1. TM SM Maximum Value for OEMs SM From Rockwell Automation Using Modbus Protocol with OEMax Products Feb 26 ~ Mar 2, 2007 K.J Kim RAK OBB Strategic Marketing K.J Kim RAK OBB Strategic Marketing

2. 2 What is Modbus ? Introduced by Modicon,1979 Modbus communication interface for a multidrop network based on a master/client architecture Connection Type: RS-232, RS-485, TCP/IP Message based Communication Coil : Discrete Output Value FieldDescription Device AddressAddress of Receiver Function CodeCode defining Message Type DataData Block with additional information Error CheckNumeric Check value to test for communication errors (LRC / CRC)

3. Modbus Communication Stack 3 Only, explain Modbus RS-232C In this training

4. Modbus Network Architecture 4

5. Modbus Serial Transmission Modes Two Modbus Serial Modes Modbus/ASCII  ASCII Code Format Modbus/RTU (Remote Terminal Unit)  Binary Format 5 Modbus/ASCIIModbus/RTU CharactersASCII 0~9, A~FBinary 0 ~ 255 Error CheckLRC( Longitudinal Redundancy Check )CRC( Cyclic Redundancy Check ) Frame StartCharacters [:] Frame EndCharacters [CR][LF] Gaps in Message 1 Sec Start Bit11 Data Bits78 ParityEven/OddNoneEven/OddNone Stop Bits1212

6. General Modbus Frame 6 Additional AddressFunction CodeDataError Check PDU (Protocol Data Unit) ADU (Application Data Unit)

7. Modbus Addressing Device and Modbus address ranges All Registers will be assigned a number between 1 and 10000 Modbus message addresses are used a number between 0 and 9999 So, To access correctly, You must subtract -1 (or -10001 or -40001) [Example] If you want to read Output coil 18, You must use value 17 in Modbus message 7 Device AddressModbus AddressDescription 1 … 10000  Address – 1Coils (Outputs) 10001 … 20000  Address – 10001Inputs 40001 …50000  Address - 40001Holding Registers  Maximum Value is device dependent.

8. Modbus Function Code Common Modbus Function Code 8 CodeDescriptionCodeDescription 01Read Coil Status16Preset Multiple Registers 02Read Input Status17Report Slave ID 03Read Holding Register20Read File Record 04Read Input Register21Write File Record 05Force Single Coil22Mask Write Register 06Preset Single Register23Read/Write Multiple Registers 07Read Exception Status24Read FIFO Queue 08Diagnostics43Encapsulated Interface Transport 11Get Comm. Event Counter43/13CANopen General Reference Request and Response 12Get Comm Event Log43/14Read Device Identification 15Force Multiple Coils NX Series PLC supports these kinds of Functions which are blue color.

9. Function 01 : Read Coil Status 9 ByteValueDescription 11 … 247Slave device address 21Function Code 30 … 255Starting address, High byte 40 … 255Starting address, Low byte 50 … 255Number of coils, High byte 60 … 255Number of coils, Low byte 7(..8)LRC/CRCError check value ByteValueDescription 11 … 247Slave device address 21Function Code 30 … 255Number of data bytes N 4..N+30 … 255Bit pattern of coil values N+4(..N+5)LRC/CRCError check value Function 01 : Query StructureFunction 01 : Answer Structure This sample is “Read Coils 20 (0x14) to 56 (0x38) from device 17 ((0x11)” Field NameExample (Hex) Slave Address11 Function01 Starting Address High00 Starting Address Low13 No. of Points High00 No. of Points Low25 Error Check-- Field NameExample (Hex) Slave Address11 Function01 Byte Count05 Data (Coil 27-20)CD Data (Coil 35-28)6B Data (Coil 43-36)B2 Data (Coil 51-44)OE Data (Coil 56-52)1B Error Check-- The Address will be 0013H because 20-1=19=13H.

