SIMATIC TI500/TI505 TIWAY 1 Gateway User Manual Order Number PPX:TIWAY-8104-02 Manual Assembly Number: 2587871-0004 Second Edition
Copyright 1992 by Siemens Industrial Automation, Inc. All Rights Reserved — Printed in USA Reproduction, transmission or use of this document or contents is not permitted without express consent of Siemens Industrial Automation, Inc. All rights, including rights created by patent grant or registration of a utility model or design, are reserved. Since Siemens Industrial Automation, Inc.
MANUAL PUBLICATION HISTORY SIMATIC TI500/TI505 TIWAY I Gateway User Manual Order Manual Number: PPX:TIWAY–8104–2 Refer to this history in all correspondence and/or discussion about this manual.
LIST OF EFFECTIVE PAGES Pages Cover/Copyright History/Effective Pages iii — x 1-1 — 1-4 2-1 — 2-12 3-1 — 3-14 A-1 — A-4 B-1 — B-3 C-1 — C-28 D-1 — D-11 Index-1 — Index-3 Registration Description Second Second Second Second Second Second Second Second Second Second Second Second Pages Description
Contents Preface Chapter 1 1.1 1.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 The Gateway Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Distributed Control Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 1-2 Basic Operating Features . . . . . . .
Chapter 3 3.1 3.2 3.3 3.4 Gateway Installation and Configuration Installing the TIWAY I Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 Basic Mounting Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Power Connections and Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Appendix C C.1 C.2 C.3 Modbus Commands Modbus Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-2 The RTU Transmission Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Delineation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Address Field . . . . . . . . . . . . . . . . . . . .
List of Figures 1-1 1-2 TIWAY I Gateway as Interface Between PLC Network and Host System . . . . . . . . . . . . . TIWAY I Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 1-3 2-1 2-2 2-3 2-4 2-5 2-6 Basic Installation and Set-up Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Number of Local Line Secondaries vs. Cable Distance . . . . . . . . . . . . . . . . . .
C-26 C-27 C-28 C-29 C-30 C-31 C-32 C-33 C-34 C-35 C-36 C-37 Write Multiple Coils Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Coil Bit Pattern . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Write Multiple Coils Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Write Multiple Registers Example — Request . . . . . . . .
List of Tables 1 TIWAY I Gateway Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix 1-1 Data Transmission Rates Supported . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4 2-1 2-2 Pin Assignments for Local Line Connector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RS-232-C Connector Pin Assignments . . . . . . . . . . . . . . . . . . . . . . . . . .
Preface Purpose of this Manual This manual describes the basic features, operation, and installation of the TIWAY I Gateway. The Gateway provides an interface between the SIMATIC TIWAY I network and a distributed control system host using Modbus protocol. The TIWAY I Gateway translates Modbus commands from a host into the TIWAY I protocol format.
Related Manuals The information in this manual is supplemented by the following Siemens manuals. You may find it helpful to refer to these or other related manuals when using the TIWAY I Gateway.
Chapter 1 Product Overview 1.1 1.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 The Gateway Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Distributed Control Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 1-2 Basic Operating Features . . . . . .
1.1 Introduction The Gateway Interface The TIWAY I Gateway allows a TIWAY I network of PLCs to be hosted by a Modbus-compatible host system. Figure 1-1 shows the relationship of the Gateway to one of several possible Modbus-compatible host systems. Distributed Control Systems The Foxboro SPECTRUM, Fisher PROVOX, and Honeywell TDC 2000 are distributed control systems which have interfaces to PLCs.
1.2 Basic Operating Features Interface Ports Two interface ports are located on the bottom of the TIWAY I Gateway unit. The AC power connections are also located on the bottom, covered by a protective plate. (See Figure 1-2.) • Host: an RS-232-C host interface port (25-pin female D-shell connector) • TIWAY I: the network port (9-pin female D-shell connector) The host system is connected by cable to the host interface on the Gateway. The communications cable is supplied with the Gateway.
