Modbus and Modbus TCPClient/Server communications protocol designed by Modicon in 1979 for use with its PLCsOpenly published and free of royalties or licensing feesThe most common industrial communications protocol in the US Used widely for Building Management Systems Passes raw words of bits without processing themOriginally a serial protocol very similar to RS-485, it now has a TCP variantAlso available as Modbus Plus, which is proprietary to Modicon and requires specialized hardware

Modbus and Modbus TCPBasic Modbus protocol does not support floating point or ASCIIA MODBUS Request is the message sent on the network by the Client to initiate a transactionA MODBUS Indication is the Request message received on the Server sideA MODBUS Response is the Response message sent by the ServerA MODBUS Confirmation is the Response Message received on the Client side

Modbus TCP

Modbus TCP

Basic RequirementsThe Ethernet physical interface must be present The Modbus TCP firmware for the Ethernet processor must be installed V 1.117 or newer PMAC or V1.941 or newer Turbo PMAC firmware must be installed A user buffer of 256 or more words must have been defined with the DEFINE UBUFFER command I67 must be set to a value greater than 0.

Modbus TCPBasic Setup with PEWIN32 Pro2Configure->Modbus Setup Set the start address - In the standard Turbo PMAC CPU/memory configuration (Option 5C0), this address will be $010700The software will automatically set I67 to the correct value The book says it will do so after setting it equal to any number > 0, then SAVE and $$$, but this does not always workYou must choose the size of the buffer default is 256 wordsPress Setup Modbus Buffer button

Modbus TCP SetupPress Update PMAC button this will SAVE and $$$

ACC-65ETHSet up the IP address of the ACC-65ETH as per the hardware reference manual using the web browser and the default address of http://192.6.94.50 Go to the Modbus TCP configuration utility in PEWIN32 Pro2Choose the next unused Active Socket. If you are not using a socket for PMAC interrupts, you may use Socket 1Choose Modbus Client as the Active ModeSet Timer 1 to 50 (250 ms)Set the Server Address as per that set in the ACC-65ETHSet the Timer to 1Set the FC Command Description to 23 (read/write multiple words)

ACC-65ETHSet the Modbus Reference Number for the Write to 4Set the Modbus Reference Number for the Read to 0Set the PMAC Reference Number for the Write to 36Set the PMAC Reference Number for the Read to 32Set both Lengths to 4Press the Update Command button, then the Update PMAC button

This writes the command shown in the Command text box to memory in the PMAC. You can check this by pointing MVARs to the Modbus Command memory space at the start of the Modbus Buffer space.

ACC-65ETHData begins at i67+$80+$10 (PMAC Reference 32=16 words =$10)Assuming i67=$10700:X:$10790,0,16 Digital inputs 0-1532Y:$10790,0,16 24Vok input and digital inputs 16-23 33X:$10791,0,12 ADC Input134Y:$10791,0,12 ADC Input235X:$10792,0,16 Digital Outputs 0-1536Y:$10792,0,16 RLY1, RLY2, Digital outputs 16-2337X:$10793,0,12 DAC 138Y:$10793,0,12 DAC 2 39

The PMAC Modbus/TCP-IP configuration & buffer memory format

Offset from I6723 X Memory 023 Y Memory 00Sock #0Mode(upper4 of 8 bits)TBD (16 bits)TBD (8 bits)Client CmdListStrt(8bits)Client CmdListEnd(8bits)1IP futureIP futureServer IP0Server IP1Server IP2Server IP32Future SpareFuture Spare4-0xBRepeat above for Sockets 1-3Repeat above for Sockets 1-30xCTBD(8 bits)TBD (8 bits)Period Timer 4(8 bits)Period Timer 3(8 bits)Period Timer 2(8 bits)Period Timer 1(8 bits)0xDTBDTBD0xETBDTBD0xFTBDTBD0x100x69Start of 1st Client Modbus Cmd ListStart of 1st Client Modbus Cmd List0x80Start of 16 bit Client/Server Modbus BufferStart of 16 bit Client/Server Modbus Buffer

