (the slot number of the ENET gateway can be substituted for the name), the second element, "2", represents the Ethernet port on the 1756-

ENET gateway, and the last element of the path, "192.168.0.75", is the IP address of the gateway, the target for the message.

More complex paths are possible if routing to other networks using multiple 1756-

ENET gateways and racks. Refer to the Support Knowledgebase for more information on Ethernet routing and path definitions.

Encapsulated PCCC Read Message

Read commands transfer data from the gateway to a processor. The following encapsulated PCCC commands are supported:

♦ PLC2 Unprotected Read

♦ PLC5 Typed Read

♦ PLC5 Word Range Read

♦ PLC Typed Read

An example rung used to execute a read command is shown in the following diagram:

The MESSAGE CONFIGURATION dialog box must be completed to define the data set to transfer to the processor from the gateway. An example of the dialog box follows:

ProSoft Technology, Inc.

August 12, 2015

Page 87 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Complete the dialog box for the data area to be transferred. For PLC5 and SLC messages, the SOURCE ELEMENT should be an element in a data file (such as,

N10:0). For the PLC2 Unprotected Read message, the SOURCE ELEMENT is the address in the gateway’s internal database and cannot be set to value less than ten. This is not a limitation of the gateway but of the RSLogix software. The

COMMUNICATION information must also be configured. An example of the dialog box follows:

Verify that the CIP radio-button is selected as the COMMUNICATION METHOD.

The PATH specifies the message route from the processor to the EIP gateway.

Path elements are separated by commas. In the example path shown, the first element is "Enet", which is the user-defined name given to the 1756-ENET gateway in the chassis (the slot number of the ENET gateway can be substituted for the name), the second element, "2", represents the Ethernet port on the 1756-

ENET gateway, and the last element of the path, "192.168.0.75", is the IP address of the gateway, the target for the message.

More complex paths are possible if routing to other networks using multiple 1756-

ENET gateways and racks. Refer to the Support Knowledgebase for more information on Ethernet routing and path definitions.

Page 88 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

EIP Protocol

User Manual

CIP Data Table Operations

This method of data transfer uses CIP messages to transfer data between the

ControlLogix or CompactLogix processor and the gateway. Tag names define the elements to be transferred. The following topics describe the support for the read and write operations.

CIP Data Table Write

CIP data table write messages transfer data from the processor to the gateway.

An example rung used to execute a write command is shown in the following diagram:

The MESSAGE CONFIGURATION dialog box must be completed to define the data set to be transferred from the processor to the gateway. An example of the dialog box follows:

Complete the dialog box for the data area to be transferred. CIP Data Table messages require a tag database element for both the source and destination.

The SOURCE TAG is a tag defined in the Controller Tag database. The

DESTINATION ELEMENT is the tag element in the gateway.

The gateway simulates a tag database as an array of elements defined by the maximum register size for the gateway (user configuration parameter "Maximum

Register" in the [Gateway] section) with the tag name INT_DATA.

ProSoft Technology, Inc.

August 12, 2015

Page 89 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

In the previous example, the first element in the database is the starting location for the write operation of ten elements. The COMMUNICATION information must also be configured. An example of the dialog box follows:

Verify that the CIP radio-button is selected as the COMMUNICATION METHOD.

The PATH specifies the message route from the processor to the EIP gateway.

Path elements are separated by commas. In the example path shown, the first element is "Enet", which is the user-defined name given to the 1756-ENET gateway in the chassis (the slot number of the ENET gateway can be substituted for the name), the second element, "2", represents the Ethernet port on the 1756-

ENET gateway, and the last element of the path, "192.168.0.75", is the IP address of the gateway, the target for the message.

More complex paths are possible if routing to other networks using multiple 1756-

ENET gateways and racks. Refer to the Support Knowledgebase for more information on Ethernet routing and path definitions.

CIP Data Table Read

CIP data table read messages transfer data to the processor from the gateway.

An example rung used to execute a read command is shown:

Page 90 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

EIP Protocol

User Manual

The MESSAGE CONFIGURATION dialog box must be completed to define the data set to transfer to the processor from the gateway. An example of the dialog box follows:

ProSoft Technology, Inc.

August 12, 2015

Complete the dialog box for the data area to be transferred. CIP Data Table messages require a tag database element for both the source and destination.

The DESTINATION TAG is a tag defined in the Controller Tag database. The

SOURCE ELEMENT is the tag element in the EIP gateway. The gateway simulates a tag database as an array of elements defined by the maximum register size for the gateway (user configuration parameter "Maximum Register" in the [Gateway] section) with the tag name INT_DATA. In the example above, the first element in the database is the starting location for the read operation of ten elements. Additionally, the COMMUNICATION information must also be configured. An example of the dialog box follows:

Page 91 of 218

EIP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Verify that the CIP radio-button is selected as the COMMUNICATION METHOD.

The PATH specifies the message route from the processor to the EIP gateway.

Path elements are separated by commas. In the example path shown, the first element is "Enet", which is the user-defined name given to the 1756-ENET gateway in the chassis (the slot number of the ENET gateway can be substituted for the name), the second element, "2", represents the Ethernet port on the 1756-

ENET gateway, and the last element of the path, "192.168.0.75", is the IP address of the gateway, the target for the message.

More complex paths are possible if routing to other networks using multiple 1756-

ENET gateways and racks. Refer to the Support Knowledgebase for more information on Ethernet routing and path definitions.

5.4.4 EIP Command Entry Form

The following form can be used to design the application’s command list:

Gateway Information Data

Column # 1

Function

Code

Enable

Code

2

Internal

Address

3

Poll

Interval

Time

4 5

Count Swap

Code

Device Information Data

6 7 8

IP

Address

Slot

Number

Function

Code

9 10 11

Function Parameters

12

IP Address = IP address of processor to reach

Slot Number = -1 for PLC5 & SLC, processor slot number of ControlLogix

Page 92 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBTCP Protocol

User Manual

6 MBTCP Protocol

In This Chapter

MBTCP Functional Overview ............................................................ 94

MBTCP Configuration ....................................................................... 98

MBTCP Diagnostics ........................................................................ 105

MBTCP Reference .......................................................................... 109

This chapter contains information specific to the PLX3x-series gateway Modbus

TCP/IP (MBTCP) protocol driver.

ProSoft Technology, Inc.

August 12, 2015

Page 93 of 218

MBTCP Protocol

User Manual

6.1 MBTCP Functional Overview

PLX3x Series

Ethernet and Serial Gateways

The PLX3x Modbus TCP/IP (MBTCP) protocol can be used to interface many different protocols into the Schneider Electric Quantum family of processors as well other devices supporting the protocol. The MBTCP protocol supports both

Client and server connections.

The gateway supports a Client connection on the TCP/IP network to interface with processors (and other server based devices) using a user constructed command list of up to 100 entries. The gateway’s internal database is used as the source for write commands to the remote processors. Data collected from the processors using read commands is placed in the gateway’s database.

Data in the gateway’s internal database is accessible for read and write operations by any node on the network supporting the MBAP (Service Port 502) or MBTCP (Service Ports 2000/2001) TCP/IP protocols. The MBAP protocol

(Port 502) is a standard implementation defined by Schneider Electric and used on their Quantum processor. This open protocol is a modified version of the

Modbus serial protocol. The MBTCP protocol is an embedded Modbus protocol message in a TCP/IP packet. The gateway supports up to five active server connections on Service Ports 502, five additional active server connections on

Service Port 2000, and one active Client connection.

6.1.1 General Specifications - Modbus TCP/IP

The Modbus TCP/IP protocol allows multiple independent, concurrent Ethernet connections. The connections may be all Clients, all servers, or a combination of both Client and server connections.

♦ 10/100 MB Ethernet Communication port

♦ Supports Enron version of Modbus protocol for floating-point data transactions

♦ Configurable parameters for the client including a minimum response delay of

0 to 65535 ms and floating-point support

♦ Supports five independent server connections for Service Port 502

♦ Supports five independent server connections for Service Port 2000

♦ All data mapping begins at Modbus register 400001, protocol base 0.

♦ Error codes, network error counters, and port status data available in user data memory

Modbus TCP/IP Client

♦ Actively reads data from and writes data to Modbus TCP/IP devices using

MBAP

♦ Up to 10 Client connections with multiple commands to talk to multiple servers

Page 94 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBTCP Protocol

User Manual

Modbus TCP/IP Server

♦ The server driver accepts incoming connections on Service Port 502 for

Clients using Modbus TCP/IP MBAP messages and connections on Service

Port 2000 (or other Service Ports) for Clients using Encapsulated Modbus messages.

♦ Supports multiple independent server connections for any combination of

Service Port 502 (MBAP) and Service Port 2000 (Encapsulated)

♦ Up to 20 servers are supported

Modbus Commands

Supported

(Client and Server)

Configurable

Parameters:

(Client and Server)

Configurable

Parameters:

(Client Only)

Command List

Status Data

1: Read Coil Status

2: Read Input Status

3: Read Holding Registers

4: Read Input Registers

5: Force (Write) Single Coil

6: Preset (Write) Single

Holding Register

Gateway IP Address

15: Force (Write) Multiple Coils

16: Preset (Write) Multiple

Holding Registers

22: Mask Write Holding

Register (Slave Only)

23: Read/Write Holding

Registers (Slave Only)

PLC Read Start Register (%MW)

PLC Write Start Register (%MW)

Number of MBAP and MBTCP servers

Gateway Modbus Read Start Address

Gateway Modbus Write Start Address

Minimum Command Delay

Response Timeout

Retry Count

Command Error Pointer

Up to 160 Modbus commands (one tag per command)

Error codes reported individually for each command.

High-level status data available from Modbus TCP/IP Client

(for example PLC)

Command List Polling

Each command can be individually enabled or disabled; write-only-on-data-change is available

6.1.2 Internal Database

Central to the functionality of the gateway is the internal database. This database is shared between all the ports on the gateway and is used as a conduit to pass information from one device on one network to one or more devices on another network. This permits data from devices on one communication port to be viewed and controlled by devices on another communication port.

In addition to data from the Client and server, status and error information generated by the gateway can also be mapped into the internal database.

ProSoft Technology, Inc.

August 12, 2015

Page 95 of 218

MBTCP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Modbus TCP/IP Client Access to Database

The Client functionality exchanges data between the PLX3x gateway's internal database and data tables established in one or more Quantum processors or other server based devices. The command list, defined in the user configuration, specifies what data is to be transferred between the gateway and each of the servers on the network. No ladder logic is required in the processor (server) for

Client functionality, except to assure that sufficient data memory exists.

The following illustration describes the flow of data between the Ethernet Clients and the internal database.

Multiple Server Access to Database

The MBTCP gateway provides server functionality using reserved Service Port

502 for Modbus TCP/IP MBAP messages, as well as Service Ports 2000 and

2001 to support the TCP/IP Encapsulated Modbus version of the protocol used by several HMI manufacturers. Server support in the gateway permits Client applications (for example: HMI software, Quantum processors, etc) to read from and write to the gateway’s database. This section discusses the requirements for attaching to the gateway using Client applications.

The server driver is able to support multiple concurrent connections from several

Clients. Up to five (5) Clients can simultaneously connect on Service Port 502 and five (5) more can also simultaneously connect on Service Port 2000. Service

Port 2001 is used by the MBTCP protocol to pass Encapsulated Modbus commands through from the Ethernet port to the gateway’s serial port.

When configured as a server, the internal database of the MBTCP gateway is used as the source for read requests and the destination for write requests from remote Clients. Access to the database is controlled by the command type received in the incoming message from the Client. The following table specifies the relationship of the gateway’s internal database to the addresses required in the incoming Modbus TCP/IP requests.

Page 96 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBTCP Protocol

User Manual

Database Address

0

1000

2000

3000

3999

Modbus Address

40001

41001

42001

43001

44000

The following virtual addresses are not part of the normal gateway user database and are not valid addresses for standard data. However, these addresses may be used for incoming commands that are requesting floating-point data.

To use addresses in this upper range requires the following

♦ Set the Float Flag in the MBTCP server configuration to Yes

♦ Set the Float Start to a database address in the range below

♦ Set the Float Offset to a database address in the gateway user memory area shown above.

Remember that, once this is done, all data above the Float Start address must be floating-point data.

Database Address

4000

5000

6000

7000

8000

9000

9999

Modbus Address

44001

45001

46001

47001

48001

49001

50000

The MBTCP gateway must be correctly configured and connected to the network before any attempt is made to use it. Use a network verification program, such as

ProSoft Discovery Service or the command prompt PING instruction, to verify that the gateway can be seen on the network. Use ProSoft Configuration Builder

to confirm proper configuration of the gateway and to transfer the configuration files to and from the gateway.

Modbus Message Routing: Port 2001

When Modbus messages are sent to the Gateway over the TCP/IP connection to port 2001, the messages are sent (routed in the Gateway) directly out the serial communication port (Port 0, if it is configured as a Modbus Master. The commands (whether a read or a write command) are immediately routed to the slave devices on the serial port. Response messages from the slave devices are routed to the TCP/IP network to be received by the originating host.

ProSoft Technology, Inc.

August 12, 2015

Page 97 of 218

MBTCP Protocol

User Manual

6.2 MBTCP Configuration

PLX3x Series

Ethernet and Serial Gateways

6.2.1 MBTCP Servers

This section contains database offset information used by the server when accessed by external Clients. These offsets can be utilized to segment the database by data type.

Parameter

Float Flag

Float Start

Float Offset

Output

Offset

Value

YES or NO

0 to 65535

0 to 3999

0 to 3999

Description

This flag specifies if the floating-point data access functionality is to be implemented. If the float flag is set to YES, Modbus functions 3,

6, and 16 will interpret floating-point values for registers as specified by the two following parameters.

This parameter specifies the first register of floating-point data. All requests with register values greater than or equal to this value will be considered floating-point data requests. This parameter is only used if the Float Flag is enabled. For example, if a value of 7000 is entered, all requests for registers 7000 and above will be considered floating-point data.

This parameter specifies the start register for floating-point data in the internal database. This parameter is used only if the Float Flag is enabled. For example, if the Float Offset value is set to 3000 and the float start parameter is set to 7000, data requests for register

7000 will use the internal Modbus register 3000.

When the port is configured as a slave, this parameter specifies the internal database address to use as the zero address or starting point for binary output Coil data. Coil data is read by Modbus

Function Code 1 commands (Read Coils) and written by Function

Codes 5 (Force Single Coil) or Function Code 15 (Force Multiple

Coils). For example, if this parameter is set to 50 and a Function

Page 98 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Parameter

Value

Bit Input

Offset

Holding

Register

Offset

Word Input

Offset

0 to 3999

0 to 3999

Connection

Timeout

0 to 1200 seconds

MBTCP Protocol

User Manual

0 to 3999

Description

Code 1 command is received requesting Coil address 0 (virtual

Modbus Coil address 00001 or 000001), the data returned in the response will be the value at register 50, bit 0 in the gateway's database.

This parameter specifies the offset address in the internal Modbus database for network requests for Modbus function 2 commands.

For example, if the value is set to 150, an address request of 0 will return the value at register 150 in the database.

This parameter specifies the offset address in the internal Modbus database to with network requests for Modbus functions 3, 6, or 16 commands. For example, if the value is set to 50, an address request of 0 will return the value at register 50 in the database.

This parameter specifies the offset address in the internal Modbus database for network requests for Modbus function 4 commands.

For example, if the value is set to 150, an address request of 0 will return the value at register 150 in the database.

This parameter specifies the number of seconds the server will wait to receive new data. If the server does not receive any new data during this time, it will close the connection.

ProSoft Technology, Inc.

August 12, 2015

Page 99 of 218

MBTCP Protocol

User Manual

6.2.2 MBTCP Client[x]

PLX3x Series

Ethernet and Serial Gateways

The MBTCPClient [x] section of the configuration specifies the parameters for the client to be emulated on the gateway. The command list for the client is entered in a separate section.

Parameter

Minimum

Command

Delay

Response

Timeout

Retry Count

Float Flag

Float Start

Value

0 to 32767

0 to 65535 milliseconds

0 to 10

YES or NO

0 to 32767

0 TO 3998

Description

This parameter specifies the number of milliseconds to wait between the initial issuance of a command. This parameter can be used to delay all commands sent to slaves to avoid

"flooding" commands on the network. This parameter does not affect retries of a command as they will be issued when failure is recognized.

This parameter specifies the time in milliseconds that a Client will wait before re-transmitting a command if no response is received from the addressed server. The value to use depends on the type of communication network used, and the expected response time of the slowest device on the network.

This parameter specifies the number of times a command will be retried if it fails.

This flag specifies if the floating-point data access functionality is to be implemented. If the float flag is set to YES, Modbus functions 3, 6, and 16 will interpret floating-point values for registers as specified by the two following parameters.

This parameter specifies the first register of floating-point data.

All requests with register values greater-than or equal to this value will be considered floating-point data requests. This parameter is only used if the Float Flag is enabled. For example, if a value of 7000 is entered, all requests for registers

7000 and above will be considered as floating-point data.

This parameter specifies the starting register for floating-point data in the internal gateway database. This parameter is used

Float Offset

Page 100 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Parameter

Value

ARP Timeout

Command

Error Delay

1 to 60

0 to 300

MBTCP Protocol

User Manual

Description

only if the Float Flag is set to YES.

For example, if the Float Offset value is set to 3000 and the

Float Start parameter is set to 7000, the data returned as floating-point data for register 47001 (or 407001) will actually come from internal gateway registers 3000 and 3001. If the requested address was 47002 (407002), the data will be returned from internal registers 3002 and 3003. If the requested address was 47101 (407101), the data will be returned from internal registers 3200 and 3201; and so on.

This parameter specifies the number of seconds to wait for an

ARP reply after a request is issued.

This parameter specifies the number of 100 millisecond intervals to turn off a command in the error list after an error is recognized for the command. If this parameter is set to 0, there will be no delay.

ProSoft Technology, Inc.

August 12, 2015

Page 101 of 218

MBTCP Protocol

User Manual

6.2.3 MBTCP Client[x] Commands

PLX3x Series

Ethernet and Serial Gateways

The MBTCP Client[x] Commands section defines the Modbus TCP/IP commands to be issued from the gateway to server devices on the network. These commands can be used for data collection and/or control of devices on the

TCP/IP network.

In order to interface the PLX3x gateway with Modbus TCP/IP server devices, a command list must be constructed. The commands in the list specify the server device to be addressed, the function to be performed (read or write), the data area in the device to interface with and the registers in the internal database to be associated with the device data. The Client command list supports up to 16 commands per Client. The command list is processed from top (command #0) to bottom.