10. Function 02 : Read Input Status 10 ByteValueDescription 11 … 247Slave device address 22Function Code 30 … 255Starting address, High byte 40 … 255Starting address, Low byte 50 … 255Number of coils, High byte 60 … 255Number of coils, Low byte 7(..8)LRC/CRCError check value ByteValueDescription 11 … 247Slave device address 22Function Code 30 … 255Number of data bytes N 4..N+30 … 255Bit pattern of coil values N+4(..N+5)LRC/CRCError check value Function 02 : Query StructureFunction 02 : Answer Structure Field NameExample (Hex) Slave Address11 Function02 Starting Address High00 Starting Address LowC4 No. of Points High00 No. of Points Low16 Error Check-- Field NameExample (Hex) Slave Address11 Function02 Byte Count03 Data (Inputs 10204~10197)AC Data (Inputs 10212~10205)DB Data (Inputs 10218~10213)35 Error Check-- This sample is “Read Inputs 10197 ~ 10218 from device 17” The Address will be 00C4H because 10197-10001=196 =C4H.

11. Function 03 : Read Holding Registers 11 ByteValueDescription 11 … 247Slave device address 23Function Code 30 … 255Starting address, High byte 40 … 255Starting address, Low byte 50 … 255Number of coils, High byte 60 … 255Number of coils, Low byte 7(..8)LRC/CRCError check value ByteValueDescription 11 … 247Slave device address 23Function Code 30 … 255Number of data bytes N 4..N+30 … 255Bit pattern of coil values N+4(..N+5)LRC/CRCError check value Function 03 : Query StructureFunction 03 : Answer Structure Field NameExample (Hex) Slave Address11 Function03 Starting Address High00 Starting Address Low6B No. of Points High00 No. of Points Low03 Error Check-- This sample is “Read Register 40108 ~ 40110 from device 17” Field NameExample (Hex) Slave Address11 Function03 Byte Count06 Data High (Register 40108)02 Data Low (Register 40108)2B Data High (Register 40109)00 Data Low (Register 40109)00 Data High (Register 40110)00 Data Low (Register 40110)64 Error Check-- The Address will be 006BH because 40108-40001=107= 6BH.

12. Function 04 : Read Input Registers 12 ByteValueDescription 11 … 247Slave device address 24Function Code 30 … 255Starting address, High byte 40 … 255Starting address, Low byte 50 … 255Number of coils, High byte 60 … 255Number of coils, Low byte 7(..8)LRC/CRCError check value ByteValueDescription 11 … 247Slave device address 24Function Code 30 … 255Number of data bytes N 4..N+30 … 255Bit pattern of coil values N+4(..N+5)LRC/CRCError check value Field NameExample (Hex) Slave Address11 Function04 Starting Address High00 Starting Address Low08 No. of Points High00 No. of Points Low01 Error Check-- This sample is “Read Register 30009 from device 17” Field NameExample (Hex) Slave Address11 Function04 Byte Count02 Data High (Register 30009)00 Data Low (Register 30009)0A Error Check-- Function 04 : Query StructureFunction 04 : Answer Structure The Address will be 0008H because 30009-30001=8.

13. Function 05 : Force Single Coil 13 ByteValueDescription 11 … 247Slave device address 25Function Code 30 … 255Starting address, High byte 40 … 255Starting address, Low byte 50 … 255Number of coils, High byte 60 … 255Number of coils, Low byte 7(..8)LRC/CRCError check value ByteValueDescription 11 … 247Slave device address 25Function Code 30 … 255Number of data bytes N 4..N+30 … 255Bit pattern of coil values N+4(..N+5)LRC/CRCError check value Field NameExample (Hex) Slave Address11 Function05 Coil Address High00 Coil Address LowAC Force Data HighFF Force Data Low00 Error Check-- This sample is “Request to Force Coil 173 ON in Slave Device 17” Field NameExample (Hex) Slave Address11 Function05 Coil Address High00 Coil Address LowAC Force Data HighFF Force Data Low00 Error Check-- Function 05 : Query StructureFunction 05 : Answer Structure The Address will be 0xAC because 173-1=172=0xAC FF00  ON, 0000  OFF