The PMAC Modbus/TCP-IP configuration & buffer memory format

The Socket Modes ( upper 4 of 8 bits):0 - Socket NOT ACTIVE1 - Server TCP, PMAC ASCII protocol.IP Address = 0.0.0.02 - Server TCP, PMACtoClient Interrupt ASCII string. IP Address = 0.0.0.0 Only available on Turbo UMACs.3 - Server Modbus/TCP-IP. IP Address not used.4 - Client Modbus/TCP-IP. IP Address of Server.

The IP Address 192.6.94.5 is stored as:

IP0=192, IP1=6, IP2=94, IP3=5

M6704=IP address 192.168.0.50M6703=first digit=4 for ClientM6716=start of FC23 for Socket 1M6717=end of FC23 for Socket 1M6710 M6715 are commands for PMAC ASCII on Socket 0

Modbus Client Command List Memory Format$370000040020,$000004040024$37 = Timer 1, FC 23$0000 = Modbus Reference Number = 0$04 = Length = 4$0020 = PMAC Reference Number = $20$0004 = Modbus Reference Number = 0$04 = Length = 4$0024 = PMAC Reference Number = $20$00 = no function for FC 23First Word = Read DataSecond Word = Write Data

X:23 - 16X:15 - 0Y:23 - 16Y:15 - 0Timer (3 bits)/Function Code (5 bits)Modbus Reference # (16 bits)Count (length) (8 bits)PMAC Reference # (16 bits)

Reference NumbersThe PMAC one is the offset into the PMAC Modbus Server/Client buffer where the Modbus data is read from or written to. The Modbus one is sent over Modbus/TCP-IP with the data. Note the PMAC & Modbus reference numbers are actual offsets and do not abide by the standard Modbus reference number where you subtract one from it to get the offset into memory. We start at zero and not one.

Memory Allocation

PMAC Modbus/TCP Client/Server Buffer Size is fixed at 128 x 32 bits.Length for FC23 is fixed in 2 x Modbus Bytes = 16 bitsLength for FC2 and FC15 is in bitsAlways use all 32 bits of one Modbus memory location for one type do not use 16 bits for inputs and 16 for outputs

Wago Modular I/OSetting up a Wago 750-342 Modbus TCP module and rack with a 753-512 (2 DO), a 753-502 ( 4 DI), 753-4011 (2 AO), and a 753-403 (2 AI)Run BootPServer, and Edit BootPTabIf using no Proxy server then edit the line that starts with KeinProxy:Wago1NoProxy:ht=1:ha=0030DE00B6DF:ip=192.168.0.52:If using proxy then edit the line that starts with Hamburg:Wago1Proxy:ht=1:ha=0030DE00B6DF:ip=192.168.0.52:T3=0A.01.FE.01: NOTE: IP address of the proxy server is in Hex NOTE: ha parameter must match the MAC address of your 750-342

Wago Modular I/OWhen addressing, first of all the more complex modules (modules occupying 1 or more bytes) are taken into account in accordance with their physical order behind the field bus coupler. As such, they occupy the addresses starting with word 0.

Following this, the data of the other modules (modules occupying less than 1 byte) follow, grouped into bytes. In accordance with the physical byte-wise order this data is used to fill up the bytes. As soon as a full byte is occupied by the bit-oriented modules, the next byte is automatically started.