The following table describes the command list configuration parameters.

Parameter

Enable

Internal

Address

Value

YES

NO

CONDITONAL

0 to 3999 (for register-level addressing) or

0 to 63999(for bit-level addressing)

Description

Specifies if the command is to be executed and under what conditions.

No (0) - the command is disabled and will not be executed in the normal polling sequence.

Yes (1)- the command will be executed upon each scan of the

Command List if the Poll Interval is set to zero (0). If the Poll

Interval is set to a non-zero value, the command will be executed when the interval timer for that command expires.

Conditional (2)- the command will execute only if the internal bit data associated with the command changes. It will also clear the bit or bits in the internal database after the write command is built.

This parameter is valid only for bit-level write commands (FC 5 and 15).

Specifies the database address in the gateway's internal database to use as the destination for data brought in by a read command, or as the source for data to be sent out by a write command. The database address is interpreted as a bit address or a 16-bit register (word) address, depending on the Modbus

Function Code used in the command.

For Modbus functions 1, 2, 5, and 15, this parameter is

Page 102 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Parameter

Poll Interval

Reg Count

Swap Code

Value Description

interpreted as a bit-level address.

For Modbus functions 3, 4, 6, and 16, this parameter is interpreted as a register-level address.

MBTCP Protocol

User Manual

0 to 65535

Specifies the minimum interval between executions of continuous commands. The value is in tenths of a second. Therefore, if a value of 100 is entered, the command will execute no more frequently than once every 10 seconds.

1 to 125 (for registers) or

1 to 800 (for coils)

This parameter specifies the number of 16-bit registers or binary bits to be transferred by the command.

Modbus functions 5 and 6 ignore this field as they apply only to a single data point.

For Modbus functions 1, 2, and 15, this parameter sets the number of bits (inputs or coils) to be transferred by the command.

For Modbus functions 3, 4, and 16, this parameter sets the number of registers to be transferred by the command.

No Change

Word Swap

Word and Byte

Swap

Byte Swap

Specifies if and how the order of bytes in data received or sent is to be rearranged. This option exists to allow for the fact that different manufacturers store and transmit multi-byte data in different combinations. This parameter is helpful when dealing with floating-point or other multi-byte values, as there is no one standard method of storing these data types. The parameter can be set to rearrange the byte order of data received or sent into an order more useful or convenient for other applications.

No change(0) - No change is made in the byte ordering (1234 =

1234)

Word Swap (1) -The words are swapped (1234=3412)

Word and Byte Swap (2) - The words are swapped, then the bytes in each word are swapped (1234=4321)

Byte Swap (3) - The bytes in each word are swapped

(1234=2143)

These swap operations affect 4-byte (or 2-word) groups of data.

Therefore, data swapping using these Swap Codes should be done only when using an even number of words, such as when

32-bit integer or floating-point data is involved. xxx.xxx.xxx.xxx IP address of the device being addressed by the command.

Node IP

Address

Serv Port

502 or other supported port on server

Slave

Address

1 to 255 (0 is a broadcast)

Service port on which communication will occur. Use a value of

502 when addressing Modbus TCP/IP servers which are compatible with the Schneider Electric MBAP specifications (this will be most devices). If the server device supports another service port, enter the value here.

Specifies the node address of a remote Modbus Serial device through a Modbus Ethernet to Serial converter. Values of 1 to 255 are permitted.

Note: Most Modbus devices only accept addresses in the range of 1 to 247, so check with the slave device manufacturer to see if a particular slave can use addresses 248 to 255.

If the value is set to zero, the command will be a broadcast message on the network. The Modbus protocol permits broadcast commands for write operations. Do not use node address 0 for

read operations.

Modbus

1, 2, 3, 4, 5, 6,

15, or 16

ProSoft Technology, Inc.

August 12, 2015

Specifies the Modbus Function Code to be executed by the

Page 103 of 218

MBTCP Protocol

User Manual

Parameter

Function

Page 104 of 218

Value

MB Address in Device

Varies

PLX3x Series

Ethernet and Serial Gateways

Description

command. These function codes are defined in the Modbus protocol. (More information on the protocol is available from www.modbus.org

.) The following function codes are supported by the gateway.

1 - Read Coil Status

2 - Read Input Status

3 - Read Holding Registers

4 - Read Input Registers

5 - Force (Write) Single Coil

6 - Preset (Write) Single Register

15 - Force Multiple Coils

16 - Preset Multiple Registers

Specifies the starting Modbus register or bit address in the server to be used by the command. Refer to the documentation of each

Modbus server device for the register and bit address assignments valid for that device.

The Modbus Function Code determines whether the address will be a register-level or bit-level OFFSET address into a given data type range. The offset will be the target data address in the server minus the base address for that data type. Base addresses for the different data types are:

♦ 00001 or 000001 (0x0001) for bit-level Coil data (Function

Codes 1, 5, and 15).

♦ 10001 or 100001 (1x0001) for bit-level Input Status data

(Function Code 2)

♦ 30001 or 300001 (3x0001) for Input Register data (Function

Code 4)

♦ 40001 or 400001 (4x0001) for Holding Register data

(Function Codes 3, 6, and 16).

♦ Address calculation examples: o

For bit-level Coil commands (FC 1, 5, or 15) to read or write a Coil 0X address 00001, specify a value of 0

(00001 - 00001 = 0). o

For Coil address 00115, specify 114 o

(00115 - 00001 = 114)

♦ For register read or write commands (FC 3, 6, or 16) 4X range, for 40001, specify a value of 0 o

(40001 - 40001 = 0).

♦ For 01101, 11101, 31101 or 41101, specify a value of 1100. o

(01101 - 00001 = 1100) o

(11101 -10001 = 1100) o

(31101 - 30001 = 1100) o

(41101 - 40001 = 1100)

Note: If the documentation for a particular Modbus server device lists data addresses in hexadecimal (base16) notation, you will need to convert the hexadecimal value to a decimal value to enter in this parameter. In such cases, it is not usually necessary to subtract 1 from the converted decimal number, as this addressing scheme typically uses the exact offset address expressed as a hexadecimal number.

ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

6.3 MBTCP Diagnostics

MBTCP Protocol

User Manual

6.3.1 PCB Diagnostics

The best way to troubleshoot the MBTCP driver is to use ProSoft Configuration

Builder to access the diagnostic capabilities of the gateway through the Ethernet

debug port. For instructions on how to access Diagnostics, see Using

Diagnostics in ProSoft Configuration Builder

(page 36).

6.3.2 MBTCP Status Data in Upper Memory

The MBTCP driver has an associated status data area located in the gateway’s upper memory. The Data Map functionality of the gateway can be used to map

this data into the normal user data range of the gateway’s database. See Using the CommonNet Data Map (page 25).

Note that all the status values are initialized to zero (0) at power-up, cold boot and during warm boot.

7

8

9

3

4

5

6

Offset

0

1

2

MBTCP Server Status Data

The following table lists the addresses in upper memory where status data for

MBTCP servers can be found.

Server Port

2000

502

2001

Address Range

6200 through 6209

6210 through 6219

6220 through 6229

The content of each server port’s status data area is structured the same. The following table describes the content of each register in the status data area.

Description

Number of Command Requests

Number of Command Responses

Number of Command Errors

Number of Requests

Number of Responses

Number of Errors Sent

Number of Errors Received

Configuration Error Word

Current Error Code

Last Error Code

ProSoft Technology, Inc.

August 12, 2015

Page 105 of 218

MBTCP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

.

MBTCP Client Status Data

The following table lists the addresses in upper memory that hold status data for each MBTCP Client.

Client

0

1

2

.

Address Range

15500 through 15509

15526 through 15535

15552 through 15561

.

.

Offset

3

4

5

6

0

1

2

7

8

9

8

9

15708 through 15717

15734 through 15743

The content of each Client’s status data area is structured the same. The following table describes the content of each register in the status data area.

Description

Command Request Count (total Client commands sent)

Command Response Count (total command responses received)

Command Error Count

Number of Request Packets

Number of Response Packets

Errors Sent

Errors Received

Reserved

Current Error

Last Error

Offsets 8 and 9 contain information about the most recent communication errors.

The Current Error (offset 8) will have a non-zero value if the currently executing

Client command experiences an error.

The Last Error (offset 9) will store the most recent non-zero value error code that was reported by the Client the last time it experienced an error. Note that this value is retentive. This register will hold the last error value until the memory is cleared by a restart, reset, cold-boot, or warm-boot operation. Therefore, any value you see here may indicate an error that could have occurred at any time since the gateway was last restarted and may not indicate a current or recent

error. For details on error codes, see MBTCP Client Command List Error Data

(page 108).

Page 106 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBTCP Protocol

User Manual

.

MBTCP Client Command List Error Data

A status/error code is held in upper memory for each command in each MBTCP

Client’s command list.

The following table lists the addresses in upper memory that hold command list error data for each MBTCP Client.

Client

0

1

2

.

Address Range

15510 through 15525

15536 through 15551

15562 through 15577

.

.

8

9

15718 through 15733

15744 through 15759

The first word in each Client’s command list error data area contains the status/error code for the first command in the Client’s Command List. Each successive word in the Command Error List is associated with the next command in the Client Command List. Therefore, the number of valid error values is dependent upon the number of commands defined.

The structure of the command list error data area (which is the same for all

Clients) is displayed in the following table.

Offset

0

1

2

3

4

.

Description

Command #1 Error Code

Command #2 Error Code

Command #3 Error Code

Command #4 Error Code

Command #5 Error Code

.

.

.

.

.

13

14

15

Command #14 Error Code

Command #15 Error Code

Command #16 Error Code

A non-zero error code for a command indicates an error. To interpret the

status/error codes, refer to MBTCP Error Codes (page 108).

ProSoft Technology, Inc.

August 12, 2015

Page 107 of 218

MBTCP Protocol

User Manual

6.3.3 MBTCP Error Codes

3

4

5

6

Code

1

2

Standard Modbus Exception Code Errors

Description

Illegal function

Illegal data address

Illegal data value

Failure in associated device

Acknowledge

Busy; message was rejected

PLX3x Series

Ethernet and Serial Gateways

MBTCP Client Specific Errors

Code

-33

-35

-36

-37

Description

Failed to connect to server specified in command

Wrong message length in the response

MBTCP command response timeout (same as -11)

TCP/IP connection ended before session finished

Code

-40

-41

-42

-43

-44

-45

-46

Command List Entry Errors

Description

Too few parameters

Invalid enable code

Internal address > maximum address

Invalid node address (<0 or >255)

Count parameter set to 0

Invalid function code

Invalid swap code

Gateway Communication Error Codes

Code

-2

-11

253

254

255

Description

Timeout while transmitting message

Timeout waiting for response after request (same as -36)

Incorrect slave/server address in response

Incorrect function code in response

Invalid CRC/LRC value in response

Page 108 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

6.4 MBTCP Reference

6.4.1 Modbus Protocol Specification

MBTCP Protocol

User Manual

Read Coil Status (Function Code 01)

Query

This function allows the user to obtain the ON/OFF status of logic coils used to control discrete outputs from the addressed server only. Broadcast mode is not supported with this function code. In addition to the server address and function fields, the message requires that the information field contain the initial coil address to be read (Starting Address) and the number of locations that will be interrogated to obtain status data.

The addressing allows up to 2000 coils to be obtained at each request; however, the specific server device may have restrictions that lower the maximum quantity.

The coils are numbered from zero; (coil number 1 = zero, coil number 2 = one, coil number 3 = two, and so on).

The following table is a sample read output status request to read coils 0020 to

0056 from server device number 11.

Adr

11

Func Data Start Pt Hi Data Start Pt Lo Data # Of Pts Ho Data # Of Pts Lo Error Check Field

01 00 13 00 25

CRC

Response

An example response to Read Coil Status is as shown in Figure C2. The data is packed one bit for each coil. The response includes the server address, function code, quantity of data characters, the data characters, and error checking. Data will be packed with one bit for each coil (1 = ON, 0 = OFF). The low order bit of the first character contains the addressed coil, and the remainder follows. For coil quantities that are not even multiples of eight, the last characters will be filled in with zeros at high order end. The quantity of data characters is always specified as quantity of RTU characters, that is, the number is the same whether RTU or

ASCII is used.

ProSoft Technology, Inc.

August 12, 2015

Page 109 of 218

MBTCP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Because the server interface device is serviced at the end of a controller's scan, data will reflect coil status at the end of the scan. Some servers will limit the quantity of coils provided each scan; thus, for large coil quantities, multiple PC transactions must be made using coil status from sequential scans.

11 01

05

Data Coil

Status 20 to

27

CD

Data Coil

Status 28 to

35

6B

Data Coil

Status 36 to

43

B2

Data Coil

Status 44 to

51

OE

Data Coil

Status 52 to

56

1B

Error

Check

Field

CRC

The status of coils 20 to 27 is shown as CD(HEX) = 1100 1101 (Binary). Reading left to right, this shows that coils 27, 26, 23, 22, and 20 are all on. The other coil data bytes are decoded similarly. Due to the quantity of coil statuses requested, the last data field, which is shown 1B (HEX) = 0001 1011 (Binary), contains the status of only 5 coils (52 to 56) instead of 8 coils. The 3 left most bits are provided as zeros to fill the 8-bit format.

Read Input Status (Function Code 02)

Query

This function allows the user to obtain the ON/OFF status of discrete inputs in the addressed server PC Broadcast mode is not supported with this function code. In addition to the server address and function fields, the message requires that the information field contain the initial input address to be read (Starting Address) and the number of locations that will be interrogated to obtain status data.

The addressing allows up to 2000 inputs to be obtained at each request; however, the specific server device may have restrictions that lower the maximum quantity. The inputs are numbered form zero; (input 10001 = zero, input 10002 = one, input 10003 = two, and so on, for a 584).

The following table is a sample read input status request to read inputs 10197 to

10218 from server number 11.

Adr

11

Func Data Start Pt Hi Data Start Pt Lo Data #of Pts Hi Data #of Pts Lo Error Check Field

02 00 C4 00 16

CRC

Response

An example response to Read Input Status is as shown in Figure C4. The data is packed one bit for each input. The response includes the server address, function code, quantity of data characters, the data characters, and error checking. Data will be packed with one bit for each input (1=ON, 0=OFF). The lower order bit of the first character contains the addressed input, and the remainder follows. For input quantities that are not even multiples of eight, the last characters will be filled in with zeros at high order end. The quantity of data characters is always specified as a quantity of RTU characters, that is, the number is the same whether RTU or ASCII is used.

Page 110 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBTCP Protocol

User Manual

Because the server interface device is serviced at the end of a controller's scan, data will reflect input status at the end of the scan. Some servers will limit the quantity of inputs provided each scan; thus, for large coil quantities, multiple PC transactions must be made using coil status for sequential scans.

Adr

Func Byte

Count

11

02 03

Data Discrete Input

10197 to 10204

AC

Data Discrete Input

10205 to 10212

DB

Data Discrete Input

10213 to 10218

35

Error Check Field

CRC

The status of inputs 10197 to 10204 is shown as AC (HEX) = 10101 1100

(binary). Reading left to right, this show that inputs 10204, 10202, and 10199 are all on. The other input data bytes are decoded similar.

Due to the quantity of input statuses requested, the last data field which is shown as 35 HEX = 0011 0101 (binary) contains the status of only 6 inputs (10213 to

102180) instead of 8 inputs. The two left-most bits are provided as zeros to fill the 8-bit format.

Read Holding Registers (Function Code 03)

Query

Read Holding Registers (03) allows the user to obtain the binary contents of holding registers 4xxxx in the addressed server. The registers can store the numerical values of associated timers and counters which can be driven to external devices. The addressing allows up to 125 registers to be obtained at each request; however, the specific server device may have restrictions that lower this maximum quantity. The registers are numbered form zero (40001 = zero, 40002 = one, and so on). The broadcast mode is not allowed.

The example below reads registers 40108 through 40110 from server 584 number 11.

Adr Func Data Start Reg Hi Data Start Reg Lo Data #of Regs Hi Data #of Regs Lo Error Check Field

11 03

00 6B 00 03 CRC

Response

The addressed server responds with its address and the function code, followed by the information field. The information field contains 1 byte describing the quantity of data bytes to be returned. The contents of the registers requested

(DATA) are two bytes each, with the binary content right justified within each pair of characters. The first byte includes the high order bits and the second, the low order bits.

Because the server interface device is normally serviced at the end of the controller's scan, the data will reflect the register content at the end of the scan.

Some servers will limit the quantity of register content provided each scan; thus for large register quantities, multiple transmissions will be made using register content from sequential scans.

ProSoft Technology, Inc.

August 12, 2015

Page 111 of 218

MBTCP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

In the example below, the registers 40108 to 40110 have the decimal contents

555, 0, and 100 respectively.

Adr Func ByteCnt Hi Data Lo Data Hi Data Lo Data Hi Data Lo Data Error Check Field

11 03

06 02 2B 00 00 00 64 CRC

Read Input Registers (Function Code 04)

Query

Function code 04 obtains the contents of the controller's input registers at addresses 3xxxx. These locations receive their values from devices connected to the I/O structure and can only be referenced, not altered from within the controller, The addressing allows up to 125 registers to be obtained at each request; however, the specific server device may have restrictions that lower this maximum quantity. The registers are numbered for zero (30001 = zero, 30002 = one, and so on). Broadcast mode is not allowed.

The example below requests the contents of register 3009 in server number 11.

Adr Func Data Start Reg Hi Data Start Reg Lo Data #of Regs Hi Data #of Regs Lo Error Check Field

11 04

00 08 00 01 CRC

Response

The addressed server responds with its address and the function code followed by the information field. The information field contains 1 byte describing the quantity of data bytes to be returned. The contents of the registers requested

(DATA) are 2 bytes each, with the binary content right justified within each pair of characters. The first byte includes the high order bits and the second, the low order bits.

Adr

11

Because the server interface is normally serviced at the end of the controller's scan, the data will reflect the register content at the end of the scan. Each PC will limit the quantity of register contents provided each scan; thus for large register quantities, multiple PC scans will be required, and the data provided will be form sequential scans.

In the example below the register 3009 contains the decimal value 0.