Basic Operating Features (continued) Translating Commands between Host and PLC Network The Gateway provides protocol and electrical interface conversion. A command issued by the host system is transmitted to the Gateway. Once it receives the command, the Gateway converts the protocol and electrical signals and then relays the command to the PLC which was addressed. After the PLC responds, the Gateway re-translates the information and sends it back to the host system through the interface device.
Chapter 2 Network Installation 2.1 2.2 2.3 TIWAY I Network and Gateway Installation Checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2 Quick Reference Installation Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Basic Installation Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Requirements for Installing the Gateway . . . . . . . . . . . . . . . . . . . . . .
2.1 TIWAY I Network and Gateway Installation Checklist Quick Reference Installation Steps Figure 2-1 is a quick reference list of steps to be taken when installing the TIWAY I Gateway. Refer to Chapter 3 for specific procedures and cautions. Attach AC power cable to the Gateway. Run diagnostic tests. Connect the network and host interface cables. Configure the host system. Configure the Gateway dipswitches. Check Gateway indicators for proper operation.
Basic Installation Procedures Requirements for Installing the Gateway Some basic procedures to follow when installing a Gateway system include the following. • Be sure you have all components necessary to install the Gateway and the network cables. (Refer to the checklist below for required parts.) • Install the TIWAY I network and host system interface cables (see Section 2.2).
2.2 Network Media Installation — Local Line Overview TIWAY I is a multi-drop communications network. It consists of a main trunk cable (the “spine”) and dropline cables. The network can connect up to 248 secondaries to a host computer. NOTE: Although addresses can range from 1 to 254 on TIWAY I, addresses 248 through 254 cannot be used because of the limitations of the Modbus protocol.
TIWAY I Network Characteristics The TIWAY I network cable consists of a main cable or spine with droplines or taps for each secondary. The maximum main line cable length, cable type, tap length, tap spacing, number of secondaries, and maximum baud rates are interrelated network variables and have a direct influence upon network performance. Figure 2-2 shows the relationship of cable distance to the number of secondaries for different baud rates for two types of twisted-pair cable.
Network Media Installation — Local Line (continued) Local Line Hardware Components The hardware components of a Local Line network consist of the following: TIWAY I Tap Housing (PPX:500–5606) Shielded, twisted-pair cabling (customer-supplied) These components are described in the following sections. Tap Housing The TIWAY I Tap Housing, shown in Figure 2-3, is designed specifically for Local Line networks. The tap housing can be mounted rigidly to a NEMA panel or other enclosure.
Terminating the Main Line Cable The terminating resistors must be used to ensure that the main line cable is properly terminated and biased for improved reliability. Each tap housing is supplied with terminating resistors to connect to the ends of the main line cable. At each end, a terminating resistor must be connected between LLM+ and the cable shield and also between LLM– and the cable shield inside the tap housing.
Network Media Installation — Local Line (continued) Local Line Tap Spacing Rules Local Line networks must adhere to specific tap spacing requirements to maintain signal integrity. These requirements are outlined in the following sections. 100′ 100′ 20′ 50′ min 50′ min 50′ 30′ 60′ 100′ I000000 Figure 2-5 Basic Tap Spacing Rules Basic Considerations The rules for determining the correct distances between taps exist simply for the prevention of signal degradation caused by reflections.
36″ max Double Drop Drop lines less than 36 inches can be ignored. 100′ max 80′ 30′ 30″ 50′ min 100′ 100′ I000000 Figure 2-6 Additional Tap Spacing Rules Double Drops If a tap cable is installed less than the minimum distance as stated in the primary rule, then the two drops, the previous one and the one being installed, are considered a double drop. Double drops are allowed, but triple drops are not allowed.
Network Media Installation — Local Line (continued) Cable Routing ! CAUTION Cable routing should be planned as if the path between all stations on the network were free of obstructions. The next step is to modify the first routing to account for obstructions, then calculate the amount of cable needed. Observe all local and national electrical and fire codes when installing wiring.