Wago Modular I/OFC23, PMAC refs 40, 44, Modbus ref 0,4Note that Wago documentation starts with 0, not 1DO found at i67+$95AO found at i67+$94DI found at i67+$97AI found at i67+$96

Wago Modular I/OData width >= 1 word/channelAnalog input modulesAnalog output modulesInput modules for thermal elementsInput modules for resistance sensorsPulse width output modulesInterface moduleUp/down counterI/O modules for angle and path measurement

Wago Modular I/OData width = 1 Bit / channelDigital input modulesDigital output modulesDigital output modules with diagnosis (2 Bit / channel)Power supply modules with fuse holder / diagnosisSolid State power relayRelay output modules

Automation Direct GS Series VFDSet IP Address using DIP switchSet SW2 and SW3 to RS-485Parameters to set using IE or keypad:P 3.00: 03 (keypad stop ena) 04 (keypad stop disabled)P 4.00: 05 (frequency determined by RS485 interface)P 4.04: 01 (states is to enable reverse command from analog but when = 0 the remote RUN command dead)P 9.00: xx (unique communication address 1-254)P 9.01: 01 (9600 baud data transmission rate)P 9.02: 05 (MODBUS RTU mode - 8 data bits, odd parity, 1 stop bit)

Automation Direct GS Series VFDdownload NetEdit3 from Automation Direct at: http://www.hosteng.com/SW-Products/NetEdit3.zipInsure that NWLink IPX/SPX/NetBios compatible protocol is loaded on your PC by going to the properties of your Ethernet connectionRun NetEdit 3 and select TC/PIP as typePress the Scan Network Button. If this is the first time you have talked to this device you will see the address 255.255.255.0. Click on this address and set to the desired network address. This address should be in the same range as that of the PMAC.Now you must power the drive down and back up. If you open NetEdit again you should now see the drive type listed in the address.

Automation Direct GS Series VFDConnect to the drive using IE to set drive parametersCalculating Modbus Reference for the GS-EDRVTake the GS parameter number (for example, 6.31 is the current error code)Take the digits after the decimal place and convert to hex (for 6.31 this will be $1F)Multiply the digit(s) before the decimal by $100 and add to the results of the previous calculation (for 6.31 this will yield $61fConvert this to decimal ($61f -> 1567) and this is your Modbus Reference

Automation Direct GS Series VFD

Automation Direct GS Series VFD

Read/Write Hex Modbus Speed Reference 091AH 42331 Run Command 091BH 42332 Direction 091CH 42333 External Fault 091DH 42334 Fault reset 091EH 42335 Jog 091FH 42336 Status 2101H 48450 Frequency cmd 2102H 48451 Output frequency 2103H 48452 Output current 2104H 48453 DC-bus voltage 2105H 48454 Output voltage 2106H 48455 Motor RPM 2107H 48456 Scale freq (low) 2108H 48457 Scale freq (high) 2109H 48458 % Load 210BH 48460 Firmware Version 2110H 48465

$91a=2330

4 is used as a holderModbus Reference start with 1, not 0

The correct Modbus Reference for us is 2330, not 2331

Phoenix FL IL BK Modbus I/OIn the demo this is a client at 192.168.2.80 on Socket 3FC3 with Modbus Ref 0, PMAC Ref 6, Count 1, and FC6 with Modbus Ref 384, PMAC Ref 24, Count 1

Demo has 16 digital inputs mapped to M839 and 16 digital outputs mapped to M1 Demo is being set output values by the PMAC, and the QTERM is reading input values

Phoenix FL IL BK Modbus I/OBase configuration at the module can be done with IE

QTermActing as a client in the demoPLCs running on PMAC interpreting command words from the clientM844 Feedrate overrideM841 Command WordM846 Rotary Position AM847 Rotary Position B

QTerm

Exor Uniop TerminalClient mode or Server modeBasic HMI with development package

Exor Uniop Terminal

Exor Uniop Terminal

Modbus TCP Software Control PanelAllows command of the PMAC with no code on the PMAC exactly as the DPR Control Panel doesI69 enables (firmware 1.942 and up)Typically set to $80 to set the start of the panel memory space $80 long words after the start of Modbus memoryReserves 26 long words