Func Byte Count Data Input Reg Hi

04 02 00

Data Input Reg Lo

00

Error Check Field

E9

Page 112 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Force Single Coil (Function Code 05)

MBTCP Protocol

User Manual

Query

This message forces a single coil either ON or OFF. Any coil that exists within the controller can be forced to either state (ON or OFF). However, because the controller is actively scanning, unless the coil is disabled, the controller can also alter the state of the coil. Coils are numbered from zero (coil 0001 = zero, coil

0002 = one, and so on). The data value 65,280 (FF00 HEX) will set the coil ON and the value zero will turn it OFF; all other values are illegal and will not affect that coil.

The use of server address 00 (Broadcast Mode) will force all attached servers to modify the desired coil.

Note: Functions 5, 6, 15, and 16 are the only messages that will be recognized as valid for broadcast.

The example below is a request to server number 11 to turn ON coil 0173.

Adr

11

Func Data Coil # Hi Data Coil # Lo Data On/off Ind Data

05 00 AC FF 00

Error Check Field

CRC

Response

The normal response to the Command Request is to re-transmit the message as received after the coil state has been altered.

Adr

11

Func Data Coil # Hi Data Coil # Lo Data On/ Off Data

05 00 AC FF 00

Error Check Field

CRC

The forcing of a coil via MODBUS function 5 will be accomplished regardless of whether the addressed coil is disabled or not (In ProSoft products, the coil is only

affected if the necessary ladder logic is implemented).

Note: The Modbus protocol does not include standard functions for testing or changing the

DISABLE state of discrete inputs or outputs. Where applicable, this may be accomplished via device specific Program commands (In ProSoft products, this is only accomplished through ladder

logic programming).

ProSoft Technology, Inc.

August 12, 2015

Page 113 of 218

MBTCP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Coils that are reprogrammed in the controller logic program are not automatically cleared upon power up. Thus, if such a coil is set ON by function Code 5 and

(even months later), an output is connected to that coil, the output will be "hot".

Preset Single Register (Function Code 06)

Query

Function (06) allows the user to modify the contents of a holding register. Any holding register that exists within the controller can have its contents changed by this message. However, because the controller is actively scanning, it also can alter the content of any holding register at any time. The values are provided in binary up to the maximum capacity of the controller unused high order bits must be set to zero. When used with server address zero (Broadcast mode) all server controllers will load the specified register with the contents specified.

Note Functions 5, 6, 15, and 16 are the only messages that will be recognized as valid for broadcast.

Adr

11

Func Data Start Reg

Hi

06 00

Data Start Reg

Lo

01

Data #of Regs Hi Data #of Regs Lo Error Check Field

00 03 CRC

Response

The response to a preset single register request is to re-transmit the query message after the register has been altered.

Adr

11

Func Data Reg Hi Data Reg Lo Data Input Reg Hi Data Input Reg Lo Error Check Field

06 00 01 00 03 CRC

Diagnostics (Function Code 08)

MODBUS function code 08 provides a series of tests for checking the communication system between a Client device and a server, or for checking various internal error conditions within a server.

The function uses a two-byte sub-function code field in the query to define the type of test to be performed. The server echoes both the function code and subfunction code in a normal response. Some of the diagnostics cause data to be returned from the remote device in the data field of a normal response.

In general, issuing a diagnostic function to a remote device does not affect the running of the user program in the remote device. Device memory bit and register data addresses are not accessed by the diagnostics. However, certain functions can optionally reset error counters in some remote devices.

Page 114 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBTCP Protocol

User Manual

A server device can, however, be forced into 'Listen Only Mode' in which it will monitor the messages on the communications system but not respond to them.

This can affect the outcome of your application program if it depends upon any further exchange of data with the remote device. Generally, the mode is forced to remove a malfunctioning remote device from the communications system.

Sub-function Codes Supported

Only Sub-function 00 is supported by the gateway.

00 Return Query Data

The data passed in the request data field is to be returned (looped back) in the response. The entire response message should be identical to the request.

Sub-function

00 00

Data Field (Request)

Any

Data Field (Response)

Echo Request Data

Example and State Diagram

Here is an example of a request to remote device to Return Query Data. This uses a sub-function code of zero (00 00 hex in the two-byte field). The data to be returned is sent in the two-byte data field (A5 37 hex).

Request

Response

Field Name

Function

Sub-function Hi

Sub-function Lo

Data Hi

Data Lo

(Hex)

08

00

00

A5

37

Field Name

Function

Sub-function Hi

Sub-function Lo

Data Hi

Data Lo

(Hex)

08

00

00

A5

27

ProSoft Technology, Inc.

August 12, 2015

Page 115 of 218

MBTCP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

The data fields in responses to other kinds of queries could contain error counts or other data requested by the sub-function code.

Page 116 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBTCP Protocol

User Manual

Modbus Exception Responses

When a Modbus Master sends a request to a server device, it expects a normal response. One of four possible events can occur from the Master's query:

♦ If the server device receives the request without a communication error, and can handle the query normally, it returns a normal response.

♦ If the server does not receive the request due to a communication error, no response is returned. The Master program will eventually process a timeout condition for the request.

♦ If the server receives the request, but detects a communication error

(parity, LRC, CRC, etc...), no response is returned. The Master program will eventually process a timeout condition for the request.

♦ If the server receives the request without a communication error, but cannot handle it (for example, if the request is to read a non-existent output or register), the server will return an exception response informing the Master of the nature of the error.

The exception response message has two fields that differentiate it from a normal response:

Function Code Field: In a normal response, the server echoes the function code of the original request in the function code field of the response. All function codes have a most-significant bit (MSB) of 0 (their values are all below 80 hexadecimal). In an exception response, the server sets the MSB of the function code to 1. This makes the function code value in an exception response exactly

80 hexadecimal higher than the value would be for a normal response.

With the function code's MSB set, the Master's application program can recognize the exception response and can examine the data field for the exception code.

Data Field: In a normal response, the server may return data or statistics in the data field (any information that was requested in the request). In an exception response, the server returns an exception code in the data field. This defines the server condition that caused the exception.

The following table shows an example of a Master request and server exception response.

Request

Field Name

Function

Starting Address Hi

Starting Address Lo

(Hex)

01

04

A1

Quantity of Outputs Hi

00

Quantity of Outputs Lo 01

Response

Field Name

Function

Exception Code

(Hex)

81

02

In this example, the Master addresses a request to server device. The function code (01) is for a Read Output Status operation. It requests the status of the output at address 1245 (04A1 hex). Note that only that one output is to be read, as specified by the number of outputs field (0001).

ProSoft Technology, Inc.

August 12, 2015

Page 117 of 218

MBTCP Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

If the output address does not exist in the server device, the server will return the exception response with the exception code shown (02). This specifies an illegal data address for the server.

Modbus Exception Codes

Code

01

02

03

04

05

06

08

0a

0b

Name

Illegal Function

Illegal Data Address

Illegal Data Value

Slave Device Failure

Acknowledge

Slave Device Busy

Meaning

The function code received in the query is not an allowable action for the server. This may be because the function code is only applicable to newer devices, and was not implemented in the unit selected. It could also indicate that the server is in the wrong state to process a request of this type, for example because it is unconfigured and is being asked to return register values.

The data address received in the query is not an allowable address for the server. More specifically, the combination of reference number and transfer length is invalid. For a controller with 100 registers, a request with offset 96 and length 4 would succeed; a request with offset 96 and length

5 will generate exception 02.

A value contained in the query data field is not an allowable value for server. This indicates a fault in the structure of the remainder of a complex request, such as that the implied length is incorrect. It specifically does not mean that a data item submitted for storage in a register has a value outside the expectation of the application program, because the

Modbus protocol is unaware of the significance of any particular value of any particular register.

An unrecoverable error occurred while the server was attempting to perform the requested action.

Specialized use in conjunction with programming commands. The server has accepted the request and is processing it, but a long duration of time will be required to do so. This response is returned to prevent a timeout error from occurring in the Master. The Master can next issue a poll program complete message to determine if processing is completed.

Specialized use in conjunction with programming commands. The server is engaged in processing a longduration program command. The Master should retransmit the message later when the server is free.

Memory Parity Error Specialized use in conjunction with function codes 20 and

21 and reference type 6, to indicate that the extended file area failed to pass a consistency check. The server attempted to read record file, but detected a parity error in the memory. The Master can retry the request, but service may be required on the server device.

Gateway Path Unavailable Specialized use in conjunction with gateways, indicates that the gateway was unable to allocate an internal communication path from the input port to the output port for processing the request. Usually means that the gateway is misconfigured or overloaded.

Gateway Target Device

Failed To Respond

Specialized use in conjunction with gateways, indicates that no response was obtained from the target device.

Usually means that the device is not present on the network.

Page 118 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Force Multiple Coils (Function Code 15)

MBTCP Protocol

User Manual

Query

This message forces each coil in a consecutive block of coils to a desired ON or

OFF state. Any coil that exists within the controller can be forced to either state

(ON or OFF). However, because the controller is actively scanning, unless the coils are disabled, the controller can also alter the state of the coil. Coils are numbered from zero (coil 00001 = zero, coil 00002 = one, and so on). The desired status of each coil is packed in the data field, one bit for each coil (1=

ON, 0= OFF). The use of server address 0 (Broadcast Mode) will force all attached servers to modify the desired coils.

Note: Functions 5, 6, 15, and 16 are the only messages (other than Loopback Diagnostic Test) that will be recognized as valid for broadcast.

The following example forces 10 coils starting at address 20 (13 HEX). The two data fields, CD =1100 and 00 = 0000 000, indicate that coils 27, 26, 23, 22, and

20 are to be forced on.

Adr

Func Hi Add Lo

Add

11

0F 00 13

Quantity

00

Byte

Cnt

0A

Data Coil Status

20 to 27

02

Data Coil Status

28 to 29

CD

Error Check

Field

00 CRC

Response

The normal response will be an echo of the server address, function code, starting address, and quantity of coils forced.

Adr

11

Func

0F

Hi Addr

00

Lo Addr

13

Quantity

00

Error Check Field

0A CRC

The writing of coils via Modbus function 15 will be accomplished regardless of whether the addressed coils are disabled or not.

Coils that are not programmed in the controller logic program are not automatically cleared upon power up. Thus, if such a coil is set ON by function code 15 and (even months later) an output is connected to that coil, the output will be hot.

ProSoft Technology, Inc.

August 12, 2015

Page 119 of 218

MBTCP Protocol

User Manual

Preset Multiple Registers (Function Code 16)

PLX3x Series

Ethernet and Serial Gateways

Query

Holding registers existing within the controller can have their contents changed by this message (a maximum of 60 registers). However, because the controller is actively scanning, it also can alter the content of any holding register at any time.

The values are provided in binary up to the maximum capacity of the controller

(16-bit for the 184/384 and 584); unused high order bits must be set to zero.

Note: Function codes 5, 6, 15, and 16 are the only messages that will be recognized as valid for broadcast.

Adr

11

Func Hi

Add

10 00

Lo Add Quantity

87 00

Byte

Cnt

02 04

Hi

Data

00

Lo

Data

Hi

Data

0A 01

Lo Data Error Check

Field

02 CRC

Response

The normal response to a function 16 query is to echo the address, function code, starting address and number of registers to be loaded.

Adr

11

Func

10

Hi Addr

00

Lo Addr

87

Quantity

00 02

Error Check Field

56

Page 120 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBS Protocol

User Manual

7 MBS Protocol

In This Chapter

MBS Functional Overview .............................................................. 122

MBS Configuration.......................................................................... 125

MBS Diagnostics ............................................................................ 132

MBS Reference .............................................................................. 139

This chapter contains information specific to the PLX3x-series gateway Modbus

Serial (MBS) protocol driver.

ProSoft Technology, Inc.

August 12, 2015

Page 121 of 218

MBS Protocol

User Manual

7.1 MBS Functional Overview

PLX3x Series

Ethernet and Serial Gateways

The Modbus Serial protocol supports both Master and slave implementations of the protocol. Each of the gateway serial ports is individually configurable to communicate to separate networks.

7.1.1 Modbus Serial Specifications

Command List

Supported Modbus

Function Codes

Polling of Command

List

Status Data

Node Address

RS Interface

Up to 100 commands per Master port, each fully configurable for

Function Code, slave address, register to/from addressing and word/bit count.

1: Read Coil Status

2: Read Input Status

3: Read Holding Registers

4: Read Input Registers

5: Force (Write) Single Coil

6: Preset (Write) Single Holding Register

15: Force (Write) Multiple Coils

16: Preset (Write) Multiple Holding Registers

Configurable polling of command list, including continuous and on change of data, and dynamically user or automatic enabled.

Error codes available on an individual command basis. In addition, a slave status list is maintained per active Modbus Master port.

1 to 247 (software selectable)

RS232, RS422, and RS485

Page 122 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

7.1.2 Modbus Master/Slave Port Specifications

Specifications

Type

General Parameters

Internal Database

Communication parameters

Modbus Modes

Floating Point Data

Modbus Function Codes

MBS Protocol

User Manual

Up to 4000 registers (words) available.

Port 0: Baud Rate: 110 to 115K baud possible

110 to 38.4K baud recommended for all applications.

Higher baud rates are recommended only for use with very slow Modbus polling rates (e.g. 1command or less per second)

Port 1, 2, 3: Baud Rate: 110 to 115K baud

Stop Bits: 1 or 2

Data Size: 5 to 8 bits

Parity: None, Even, Odd RTS Timing delays: 0 to

65535 milliseconds

RTU mode (binary) with CRC-16

ASCII mode with LRC error checking

Floating point data movement supported, including configurable support for Enron implementation

1: Read Coil Status

2: Read Input Status

3: Read Holding Registers

4: Read Input Registers

5: Force (Write) Single Coil

6: Preset (Write) Single Register

15: Force(Write) Multiple Coils

16: Force (Write) Multiple Register

22: Mask Write Holding Register (Slave Only)

23: Read/Write Holding Registers (Slave Only)

Modbus Master

Command List

Status Data

Polling of command list

Up to 100 command per Master port, each fully configurable for function, slave address, register to/from addressing and word/bit count

Error codes available on an individual command basis. In addition, a slave status list is maintained per active Modbus Master port.

Configurable polling of command list, including continuous and on change of data

Modbus Slave

Node address

Status Data

1 to 247 (software selectable)

Error codes, counters and port status available per configured slave port starting at memory register

4400.

ProSoft Technology, Inc.

August 12, 2015

Page 123 of 218

MBS Protocol

User Manual

7.1.3 Gateway Internal Database

PLX3x Series

Ethernet and Serial Gateways

The internal gateway database is central to the functionality of the gateway. This database is shared between all the ports on the gateway, permitting data from devices on one communication network port to be viewed and controlled by devices on another port or network.

Modbus Port Access to Database

The Multiple slave support in the gateway permits remote Master applications

(HMI software, Quantum processors, etc) to read from and write to the gateway’s database.

When configured as a slave, the internal database of the gateway is used as the source for read requests and the destination for write requests from remote

Masters. Access to the database is controlled by the command type received in the incoming message from the remote Master. The following table defines the relationship of the gateway’s internal database to the addresses required in the incoming Modbus TCP/IP requests.

Database Address

0

1000

2000

3000

3999

Modbus Address

40001 (five-digit addressing) or 400001 (six-digit addressing)

41001 or 410001

42001 or 420001

43001 or 430001

44000 or 440000

Page 124 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

7.2 MBS Configuration

MBS Protocol

User Manual

7.2.1 MBS Port [x]

The Modbus Port [x] sections of the PCB Tree Window, where x stands for 1, 2,

3 or 4, set the Modbus Master and slave port communication parameters and specify the protocol-specific settings.

Configuration Parameters Common to Master and Slave

Parameter

Enabled

RS Interface

Type

Float Flag

Float Start

Float Offset

Protocol

Baud Rate

Parity

Data Bits

Stop Bits

Value Description

YES or NO Specifies if the port will be used. If the parameter is set to No, the port will not be used. If the parameter is set to Yes, the port will be used.

Specifies the electrical interface for the ports. RS-232

RS-485

RS-422

MASTER or

SLAVE

Specifies if the port will emulate a Master or slave device.

Master - The gateway initiates Modbus commands to one or more

Modbus devices

Slave- The gateway responds to Modbus commands initiated by a

Modbus master

YES or NO Specifies if the floating-point data access functionality is to be implemented. If the float flag is set to YES, Modbus functions 3, 6, and 16 will interpret floating-point values for registers as specified by the two following parameters.

0 to 32767

0 to 3998

Specifies the first register of floating-point data. All requests with register values greater than or equal to this value will be considered floating-point data requests. This parameter is only used if the Float

Flag is enabled. For example, if a value of 7000 is entered, all requests for registers 7000 and above will be considered as floating-point data.

Specifies the start register for floating-point data in the internal database. This parameter is used only if the Float Flag is enabled.

For example, if the Float Offset value is set to 3000 and the float start parameter is set to 7000, data requests for register 7000 will use the internal Modbus register 3000.

Specifies the Modbus protocol version to be used on the port. RTU or

ASCII

Various

None

Odd

Even

7 or 8

1 or 2

Specifies the baud rate to be used on the port.

Parity is a simple error checking algorithm used in serial communication. This parameter specifies the type of parity checking to use. All devices communicating through this port must use the same parity setting.

Specifies the number of data bits for each word used by the protocol. All devices communicating through this port must use the same number of data bits.

Stop bits signal the end of a character in the data stream. For most applications, use one stop bit. For slower devices that require more time to re-synchronize, use two stop bits.

All devices communicating through this port must use the same number of stop bits.

ProSoft Technology, Inc.

August 12, 2015

Page 125 of 218

MBS Protocol

User Manual

Parameter

RTS On

RTS Off

Use CTS

Line

PLX3x Series

Ethernet and Serial Gateways

Value

0 to 65535

0 to 65535

YES or NO

Description

Specifies the number of milliseconds to delay data transmission after

Ready To Send

(RTS) is asserted.

Specifies the number of milliseconds to delay after the last byte of data is sent before the RTS modem signal is set low.

This parameter specifies if the Clear To Send (CTS) modem control line is to be used or not. If the parameter is set to

NO

, the CTS line will not be monitored. If the parameter is set to

YES

, the CTS line will be monitored and must be high before the gateway will send data. Normally, this parameter is required when half-duplex modems are used for communication (2-wire). This procedure is commonly referred to as hardware handshaking.

Master Configuration Parameters

Parameter

Response

Timeout

Retry Count

End of

Message

Delay

Minimum

Command

Delay

Error Delay

Counter

Command

Control Reg

Value

0 to 65535

Description

Specifies the command response timeout period in 1 millisecond increments. This is the time that a port configured as a Master will wait for a response from the addressed slave before re-transmitting the command (Retries) or skipping to the next command in the

Command List. The value to specify depends on the communication network used and the expected response time (plus or minus) of the slowest device on the network.

