Modbus TCP/IP Client

Topic Menu

Modbus TCP/IP Client Overview

Using Modbus TCP for OCS to OCS Communication

Note: Each controller family has its own Modbus Mapping table. See the User Manual for an OCS to view a specific controller's Modbus table. Refer to the Documentation Search on the Horner website.

Modbus TCP/IP TCP/IP – Transmission Control Protocol / Internet Protocol - A transport layer protocol and a network layer protocol developed by the Department of Defense. This is a commonly used combination for communication within networks and across internetwork. is a variant of the Modbus family of simple, vendor-neutral communication protocols. It is intended for supervision and control of automation equipment. Specifically, it covers the use of Modbus messaging in an ‘Intranet’ or ‘Internet’ environment using the TCP/IP protocols. The most common use of this protocol is for Ethernet attachment of PLC’s, I/O modules, and ‘gateways’ to other simple field buses or I/O networks.

Note: This is a Downloadable Industrial Protocol.

Modbus TCP TCP - Transmission Control Protocol - A standard that defines how to establish and maintain a network conversation through which application programs can exchange data. is a Client/Server protocol, which allows a remote Modbus TCP Client to request services from a Modbus TCP Server. In this context, the OCS acts as a Modbus TCP Server, which responds to requests from one or more Modbus Clients. All Modbus requests that contain the OCS’s IP Address are serviced. The client needs to be configured with the OCS’s IP Address, and most clients also require the server unit number. Since each Ethernet module must have its own unique IP Address, the server unit number is not relevant and is discarded by the Ethernet module. To access OCS registers, a Modbus TCP Client must be configured with the appropriate register type and offset.

This is usually accomplished with one of two methods:

Use either Traditional Modbus References or Expanded Modbus References, in which the high digit represents the register type and the lower digits represent the register offset (starting with register 1 for each type). Since only four Modbus register types (0, 1, 3, and 4) can be represented in this manner, the OCS’s Modbus implementation packs several OCS register types into each Modbus register type. Starting addresses of each OCS register type are shown in the Traditional Modbus Reference and Expanded Modbus Reference columns.
The second method requires the Modbus TCP Client to be configured with a specific Modbus Command and Offset. The supported Modbus commands and the associated offsets are also illustrated in the tables below.

Return to the Top: Modbus TCP/IP Client

Configuring Modbus Client Device

The following are the steps for configuring Modbus Client with Cscape.

Open Home > Controller > Hardware Configuration (select a series and device type).
Select Config button next to LAN1/LAN2 . Downloadable Protocols and perform the following configurations: Select Modbus Client from the Downloadable Protocols/ETN1/1 drop-down list. Then click on the Network button. This will open the Network Config (Modbus Client) dialog.

Return to the Top: Modbus TCP/IP Client

Network Config (Modbus Client)

Home > Controller > Hardware Configuration > Downloadable Protocols > Modbus Client

Select Network button.

Network parameters and status registers can be configured in the Network Config dialog.

Configure minimum and maximum value for port ID’s as 1024 and 4096 respectively.
Configure the update Scan type as automatic or manual according to process requirements.
Configure the (optional) network status register.
Configure the (optional) disable network bit.

Return to the Top: Modbus TCP/IP Client

Device List (Modbus Client)

Home > Controller > Hardware Configuration > Downloadable Protocols > Modbus Client

Select Devices button. The Devices button allows configuration of the Server device (max 64) as follows:

Select a device:

Configure server device name, IP address (either direct or through registers) and port ID (either direct or through registers). Configuring IP address or port ID through registers allows user to modify IP address or port ID during runtime.

Note: User should change the controller mode to Idle and then to Run after modifying port ID during runtime.
Select the address mode (refer to the Configuring Modbus Client Device ) required when talking to this device.
If option for Swap Words on 32-bit Data is checked, the high and low 16-bit values of 32-bit Data are swapped when transferred between the target and OCS.
Disable Device - From Cscape 9.90 SP3 and firmware 15.40 onwards, disable device feature has been added in protocol device configuration. This option is used to disable a particular slave configured in the network. Single bit register has to be configured to use this function.Setting the bit high disables the slave and OCS will not send any TCP packets only to this slave until the bit is high. Setting the bit low enables the communication with the slave again.
Device status registers can be optionally enabled and used to determine the current state of communications.
Select Stop on Error as per process requirement (located in the Status box at the bottom).

Device Type: Modbus TcpIpClient.Dll supports the following addressing modes:

Generic Decimal Addressing
Generic Hexadecimal A base-16 numbering system which uses the symbols 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F for numeral. Addressing
Native Addressing
Modicon PLC 5-Digit Addressing
Modicon PLC 6-Digit Addressing

Generic Decimal Addressing

The first option is Generic Decimal Addressing. Use this when the connected device uses an addressing mode which does not correspond to a Modicon PLC, and offsets in the documentation for the target device are given in decimal.

Addresses are entered in the following form:

Data type takes one of the following values:

RWR : (Read/Write Registers) Uses Modbus function codes 3, 6, 16

RWB : (Read/Write Bits) Uses Modbus function codes 1, 5, 15

ROR : (Read Only Registers) Uses Modbus function code 4

ROB : (Read Only Bits) Uses Modbus function code 2

The decimal number gives the offset of the target data in the selected data type.