Some disadvantages are the following. • Is is impractical for buildings without drop ceilings • Working in high ceilings can be hazardous • Ceilings often collect dust and other debris Surface ducting — Surface ducting for network cabling is usually installed along the baseboards or is attached to walls at desktop height. While surface ducting ordinarily protects cables from both physical and EMI effects, it may also require that network computing devices be positioned near a wall.
2.3 Network Media Installation — RS-232-C Modem Interface Data Transmission Characteristics The physical layer in TIWAY I provides a modem interface for synchronous or asynchronous communications at data transmission rates up to 115.2 K bps. The modem interface provides standard signals for control of two-way alternate data transmission using both half and full duplex modems. RS-232 Pin Assignments The modem interface is a standard Type E DTE configuration as defined in the EIA RS-232-C standard.
Chapter 3 Gateway Installation and Configuration 3.1 3.2 3.3 3.4 Installing the TIWAY I Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 Basic Mounting Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Power Connections and Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1 Installing the TIWAY I Gateway Basic Mounting Guidelines There are three possible places on the Gateway where the two L-shaped mounting brackets can be located. Depending on how you want to mount the Gateway, attach the brackets to the appropriate locations, as shown in Figure 3-1. ÇÇ ÇÇ ÇÇ ÇÇ ÇÇ ÇÇ Mounting brackets located at top of Gateway Mounting brackets located at rear of Gateway Gateway mounted behind panel.
Power Connections and Initialization After mounting the unit in an appropriate location, follow these steps for connecting the power supply and running diagnostic tests. 1. Remove the shield covering the three AC terminals (Line, Ground, and Neutral). 2. With power off, attach all three connections according to Figure 3-2 and then replace the shield. AC Power Connections I00xxxx Figure 3-2 AC Power Connections 3. Apply power to the unit. 4. Install loopback connector on each RS-232 port. 5.
Installing the TIWAY I Gateway (continued) 6. Run the user-initiated test. (Refer to the Diagnostics Tests section.) 7. Remove loopback connector. 8. Set the Online/Offline switch on the Gateway to the ONLINE position. 9. Connect the Local Line or RS-232 interface cable to the TIWAY I port. 10. Connect the host system interface cable to to the host port. 11. Configure the communications parameters on the host system.
GATEWAY GOOD COMM ACTIVE ONLINE RECEIVE TIWAY I Gateway shown with switch access cover open TRANSMIT TEST MODE Reset Self-Test Online Online/Offline Offline Network Port Configuration Dipswitches Host Port Configuration Dipswitches Dipswitches for Network and Host Ports NETWORK Port C Coils 10 Test 9 NRZI Encoding 8 IDT Data Addressing 7 Full Duplex 6 Synchronous 5 1 4 1 3 1 2 1 1 1 Y Coils Operate NRZ Encoding MODBUS Half Duplex Asynchronous 0 NETWORK 0 Baud Rate 0 Select 0 0 HOST Port Even Parit
3.2 Dipswitch Configuration and Function Overview Two banks of dipswitches are located behind the access cover on the front of the Gateway. One is for the host port and the other is for the network port. The following sections define the switches and describe the effect they have on the Gateway’s operation. There are eight configuration switches for the host port, and ten for the network port.
Dipswitch Settings for the Host Interface Port The 8-switch bank governs the host interface. The following paragraphs describe the switch-selectable options for setting the host interface parameters. Data Transmission Rate Selection (Switches 1 through 4): For the host port, Table 3-3 shows what data transmission rates are supported on the listed host systems. (Refer to Figure 3-3 for the host baud rate dipswitch settings.
Dipswitch Configuration and Function (continued) Dipswitch Settings for the Network Interface Port The 10-dipswitch bank governs the network communications port. The following paragraphs describe the switch-selectable options available for the network port. Data Transmission Rate Selection (Switches 1 through 4): The TIWAY I network supports the following data transmission rates: 110, 150, 300, 600, 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115,200 bits per second.