0 to 10

Specifies the number of times a command will be retried if it fails.

0 to 65535

0 to 32767

Specifies a time delay in milliseconds to be added to the 3.5 character time delay used by the module to recognize the end of a message. Certain applications may require validation of Modbus messages with more than 3.5 character time between consecutive bytes (example: modem applications). A value of 0 will cause the default end of message delay to be used.

Specifies the number of milliseconds to wait between receiving the end of a slave's response to the most recently transmitted command and the issuance of the next command. This parameter can be used to place a delay after each command to avoid sending commands on the network faster than the slaves can be ready to receive them.

This parameter does not affect retries of a command, as retries will be issued when a command failure is recognized.

0 to 60000 Specifies the number of poll attempts to be skipped before trying to re-establish communications with a slave that has failed to respond to a command within the time limit set by the Response Timeout parameter. After the slave fails to respond, the master will skip sending commands that should have been sent to the slave until the number of skipped commands matches the value entered in this parameter. This creates a sort of slow poll mode for slaves that are experiencing communication problems.

-1, 0 to 3900 This parameter allows the execution of commands in the Command

List (page 129) to be controlled by setting a value of zero (0), one

(1), two (2), or three (3) into a 100-register area of the gateway database, beginning at the address entered in this parameter. If commands in the list are specified with an Enable code of zero for

Page 126 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Parameter

Value

MBS Protocol

User Manual

Description

all commands, no commands will be executed. If the value in the first control register is changed to one (1), command zero will be executed continuously. If the value is the control register for a write command is set to two (2), the command will be enabled for conditional writing, which will cause the command to be executed whenever the values in the database registers associated with the command change. Use the value of three (3) only for bit-level write commands, FC 5 and 15. If the parameter is set to three (3), the command will be executed only if the internal bit data associated with the command changes. It will also clear the bit or bits in the internal database after the write command is built.

To use this feature, configure the commands as disabled (enable code = 0).

This Command Control feature can be disabled by setting this parameter to a value of 0 to -1.

ProSoft Technology, Inc.

August 12, 2015

Page 127 of 218

MBS Protocol

User Manual

Slave Configuration Parameters

Parameter

Minimum

Response

Delay

Internal

Slave ID

Value

0 to 65535

0 to 247

Bit Input

Offset

Word Input

Offset

Output

Offset

Holding

Register

Offset

End of

Message

Delay

0 to 3998

0 to 3998

0 to 3998

0 to 3998

0 to 65535

PLX3x Series

Ethernet and Serial Gateways

Description

Specifies the number of milliseconds to wait before responding to a command received on the port from a remote Master. This delay is sometimes required to accommodate slower Master devices.

Defines the virtual Modbus slave address for the port. Any commands received on the slave port, addressed to the node address entered here, will be processed by the gateway. Each slave device on the network must be assigned a unique address.

Specifies the internal database address to use as the zero address or starting point for binary Input Status data. Input Status data is read-only data, requested by Modbus Function Code 2 commands

(Read Input Status). For example, if this parameter is set to 150 and a Function Code 2 command is received requesting Input Status address 0 (virtual Modbus Address 10001 or 100001), the data returned in the response will be the bit value at register 150, bit 0 in the gateway's database.

Specifies the internal database address to use as the zero address or starting point for Input Register (16-bit integer) data. Input

Register data is read-only data, requested by Modbus Function

Code 4 commands (Read Input Registers). For example, if this parameter is set to 500 and a Function Code 4 command is received requesting Input Register address 0 (virtual Modbus address 30001 or 300001), the data returned in the response will be the value at register 500 in the gateway's database.

Specifies the internal database address to use as the zero address or starting point for binary output Coil data. Coil data is read by

Modbus Function Code 1 commands (Read Coils) and written by

Function Codes 5 (Force Single Coil) or Function Code 15 (Force

Multiple Coils). For example, if this parameter is set to 50 and a

Function Code 1 command is received requesting Coil address 0

(virtual Modbus Coil address 00001 or 000001), the data returned in the response will be the value at register 50, bit 0 in the gateway's database.

Specifies the internal database address to use as the zero address or starting point for Holding Register (16-bit integer) data. Holding

Register data is read by Modbus Function Code 3 commands (Read

Holding Registers) and written by Function Code 6 (Preset Single

Register) or Function Code 16 (Preset Multiple Registers).

For example, if this parameter is set to 1000 and a Function Code 3 command is received requesting Holding Register address 0 (virtual

Modbus address 40001 or 400001), the data returned in the response will be the value at register 1000 in the gateway's database.

Specifies a time delay in milliseconds to be added to the 3.5 character time delay used by the module to recognize the end of a message. Certain applications may require validation of Modbus messages with more than 3.5 character time between consecutive bytes (example: modem applications). A value of 0 will cause the default end of message delay to be used.

Page 128 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

7.2.2 MBS Port [x] Commands

MBS Protocol

User Manual

The Modbus Port[x] Commands (where x can be 1, 2, 3 or 4) sections of the PCB tree Window are used to define a Master serial port Command List. This list holds the parameters needed to poll slave devices attached to a Master port.

Parameter

Enable

Internal

Address

Value

Disabled

Continuous

Event

Command

Conditional

0 to 3999

(for registerlevel addressing) or

0 to 63999

(for bit-level addressing)

Description

Specifies if the command is to be executed and under what conditions.

Disabled (0) - the command is disabled and will not be executed in the normal polling sequence. However, the command can still be activated using Command Control.

Continuous (1) - the command will be executed upon each scan of the Command List if the Poll Interval is set to zero (0). If the Poll

Interval is set to a non-zero value, the command will be executed when the interval timer for that command expires.

Event Command (2) - the command will execute only if the internal data associated with the command changes. This parameter is valid only for write commands (FC 5, 6, 15, and 16).

Conditional (3) - the command will execute only if the internal bit data associated with the command changes. It will also clear the bit or bits in the internal database after the write command is built. This parameter is valid only for bit-level write commands (FC 5 and 15).

Specifies the database address in the gateway's internal database to use as the destination for data brought in by a read command, or as the source for data to be sent out by a write command. The database address is interpreted as a bit address or a 16-bit register

(word) address, depending on the Modbus Function Code used in the command.

For Modbus functions 1, 2, 5, and 15, this parameter is interpreted as a bit-level address.

For Modbus functions 3, 4, 6, and 16, this parameter is interpreted as a register-level address.

Poll Interval

0 to 65535

Specifies the minimum interval between executions of continuous commands. The value is in seconds. Therefore, if a value of 10 is entered, the command will execute no more frequently than once every 10 seconds.

Reg Count

1 to 125 (for registers) or

1 to 800 (for coils)

Swap Code

No Change

Word Swap

Word and

Byte Swap

Byte Swap

Specifies the number of 16-bit registers or binary bits to be transferred by the command.

Modbus functions 5 and 6 ignore this field as they apply only to a single data point.

For Modbus functions 1, 2, and 15, this parameter sets the number of bits (inputs or coils) to be transferred by the command.

For Modbus functions 3, 4, and 16, this parameter sets the number of registers to be transferred by the command.

Specifies if and how the order of bytes in data received or sent is to be rearranged. This option exists to allow for the fact that different manufacturers store and transmit multi-byte data in different combinations. This parameter is helpful when dealing with floatingpoint or other multi-byte values, as there is no one standard method of storing these data types. The parameter can be set to rearrange the byte order of data received or sent into an order more useful or convenient for other applications.

No change(0) - No change is made in the byte ordering (1234 =

ProSoft Technology, Inc.

August 12, 2015

Page 129 of 218

MBS Protocol

User Manual

Parameter

PLX3x Series

Ethernet and Serial Gateways

Node

Address

Modbus

Function

MB Address in Device

Value

1 to 255 (0 is a broadcast)

1, 2, 3, 4, 5,

6, 15, or 16

Varies

Description

1234)

Word Swap (1) -The words are swapped (1234=3412)

Word and Byte Swap (2) - The words are swapped, then the bytes in each word are swapped (1234=4321)

Byte Swap (3) - The bytes in each word are swapped (1234=2143)

These swap operations affect 4-byte (or 2-word) groups of data.

Therefore, data swapping using these Swap Codes should be done only when using an even number of words, such as when 32-bit integer or floating-point data is involved.

Specifies the node address of the Modbus slave device. Values of 1 to 255 are permitted.

Note: Most Modbus devices only accept addresses in the range of

1 to 247, so check with the slave device manufacturer to see if a particular slave can use addresses 248 to 255.

If the value is set to zero, the command will be a broadcast message on the network. The Modbus protocol permits broadcast commands for write operations. Do not use node address 0 for read operations.

Specifies the Modbus Function Code to be executed by the command. These function codes are defined in the Modbus protocol. (More information on the protocol is available from www.modbus.org

.) The following function codes are supported by the gateway.

1 - Read Coil Status

2 - Read Input Status

3 - Read Holding Registers

4 - Read Input Registers

5 - Force (Write) Single Coil

6 - Preset (Write) Single Register

15 - Force Multiple Coils

16 - Preset Multiple Registers

Specifies the starting Modbus register or bit address in the server to be used by the command. Refer to the documentation of each

Modbus server device for the register and bit address assignments valid for that device.

The Modbus Function Code determines whether the address will be a register-level or bit-level OFFSET address into a given data type range. The offset will be the target data address in the server minus the base address for that data type. Base addresses for the different data types are:

♦ 00001 or 000001 (0x0001) for bit-level Coil data (Function

Codes 1, 5, and 15).

♦ 10001 or 100001 (1x0001) for bit-level Input Status data

(Function Code 2)

♦ 30001 or 300001 (3x0001) for Input Register data (Function

Code 4)

♦ 40001 or 400001 (4x0001) for Holding Register data (Function

Codes 3, 6, and 16).

♦ Address calculation examples: o

For bit-level Coil commands (FC 1, 5, or 15) to read or write a Coil 0X address 00001, specify a value of 0 (00001

- 00001 = 0).

Page 130 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Parameter

Value

MBS Protocol

User Manual

Description

o

For Coil address 00115, specify 114 o

(00115 - 00001 = 114)

♦ For register read or write commands (FC 3, 6, or 16) 4X range, for 40001, specify a value of 0 o

(40001 - 40001 = 0).

♦ For 01101, 11101, 31101 or 41101, specify a value of 1100. o

(01101 - 00001 = 1100) o

(11101 -10001 = 1100) o

(31101 - 30001 = 1100) o

(41101 - 40001 = 1100)

Note: If the documentation for a particular Modbus server device lists data addresses in hexadecimal (base16) notation, you will need to convert the hexadecimal value to a decimal value to enter in this parameter. In such cases, it is not usually necessary to subtract 1 from the converted decimal number, as this addressing scheme typically uses the exact offset address expressed as a hexadecimal number.

ProSoft Technology, Inc.

August 12, 2015

Page 131 of 218

MBS Protocol

User Manual

7.3 MBS Diagnostics

PLX3x Series

Ethernet and Serial Gateways

7.3.1 PCB Diagnostics

The best way to troubleshoot the MBS driver is to use ProSoft Configuration

Builder to access the diagnostic capabilities of the gateway through the Ethernet

debug port. For instructions on how to access Diagnostics, see Using

Diagnostics in ProSoft Configuration Builder

(page 36).

7.3.2 MBS Status Data in Upper Memory

Each Modbus port has an associated status data area located in the gateway’s upper memory. The Data Map functionality of the gateway can be used to map

this data into the normal user data range of the gateway’s database. See Using the CommonNet Data Map (page 25).

General Modbus Error and Status Data

The following table lists the starting addresses in upper memory where general error and status data for each Modbus Master or slave port can be found.

Modbus Port

Starting Address

1

2*

3*

4*

4400

4800

5200

5600

*Status data for Ports 2 through 4 is only present in 4-port MBS gateways.

Note: None of the addresses are available in the Modbus address range. In order for them to be

accessed via a Modbus request, they must be moved into the 0 to 3999 address range. See Using the CommonNet Data Map (page 25).

The status data area is initialized with zeros whenever the gateway is restarted.

This occurs during a cold-start (power-on), reset (reset push-button pressed) or a warm-boot operation (commanded from a debug screen or after downloading a new configuration).

Page 132 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBS Protocol

User Manual

Port 1 General Modbus Error and Status Layout

The addresses listed are for Port 1only; but the format is the same for each port.

The start address for each port is given in the previous section.

Offset Description

Example Internal

Database Address

4400

4401

4402

4403

4404

4405

4406

4407

4408

4409

4

5

6

7

0

1

2

3

8

9

Number of Command Requests

Number of Command Responses

Number of Command Errors

Number of Requests

Number of Responses

Number of Errors Sent

Number of Errors Received

Configuration Error Code

Current Error/Index

Last Error/Index

Slave Port: General Port STATE and COMM STATE Status

Note: There are two additional port status parameters that are not available from the General

Modbus Error and Status Data area. The status values, Port STATE and Port COMM STATE

(circled in red), can be found only in the PCB diagnostic menus under Comm Status for a port as shown in the following graphic.

ProSoft Technology, Inc.

August 12, 2015

Page 133 of 218

MBS Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

These status values are state registers. They are used as ‘scratchpad’ areas by the operating firmware to keep track of the current logical state of activities on a slave port. These state registers are constantly changing as the gateway progresses through the various stages needed to process communication on the serial ports. This processing happens faster than can be followed, unless a port error causes the value to remain constant for some noticeable length of time.

The diagnostic screen displays are 'snapshot' type screens; that is, they display the current value at the time they are called but do not continue to automatically update the data displayed. They are not live-data screens. Therefore, to see a change in STATE or COMM STATE, you must repeatedly call the screen by pressing the appropriate menu key to have the screen refreshed. Depending on the refresh timing you may or may not see a change in the displayed values every time you call for an update.

The STATE register may display any of the following values.

STATE Value

-2

-1

0

1

2

7

2000

The COMM STATE register may display any of the following values.

COMM STATE

Value

0

1

101

2

3

4

5

6

Description

Preparing port, Flushing all buffers, Scan for RTS-Off, or Waiting for port enable signal

Waiting for receipt of data

Undefined state

Receiving a message from the Master

Building a slave response message

Modbus master is fetching next command

Sending slave response to the Master

Description

Port not sending data (Wait for send)

Setting up minimum Response Delay Timer

Waiting for Minimum Response Delay to timeout

Turning on RTS line and starting RTS-On Delay Timer

Waiting for RTS-On Delay timer to timeout

Sending data

Waiting for all data to be sent and starting RTS-Off Delay Timer

Waiting for RTS-Off Delay timeout and then turning OFF RTS line after timeout

Page 134 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBS Protocol

User Manual

Master Port: Command List Errors

The individual command errors for each Master port are returned to the address locations specified in the following table. Each port can have up to 100 commands configured. Each configured command will use one word of these data areas to store a value representing the execution status from the most recent command execution attempt.

Modbus Port

1

2*

3*

4*

Address Range

4410 to 4509

4810 to 4909

5210 to 5309

5610 to 5709

*Status data for Ports 2 through 4 is only present in 4-port MBS gateways

Port 1 Command Error List Layout

The first word in the specified register location contains the status/error code for the first command in the port's Command List. Successive words in the

Command Error List are associated with corresponding commands in the list.

The addresses listed are for Port 1 only; but the format is the same for each port.

The start address for each port is given in the previous section.

Internal Database

Address (Example)

4410

4411

4412

4413

4414

...

...

...

4507

4508

4509

Offset

4

...

...

...

97

98

99

0

1

2

3

Description

Command #1 Error Code

Command #2 Error Code

Command #3 Error Code

Command #4 Error Code

Command #5 Error Code

...

...

...

Command #98 Error Code

Command #99 Error Code

Command #100 Error Code

Note that the values in the Command Error List tables are initialized to zero (0) at power-up, cold boot, and warm boot. If a command executes successfully, the value in the associated register will remain at zero (0), indicating no command error was detected. Any non-zero value in this table indicates the corresponding command experienced an error.

The data in this table is dynamic. It is updated each time a command is executed. Therefore, if the command fails once and succeeds on the next attempt, the Error Code from the previously failed attempt will be replace with zero and be lost. Error Codes are not archived in the gateway's database. To see if the port has experienced an error since the most recent restart and what the most recently occurring error was, if any, you can check the Last Error/Index.

ProSoft Technology, Inc.

August 12, 2015

Page 135 of 218

MBS Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Master Port: Modbus Slave List Status

Slave List Status values for each Master port are returned to the address locations specified in the following table.

Modbus Port

1

2*

3*

4*

Address Range

4510 to 4764

4910 to 5164

5310 to 5564

5710 to 5964

*Status data for Ports 2 through 4 is only present in 4-port MBS gateways.

Port 1 Slave List Status Layout

The addresses listed are for Port 1 only; but the format is the same for each port.

The start address for each port is given in the previous section.

Internal

Database

Address

(Example)

4510

4511

4512

4513

4514

Offset

0

1

2

3

4

.

Description

Slave #1 Status

Slave #2 Status

Slave #3 Status

Slave #4 Status

Slave #5 Status

.

0

1

2

. .

The slave status list contains the current poll status of each slave device on a

Master port. Slaves attached to a Master port can have one of three states.

The slave has not defined in the command list for the Master port and will not be polled from the Command List.

The slave is configured to be polled by the Master port and the most recent communication attempt was successful.

The Master port has failed to communicate with the slave device. Communication with the slave is suspended for a user defined period based on the scanning of the command list.

Slaves are defined to the system when the gateway loads the Master Command

List during start-up and initialization. Each slave defined will be set to a state value of 1 in this initial step. If the Master port fails to communicate with a slave device (timeout expired on a command, retries failed), the Master will set the state of the slave to a value of 2 in this status table. This suspends communication with the slave device for a user-specified Error Delay Count.

Page 136 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBS Protocol

User Manual

When the Master first suspends polling of a particular slave, it creates an Error

Delay Counter for this slave address and set the value in that counter equal to the Error Delay Counter parameter in the configuration file. Then, each time a command in the list is scanned that has the address of a suspended slave, the delay counter value for that slave will be decremented. When the value reaches zero, the slave state will be set to 1. This will re-enable polling of the slave.

The first word in the defined register locations contains the status code for slave node address 1. Each successive word in the list is associated with the next node in sequence, up to slave node address 255.

Note: The values in the slave List Status tables are initialized to zero (0) at power-up, cold boot and during warm boot.