PMAC/TURBO Firmware Modbus (I69) Memory Map

PMAC Address (I69 +) PMAC/Modbus Ref. # X: Memory ParameterY: Memory Parameter$00/1Coordinate System Feed Pot Override EnableMotor/Coordinate System Enable$12/3Coordinate 1 System Feed Pot OverrideMotor/Coordinate System 1 Request$2 4/5Coordinate 2 System Feed Pot OverrideMotor/Coordinate System 2 Request$3 6/7Coordinate 3 System Feed Pot OverrideMotor/Coordinate System 3 Request$4 8/9Coordinate 4 System Feed Pot OverrideMotor/Coordinate System 4 Request$5 10/11Coordinate 5 System Feed Pot OverrideMotor/Coordinate System 5 Request$6 12/13Coordinate 6 System Feed Pot OverrideMotor/Coordinate System 6 Request$7 14/15Coordinate 7 System Feed Pot OverrideMotor/Coordinate System 7 Request$816/17Coordinate 8 System Feed Pot OverrideMotor/Coordinate System 8 Request$918/19ReservedReserved$A20/21ReservedReserved$B22/23ReservedReserved$C24/25ReservedReserved$D26/27ReservedReserved$E28/29ReservedReserved$F30/31ReservedReserved

Bit Format of Control Panel Motor/Coordinate System Enable Word (Y:I69)

BIT Control Panel Motor/Coordinate System Enable Mask(Set bit to enable; PMAC clears on taking action)0 Motor/Coordinate System # 1 + Mtr/CS offset1Motor/Coordinate System # 2 + Mtr/CS offset2Motor/Coordinate System # 3 + Mtr/CS offset3Motor/Coordinate System # 4 + Mtr/CS offset4Motor/Coordinate System # 5 + Mtr/ CS offset5Motor/Coordinate System # 6 + Mtr/CS offset6Motor/Coordinate System # 7 + Mtr/CS offset7Motor/Coordinate System # 8 + Mtr/CS offset15 8Turbo Mtr/CS offset is limited to 31 (PMAC not used)

Bit Format of Coordinate System (CS) Feed Pot Override Enable Word (X:I69)

BIT Set bit to enable Override, clear bit to disable0 Coordinate System # 1 + CS offset1Coordinate System # 2 + CS offset2Coordinate System # 3 + CS offset3Coordinate System # 4 + CS offset4Coordinate System # 5 + CS offset5Coordinate System # 6 + CS offset6Coordinate System # 7 + CS offset7Coordinate System # 8 + CS offset15 8Turbo CS offset is limited to 8 (PMAC not used)

Bit Format of Motor/Coordinate System Words (Y:I69+1 to 8)* When both Jog-Minus and Jog-Plus are set, motor will stop

BIT REQUEST (1 = action requested; 0 = no action requested)0-7 (Reserved for Delta Tau Future Use)8Jog-Minus (Motor Only) * 9Jog-Plus (Motor Only) * 10Pre-Jog - J= (Motor Only)11Start (RUN) (Coord. Sys. Only)12Step (STEP/QUIT) (Coord. Sys. Only)13Stop (ABORT) (Coord. Sys. Only)14Home (Motor Only)15Feed Hold (HOLD) (Coord. Sys. Only)

New Features (1.943+, 1.117+)Add eight more direct control bits commands:B, K, J:*, J^*, J=*, >,

New Features (1.943+, 1.117+)Read/Write PMAC Qn C.S. # (PMAC Modbus Address 0xF500)Read & Clear PMAC Modbus Command Error Status word (PMAC Modbus Address 0xF100)Read/Write PMAC Modbus Registers relative to I69 (PMAC Modbus Address 0xF200-0xF2FF) Read/Write PMAC Modbus Coils relative to I69 (PMAC Modbus Address 0xF300-0xF4FF)

GotchasWith a non-Turbo PMAC do not do power on phasing as it turns off background processing long enough for the Ethernet processor to initialize without the main processor initializing the i67 socketsMake sure that server Port 502 is not being blocked by firewall softwareMake sure that firewall software is not blocking client ports (>1024, exact port dependent on device, but different port for every open client socketServer vs Client in 3d party documentationAddressing in 3d party documentation