Full/Half Duplex Operation (Switch 6): the Full/Half Duplex switch selects operation compatible with full or half-duplex modems even though communication with the Gateway is half-duplex only. When you select Half-duplex operation, the Gateway does not activate the Request to Send circuit before Data Carrier Detect becomes inactive. Timing relationships between Data Carrier Detect and Request to Send are ignored when full duplex is selected.
3.3 Switches and Indicator Lights Reset Self-Test Online Online/Offline Offline I000000 Figure 3-5 Gateway Operation Switches Online/Offline Switch The Online/Offline switch, when placed in the Online position, allows the Gateway to communicate with the network and the other systems connected to the Gateway. In the Offline position, the Gateway is disconnected from the network. This prevents access to the network while secondaries are being changed or while maintenance is being performed.
GATEWAY GOOD ON = All tests passed successfully COMM ACTIVE ON = Communication in progress ONLINE ON = Communicating with network RECEIVE ON = Receiving data TRANSMIT ON = Transmitting data TEST MODE ON = In test mode (test button pressed) Flashing = Tests completed successfully I000000 Figure 3-6 Indicator Lights Status Indicator Lights The six indicator lights on the front panel of the Gateway show module and communication status, as described in the following paragraphs.
3.4 Diagnostic Tests Built-In Diagnostic Tests Power-On Test The Gateway has five levels of built-in tests, three of which are designed for the user. • Power-on test • Operational Diagnostic test • User-initiated test • Burn-in test • Final test Used only in quality assurance tests by manufacturer The Power-on test executes the initialization routine following a master reset. All indicators light for approximately one second before any subtests begin.
User-Initiated Test You should run the user-initiated test only when the Gateway is in Off-line mode (that is, when the On-line/Off-line switch is in the OFFLINE position). Normal Gateway operation is suspended during this test mode. NOTE: Before initiating the diagnostic routine, make sure that the network and host computer cables are disconnected from the Gateway, and that the Gateway is in off-line mode. Only the GATEWAY GOOD indicator should be lit.
Diagnostic Tests (continued) Table 3-5 shows how to interpret the results of the user-initiated diagnostic test according to the status of the indicator lights.
Appendix A Data Type Identification A.1 Corresponding Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2 A.2 SIMATIC TI PLCs Supported by TIWAY I Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-3 A.3 TIWAY I Gateway Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.1 Corresponding Data Types This appendix provides information on which Siemens PLCs are supported by the Gateway, and how SIMATIC TI data types correspond to those of the host systems. Also included in this appendix are a list of features added to the latest release of the Gateway and a list of hardware specifications. Table A-1 shows the correspondence between data types configured in the host systems and the data retrieved from SIMATIC TI PLCs.
A.2 SIMATIC TI PLCs Supported by TIWAY I Gateway Table A-2 shows all the PLCs supported by the TIWAY I Gateway and lists the maximum number of discrete points, V-memory locations, and word input memory locations which are accessible from the Gateway. Table A-2 SIMATIC TI PLCs Supported and Accessible Data SIMATIC TI PLC Models Discrete Points (maximum no.) V-Memory Locations (max.) Word Input Locations (max.
A.3 TIWAY I Gateway Specifications Table A-3 TIWAY I Gateway Features TIWAY I Gateway Features Before Rel. 1.3 Release 1.
Appendix B System Configuration Forms B.1 System Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-2 B.2 V-Memory Offset Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
B.1 System Configuration It is extremely important to keep complete, up-to-date records on system configuration. This appendix provides some sample record-keeping forms for use with a TIWAY I Gateway system.
B.
Appendix C Modbus Commands C.1 C.2 C.3 Modbus Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-2 The RTU Transmission Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Delineation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Address Field . . . . . . . . . . . . . . . . . . . .