ProSoft Technology, Inc.

August 12, 2015

Page 137 of 218

MBS Protocol

User Manual

7.3.3 Error/Status Codes

PLX3x Series

Ethernet and Serial Gateways

These are error codes that are part of the Modbus protocol or are extended codes unique to this gateway.

3

4

5

6

Code

1

2

Modbus Error Codes

These error codes are generated or returned on both the Master and slave ports.

These codes are the standard Modbus errors (page 147).

Description

Illegal Function

Illegal Data Address

Illegal Data Value

Failure in Associated Device

Acknowledge

Busy, Rejected Message

Code

-1

-2

-11

253

254

255

Module Communication Error Codes

These gateway-specific error codes are also returned from the command polling process and stored in the Command Error List memory area.

Description

CTS modem control line not set before transmit

Timeout while transmitting message

Timeout waiting for response after request

Incorrect slave address in response

Incorrect function code in response

Invalid CRC/LRC value in response

Code

-41

-42

-43

-44

-45

-46

-47

Command List Error Codes

These command-specific error codes are detected during initial command list loading at gateway power-up or reset and are stored in the Command Error List memory region.

Description

Invalid enable code

Internal address > maximum address

Invalid node address (<0 or > 255)

Count parameter set to 0

Invalid function code

All parameters set to 0

All parameters set to -1

Page 138 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

7.4 MBS Reference

MBS Protocol

User Manual

7.4.1 Modbus Protocol Specification

Read Coil Status (Function Code 01)

Query

This function allows the user to obtain the ON/OFF status of logic coils used to control discrete outputs from the addressed server only. Broadcast mode is not supported with this function code. In addition to the server address and function fields, the message requires that the information field contain the initial coil address to be read (Starting Address) and the number of locations that will be interrogated to obtain status data.

The addressing allows up to 2000 coils to be obtained at each request; however, the specific server device may have restrictions that lower the maximum quantity.

The coils are numbered from zero; (coil number 1 = zero, coil number 2 = one, coil number 3 = two, and so on).

The following table is a sample read output status request to read coils 0020 to

0056 from server device number 11.

Adr

11

Func Data Start Pt Hi Data Start Pt Lo Data # Of Pts Ho Data # Of Pts Lo Error Check Field

01 00 13 00 25 CRC

Response

An example response to Read Coil Status is as shown in Figure C2. The data is packed one bit for each coil. The response includes the server address, function code, quantity of data characters, the data characters, and error checking. Data will be packed with one bit for each coil (1 = ON, 0 = OFF). The low order bit of the first character contains the addressed coil, and the remainder follows. For coil quantities that are not even multiples of eight, the last characters will be filled in with zeros at high order end. The quantity of data characters is always specified as quantity of RTU characters, that is, the number is the same whether RTU or

ASCII is used.

ProSoft Technology, Inc.

August 12, 2015

Page 139 of 218

MBS Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Because the server interface device is serviced at the end of a controller's scan, data will reflect coil status at the end of the scan. Some servers will limit the quantity of coils provided each scan; thus, for large coil quantities, multiple PC transactions must be made using coil status from sequential scans.

11 01

05

Data Coil

Status 20 to

27

CD

Data Coil

Status 28 to

35

6B

Data Coil

Status 36 to

43

B2

Data Coil

Status 44 to

51

OE

Data Coil

Status 52 to

56

1B

Error

Check

Field

CRC

The status of coils 20 to 27 is shown as CD (HEX) = 1100 1101 (Binary).

Reading left to right, this shows that coils 27, 26, 23, 22, and 20 are all on. The other coil data bytes are decoded similarly. Due to the quantity of coil statuses requested, the last data field, which is shown 1B (HEX) = 0001 1011 (Binary), contains the status of only 5 coils (52 to 56) instead of 8 coils. The 3 left most bits are provided as zeros to fill the 8-bit format.

Read Input Status (Function Code 02)

Adr

11

Query

This function allows the user to obtain the ON/OFF status of discrete inputs in the addressed server PC Broadcast mode is not supported with this function code. In addition to the server address and function fields, the message requires that the information field contain the initial input address to be read (Starting Address) and the number of locations that will be interrogated to obtain status data.

The addressing allows up to 2000 inputs to be obtained at each request; however, the specific server device may have restrictions that lower the maximum quantity. The inputs are numbered form zero; (input 10001 = zero, input 10002 = one, input 10003 = two, and so on, for a 584).

The following table is a sample read input status request to read inputs 10197 to

10218 from server number 11.

Func Data Start Pt Hi Data Start Pt Lo Data #of Pts Hi Data #of Pts Lo Error Check Field

02 00 C4 00 16

CRC

Page 140 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBS Protocol

User Manual

Response

An example response to Read Input Status is as shown in Figure C4. The data is packed one bit for each input. The response includes the server address, function code, quantity of data characters, the data characters, and error checking. Data will be packed with one bit for each input (1=ON, 0=OFF). The lower order bit of the first character contains the addressed input, and the remainder follows. For input quantities that are not even multiples of eight, the last characters will be filled in with zeros at high order end. The quantity of data characters is always specified as a quantity of RTU characters, that is, the number is the same whether RTU or ASCII is used.

Because the server interface device is serviced at the end of a controller's scan, data will reflect input status at the end of the scan. Some servers will limit the quantity of inputs provided each scan; thus, for large coil quantities, multiple PC transactions must be made using coil status for sequential scans.

Adr

11

Func Byte

Count

02 03

Data Discrete Input

10197 to 10204

AC

Data Discrete Input

10205 to 10212

DB

Data Discrete Input

10213 to 10218

35

Error Check Field

CRC

The status of inputs 10197 to 10204 is shown as AC (HEX) = 10101 1100

(binary). Reading left to right, this show that inputs 10204, 10202, and 10199 are all on. The other input data bytes are decoded similar.

Due to the quantity of input statuses requested, the last data field which is shown as 35 HEX = 0011 0101 (binary) contains the status of only 6 inputs (10213 to

102180) instead of 8 inputs. The two left-most bits are provided as zeros to fill the 8-bit format.

Read Holding Registers (Function Code 03)

Query

Read Holding Registers (03) allows the user to obtain the binary contents of holding registers 4xxxx in the addressed server. The registers can store the numerical values of associated timers and counters which can be driven to external devices. The addressing allows up to 125 registers to be obtained at each request; however, the specific server device may have restrictions that lower this maximum quantity. The registers are numbered form zero (40001 = zero, 40002 = one, and so on). The broadcast mode is not allowed.

The example below reads registers 40108 through 40110 from server 584 number 11.

Adr Func Data Start Reg Hi Data Start Reg Lo Data #of Regs Hi Data #of Regs Lo Error Check Field

11 03

00 6B 00 03 CRC

ProSoft Technology, Inc.

August 12, 2015

Page 141 of 218

MBS Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Response

The addressed server responds with its address and the function code, followed by the information field. The information field contains 1 byte describing the quantity of data bytes to be returned. The contents of the registers requested

(DATA) are two bytes each, with the binary content right justified within each pair of characters. The first byte includes the high order bits and the second, the low order bits.

Because the server interface device is normally serviced at the end of the controller's scan, the data will reflect the register content at the end of the scan.

Some servers will limit the quantity of register content provided each scan; thus for large register quantities, multiple transmissions will be made using register content from sequential scans.

In the example below, the registers 40108 to 40110 have the decimal contents

555, 0, and 100 respectively.

Adr Func ByteCnt Hi Data Lo Data Hi Data Lo Data Hi Data Lo Data Error Check Field

11 03

06 02 2B 00 00 00 64 CRC

Read Input Registers (Function Code 04)

Query

Function code 04 obtains the contents of the controller's input registers at addresses 3xxxx. These locations receive their values from devices connected to the I/O structure and can only be referenced, not altered from within the controller, The addressing allows up to 125 registers to be obtained at each request; however, the specific server device may have restrictions that lower this maximum quantity. The registers are numbered for zero (30001 = zero, 30002 = one, and so on). Broadcast mode is not allowed.

The example below requests the contents of register 3009 in server number 11.

Adr Func Data Start Reg Hi Data Start Reg Lo Data #of Regs Hi Data #of Regs Lo Error Check Field

11 04

00 08 00 01 CRC

Page 142 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBS Protocol

User Manual

Adr

11

Response

The addressed server responds with its address and the function code followed by the information field. The information field contains 1 byte describing the quantity of data bytes to be returned. The contents of the registers requested

(DATA) are 2 bytes each, with the binary content right justified within each pair of characters. The first byte includes the high order bits and the second, the low order bits.

Because the server interface is normally serviced at the end of the controller's scan, the data will reflect the register content at the end of the scan. Each PC will limit the quantity of register contents provided each scan; thus for large register quantities, multiple PC scans will be required, and the data provided will be form sequential scans.

In the example below the register 3009 contains the decimal value 0.

Func Byte Count Data Input Reg Hi

04 02 00

Data Input Reg Lo

00

Error Check Field

E9

Force Single Coil (Function Code 05)

Query

This message forces a single coil either ON or OFF. Any coil that exists within the controller can be forced to either state (ON or OFF). However, because the controller is actively scanning, unless the coil is disabled, the controller can also alter the state of the coil. Coils are numbered from zero (coil 0001 = zero, coil

0002 = one, and so on). The data value 65,280 (FF00 HEX) will set the coil ON and the value zero will turn it OFF; all other values are illegal and will not affect that coil.

The use of server address 00 (Broadcast Mode) will force all attached servers to modify the desired coil.

Note: Functions 5, 6, 15, and 16 are the only messages that will be recognized as valid for broadcast.

The example below is a request to server number 11 to turn ON coil 0173.

Adr

Func Data Coil # Hi Data Coil # Lo Data On/off Ind Data

11

05 00 AC FF 00

Error Check Field

CRC

ProSoft Technology, Inc.

August 12, 2015

Page 143 of 218

MBS Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Adr

11

Response

The normal response to the Command Request is to re-transmit the message as received after the coil state has been altered.

Func Data Coil # Hi Data Coil # Lo Data On/ Off Data

05 00 AC FF 00

Error Check Field

CRC

The forcing of a coil via MODBUS function 5 will be accomplished regardless of whether the addressed coil is disabled or not (In ProSoft products, the coil is only

affected if the necessary ladder logic is implemented).

Note: The Modbus protocol does not include standard functions for testing or changing the

DISABLE state of discrete inputs or outputs. Where applicable, this may be accomplished via device specific Program commands (In ProSoft products, this is only accomplished through ladder

logic programming).

Coils that are reprogrammed in the controller logic program are not automatically cleared upon power up. Thus, if such a coil is set ON by function Code 5 and

(even months later), an output is connected to that coil, the output will be "hot".

Preset Single Register (Function Code 06)

Query

Function (06) allows the user to modify the contents of a holding register. Any holding register that exists within the controller can have its contents changed by this message. However, because the controller is actively scanning, it also can alter the content of any holding register at any time. The values are provided in binary up to the maximum capacity of the controller unused high order bits must be set to zero. When used with server address zero (Broadcast mode) all server controllers will load the specified register with the contents specified.

Note Functions 5, 6, 15, and 16 are the only messages that will be recognized as valid for broadcast.

Adr

11

Func Data Start Reg

Hi

06 00

Data Start Reg

Lo

01

Data #of Regs Hi Data #of Regs Lo Error Check Field

00 03 CRC

Page 144 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Adr

11

Response

The response to a preset single register request is to re-transmit the query message after the register has been altered.

Func Data Reg Hi Data Reg Lo Data Input Reg Hi Data Input Reg Lo Error Check Field

06 00 01 00 03 CRC

MBS Protocol

User Manual

Diagnostics (Function Code 08)

MODBUS function code 08 provides a series of tests for checking the communication system between a Client device and a server, or for checking various internal error conditions within a server.

The function uses a two-byte sub-function code field in the query to define the type of test to be performed. The server echoes both the function code and subfunction code in a normal response. Some of the diagnostics cause data to be returned from the remote device in the data field of a normal response.

In general, issuing a diagnostic function to a remote device does not affect the running of the user program in the remote device. Device memory bit and register data addresses are not accessed by the diagnostics. However, certain functions can optionally reset error counters in some remote devices.

A server device can, however, be forced into 'Listen Only Mode' in which it will monitor the messages on the communications system but not respond to them.

This can affect the outcome of your application program if it depends upon any further exchange of data with the remote device. Generally, the mode is forced to remove a malfunctioning remote device from the communications system.

Sub-function Codes Supported

Only Sub-function 00 is supported by the gateway.

00 Return Query Data

The data passed in the request data field is to be returned (looped back) in the response. The entire response message should be identical to the request.

Sub-function

00 00

Data Field (Request)

Any

Data Field (Response)

Echo Request Data

ProSoft Technology, Inc.

August 12, 2015

Page 145 of 218

MBS Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Example and State Diagram

Here is an example of a request to remote device to Return Query Data. This uses a sub-function code of zero (00 00 hex in the two-byte field). The data to be returned is sent in the two-byte data field (A5 37 hex).

Request

Response

Field Name

Function

Sub-function Hi

Sub-function Lo

Data Hi

Data Lo

(Hex)

08

00

00

A5

37

Field Name

Function

Sub-function Hi

Sub-function Lo

Data Hi

Data Lo

(Hex)

08

00

00

A5

27

The data fields in responses to other kinds of queries could contain error counts or other data requested by the sub-function code.

Page 146 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

MBS Protocol

User Manual

Modbus Exception Responses

When a Modbus Master sends a request to a server device, it expects a normal response. One of four possible events can occur from the Master's query:

♦ If the server device receives the request without a communication error, and can handle the query normally, it returns a normal response.

♦ If the server does not receive the request due to a communication error, no response is returned. The Master program will eventually process a timeout condition for the request.

♦ If the server receives the request, but detects a communication error

(parity, LRC, CRC, etc...), no response is returned. The Master program will eventually process a timeout condition for the request.

♦ If the server receives the request without a communication error, but cannot handle it (for example, if the request is to read a non-existent output or register), the server will return an exception response informing the Master of the nature of the error.

The exception response message has two fields that differentiate it from a normal response:

Function Code Field: In a normal response, the server echoes the function code of the original request in the function code field of the response. All function codes have a most-significant bit (MSB) of 0 (their values are all below 80 hexadecimal). In an exception response, the server sets the MSB of the function code to 1. This makes the function code value in an exception response exactly

80 hexadecimal higher than the value would be for a normal response.

With the function code's MSB set, the Master's application program can recognize the exception response and can examine the data field for the exception code.

Data Field: In a normal response, the server may return data or statistics in the data field (any information that was requested in the request). In an exception response, the server returns an exception code in the data field. This defines the server condition that caused the exception.

The following table shows an example of a Master request and server exception response.

Request

Field Name

Function

Starting Address Hi

Starting Address Lo

(Hex)

01

04

A1

Quantity of Outputs Hi

00

Quantity of Outputs Lo 01

Response

Field Name

Function

Exception Code

(Hex)

81

02

In this example, the Master addresses a request to server device. The function code (01) is for a Read Output Status operation. It requests the status of the output at address 1245 (04A1 hex). Note that only that one output is to be read, as specified by the number of outputs field (0001).

ProSoft Technology, Inc.

August 12, 2015

Page 147 of 218

MBS Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

If the output address does not exist in the server device, the server will return the exception response with the exception code shown (02). This specifies an illegal data address for the server.

Modbus Exception Codes

Code

01

02

03

04

05

06

08

0a

0b

Name

Illegal Function

Illegal Data Address

Illegal Data Value

Slave Device Failure

Acknowledge

Slave Device Busy

Meaning

The function code received in the query is not an allowable action for the server. This may be because the function code is only applicable to newer devices, and was not implemented in the unit selected. It could also indicate that the server is in the wrong state to process a request of this type, for example because it is unconfigured and is being asked to return register values.

The data address received in the query is not an allowable address for the server. More specifically, the combination of reference number and transfer length is invalid. For a controller with 100 registers, a request with offset 96 and length 4 would succeed; a request with offset 96 and length

5 will generate exception 02.

A value contained in the query data field is not an allowable value for server. This indicates a fault in the structure of the remainder of a complex request, such as that the implied length is incorrect. It specifically does not mean that a data item submitted for storage in a register has a value outside the expectation of the application program, because the

Modbus protocol is unaware of the significance of any particular value of any particular register.

An unrecoverable error occurred while the server was attempting to perform the requested action.

Specialized use in conjunction with programming commands. The server has accepted the request and is processing it, but a long duration of time will be required to do so. This response is returned to prevent a timeout error from occurring in the Master. The Master can next issue a poll program complete message to determine if processing is completed.

Specialized use in conjunction with programming commands. The server is engaged in processing a longduration program command. The Master should retransmit the message later when the server is free.

Memory Parity Error Specialized use in conjunction with function codes 20 and

21 and reference type 6, to indicate that the extended file area failed to pass a consistency check. The server attempted to read record file, but detected a parity error in the memory. The Master can retry the request, but service may be required on the server device.

Gateway Path Unavailable Specialized use in conjunction with gateways, indicates that the gateway was unable to allocate an internal communication path from the input port to the output port for processing the request. Usually means that the gateway is misconfigured or overloaded.

Gateway Target Device

Failed To Respond

Specialized use in conjunction with gateways, indicates that no response was obtained from the target device.

Usually means that the device is not present on the network.

Page 148 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Force Multiple Coils (Function Code 15)

MBS Protocol

User Manual

Query

This message forces each coil in a consecutive block of coils to a desired ON or

OFF state. Any coil that exists within the controller can be forced to either state

(ON or OFF). However, because the controller is actively scanning, unless the coils are disabled, the controller can also alter the state of the coil. Coils are numbered from zero (coil 00001 = zero, coil 00002 = one, and so on). The desired status of each coil is packed in the data field, one bit for each coil (1=

ON, 0= OFF). The use of server address 0 (Broadcast Mode) will force all attached servers to modify the desired coils.

Note: Functions 5, 6, 15, and 16 are the only messages (other than Loopback Diagnostic Test) that will be recognized as valid for broadcast.

The following example forces 10 coils starting at address 20 (13 HEX). The two data fields, CD =1100 and 00 = 0000 000, indicate that coils 27, 26, 23, 22, and

20 are to be forced on.

Adr

Func Hi Add Lo

Add

11

0F 00 13

Quantity

00

Byte

Cnt

0A

Data Coil Status

20 to 27

02

Data Coil Status

28 to 29

CD

Error Check

Field

00 CRC

Response

The normal response will be an echo of the server address, function code, starting address, and quantity of coils forced.