14. Function 06 : Preset Single Register 14 ByteValueDescription 11 … 247Slave device address 26Function Code 30 … 255Starting address, High byte 40 … 255Starting address, Low byte 50 … 255Number of coils, High byte 60 … 255Number of coils, Low byte 7(..8)LRC/CRCError check value ByteValueDescription 11 … 247Slave device address 26Function Code 30 … 255Number of data bytes N 4..N+30 … 255Bit pattern of coil values N+4(..N+5)LRC/CRCError check value Field NameExample (Hex) Slave Address11 Function06 Register Address High00 Register Address Low01 Preset Data High00 Preset Data Low03 Error Check-- This sample is “Request to preset register 40002 to 00 03 in Slave Device 17” Field NameExample (Hex) Slave Address11 Function06 Register Address High00 Register Address Low01 Preset Data High00 Preset Data Low03 Error Check-- Function 06 : Query StructureFunction 06 : Answer Structure The Address will be 0001H because 40002-40001=1.

15. Function 07 : Read Exception Status 15 ByteValueDescription 11 … 247Slave device address 27Function Code 7(..8)LRC/CRCError check value ByteValueDescription 11 … 247Slave device address 27Function Code 30 … 255Coil Data N+4(..N+5)LRC/CRCError check value Field NameExample (Hex) Slave Address11 Function07 Error Check-- This sample is “Request to Read Exception Status in Slave Device 17” Field NameExample (Hex) Slave Address11 Function07 Coil Data6D Error Check-- Function 07 : Query StructureFunction 07 : Answer Structure

16. Function 15 : Force Multiple Coils 16 ByteValueDescription 11 … 247Slave device address 215Function Code 30 … 255Coil Address, High byte 40 … 255Coil Address, Low byte 50 … 255Quantity of coils, High byte 60 … 255Quantity of coils, Low byte 70 … 255Byte Count 80 … 255Force Data, High Byte 90 … 255Force Data, Low Byte 10(..11)LRC/CRCError check value ByteValueDescription 11 … 247Slave device address 215Function Code 30 … 255Coil Address, High byte 40 … 255Coil Address, Low byte 50 … 255Quantity of Coils, High Byte 60 … 255Quantity of Coils, Low Byte 7(..8)LRC/CRCError check value Field NameExample (Hex) Slave device address11 Function Code0F Coil Address, High byte00 Coil Address, Low byte13 Quantity of coils, High byte00 Quantity of coils, Low byte0A Byte Count02 Force Data, High ByteCD Force Data, Low Byte01 Error check value-- This sample is “Request to Force 10 Coils starting at coil 20 in Slave Device 17” Field NameExample (Hex) Slave device address11 Function Code0F Coil Address, High byte00 Coil Address, Low byte13 Quantity of Coils, High Byte00 Quantity of Coils, Low Byte0A Error check value-- Function 15 : Query StructureFunction 15 : Answer Structure

17. Function 16 : Preset Multiple Registers 17 ByteValueDescription 11 … 247Slave device address 216Function Code 30 … 255Starting Address, High byte 40 … 255Starting Address, Low byte 50 … 255No. of Registers, High byte 60 … 255No. of Registers, Low byte 70 … 255Byte Count 80 … 255Data, High Byte 90 … 255Data, Low Byte 100 … 255Data, High Byte 110 … 255Data, Low Byte 12(..13)LRC/CRCError check value ByteValueDescription 11 … 247Slave device address 216Function Code 30 … 255Starting Address, High byte 40 … 255Starting Address, Low byte 50 … 255No. of Registers, High Byte 60 … 255No. of Registers, Low Byte 7(..8)LRC/CRCError check value Field NameExample (Hex) Slave device address11 Function Code10 Starting Address, High byte00 Starting Address, Low byte01 No. of Registers, High byte00 No. of Registers, Low byte02 Byte Count04 Data, High Byte00 Data, Low Byte0A Data, High Byte01 Data, Low Byte02 Error check value-- This sample is “Request to preset two registers starting at 40002 to 00 0A and 01 02 in Device 17 Field NameExample (Hex) Slave device address11 Function Code10 Starting Address, High byte00 Starting Address, Low byte01 No. of Registers, High Byte00 No. of Registers, Low Byte02 Error check value-- Function 16 : Query StructureFunction 16 : Answer Structure