C.1 Modbus Protocol Overview This appendix describes the Modbus protocol in detail. For each of the Modbus functions described, examples of requests and responses are given. Table C-1 describes the Modbus functions supported by the Gateway. Table C-1 Modbus Functions Supported Code The RTU Transmission Frame Type Description 01 Read Coil Status Get current status of a group of coils. 02 Read Input Status Get current status of a group of discrete inputs.
Message Delineation The start and finish of a message is determined by timing in RTU mode. Any time longer than 3.5 character lengths marks the end of a transmission. The next character after that would then mark the start of the next message. This time period is dependent on the baud rate. Table C-2 shows the effect of baud rate on the time period (assuming 2 stop bits). Table C-2 RTU Timing Baud Rate 19200 9600 7200 4800 3600 2400 1800 1200 600 300 200 150 110 Time (ms) 2.2 4.4 5.9 8.8 11.7 17.5 23.
Modbus Protocol Overview (continued) Invalid Characters and Messages Modbus Functions The Gateway ignores messages that contain invalid characters. Messages containing the following errors will also be ignored. • Incorrect checksum • Parity error • Framing errors • Incomplete transmission This section outlines some of the differences between Modbus and TIWAY I network commands. • Whereas Modbus uses Functions Codes, TIWAY I uses Primitives.
• Terminology is another area in which differences occur. Some of the differences in terms are given in Table C-3.
C.2 Modbus Function Descriptions Introduction In the descriptions that follow, each function starts on a separate page and includes the TIWAY primitive sent to the secondary in square brackets. For each function, an example of request and response is given. Code 01 — Read Coil Status Code 01 enables the user to read the On/Off values of logic coils. The data passed with this command is the start address and the number of coils to be read.
Response: 07 01 01 1A XXXX Checksum (XXXX) Data (1A) Number of bytes (01) Function code (01) Slave address (07) I000000 Figure C-4 Read Coil Status Example — Response The response returns in the data field a single byte (1A) which contains the 1’s or 0’s for the 5 coils, packed out with zeros for the three high bits.
Modbus Function Descriptions (continued) Code 02 — Read Input Status Code 02 allows the application to read a series of discrete inputs. The command includes the start address and the number of points to be read. Addressing is sequential up to the maximum memory size for a particular PLC. The maximum number of inputs that can be addressed with one command is 2000. If more are requested, the whole command will be rejected with an Exception code 03.
The response returns in the data field a single byte (1A) containing the 1’s or 0’s for the 5 discrete inputs, packed out with zeros for the three high bits.
Modbus Function Descriptions (continued) Code 03 — Read Output Registers Code 03 allows you to read the contents of holding registers in the attached secondary device. The data field of this command includes the start address of the registers and the number of registers to be read. Addressing is sequential up to the maximum memory size for a particular PLC. The maximum number of registers that can be addressed with one command is 125.
Code 04 — Read Input Registers Code 04 allows you to read the contents of input registers in the attached PLC. These registers hold the values returned by the I/O devices. The data field of this command includes the start address of the registers and the number of registers to be read. Addressing is sequential up to the maximum memory size for a particular PLC. The maximum number of registers that can be addressed with one command is 125.
Modbus Function Descriptions (continued) Code 05 — Write a Single Coil Code 05 allows a designated coil [discrete output Y or C, depending on the position of Switch 10 on the network dipswitches] to be written. Depending on the code passed in the data field, it can be changed to On (1) or Off (0), forced On or Off, or unforced. The two-byte codes are the following. FF00 (hex) . . . . . . . . . . ON 0000 (hex) . . . . . . . . . . .
Response: 07 05 0064 FF00 XXXX Checksum (XXXX) OFF/ON code (FF00 = ON) Coil address (0064) Function code (05) Slave address (07) I000000 Figure C-14 Read Input Register Example — Response The response to Function Code 05 is to return the request as received. In the case of a broadcast request, there is no response.