Adr

11

Func

0F

Hi Addr

00

Lo Addr

13

Quantity

00

Error Check Field

0A CRC

The writing of coils via Modbus function 15 will be accomplished regardless of whether the addressed coils are disabled or not.

Coils that are not programmed in the controller logic program are not automatically cleared upon power up. Thus, if such a coil is set ON by function code 15 and (even months later) an output is connected to that coil, the output will be hot.

ProSoft Technology, Inc.

August 12, 2015

Page 149 of 218

MBS Protocol

User Manual

Preset Multiple Registers (Function Code 16)

PLX3x Series

Ethernet and Serial Gateways

Query

Holding registers existing within the controller can have their contents changed by this message (a maximum of 125 registers). However, because the controller is actively scanning, it also can alter the content of any holding register at any time. The values are provided in binary up to the maximum capacity of the controller (16-bit for the 184/384 and 584); unused high order bits must be set to zero.

Note: Function codes 5, 6, 15, and 16 are the only messages that will be recognized as valid for broadcast.

Adr

Func Hi

Add

10 00

Lo Add Quantity

87 00

Byte

Cnt

02 04

Hi

Data

00

Lo

Data

Hi

Data

0A 01

Lo Data Error Check

Field

02 CRC

11

Response

The normal response to a function 16 query is to echo the address, function code, starting address and number of registers to be loaded.

Adr

11

Func

10

Hi Addr

00

Lo Addr

87

Quantity

00 02

Error Check Field

56

Page 150 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

8 ASCII Protocol

In This Chapter

ASCII Functional Overview ............................................................. 152

ASCII Configuration ........................................................................ 161

ASCII Diagnostics ........................................................................... 163

This chapter contains information specific to the PLX3x-series gateway ASCII protocol driver.

ASCII Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 151 of 218

ASCII Protocol

User Manual

8.1 ASCII Functional Overview

PLX3x Series

Ethernet and Serial Gateways

The ASCII protocol permits the PLX3x Gateway to interface any ASCII device to the many protocols and networks available. ASCII devices include barcode scanners, weigh scales, many field instruments, printers, and terminals. The protocol supports one to four serial communication ports that provide accessibility from one to four independent serial networks.

8.1.1 General Specifications

Ports: One to four serial communication ports to receive and/or transmit data

Receive buffer size: 255 bytes

Receive termination: Stream mode, termination character(s), message timeout, inter-character delay, or packet size length

Receive database location: -1 = disable receiver, 0 to 3896

Transmit buffer size: 255 bytes

Transmit characters with pacing: 0 to 65535 millisecond delay between each transmitted character

Transmit database location: -1 = disable transmitter, 0 to 3896

Communication Configuration o

Baud Rate: 110 to 115,200 o

Parity: None, Odd, Even o

Data Bits: 5 to 8 o

Stop Bits: 1 or 2 o

RTS On and Off Timing: 0 to 65535 milliseconds o

Minimum Response Delay: 0 to 65535 milliseconds o

Hardware or Software Handshaking: RTS/CTS, DTR/DSR, or

XON/XOFF

Page 152 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

8.1.2 Data Flow

The following illustration shows receive and transmit data flow of the ASCII protocol.

ASCII Protocol

User Manual

Data received from the ASCII device is accepted by the receive driver and placed in the receive database location configured by the user. The receive driver waits until the user-configured termination condition is recognized while receiving the data before placing the new data into the database.

For example, if the carriage-return character (ASCII 13) is used as the termination condition for a received message, this signals the end of the message. When the receive driver observes this character in the input stream, it takes all received characters and places them in the internal database.

In both receive and transmit operations, a signal is required to determine when new data is received or must be transmitted. The first word in the two data area is used for this purpose. There is new data available when the first word changes.

Example:

The sequence number in the receive data block has a value of 0 as set when the gateway initializes. The ASCII device sends a new data packet and the termination condition is present. The receive driver copies the data into the internal data area, sets the message length in the data area, and finally, sets the new sequence number. Receive and transmit data block structure is discussed in the following topics.

ProSoft Technology, Inc.

August 12, 2015

Page 153 of 218

ASCII Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Receive Data

Data received by the receive driver is placed in the gateway’s internal database in a fixed format at the location selected by the user. The receiver driver is disabled if the database start location is set to a value of -1. The following table shows the structure of the received data.

Word Offset

0

1

2

3

4

5

6

7

8

9 to 136

Description

Receive sequence number. This register is incremented by the gateway’s Receive

Driver for each new packet received.

Number of characters transmitted (0 to 255) from last transmit request

Number of characters (0 to 256) in receive block (9 to 136)

Receive State

-1 = Listening for data

1 = Receiving port data

Total receive character count

Total receive message count

Transmit State

0 = Waiting for data to send

1 = RTS on

2 = RTS timeout

3 = Sending data

4 = Waiting for RTS off

5 = RTS turned off

30 = Intercharacter delay

31 = Intercharacter delay

32 = Intercharacter delay

100 = Message delay before transmit

101 = Message delay before transmit

Total transmit character count

Configuration error word

Received data on port

An incremented received sequence number in Word 0 signals that new data is available in Words 1, 2, and 9 through 136. (Words 3 through 8 are updated continuously by the gateway, whether or not the port is receiving messages.)

If the gateway is configured to swap the data bytes received, the receive driver will swap the bytes in each word received before placing the data into the data block. Because the data received may contain an odd number of bytes, the length of the message received will be incremented by 1 when an odd number of bytes are received and the swap option is utilized. This is to avoid losing the last byte of data in the message.

Page 154 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

ASCII Protocol

User Manual

Transmit Data

Data to transmit by the transmit driver is placed in the gateway’s internal database in a fixed format at the location selected by the user. The transmit driver is disabled if the database start location is set to a value of -1. The following table shows the structure of transmit data.

Word Offset

0

1

2

3

4 to 131

Description

Transmit sequence number. This number is incremented by the user’s application for each new packet to transmit.

Number of characters received (0 to 256) from last receive request

Inter-character delay for this message (milliseconds between characters)

Number of characters to transmit on port (0 to 255)

Data to transmit on port

The first word of the data block is used to signal when new transmit data is available. Word 1 of the block may optionally contain the number of characters processed in the last receive message. Word 2 of the message is used to pace the characters during the transmission process. This may be required when interfacing with slow ASCII devices (that is, modems in command mode).

If the word is set to a value other than zero, a time delay corresponding to the number of milliseconds entered will be placed between each character transmitted. If the word is set to zero, the whole data packet will be transmitted as fast as the transmit driver can function. Word 3 of the data block contains the number of bytes present in the transmit data area to send out the ASCII serial communication port. Words 4 to 131 contain the actual data to transmit. If the swap option is utilized, the transmit driver will swap each byte in the words received before transmitting them.

Note: If an odd number of bytes are sent by the end device when the swap option is used, then the last byte of the message may be lost.

ProSoft Technology, Inc.

August 12, 2015

Page 155 of 218

ASCII Protocol

User Manual

8.1.3 Modes of Operation

PLX3x Series

Ethernet and Serial Gateways

The gateway can operate in several different modes with each port acting independently. The configuration of each port’s driver determines its mode. The following topics describe these modes and describe the flow of data between the pieces of hardware (ASCII device and PLX3x Gateway). These topics describe the three possible types of communication devices that can be attached to application ports: receive-only, transmit-only, and transmit-receive mode.

Receive-Only Mode

A port on the gateway configured to function in receive-only mode is set up to only receive data from some sort of ASCII device. In this mode, the PLX3x gateway will never transmit data back to the ASCII device. Any data received from the ASCII device is passed from the receiver driver (Rx Driver) to the PLX3x

Gateway’s internal database (Rx Data). The following illustration shows the flow of data on a port configured for receive-only mode.

Configuring a Port for Receive-Only Mode

In order to set a port for Receive-Only mode, ensure that the Rx DB Start parameter in the configuration file contains the starting location of where the data will be stored. The Tx DB Start parameter must contain a value of -1. This value indicates that the port will not transmit any data.

Page 156 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

ASCII Protocol

User Manual

Transmit-Only Mode

A port on the gateway configured to function in transmit-only mode is set up to only transmit data from the PLX3x gateway’s internal database (received from an external source) to an ASCII device. When the transmit driver (Tx Driver) recognizes a new write block containing data (data placed in the gateway’s internal database), it transmits this data out to the port. The sequence number used in the block will be different than that of the previous block, and therefore, signals that the packet is fully assembled and ready to send. The following illustration shows data flow for a transmit-only device.

Configuring a Port for Transmit-Only Mode

In order to set a port for Transmit-Only mode, ensure that the Tx DB Start parameter in the configuration file contains the starting location of where the data will be stored. The Rx DB Start parameter must contain a value of -1. This value indicates that the port will not receive any data.

ProSoft Technology, Inc.

August 12, 2015

Page 157 of 218

ASCII Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Transmit-Receive Mode

A port configured in transmit-receive mode can send and receive data from an

ASCII device such as a terminal. This mode functions the same way as transmitonly mode or receive-only mode, but handles both the transmit and receive functions. Data flow to and from an ASCII device is handled by the gateway’s transmit and receive drivers. Data received from the ASCII device is stored in the gateway’s internal database until ready to be sent to an external device. Data received by an external device is also stored in the gateway’s internal database until ready to be transmitted to the ASCII device. The following illustration shows the data flow when the port is configured for transmit-receive mode:

Configuring a Port for Transmit-Receive Mode

In order to set a port to both receive data and transmit data to an ASCII device, ensure that the Rx DB Start parameter and the Tx DB Start parameter both contain values that specify data storage starting locations. A -1 value in either parameter will disable the particular function that the parameter serves.

Page 158 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

ASCII Protocol

User Manual

Termination of Received Data

When data is received on the application port, the user must define in the configuration when this data will be transferred to the internal database within the gateway. This is known as the termination type for port. When the termination condition is met, the data will be sent from the port’s receive buffer (data area of

255 bytes) to the internal database. This termination type is set in the bit mapped type field of the gateway object. The following illustration shows the bit map used for this parameter.

Termination Type Field

4 to 7

Bit(s)

Bit Value

-

3

8

2

4

1

2

0

1

Definition

Reserved

Packet size limit used

Intercharacter delay timeout used

Message timeout used

Termination character(s) used

If none of the bits are set (Type=0), the port will be configured for stream mode.

Any characters received on the port are immediately sent to the processor. The processor must buffer and assemble a packet of information if this mode is selected as required by the application. If the data can be handled by the processor in this mode and it is appropriate for your application, this is the fastest method of communication between the device and the processor.

ProSoft Technology, Inc.

August 12, 2015

Page 159 of 218

ASCII Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Any combination of bits is acceptable to the gateway and should be set to match the device on the specific port. An example of each termination type is given below.

Termination character(s) used

Settings:

Count = 1 (RTermCnt=1)

Termination on 0x0d (carriage return character) (RTermChar = 0d 00 00 00 …)

Data Received on port:

A B C 0x0d D E

Comment:

The characters "ABC" will be sent along with the 0x0d character to the controller after the

0x0d character is received. The characters "DE" will not be sent until the 0x0d character is received.

Message timeout used

Settings:

Message timeout = 1000 mSec (Rtimeout=1000)

Data Received on port:

TIME

0 1000 mSec

A B C D E F G

2000 mSec

Comment:

After the 'A' character is received on the port, the message timeout is started.

The characters "ABCDE" will be sent to the controller in one block. The characters

"FG" will follow in the second block one second later.

Intercharacter delay timeout used

Settings:

Intercharacter delay timeout = 300 mSec (Rdelay=300)

Data Received on port:

TIME

0 1000 mSec 2000 mSec

A B C D E F G H

>=300mSec time gap

Comment:

After each character is received, the intercharacter delay timer is reset. The characters

"ABCDEF" will be sent to the controller in one block because the delay timer expires.

The characters "GH" will follow in the second block when the next time gap is recognized.

Packet size limit used

Settings:

Packet size = 4 (RPacketLen=4)

Data Received on port:

A B C D E F G H I J

Comment:

The first block sent to the controller will contain the characters "ABCD", and the second block will contain the characters "EFGH". The characters "IJ" will not be sent until two more characters are received on the port.

Page 160 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

8.2 ASCII Configuration

ASCII Protocol

User Manual

In order for the ASCII driver to function, a minimum amount of configuration data must be transferred to the gateway from the gateway's file system. Care must be taken in constructing the gateway configuration parameters. If the gateway does not function as expected, examine the configuration parameters using PCB

Diagnostics.

After setting up the configuration in PCB, download it to the gateway.

8.2.1 ASCII Port [x]

Parameter

Enabled

Value

YES or NO

Description

Specifies if the port will be used. If the parameter is set to

No, the port will not be used. If the parameter is set to Yes, the port will be used supporting the ASCII protocol.

Specifies the electrical interface for the ports.

RS Interface

Rx DB Start

RS-232

RS-485

RS-422

-1 or

0 to 3896

Tx DB Start

-1 or

0 to 3896

Baud Rate

Parity

Data Bits

Various

None

Odd

Even

7 or 8

Stop Bits

RTS On

RTS Off

1 or 2

0 to 65535

0 to 65535

Specifies the starting location in the internal database where the received data will be stored. The buffer holds 130 words; however, the first three words of the data area define the sequence number, last write byte count and the

Rx message length. If the parameter is set to -1, the port

will not receive data. Refer to Receive Data (page 154) for

detailed information on Rx data structure.

This parameter specifies the starting location in the internal database where the transmit data will be stored. The buffer holds 130 words; however, the first three words of the data area define the sequence number, last write byte count and the Tx message length. If the parameter is set to -1, the port

will not transmit data. Refer to Transmit Data (page 155) for

detailed information on Tx data structure.

Specifies the baud rate to be used on the port.

Parity is a simple error checking algorithm used in serial communication. This parameter specifies the type of parity checking to use. All devices communicating through this port must use the same parity setting.

Specifies the number of data bits for each word used by the protocol. All devices communicating through this port must use the same number of data bits.

Stop bits signal the end of a character in the data stream.

For most applications, use one stop bit. For slower devices that require more time to re-synchronize, use two stop bits.

All devices communicating through this port must use the same number of stop bits.

Specifies the number of milliseconds to delay data transmission after Ready To Send (RTS) is asserted.

Specifies the number of milliseconds to delay after the last byte of data is sent before the RTS modem signal is set low.

ProSoft Technology, Inc.

August 12, 2015

Page 161 of 218

ASCII Protocol

User Manual

Parameter

Handshaking

Rx

Termination

Type

Rx Term

Count

Rx Term

Chars

Rx Packet

Length

Value

NO

YES

DTR-DSR

XON-XOFF

Description

PLX3x Series

Ethernet and Serial Gateways

Specifies the handshaking used on the port.

No-No hardware or software handshaking

Yes-RTS/CTS hardware handshaking

DTR/DSR- DTR/DSR hardware handshaking

XON/XOFF- software handshaking

TERMINATION

CHARACTERS

MESSAGE

TIMEOUT

INTERCHARACTER

DELAY

PACKET SIZE

0 to 12

Defines the receive termination characteristics for the port.

When the ASCII driver encounters the specified termination condition on the port, it will interpret it as end of message.

Used when the Rx Termination Type is TERMINATION

CHARACTERS. This parameter specifies the number of different termination characters that can be used to signal the end of a received message.

ASCII Characters

Used when the Rx Termination Type is TERMINATION

CHARACTERS. This parameter specifies the termination characters used to signal the end of each received message. Enter up to 12 ASCII character codes in decimal format, with spaces between codes. The number of termination characters is set in the Rx Term Count parameter.

0 to 200

Used when the Rx Termination Type is PACKET SIZE. This parameter sets the length of data required to be received on the port before considering end-of-message reached.

Rx Timeout

0 to 65535

Used when the Rx Termination Type is MESSAGE

TIMEOUT. This parameter sets the number of milliseconds to wait after the first character is received on the port before considering end-of-message reached.

Rx Delay

0 to 65535

Used when the Rx Termination Type is

INTERCHARACTER DELAY. This parameter sets the maximum number of milliseconds to wait between each character received on the port. When this value is exceeded, the ASCII driver considers end-of-message reached.

YES or NO

Specifies if byte swapping of received data will occur.

Swap Rx

Data Bytes

Tx Timeout

0 to 65535

Specifies the timeout period to transmit a message out the port. Message transmission will be aborted if the message is not transmitted out the port within the specified timeout period.

Tx Minimum

Delay

0 to 65535

Specifies the minimum number of milliseconds to delay before transmitting a message out the port. This pre-send delay is applied before the RTS on time. This may be required when communicating with slow devices.

Swap Tx

Data Bytes

YES or NO

Specifies if byte swapping of transmitted data will occur.

Page 162 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

8.3 ASCII Diagnostics

ASCII Protocol

User Manual

8.3.1 PCB Diagnostics

The best way to troubleshoot this driver is to use ProSoft Configuration Builder to access the diagnostic capabilities of the gateway through the Ethernet debug

port. For instructions on how to access Diagnostics, see Using Diagnostics in

ProSoft Configuration Builder

(page 36).

8.3.2 ASCII Status Data in Upper Memory

Each ASCII port has an associated status data area located in the gateway’s upper memory. The Data Map functionality of the gateway can be used to map

this data into the normal user data range of the gateway’s database. See Using the CommonNet Data Map (page 25).

The following table lists the starting addresses in upper memory where the status data for each ASCII port can be found.

Port

Gateway Starting Register for Status Data

1

2*

3*

13000

13010

4*

13020

13030

*Status data for Ports 2 through 4 are only present in 4-port ASCII gateways.

Port [x] Status Data

Status Register Offset

Description

0

Receive state:

-1 = Listening for data

1 = Receiving port data

1

Total receive character count

2

3

Total receive message count

Transmit state:

0 = Waiting for Data to Send

1 = RTS On

2 = RTS Timeout

3 = Sending data

4 = Waiting for RTS Off

5 = RTS turned off

30, 31, and 32 = Intercharacter Delay

100 and 101 = Message Delay before Transmit

4

5

6

7 to 9

Total transmit character count

Total transmit message count

Reserved

No valid data

ProSoft Technology, Inc.

August 12, 2015

Page 163 of 218

User Manual

PLX3x Series

Ethernet and Serial Gateways

Page 164 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

9 SIE Protocol

In This Chapter

SIE Functional Overview ................................................................ 166

SIE Configuration............................................................................ 167

SIE Diagnostics .............................................................................. 181

SIE Reference ................................................................................ 193

This chapter contains information specific to PLX3x-series gateways with a

Siemens Industrial Ethernet (SIE) protocol driver.

