Chapter Modbus/TCP Server

7
This section describes the implementation of the Modbus/TCP Server feature for the PACSystems family of products.

Modbus/TCP Server Reference Mapping Modbus Function Codes

GFK-2224F

7-1

Modbus/TCP Server
The PACSystems products listed below support Modbus/TCP Server functionality:

CPU010 and CPU020 with primary firmware version 3.0 or later. CRE020 with Ethernet firmware version 3.0 or later. RX7i: IC698ETM001 and RX3i IC695ETM001 with firmware version 3.0 or later.

Modbus/TCP Server Connections

The Modbus/TCP Server supports up to 16 simultaneous connections. These connections are not shared with any other applications. Other TCP-based application protocols such as SRTP Server use a different set of TCP connections.

Modbus Conformance Classes

PACSystems Modbus/TCP Server supports Modbus Conformance classes 0, 1, and 2. The RX3i Ethernet module has been certified by the Modbus/TCP Conformance Test Laboratory to be in conformance with Conformance Test Policy Version 2.1.

Server Protocol Services

The Modbus/TCP Server responds to incoming Request Connection, Terminate Connection and Request Service messages. The client with which the server is interacting should wait for the servers response before issuing the next Request Service, otherwise requests could be lost. There is no inactivity timeout in the server. If a client opens a connection, that connection stays open until the client terminates the connection or until the connection is terminated for some other reason.

Station Manager Support

The Modbus/TCP Server supports the standard Station Manager commands: STAT, TALLY, and TRACE, plus the Modbus/TCP server-specific KILLMS command. The Modbus/TCP Server task letter is o.

7-2

TCP/IP Ethernet Communications for PACSystems November 2007

GFK-2224F

Reference Mapping
The Modbus protocols reference table definition is different from the internal structure of the PACSystems reference tables. Modbus refers to Holding Register, Input Register, Input Discrete and Coil tables; PACSystems uses Discrete Input (%I), Discrete Output (%Q), Analog Input (%AI), Register (%R), and Word (%W) reference tables for Modbus data. The following table shows how each Modbus table has been mapped to the PACSystems reference tables.

Modbus Reference Tables

Modbus File Access (6xxxx) Modbus Holding Register Table (4xxxx) Modbus Input Register Table (3xxxx) Modbus Input Discrete Table (1xxxx) Modbus Coil Table (0xxxx) PACSystems Reference Tables

--------F1,R1 F525,R2880 (16-bit words)

------1 32640 (16-bit words) ---

--1 32640 (16-bit words) -------

1 32768 (bits) ---------

----1 32768 (bits) -----

%I1 32768 (bits) %AI1 32640 (16-bit words) %Q1 32768 (bits) %R1 32640 (16-bit words) %W1 5,242,880 (16-bit words)

Modbus Holding Register Table

The Modbus Holding Register table is mapped exclusively to the CPU Register (%R) table. Applicable Functions

Read Multiple Registers Write Multiple Registers Write Single Register Mask Write Register Read/Write Multiple Registers

Modbus Input Register Table

The Modbus Input Register table is mapped exclusively to the CPU Analog Input (%AI) table. Applicable Functions

Read Input Registers

Chapter 7 Modbus/TCP Server 7-3

GFK-2224F

7
Modbus Input Discrete Table
The Modbus Input Discrete table is mapped exclusively to the CPU Discrete Input (%I) table. Applicable Functions

Read Input Discretes

Modbus Coil Table

The Modbus Coil table is mapped exclusively to the CPU Discrete Output (%Q) table. Applicable Functions

Read Coils Write Coils Write Single Coil

Modbus File Access Table

The Modbus File Access table is mapped exclusively to PACSystems %W memory. Applicable Functions

Read File Record Write File Record

Translating %W Reference Addresses To find the PACSystems %W memory address equivalent of a Modbus File and Record: %W = 10,000 (F-1) + R To find the Modbus File and Record equivalent of a PACSystems %W memory address:
File = W-1 +1 10,000
(Discard any fractional portion; round the result downward to the next integer value).

Record = W (10,000 (F 1))

CAUTION
If you use the Modbus function Write File Record, and specify multiple record sections, the first N-1 sections will be written to the servers PLC reference memory, even if an error prevents the writing of the last section.

7-4

TCP/IP Ethernet Communications for PACSystems November 2007

GFK-2224F

Address Configuration
Address mapping is done in the Machine Edition Hardware Configuration of the CPU. All Ethernet modules and daughterboards in the PLC use Modbus-to-PLC address mapping based on this one map. The Modbus/TCP Server does not use COMMREQs to configure address mapping. Each PLC memory area is mapped to an appropriate Modbus address space. On the Settings tab, Modbus Address Space Mapping can be set to Standard Modbus Addressing or Disabled. If Modbus Address Space Mapping is set to Standard, the Modbus/TCP Address Map tab displays the standard references assignments.
Number 1 2 3 Modbus Register 0xxxx Coil Table 1xxxx Discrete Table 3xxxx Input Registers 4xxxx Register Table 6yxxx Internal Table Start Address 1 1 1 End Address 32768 32768 64 PLC Memory Address %Q00001 %I00001 %AI00001 Length 32768 32768 64

4 5

1 0

1024 0

%R00001 %W0001

1024 0

When Modbus Address Space Mapping is set to Disabled on the Settings tab, the Modbus/TCP Address Map tab does not appear. If the CPU module does not receive an address map from Machine Edition, Ethernet interfaces within the PLC will respond to Modbus/TCP clients with Exception Code 4, Slave Device Failure. This same exception code will also be returned when the PLCs hardware configuration is cleared.

GFK-2224F

Chapter 7 Modbus/TCP Server

7-5

Modbus Function Codes

This section summarizes the mapping of PACSystems reference tables to Modbus addresses by the Modbus function codes supported by the Modbus/TCP Server. The mapping shown in this table assumes that the PLC is configured to use its default reference table sizes.
Modbus Modbus Function Code Table 1 5 15 2 3 6 16 22 23 4 7 8 20 21 Read Coils Write Single Coil Write Multiple Coils Read Discrete Inputs Read Holding Registers Write Single Register Write Multiple Registers Mask Write Register Read/Write Multiple Registers Read Input Registers Read Exception Status Diagnostics Read File Record Write File Record Start Address Length Start Address Length PLC

0xxxx 1xxxx

1 1

32768 32768

%Q00001 %I00001

32768 32768

4xxxx

1024

%R00001

1024

3xxxx n/a

1 N/a

64 n/a

%AI00001 n/a

64 n/a

6yxxxx

%W00001

7-6

TCP/IP Ethernet Communications for PACSystems November 2007

GFK-2224F