Generic Hexadecimal A base-16 numbering system which uses the symbols 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F for numeral. Addressing

Use this when the connected device uses an addressing mode which does not correspond to a modicon PLC, and offsets in the documentation for the target device are given in hexadecimal.

Addresses are entering the in the following form:

Data type takes one of the following values:

RWR : (Read/Write Registers) Uses Modbus function codes 3, 6, 16

RWB : (Read/Write Bits) Uses Modbus function codes 1, 5, 15

ROR : (Read Only Registers) Uses Modbus function code 4

ROB : (Read Only Bits) Uses Modbus function code 2

The hexadecimal number gives the offset of the target data in the selected data type.

Native Addressing

Use this when the connected device is an OCS unit running Modbus TCP / IP host.

Addresses are entered as standard OCS addresses.

Modicon PLC 5-Digit Addressing - Use this when the connected device uses an addressing mode which corresponds to a reduced memory map modicon PLC.
Modicon PLC 6-Digit Addressing - Use this when the connected device uses an addressing mod which corresponds to an extended memory map modicon PLC.

Return to the Top: Modbus TCP/IP Client

Scan List

Home > Controller > Hardware Configuration > Downloadable Protocols > Modbus Client

Select Scan List A list of communications to carry out to one or more devices. Normally, the Master or Client device will execute this scan list, which is directed at Slave or Server devices. Scan List items may be Polled or Triggered. button. The Scan List button opens the Scan List (Modbus Client) dialog.

To transfer data between the OCS and remote target, a Scan List must be created that defines each transaction. Each mapping entry (transaction) contains the source and destination registers, the number of consecutive registers transferred, the direction of the transfer and trigger for transfer (optional). Maximum number of entries is 512.

Note: Order of the Scan List is the order in which the transaction occurs.

Scan List: Click ADD button to open the Data Mapping Data mapping is the process of mapping data fields from a source file to their related target fields. dialog for adding new entry to the Scan List. Configure the following:

Data Mapping Fields
Device Name	Select the target device from the drop-down list. Only those device entries previously created from the Device Config menu are available.
Device	Specify the target device’s register to be mapped according to the selected addressing mode. See also: Configuring Modbus Client Device
32-Bit Access	Allows two local (OCS) 16-bit registers to be treated as a single 32-bit value. For example, if the value in either 16-bit register is modified, both registers are written to the device.
Length	Specify the number of consecutive device registers to Read/Write. Maximum length is 32.
Local Mapping	Specify the local (OCS) register that is the source or destination for transfer of the data.
Local Name	(Optional) Enter/Select name for the Local Register.
Update Type	This field specifies the direction and triggers the transfer of data between the OCS and target device. Select Update Type as per the system requirements.

Refer to Modbus TCP/UDP server configuration (Modbus TCP Server Protocol (hornerautomation.com))

Connections

a. Media and Cabling

Cable Specification	Shielded and non-shielded twisted-pair 10/100Base-T cables with RJ45 connectors
Maximum Length Between 2 Stations	100 meters (323 feet)

b. Ethernet Connections

The Ethernet connector, Channel 1, is an RJ45, 10/100Base-T connector. The pin-out for the connector is shown below:

Pin	Pin Name
1	Tx+
2	Tx-
3	Rx+
4	not used by 10/100 Base-T
5	not used by 10/100 Base-T
6	Rx-
7	not used by 10/100 Base-T
8	not used by 10/100 Base-T

Network Communication Errors

In order to access the Network statistics, user must assign the “Network status register” in network configuration. The table below gives the details of statistics.

Number	Statistics	Location	Description
1	Update interval exceeded count	%Rx	This register explains number of times that the actual transaction scan time to complete all transactions exceeded specified update interval. Generally used as an indicator that an excessive number of triggered transfers or failed communication retries are occurring that is lengthening the expected transaction scan time. If the Update interval is set to zero (update as fast as possible), this 32-bit register alternately specifies the actual transaction scan time in mSec resolution.
2	No response count	%R(x+2)	This register explains number of times that a device(s) did not respond to a transaction. This includes ALL failed transaction, not just those after the retry count is exceeded
3	Corrupt response count	%R(x+4)	This register explains number of times that a device(s) returned an invalid or failed response to a transaction. This includes ALL failed Transaction, not just those after the retry count is exceeded
4	Valid response count	%R(X+6)	This register explains total number of valid responses

NOTE:

1. %Rx: 32-bit network status register configured in Network configuration. For example: %R500(501).

2. When slave device ip is configured as 0.0.0.0, valid response count will increase. Reason being 0.0.0.0 is the loopback IP address also referred as the localhost. This address is used to establish an IP connection to the same device (similar to 127.0.0.1). Also Good response will be seen when Modbus server and client (Downloadable protocol) is configured in the same device.

Error	Error Number	Description
ENET_LINK	40	Ethernet Link is down
NODE_OFFLINEe	45	Node is offline
INVALID_BLOCK	-203	Invalid size for data type
NO_RESPONSE_FROM_PLC	-204	Timeout while waiting for remote node response. (Device is connected to Slave node but not responding to Modbus queries)
INVALID_RESPONSE_FROM_PLC	-205	Corrupted response from remote node
INVALID_INITIALIZATION	-207	Internal Error - Unable to open port

Return to the Top: Modbus TCP/IP Client