SIE Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 165 of 218

SIE Protocol

User Manual

9.1 SIE Functional Overview

PLX3x Series

Ethernet and Serial Gateways

The PLX3x Siemens Industrial Ethernet (SIE) protocol can be used to interface easily with multiple Siemens Industrial Ethernet server-compatible instruments and devices. The SIE protocol improves performance when controlling multiple servers on a Siemens Industrial Ethernet network, by supporting up to 20 Clients.

The gateway’s Clients interface with processors (and other server-based devices) on the SIE network using a user-constructed command list of up to 16 entries per Client. The gateway’s internal database is used as the source for write commands to the remote processors. Data collected from the processors using read commands is placed in the gateway’s database.

9.1.1 General Specifications

• 10/100 MB Ethernet Communication port

• Actively reads data from and writes data to Siemens Industrial Ethernet devices, using Siemens Industrial Ethernet protocol

• Siemens Industrial Ethernet data types overlap in the gateway's memory database, so the same data can be conveniently read or written as bit-level or register-level data

• Offers 20 Client connections with up to 16 commands each to talk to multiple servers

• Configurable floating-point data movement is supported

• Status and error information generated by the gateway

9.1.2 Gateway Internal Database

Central to the functionality of the gateway is the internal database. This database is shared between all the ports on the gateway and is used as a conduit to pass information from one device on one network to one or more devices on another network. This permits data from devices on one communication port to be viewed and controlled by devices on another communication port.

In addition to data from the Client, status and error information generated by the gateway can also be mapped into the internal database.

Page 166 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

9.2 SIE Configuration

SIE Protocol

User Manual

9.2.1 SIE Client x

This section defines general configuration for the SIE Client (Master).

Description

Parameter

Minimum

Command

Delay

Value

0 to 65535 Specifies the number of milliseconds to wait between the initial issuances of a command. This parameter can be used to delay all commands sent to servers to avoid "flooding" commands on the network. This parameter does not affect retries of a command as they will be issued when failure is recognized.

Response

Timeout

0 to 65535

Specifies the time in milliseconds that a Client will wait before retransmitting a command if no response is received from the addressed server. The value to use depends on the type of communication network used, and the expected response time of the slowest device on the network.

Retry Count

0 to 65535

Specifies the number of times a command will be retried if it fails.

9.2.2 SIE Client x Commands

The SIE Client x Commands section of the configuration sets the Siemens

Industrial Ethernet Client command list. This command list polls Siemens

Industrial Ethernet server devices attached to the Siemens Industrial Ethernet

Client port. The gateway supports numerous commands. This permits the module to interface with a wide variety of Siemens Industrial Ethernet protocol devices.

The function codes used for each command are those specified in the Siemens

Industrial Ethernet protocol. Each command list record has the same format. The first part of the record contains the information relating to the gateway, and the second part contains information required to interface to the Siemens Industrial

Ethernet server device.

Command List Overview

A command list needs to be constructed to interface the gateway with Siemens

Industrial Ethernet server devices. The commands in the list specify the server device to be addressed, the function to be performed (read or write), the data area in the device to interface with, and the registers in the internal database to be associated with the device data. Each Client command list supports up to 16 commands.

The command list is processed from top (command #1) to bottom. A poll interval parameter is associated with each command to specify a minimum delay time in tenths of a second between the issuances of a command. If the user specifies a value of 10 for the parameter, the command will be executed no more frequently than every 1 second.

ProSoft Technology, Inc.

August 12, 2015

Page 167 of 218

SIE Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Address Type

DB

Timer:

Commands Supported by the Gateway

The format of each command in the list depends on the Siemens Industrial

Ethernet Function Code being executed.

The type of functions that will be supported will also depend on the server device and what it can support.

Below are examples of S7-200, S7-300 and S7-1200 functions that are supported by the gateway.

S7-300:

Data Block:

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

COUNT

COUNT

Address Type

Timer

Counter:

Function

READ

Data Type

TIME

Address Type

Counter

Function

READ

Data Type

Count

Page 168 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Flag:

Address Type

Flag

Output:

Address Type

Output

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

Count

Count

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

Count

Count

SIE Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 169 of 218

SIE Protocol

User Manual

Input:

Address Type

Input

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

PLX3x Series

Ethernet and Serial Gateways

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

Count

Count

Page 170 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

S7-200:

Data Block:

Address Type

DB

Flag:

Address Type

Flag

Output:

Address Type

Output

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

ProSoft Technology, Inc.

August 12, 2015

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

SIE Protocol

User Manual

Page 171 of 218

SIE Protocol

User Manual

Input:

Address Type

Input

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

PLX3x Series

Ethernet and Serial Gateways

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

Page 172 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

S7-1200:

Data Block:

Address Type

DB

Flag:

Address Type

Flag

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

Count

Count

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

COUNT

COUNT

SIE Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 173 of 218

SIE Protocol

User Manual

Output:

Input:

Address Type

Output

Address Type

Input

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Page 174 of 218

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

Count

Count

PLX3x Series

Ethernet and Serial Gateways

REAL

REAL

INT

INT

TIME

TIME

Count

Count

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Command List Parameters

SIE Protocol

User Manual

Parameter

Enable

Value

DISABLED

ENABLED

CONDITIONAL

Description

Specifies if the command is to be executed and under what conditions.

Disabled (0) - the command is disabled and will not be executed in the normal polling sequence.

Continuous (1) - the command will be executed upon each scan of the Command List if the Poll Interval is set to zero (0). If the Poll Interval is set to a non-zero value, the command will be executed when the interval timer for that command expires.

Conditional (2) - the command will execute only if the internal data associated with the command changes.

Internal

Address

0 to 3999 (for register-level addressing) or

0 to 63999(for bit-level addressing)

Specifies the database address in the gateway's internal database to use as the destination for data brought in by a read command, or as the source for data to be sent out by a write command. The database address is interpreted as a bit address or a 16-bit register (word) address, depending on the Siemens

Industrial Ethernet’s Data Type used in the command. If Data

Type – Bool is used in the command list, then the database address will be interpreted as a bit address. When any other data types are used, then the database address is interpreted as a 16-bit word (register) address.

Poll Interval

0 to 65535

Specifies the minimum interval between executions of continuous commands. The value is in tenths of a second.

Therefore, if a value of 100 is entered, the command will execute no more frequently than once every 10 seconds.

Reg Count

Commanddependent

Specifies the number of 16-bit registers or binary bits to be transferred by the command. The range depends on the

Siemens processor and the type of command. See Maximum

Register Counts (page 185).

Swap Code

No Change

Word Swap

Word and Byte

Swap

Byte Swap

Specifies if and how the order of bytes in data received or sent is to be rearranged. This option exists to allow for the fact that different manufacturers store and transmit multi-byte data in different combinations. This parameter is helpful when dealing with floating-point or other multi-byte values, as there is no one standard method of storing these data types. The parameter can be set to rearrange the byte order of data received or sent into an order more useful or convenient for other applications.

No change(0) - No change is made in the byte ordering (1234 =

1234)

Word Swap (1) -The words are swapped (1234=3412)

Word and Byte Swap (2) - The words are swapped, then the bytes in each word are swapped (1234=4321)

Byte Swap (3) - The bytes in each word are swapped

(1234=2143)

These swap operations affect 4-byte (or 2-word) groups of data.

Therefore, data swapping using these Swap Codes should be done only when using an even number of words, such as when

32-bit integer or floating-point data is involved.

Node IP

Address xxx.xxx.xxx.xxx IP address of the Siemens processor being addressed by the command.

PLC Type

S7-200

S7-300/S7-

400/S7-1200

ProSoft Technology, Inc.

August 12, 2015

Type of Siemens processor being addressed by the command.

Page 175 of 218

SIE Protocol

User Manual

Parameter

Rack

Value

0 to 999

0 to 12

Slot

TSAP

Address

PLX3x Series

Ethernet and Serial Gateways

Description

Rack number of the S7-300, S7-400 or S7-1200 CPU.

Note: Rack number is not used for the S7-200 CPU.

Slot number of the S7-300, S7-400 or S7-1200 CPU.

Note: Slot number is not used for the S7-200 CPU.

TSAP of the S7-200 CPU. This can be found in the Siemens

STEP 7 MicroWIN software.

Note: TSAP is not used for the S7-300, S7-400 and S7-1200.

This parameter can either be Read or Write.

This parameter can be BOOL, BYTE, DINT, REAL, INT, TIME, or COUNT.

Func Type

Data Type

Address

Type

DB Number

Read

Write

BOOL

BYTE

DINT

REAL

INT

TIME

COUNT

INPUT

OUTPUT

FLAG

TIMER

COUNTER

DB

0 to 32767

This parameter can be INPUT, OUTPUT,FLAG, TIMER,

COUNTER or DB (Data Block).

Specifies the Data Block number to be used with the command.

Note: DB Number is only used when the Address Type is set to

DB.

Address of the data in the Siemens device. For Read or Write operations using the INT, DINT, REAL or BYTE Data Types, the address is a byte address.

For Read or Write operations using the BOOL Data Type, the address is a bit address. Please see below for notes on addressing.

Page 176 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

SIE Protocol

User Manual

Notes on Addressing in S7 Processors

S7-300/S7-1200 Processor:

Byte Address in Data Block:

DB1.DBB1 DB1.DBB3

2#0000_0110 2#0000_0000 2#0110_0001 2#0011_0110 2#1100_0110

DB1.DBB0 DB1.DBB2 DB1.DBB4

Word Address in Data Block:

DB1.DBW1 DB1.DBW3

2#0000_0110 2#0000_0000 2#0110_0001 2#0011_0110 2#1100_0110

DB1.DBW0 DB1.DBW2

The gray area above represents the byte memory locations being overlapped when word address is used consecutively (DB1.DBW0, DB1.DBW1, DB1.DBW2, etc).

If DB1.DBW0 is used as the first address in the Siemens processor, the next word address that can be used without overwriting the data would be

DB1.DBW2.

Double Word Address in Data Block:

DB1.DBD1

2#0000_0110 2#0000_0000 2#0110_0001 2#0011_0110 2#1100_0110

DB1.DBD0

The gray area above represents the byte memory locations being overlapped when double word address is used consecutively (DB1.DBD0, DB1.DBD1,

DB1.DBD2, etc).

ProSoft Technology, Inc.

August 12, 2015

Page 177 of 218

SIE Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

If DB1.DBD0 is used as the first address in the Siemens processor, the next double word address that can be used without overwriting the data would be

DB1.DBD4.

All of the above share the same memory locations in the processor.

Note: Incorrect memory location addressing can cause the data to be overwritten.

Below is a graphical representation of the addressing of the processor’s memory locations.

DB1.DBD1

DB1.DBW0

DB1.DBW1

DB1.DBW2

DB1.DBW3

2#0000_0110 2#0000_0000 2#0110_0001 2#0011_0110 2#1100_0110

DB1.DBB2 DB1.DBB3 DB1.DBB4 DB1.DBB0DB1.DBB1

DB1.DBD0

Example:

Sending an integer value of 11733 from gateway register 1000 to a Siemens S7-

300 processor demonstrates the addressing scheme in the Siemens S7-300 processor:

Page 178 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

PCB screen shot showing Client command to send INT data to DB1 address 0:

SIE Protocol

User Manual

Row 1 in the SIMATICS Manager screen shot below shows the data transferred from the gateway.

If the data is broken up and displayed in binary format, it can be seen that the binary data stored in the first byte of DB1.DBW 0 is identical to that stored in byte address DB1.DBB 0. This is because the memory locations referenced by the first byte of DB1.DBW 0 and by DB1.DBB0 are one and the same, as explained previously.

Same memory space

Same memory space

DB1.DBW0DB1.DBW1

2#0010_1101 2#1101_0101 2#1101_0101 2#0101_0111

DB1.DBB0 DB1.DBB1 DB1.DBB1 DB1.DBB2

The first byte of DB1.DBW0 is the same as DB1.DBB0.

ProSoft Technology, Inc.

August 12, 2015

Page 179 of 218

SIE Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

The second byte of DB1.DBW0 is the same as DB1.DBB1, and is the same as the first byte of DB1.DBW1.

In reality, the memory space looks like below:

DB1.DBW0 DB1.DBW1

2#0010_1101 2#1101_0101 2#0101_0111

DB1.DBB0 DB1.DBB1 DB1.DBB2

Note: To access the first address of Data Block, Flag, Input, Output, Timer, and Counter memory locations in the S7-300 and S7-1200 processors, use the following address syntax.

Data Block -> DB1.DBB0, DB1.DBW0, DB1.DBD0

Flag -> MB0, MW0, MD0

Input -> IB0, IW0, ID0

Output -> QB0, QW0, QD0

Timers -> T0 – T65535

Counters -> C0 – C65535

Note: To access the first address of Data Block, Flag, Input and Output memory locations in the

S7-200 processor, use the following address syntax.

Data Block -> VB0, VW0, VD0

Flag -> MB0, MW0, MD0

Input -> IB0, IW0, ID0

Output -> QB0, QW0, QD0

Page 180 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

9.3 SIE Diagnostics

SIE Protocol

User Manual

The best way to troubleshoot the SIE driver is to use ProSoft Configuration

Builder to access the diagnostic capabilities of the gateway through the Ethernet

debug port. For instructions on how to access Diagnostics, see Using

Diagnostics in ProSoft Configuration Builder

(page 36).

9.3.1 Client Command Errors

Each SIE Client has an associated status data area located in the gateway’s upper memory. The Data Map functionality of the gateway can be used to map

this data into the normal user data range of the gateway’s database. See Using the CommonNet Data Map (page 25).

The following table lists the starting addresses in upper memory where the status data for each Client can be found.

18

19

Client

0

1

2

Gateway Starting Register for Status Data

21100

21125

21151

21568

21594

The following table describes the content of each Client’s status data area.

Word Offset

0

1

2

6

7

8

9

3

4

5

10 to 25

Description

Command Request Count

Command Response Count

Command Error Count

Number of Request Packets

Number of Response Packets

Errors Sent

Errors Received

Configuration Error Word

Current Error

Last Error

Command List Errors (16 per Client)

For every command that has an error, the gateway automatically sets the poll delay parameter to 30 seconds. This instructs the gateway to wait 30 seconds before it attempts to issue the command again.

ProSoft Technology, Inc.

August 12, 2015

Page 181 of 218

SIE Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

As the commands in the Client Command List are polled and executed, an error codeis maintained in the gateway for each command. The current error value for each command is displayed in the Command List Errors section of each Client’s status data area. There is one register for each of the 16 commands in the command list. An error code of 0 means no error is currently detected for the specified command.

The following tables list the various error codes that may be displayed and their descriptions.

9.3.2 SIE Error Codes

Module Communication Error Codes

10

-123

-124

-125

-126

-127

Decimal Hex

1

3

5

6

7

0x0001

0x0003

0x0005

0x0006

0x0007

-128

-129

-1024

-1025

0x000a

0xff85

0xff84

0xff83

0xff82

0xff81

0xff80

0xff7f

0xfc00

0xfbff

-32767

-32511

-32509

-32508

0x8001

0x8101

0x8103

0x8104

-32507

-32506

0x8105

0x8106

Description

No data from I/O module

The desired item is not available in the PLC (200 family)

The desired address is beyond limit for this PLC

The CPU does not support reading a bit block of length<>1

Write data size error

The desired item is not available in the PLC

Cannot evaluate the received PDU

The PLC returned a packet with no result data

The PLC returned an error code not understood by this library

This result contains no data

Cannot work with an undefined result set

Unexpected function code in answer";

PLC responds with an unknown data type

Short packet from PLC

Timeout when waiting for PLC response

Not allowed in current operating status

Hardware fault

Object access not allowed

Context is not supported. Step7 says: Function not implemented or error in telegram

Invalid address

Data type not supported

Page 182 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Decimal Hex Description

-11775

-11774

-11773

-11772

-11771

-11770

-11769

-11767

-11762

-11760

-11712

-11711

-11710

-32505

-32502

-31999

-31742

-31740

-31488

-30974

-12286

-12284

-12127

-11263

-11262

-11258

-11255

-9215

0xd201

0xd202

0xd203

0xd204

0xd205

0xd206

0xd207

0xd209

0xd20e

0xd210

0xd240

0xd241

0xd242

0x8107 Data type not consistent

0x810A Object does not exist

0x8301 Insufficient CPU memory

0x8402

0x8404

0x8500

CPU already in RUN or already in STOP

Severe error

Incorrect PDU size

0x8702

0xd002

Address invalid

Step7: Variant of command is illegal

0xd004 Step7: Status for this command is illegal

0xd0A1 Step7: Function is not allowed in the current protection level

Block name syntax error

Syntax error function parameter

Syntax error block type

No linked block in storage medium

Object already exists

Object already exists

Block exists in EPROM

Block does not exist/could not be found

No block present

Block number too big

Coordination rules were violated

Operation not permitted in current protection level

Protection violation while processing F-blocks. F-blocks can only be processed after password input

Invalid SZL ID 0xd401

0xd402

0xd406

0xd409

0xdc01

Invalid SZL index

Diagnosis: Info not available

Diagnosis: DP error

Invalid BCD code or Invalid time format

SIE Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 183 of 218

SIE Protocol

User Manual

SIE Client Specific Error Codes

Decimal Hex

-33

-34

0xffdf

0xffde

-36

-37

0xffdc

0xffdb

Description

Failed to connect to server specified in command

Failed to create a socket

SIE command response timeout (same as -11)

TCP/IP connection ended before session finished

PLX3x Series

Ethernet and Serial Gateways

Command List Entry Error Codes

-46

-47

Decimal Hex

-40 0xffd8

-41

-42

-44

-45

0xffd7

0xffd6

0xffd4

0xffd3

0xffd2

0xffd1

Description

Too few parameters

Invalid enable code

Internal address > maximum address

Count parameter set to 0

Invalid function code

Invalid swap code

Invalid TSAP code

Page 184 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

9.4 SIE Reference

9.4.1 Maximum Register Counts

CPU315-2 DP

Data Block:

Function Data Type

Address Type

DB READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

COUNT

COUNT

Timer:

Address Type

Timer

Counter:

Address Type

Counter

Function

READ

Function

READ

Data Type

TIME

Data Type

Count

Max Reg Cnt

82

82

41

82

1

164

41

41

82

41

82

Max Reg Cnt

1

164

41

Max Reg Cnt

1

Max Reg Cnt

111

SIE Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 185 of 218

SIE Protocol

User Manual

Flag:

Address Type

Flag

Output:

Address Type

Output

Function

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Function

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Data Type

REAL

INT

INT

TIME

TIME

Count

Count

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

Data Type

REAL

INT

INT

TIME

TIME

Count

Count

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

Max Reg Cnt

111

111

111

1

222

55

55

53

53

106

Max Reg Cnt

1

212

53

106

Max Reg Cnt

64

64

64

1

128

32

32

Max Reg Cnt

1

64

32

128

32

32

64

PLX3x Series

Ethernet and Serial Gateways

Page 186 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Input:

Address Type

Function

Input READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

Count

Count

Max Reg Cnt

1

128

64

64

32

32

64

32

32

64

32

64

Max Reg Cnt

1

128

SIE Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 187 of 218

SIE Protocol

User Manual

CPU1212C:

Data Block:

Address Type

DB

Flag:

Address Type

Flag

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Function

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

COUNT

COUNT

Data Type

REAL

INT

INT

TIME

TIME

Count

Count

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

Max Read

15

15

7

15

7

1

30

Max Reg Cnt

106

105

106

1

212

53

53

Max Reg Cnt

1

212

53

53

106

105

106

7

15

30

7

Max Write

1

15

15

PLX3x Series

Ethernet and Serial Gateways

Page 188 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Output:

Address Type

Function

Output

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Input:

Address Type

Input

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Data Type

REAL

INT

INT

TIME

TIME

Count

Count

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

TIME

TIME

Count

Count

Max Reg Cnt

106

105

111

1

212

53

53

53

53

106

Max Reg Cnt

1

212

105

106

Max Reg Cnt

55

111

111

111

1

222

55

53

53

111

Max Reg Cnt

1

212

106

106

SIE Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 189 of 218

SIE Protocol

User Manual

CPU224XP:

Data Block:

Address Type

Flag

DB

Flag:

Address Type

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

Max Read

1

222

55

55

111

Max Write

1

212

53

53

106

PLX3x Series

Ethernet and Serial Gateways

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

Max Reg Cnt

8

1

32

8

16

8

8

16

Max Reg Cnt

1

32

Page 190 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Output:

Address Type

Function

Output

Input:

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Address Type

Input

Function

READ

Write

READ

Write

READ

Write

READ

Write

READ

Write

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

Max Reg Cnt

8

4

4

1

16

4

8

4

Max Reg Cnt

1

16

SIE Protocol

User Manual

Data Type

BOOL

BOOL

BYTE

BYTE

DINT

DINT

REAL

REAL

INT

INT

8

4

4

Max Reg Cnt

1

16

4

8

4

Max Reg Cnt

1

16

ProSoft Technology, Inc.