Modbus Function Descriptions (continued) Code 06 — Write a Single Register Code 06 allows the contents of a holding register to be changed. Addressing is sequential up to the maximum memory size for a particular PLC. This function is limited to integer values contained in V-memory. The Gateway will also direct any broadcast address (00) to all attached secondaries. [This command is comparable to a TIWAY I request using Primitive 30 and TT-type 01 (Variable memory)].
Code 07 — Read Exception Status Code 07 instructs the Gateway to read 8 predefined Cs within a secondary. This implementation will read the first 8 Cs in the discrete image register in a secondary and pack them into one data byte. NOTE: The programmer of a non-Modbus PLC must make certain that the application program running within the PLC will place meaningful data in these locations. This data can reflect status information.
Modbus Function Descriptions (continued) The response shows that 3B (hex) has been returned. If the individual bits are examined, they indicate the status of each bit.
Code 08 — Execute Diagnostics Code 08 enables diagnostic information to be retrieved to conduct network testing. This function does not affect the operation of the PLC. Example: Request: 02 08 0000 B405 XXXX Checksum (XXXX) Information Field (B405) Diagnostic code (0000) Function code (08) Slave address (02) I000000 Figure C-20 Execute Diagnostics Example — Request This example shows a request to conduct diagnostic test 0000.
Modbus Function Descriptions (continued) Table C-4 details the diagnostic codes supported.
The diagnostics codes supported are described in the following paragraphs. Diagnostic Code — 00 0000 | any data Information frame Diagnostic code I000000 When Function Code 08 uses diagnostic code 0000, any data passed in the information field is returned to the host computer by the Gateway. The Gateway will send Primitive 02 to the secondary. If the secondary has a fatal error, communications loopback is not performed to indicate fatal error.
Modbus Function Descriptions (continued) Code 11 — Get Comms Event Counter Code 11 returns a 2-byte status word and an associated 2-byte event counter. The status word is defined in the Modbus Protocol Reference Specification as being 0 for no command in progress and FFFF if a previous command is in progress. The status will always be 0 in the Gateway. The event counter is incremented for every successful message; it is not incremented for exceptions or polls, or for this code or Code 12.
Code 12 — Get Comms Event Log Code 12 returns the same information as Function Code 11 plus a message count and an additional 64-event byte. This means that a 2-byte status word, a 2-byte event counter, a message count, and the most recent 64 events are returned. A buffer records each send or receive operation and overwrites the oldest event with the latest event. No events are recorded for this code or Code 11. The Event Byte types are shown in Table C-5.
Modbus Function Descriptions (continued) Table C-5 Event Byte Types Event Byte C-22 Bit Definitions Slave Bus Receive. Byte stored on receipt of message Bit 0 – Reserved Bit 1 – Set if communications error Bit 2 – Reserved Bit 3 – Reserved Bit 4 – Set if character overrun Bit 5 – Set if in Listen Only mode Bit 6 – Set if Broadcast Bit 7 – 1 Slave Bus Transmit.
Code 15 — Write Multiple Coils Code 15 allows the host computer to write multiple coils. When this command is given, successive coils are changed, by an associated bit pattern, to the indicated state; where each bit indicates: 1 = ON 0 = OFF Addressing is sequential up to the maximum memory size for a particular secondary. The maximum number of coils that can be addressed with one command is 800. If more are given, the whole command will be rejected with an Exception code 03.
Modbus Function Descriptions (continued) Response: 07 0F 0012 000C XXXX Checksum (XXXX) Number of coils (000C) Start coil address (0012) Function code (0F) Slave address (07) I000000 Figure C-28 Write Multiple Coils Example — Response C-24 Modbus Commands TIWAY I Gateway User Manual
Code 16 — Write Multiple Registers Code 16 allows the host computer to write multiple values into successive registers. Addressing is sequential up to the maximum memory size for a particular PLC. The maximum number of registers that can be addressed with one command is 100. If more are given, the whole command will be rejected with an Exception code 03. [This command is equivalent to a TIWAY I request using Primitive 30 with TT-type 01 (Variable memory)].