18. Function 17 : Report Slave ID 18 ByteValueDescription 11 … 247Slave device address 217Function Code 3(..4)LRC/CRCError check value ByteValueDescription 11 … 247Slave device address 217Function Code 30 … 255Byte Count 40 … 255Slave ID 5Run Indicator Status0x00=OFF, 0xFF=ON 6Additional DataDevice Specific N+7(..N+8)LRC/CRCError check value Field NameExample (Hex) Slave Address11 Function11 Error Check-- This sample is “Request to Report ID and Status of Slave Device 17” Field NameExample (Hex) Slave device address11 Function Code11 Byte CountDevice Specific Slave IDDevice Specific 0x00=OFF, 0xFF=ON0x00 or 0xFF Device SpecificAdditional Data Error check value-- Function 11 : Query StructureFunction 11 : Answer Structure

19. Samples 19 Master Query with ASCII/RTU Framing Slave Response with ASCII/RTU Framing

20. Communication with NX Series PLC To operate Modbus RTU, Must Enable F12.2 (Port1) or F12.9 (Port2) Addresses Map for Modbus NX7(S) : Port 1 – Slave, Port2 – Slave & Master 20 Registe r RangeBit AddressWord AddressRemark RR0 ~ R127, 128 Words0000 ~ 20470 ~ 127External Relay Contact LL0 ~ L63, 64 Words2048 ~ 3071128 ~ 191Link Register MM0 ~ M127, 128 Words3072 ~ 5119192 ~ 319Internal Register KK0 ~ K127, 128 Words5120 ~ 7167320 ~ 447Keep Register FF0 ~ F15, 16 Words7168 ~ 7423448 ~ 463Flag Register TCTC0 ~ TC255, 256 Bits7424 ~ 7679464 ~ 511Timer/Counter Contact WW0 ~W2047, 2048 WordsNot Available512 ~ 2559Word Register SVSV0 ~ SV255, 256 WordsNot Available2560 ~ 2817Timer/Counter Setting Value PVPV0 ~ PV255, WordsNot Available2818 ~3071Timer/Counter Current Value SRSR0 ~ SR511, 512 WordsNot Available3072 ~ 3583System Register

21. Communication with NX Series PLC Let’s see Modbus/RTU Communication Sample Program which is programmed by Visual Basic.Net 2005. 21

22. Configuration Flag in NX Series PLC 22 When F12.2 or F12.9 are set, Port1 or 2 of CPU will be configured to support Modbus RTU slave protocol.

23. Communication System Register Special Register (SR298 ~ SR373) is provided for holding the data transmitted and received 23 System RegistersDescriptionExplanation SR298 ~ SR333Transmit Data BufferHolds up to 36 words of data to be transmitted SR334 ~ SR369 Receive Data BufferHolds up to 36 words of received data SR370 Transmit Data LengthNumber of Bytes to be transmitted SR371 Receive Data LengthNumber of Bytes that have been received SR372 Start CodeStart code for ASCII Comm.– one byte, high byte unused SR373 End CodeEnd code for ASCII Comm. – one byte, high byte unused

24. 24 Calculation CRC Slave Address Function Code DataCRC LCRC H CRC Calculation Scope 2 Byte CRC CRC = 65535 For i = 0 To PL - 1 CRC = Int(CRC / 256) Xor CRCTable((CRC Xor DATABLOCK(i)) And 255) Next i  CRC : Cyclic Redundancy Check

25. Communication with NXIO-MNA/232 25

26. Communication with AC Drive MSD 26

27. 27 TM Maximum Value for OEMs SM

28. 28