August 12, 2015

Page 191 of 218

PLX3x Series

Ethernet and Serial Gateways

10 PND Protocol

In This Chapter

PND Functional Overview ..............................................................

194

PND Configuration .......................................................................... 194

Step 7 Configuration ......................................................................

198

PND Input/Output Error Status ......................................................

213

This chapter contains information specific to the PLX3x-series gateway PND protocol driver.

PND Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 193 of 218

PND Protocol

User Manual

10.1 PND Functional Overview

PLX3x Series

Ethernet and Serial Gateways

PROFINET is the communication standard for automation of PROFIBUS and

PROFINET International (PI). Many years of experience with PROFIBUS and the widespread use of Industrial Ethernet are all rolled into PROFINET.

With its integrated, Ethernet-based communication, PROFINET satisfies a wide range of requirements, from data intensive parameter assignments to extremely fast I/O data transmission which enables automation in real-time.

10.2 PND Configuration

The following procedure provides the required steps to configure the PLX31-EIP-

PND module using ProSoft Configuration Builder (PCB). This configuration provides the ability to communicate with a Siemens processor via the PROFINET protocol.

1. Launch ProSoft Configuration Builder.

2. Create a new PLX31-EIP-PND module.

3. Click OK.

Page 194 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

PND Protocol

User Manual

4. Expand PND MODULE MAP and double-click PND MODULE MAP to edit.

5. In this example, 32-bytes of input and 32-bytes of output will be used (a dropdown list provides the range that could be used in each slot).

6.

7.

Select Slot 1.

Select the number of input bytes. In this example, select Input 32 Byte from the drop down list.

ProSoft Technology, Inc.

August 12, 2015

Page 195 of 218

PND Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

8.

9.

Select Slot 2.

Select the number of output bytes. In this example, select Output 32

Byte from the drop down list.

Page 196 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

PND Protocol

User Manual

Important: The PND module map is very important because the values entered here must match the values that are entered in the Siemens processor in order for them to communicate. The total combined Input bytes and total combined Output bytes must not be greater than 1440.

10. Save and download the configuration to the module.

ProSoft Technology, Inc.

August 12, 2015

Page 197 of 218

PND Protocol

User Manual

10.3 Step 7 Configuration

PLX3x Series

Ethernet and Serial Gateways

This procedure describes the tasks required to set up the module with Siemens

Step 7. It is important to note that the configuration parameters used during PCB

Configuration and download to the module must match parameters configured here within this procedure.

1 Start Step 7 software.

2 Create a new project. For example, Profinet_Sample.

3 Add a station to the project in which the network will be configured.

4 Click on the SIMATIC 300 station.

5 Configure the station by double-clicking the hardware icon under SIMATIC

300.

Page 198 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

The HW Config window opens.

PND Protocol

User Manual

6 Click on Options > Install GSD file.

ProSoft Technology, Inc.

August 12, 2015

Page 199 of 218

PND Protocol

User Manual

The Install GSD File dialog opens.

PLX3x Series

Ethernet and Serial Gateways

7 Click Browse and locate the GSD file.

Page 200 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

PND Protocol

User Manual

8 Select the file and click the Install button. The system informs you when the install is complete.

9 Click OK.

10 From the HW Config page, select a rack and a power supply.

ProSoft Technology, Inc.

August 12, 2015

Page 201 of 218

PND Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

11 Drag and drop the processor to be used in the network. The example uses

315-2 PN/DP.

Page 202 of 218

12 Right-click on the PN-IO option and select Insert PROFINET IO System.

ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

13 Insert the ProfiNet bus network where the ProSoft module will be added by clicking on the PN-IO option and select New. The Properties - Ethernet

Interface dialog opens.

PND Protocol

User Manual

14 Click the New button. The Properties - New subnet Industrial Ethernet dialog opens.

ProSoft Technology, Inc.

August 12, 2015

Page 203 of 218

PND Protocol

User Manual

15 Click OK on the following prompt.

PLX3x Series

Ethernet and Serial Gateways

Page 204 of 218

16 Add the PLX31-EIP-PND module to the network.

ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

17 Configure the interface port for the ProSoft module as shown.

PND Protocol

User Manual

18 Configure the inputs and outputs to match the PCB configuration. The example uses 32 inputs and 32 outputs.

ProSoft Technology, Inc.

August 12, 2015

Page 205 of 218

PND Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

19 Verify the name and IP address by clicking PLC > Ethernet > Verify Device

Name…

If the status is not green, the module needs the name and IP to be assigned.

This is done by clicking PLC > Ethernet > Assign Device Name.

Page 206 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

20 Once the status is green, save and download the program.

PND Protocol

User Manual

ProSoft Technology, Inc.

August 12, 2015

Page 207 of 218

PND Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

Once you download the program, the RUN LED and the DC5V on the processor should be green. There should be no red LEDs.

Page 208 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

10.3.1 Monitoring Data in Step 7

1 To monitor the values coming out of the processor, click on the Input and choose the Monitor/Modify option.

PND Protocol

User Manual

The values coming into the processor are displayed at the input section.

ProSoft Technology, Inc.

August 12, 2015

Page 209 of 218

PND Protocol

User Manual

PLX3x Series

Ethernet and Serial Gateways

2 To modify the values that the processor sends to the module, choose the

Output, select the desired value, and select Modify Value.

Page 210 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

10.3.2 Creating a Variable Table to Display Floating Point Input

Values

1 Select Insert New Object > Variable Table.

PND Protocol

User Manual

2 Assign a name to the table and click OK.

ProSoft Technology, Inc.

August 12, 2015

Page 211 of 218

PND Protocol

User Manual

3 Double-click on the table to monitor.

PLX3x Series

Ethernet and Serial Gateways

Page 212 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

10.4 PND Diagnostics

Input Error Status

Error code

Description

0

0x0604

0x0503

0x060A

No error

Pointer to data memory is NULL

Write buffer is already locked or unlocked

Data length to be written is invalid

Output Error Status

Error code

Description

0

0x0001

0x0604

0x060B

0x0803

0x060A

No error

No new data was copied into the buffer

Pointer to data memory is NULL, or pointer to variable to receive the APDU

Data Status is NULL

IOCR ID is 0

IOCR ID could not be found, or IOCR ID is invalid

Data length to be read is invalid

PND Protocol

User Manual

10.4.1 Configuration Error Codes

The Err LED is lit when no connection from the PLC is established.

Error Codes

Error code

20

21

22

23

0

1

2

18

19

Description

No error

Input Swap Error

Output Swap Error

Get Network Data Adapter

Get IP Address Error

Get NetMask Error

Get Gateway Error

Get MAC Address Error

PROFINET Mapping Error

ProSoft Technology, Inc.

August 12, 2015

Page 213 of 218

User Manual

PLX3x Series

Ethernet and Serial Gateways

Page 214 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX3x Series

Ethernet and Serial Gateways

Support, Service and Warranty

User Manual

11 Support, Service and Warranty

In This Chapter

Contacting Technical Support ......................................................... 215

Warranty Information ...................................................................... 216

11.1 Contacting Technical Support

ProSoft Technology, Inc. (ProSoft) is committed to providing the most efficient and effective support possible. Before calling, please gather the following information to assist in expediting this process:

1 Product version number

2 System architecture

3 Network details

If the issue is hardware related, we will also need information regarding:

1 Gateway configuration and associated ladder files, if any

2 Gateway operation and any unusual behavior

3 Configuration/Debug status information

4 LED patterns

5 Details about the serial, Ethernet or fieldbus devices interfaced to the

Gateway, if any.

Note: For technical support calls within the United States, ProSoft’s 24/7 after-hours phone support

is available for urgent plant-down issues. Detailed contact information for all our worldwide

locations is available on the following page.

ProSoft Technology, Inc.

August 12, 2015

Page 215 of 218

Support, Service and Warranty

User Manual

Internet

PLX3x Series

Ethernet and Serial Gateways

Web Site: www.prosoft-technology.com/support

E-mail address: [email protected]

Asia Pacific

(location in Malaysia)

Asia Pacific

(location in China)

Europe

(location in Toulouse,

France)

Europe

(location in Dubai, UAE)

Tel: +603.7724.2080, E-mail: [email protected]

Languages spoken include: Chinese, English

Tel: +86.21.5187.7337 x888, E-mail: [email protected]

Languages spoken include: Chinese, English

Tel: +33 (0) 5.34.36.87.20,

E-mail: [email protected]

Languages spoken include: French, English

North America

(location in California)

Latin America

(Oficina Regional)

Tel: +971-4-214-6911,

E-mail: [email protected]

Languages spoken include: English, Hindi

Tel: +1.661.716.5100,

E-mail: [email protected]

Languages spoken include: English, Spanish

Tel: +1-281-2989109,

E-Mail: [email protected]

Languages spoken include: Spanish, English

Latin America

(location in Puebla, Mexico)

Tel: +52-222-3-99-6565,

E-mail: [email protected]

Languages spoken include: Spanish

Brasil

(location in Sao Paulo)

Tel: +55-11-5083-3776,

E-mail: [email protected]

Languages spoken include: Portuguese, English

11.2 Warranty Information

For complete details regarding ProSoft Technology’s TERMS & CONDITIONS

OF SALE, WARRANTY, SUPPORT, SERVICE AND RETURN MATERIAL

AUTHORIZATION INSTRUCTIONS, please see the documents on the Product

DVD or at www.prosoft-technology/legal

Documentation is subject to change without notice.

Page 216 of 218 ProSoft Technology, Inc.

August 12, 2015

PLX30 Series

Ethernet and Serial Gateways

Index

[

[Modbus Port X Commands] • 126

0

00 Return Query Data • 115, 145

4

4101 Series LEDs • 35

A

ARP Timeout • 101

ASCII Configuration • 161

ASCII Functional Overview • 152

ASCII Port [x] • 161

ASCII Protocol • 151

B

Basic Command Set Functions • 55

Bit Input Offset • 99, 128

BT • 84

C

CIP Data Table Operations • 89

CIP Data Table Read • 90

CIP Data Table Write • 89

Client Command Errors • 181

Command Error Delay • 101

Command List Entry Errors • 108, 184

Command List Error Codes • 138

Command List Overview • 167

Commands Supported by the Module

• 168

Configuring a Port for Transmit-Only Mode • 157

Configuring a Port for Transmit-Receive Mode • 158

Configuring an IP Address • 27

Configuring the Drivers • 21

Configuring the Port for Receive-Only Mode • 156

Configuring Your Gateway • 15

Connecting Power to the PLX30 Gateway • 13

Connection Timeout • 99

Contacting Technical Support • 215

Control • 84

ControlLogix and CompactLogix Processor Specifics •

85

D

Data Flow • 153

DFNT Client 0 Status • 71

DFNT Servers 1 Through 4 • 72

Diagnostics (Function Code 08) • 114, 145

Diagnostics Menu • 38

ProSoft Technology, Inc.

August 12, 2015

Index

User Manual

Downloading the Project to the Gateway • 29

E

EIP Client Command List Error Data • 71

EIP Command Entry Form • 92

EIP Functional Overview • 52

EIP Protocol • 51

EIP Reference • 77

Encapsulated PCCC Messages • 85

Encapsulated PCCC Read Message • 87

Encapsulated PCCC Write Message • 85

Error Codes • 73

Error/Status Codes • 138

Errors When EXT STS Is Present • 74

EtherNet/IP Explicit Messaging Server Command

Support • 55

Example and State Diagram • 115, 146

F

Float Flag • 98, 100, 125

Float Offset • 98, 100, 125

Float Start • 98, 100, 125

Force Multiple Coils (Function Code 15) • 119, 149

Force Single Coil (Function Code 05) • 113, 143

G

Gateway Communication Error Codes • 108

GatewayInternal Database • 124, 166

General Specifications • 152, 166

General Specifications - Modbus TCP/IP • 94

H

Hardware Information • 45

Holding Register Offset • 99, 128

How to Contact Us • 2

I

Important Installation Instructions • 3

Installing ProSoft Configuration Builder Software • 16

Internal Database • 95

L

LED Indicators • 34

Local STS Error Codes • 73

M

Main Gateway LEDs • 34

Master Port

Command List Errors • 135

Modbus Slave List Status • 136

MBS Configuration • 125

MBS Functional Overview • 122

MBS Port [x] Commands • 129

MBS Port[ x] • 125

MBS Protocol • 121

MBTCP Client [x] • 100

MBTCP Client [x] Commands • 102

Page 217 of 218

Index

User Manual

MBTCP Client Command List Error Data • 107

MBTCP Client Error/Status Data • 106

MBTCP Client Specific Errors • 108

MBTCP Configuration • 98

MBTCP Error and Status Data • 105

MBTCP Functional Overview • 94

MBTCP Server Port 2000 Status Error Locations • 105

MBTCPServers • 98

Messaging from a PLC5 • 81

Messaging from a SLC 5/05 Processor • 77

MG • 84

Minimum Command Delay • 100

MNET Client Specific Errors • 184

MNET Client x • 167

MNET Client x Commands • 167

Modbus Error and Status Data Area Addresses • 132

Modbus Error Codes • 138

Modbus Exception Codes • 118, 148

Modbus Exception Responses • 117, 138, 147

Modbus Master/Slave Port Specifications • 123

Modbus Message Routing

Port 2001 • 97

Modbus Port Access to Database • 124

Modbus Ports

Error and Status • 132

Modbus Protocol Specification • 109

Modbus TCP/IP Client Access to Database • 96

Modes of Operation • 156

Module Communication Error Codes • 182

Module Specific Error (not Multiple Compliant) • 75

Mounting the Gateway on a DIN-rail • 11

Multiple Server Access to Database • 96

O

Output Offset • 98, 128

P

Package Contents • 10

PD* • 84

Pinouts • 3

PLC-5 Command Set Functions • 55

PLC5 Read Commands • 82

PLC-5 Sub-Element Fields • 84

PLC5 Write Commands • 81

Port 1 Command Error List Layout • 135

Port 1 Slave List Status Layout • 136

Preset Multiple Registers (Function Code 16) • 120,

150

Preset Single Register (Function Code 06) • 114, 144

Printing a Configuration File • 31

ProSoft Technology® Product Documentation • 2

R

Read Coil Status (Function Code 01) • 109, 139

Read Holding Registers (Function Code 03) • 111, 141

Read Input Registers (Function Code 04) • 112, 142

Read Input Status (Function Code 02) • 110, 140

Receive Data • 154

Receive-Only Mode • 156

Page 218 of 218

PLX30 Series

Ethernet and Serial Gateways

Register Count • 26

Remote STS Error Codes • 74

Renaming PCB Objects • 20

Response Timeout • 100

Retry Count • 100

RS-232 - DTE to DCE Modem Connection • 49

RS-232 - Null Modem (DTE with Hardware

Handshaking) • 48

RS-232 - Null Modem (DTE without Hardware

Handshaking) • 49

RS-422 Interface Connections • 50

RS-485 Interface Connections • 50

S

Serial Port Cables • 48

Serial Port Specifications • 47

Setting Up the Project • 17

SLC File Types • 80

SLC5/05 Read Commands • 78

SLC5/05 Write Commands • 77

SLC-500 Command Set Functions • 55

Standard Modbus Exception Code Errors • 108

Start Here • 9

Sub-function Codes Supported • 115, 145

Support, Service & Warranty • 215

Swap Code • 26

System Requirements • 9

T

TCP/IP Interface Errors • 75

Termination of Received Data • 159

Timer / Counter • 84

To Address • 26

Transmit Data • 155

Transmit-Only Mode • 157

Transmit-Receive Mode • 158

U

Using Diagnosticsin ProSoft Configuration Builder • 36

Using the CommonNet Data Map • 25

Using the Online Help • 17

W

Warranty Information • 216

Word Input Offset • 99, 128

Your Feedback Please • 2

Y

ProSoft Technology, Inc.

August 12, 2015

advertisement

Related manuals

Download PDF

advertisement

Table of contents