C.3 User-Defined Modbus Commands There are three user-defined commands implemented in the TIWAY I Gateway. These commands, described below, allow the Gateway to work with the IDT operator interface family of products. Command 65 — Read C Memory This command permits the collection of Control Relay (C) data. The format of the command is as follows.
Command 66 — Read K Memory This command permits the collection of constant (K) memory. The formats of the command and response are as follows. Request: aa 42 llll nnnn XXXX Checksum (XXXX) Number of locations to collect (nnnn) Starting location to collect from (llll) Command 66 (42 hex) Address (aa) I000000 Figure C-33 Command 66 — Request Response: aa 42 bb dddd . . .
C.4 Error Responses Errors such as illegal addressing or failure of communications with a PLC are reported by exception responses. Exception responses replace the expected response to a request and are recognized by the returned Function Code with the top bit set high (see example in Figure C-37).
Appendix D Configuring the PLC for Fisher PROVOX D.1 D.2 D.3 Considerations for Configuring a TIWAY I/PROVOX System . . . . . . . . . . . . . . . . . . . . . . . . . D-2 PLC Configuration Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Network Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2 D-2 PLC Programming Considerations . . . . . . . . . . . . . . . . . . .
D.1 Considerations for Configuring a TIWAY I/PROVOX System PLC Configuration Requirements To configure the PLC to operate with the Fisher PROVOX Programmable Controller Interface Unit (PCIU), you need to consider the following restrictions and requirements. • A maximum of eight PLCs can be networked with each PCIU on a PROVOX system. • A total of 64 data registers can be distributed in V-memory across one to eight PLCs on the PCIU.
D.2 PLC Programming Considerations Blocking Network Data The restrictions on data types and numbers of contiguous data blocks that can be accessed by a PCIU influence the design of the PLC programs to be used in a PROVOX environment. To increase the number of secondaries that can be supported by a single PCIU, you should group together the data to be read by the network into a single contiguous block. Similarly, data supplied to the PLC from the network should be written into a single contiguous block.
D.3 PLC Programming Example Data to be Accessed Assume that you have several Series 500 or Series 505 PLCs and PM550 PLCs which need to be attached to a PROVOX system. You need to access the following data from each PLC in the network.
The V-memory block now has 9 data words (plus the status register) in each PLC. From the 64-register limit, you would calculate that there could be a maximum of 7 PLCs (64/9 = 7) configured like this and connected to a single PCIU. Relay Ladder Logic Program The following Relay Ladder Logic (RLL) programs for your Series 500/505 or PM550 PLC will block and unblock data to be accessed by way of the network. I.
PLC Programming Example (continued) C1 C7 BITP 4 A: STW1 N = 14 C1 C8 BITP 5 A: STW1 N = 15 C1 C9 BITP 6 A: STW1 N = 16 C1 MIRW 7 Copy STW01 from Image Register to V200 (status register) C2 IR = C3 A: V200 N=7 C1 Copy Y1–Y16 to V201 C2 MIRW IR = Y1 A: V201 N = 16 Y22 Y800 Place Y22, X41–X44, into contiguous Image Register locations X41 Y801 X42 Y802 (cont’d) D-6 Configuring the PLC for Fisher PROVOX TIWAY I Gateway User Manual
X43 Y803 X44 Y804 Y805 Copy discrete values written via network to C29–C32 C29 Y806 C30 Y807 C31 Y808 C32 C1 MIRW 1 Copy discrete points to V202 C2 IR = Y800 A: V202 N=9 C1 MOVW 2 Copy V14–V16 to V203–V205 C2 A: V14 B: V203 N=3 C1 MOVW 3 Copy WX17 to V206 C2 A: WX17 B: V206 N=1 C1 Copy TCC1 to V207 C2 MOVW 4 A: TCC1 B: V207 N=1 (cont’d) TIWAY I Gateway User Manual Configuring the PLC for Fisher PROVOX D-7
PLC Programming Example (continued) '(/ - $, .)"++ & )'% & +.')# +' 0 0 '(/ - $, .)"++ & )'% & +.')# +' 0 0 End II. PM550 Example Program '(/ +' $' # "&+' '&+"!,',* % %')/ '(/ "* ) + - $, * .)"++ & -" & +.
PLC Programming Example (continued) % ! ! ! % ! % ! % ! % # " $ !! # !$ ! (cont’d) TIWAY I Gateway User Manual Configuring the PLC for Fisher PROVOX D-9
! D-10 Configuring the PLC for Fisher PROVOX TIWAY I Gateway User Manual
SPECIAL FUNCTION 15 I/O MOVE START ADDRESS: C220 NEXT ADDRESS: C224 ERROR OUTPUT? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N ERROR OUTPUT DESIGNATOR: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . NUMBER OF WORDS: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 FROM IR? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Y FROM IR ADDRESS: . . . . . . .
Index A Distributed control systems, ix, 1-2 AC power connections, 1-3, 3-3 Addressing, limits, C-5 B Double drop taps, 2-9 E Baud rates, 3-4–3-8 Error responses, C-28 Bracket locations, 3-2 Exception responses, C-28 Burn-in test, 3-14 F C Cable routing in ceiling, 2-10 surface ducting, 2-11 under floor, 2-10 Checksum, C-3 Components installing Gateway, 2-3 Local line hardware, 2-6 Configuration, system, B-2 Features, Gateway Release 1.
L P Local Line cable characteristics, 2-4 cable routing, 2-10 hardware components, 2-6 installation, 2-4–2-11 tap housing, 2-6 tap spacing, 2-8–2-9 terminating, 2-7 Pin assignments local line connector, 2-4 RS-232-C interface, 2-12 Loopback connections, 3-13 connector, 3-3 Power connections, 3-3 M Manuals, x Modbus commands function code descriptions, C-6–C-25 protocol, C-2–C-5 user-defined, C-26–C-27 PLC configuration programming, D-3 requirements, D-2 PLC programming, example, D-4–D-11 Power-on te
T Tap housing, 2-6 Terminating, main line cable, 2-7 Test mode indicator, 3-11 Test/operate switch, 3-9 Transmit indicator, 3-11 Twisted-pair cable, 2-7 U User-initiated test, 3-13 V V-memory, offset tables, B-3 Y Y/C coil selection switch, 3-9 Index-3
'/ .#%'/0#.#" 0. "#* .( ,$ '#*#+/ 0#3 5 '/ 0. "#* .( ,$ '#*#+/ +"1/0.' ) 10,* 0',+ +! #.'#/ #.'#/ +" .# 0. "#* .(/ ,$ '#*#+/ +"1/0.' ) 10,* 0',+ +! ," 1/ '/ .#%'/0#.#" 0. "#* .( ,$ ,"'!,+ '/ .#%'/0#.#" 0. "#* .( ,$ ,+#53#)) +! '/ 0. "#* .( ,$ &# ,4 ,., ,*- +5 '/ .#%'/0#.#" 0. "#* .( ,$ &# ,4 ,., ,*- +5 '/ .#%'/0#.#" 0. "#* .( ,$ '/&#. ,+0.,)/ +! '/ 0. "#* .
Customer Registration We would like to know what you think about our user manuals so that we can serve you better. How would you rate the quality of our manuals? Excellent Good Fair Poor Accuracy Organization Clarity Completeness Overall design Size Index Would you be interested in giving us more detailed comments about our manuals? Yes! Please send me a questionnaire. No. Thanks anyway.
FOLD NO POSTAGE NECESSARY IF MAILED IN THE UNITED STATES BUSINESS REPLY MAIL FIRST CLASS PERMIT NO.3 JOHNSON CITY, TN POSTAGE WILL BE PAID BY ADDRESSEE SIEMENS INDUSTRIAL AUTOMATION, INC. 3000 BILL GARLAND RD. P.O.
