Order Number PPX:TIWAY-8104-02
Manual Assembly Number: 2587871-0004
Second Edition
Page 2
Copyright
1992 by Siemens Industrial Automation, Inc.
All Rights Reserved — Printed in USA
Reproduction,
contents is not permitted without express consent of
Siemens Industrial
created by patent grant or registration of a utility model or
design, are reserved.
Since Siemens Industrial Automation, Inc. does not possess
full access to data concerning all of the uses and applications
of customer’s products, we do not assume responsibility either
for customer product design or for any infringements of patents
or rights of others which may result from our assistance.
01/21/92
transmission or use of this document or
Automation, Inc. All rights, including rights
T
echnical data is subject to change.
W
e check the contents of every manual for accuracy at the
time it is approved for printing; however
undetected errors. Any errors found will be corrected in
subsequent editions. Any suggestions for improvement are
welcomed.
, there may be
Page 3
MANUAL PUBLICA
TION HISTOR
Y
SIMATICTI500/TI505
Or
der Manual Number: PPX:TIW
Refer to this history in all correspondence and/or discussion about this manual.
EventDateDescription
Original Issue
Second Edition
TIWAY I Gateway User Manual
AY–8104–2
09/85
09/92
Original Issue (2491964–0001)
Second Edition (2491964–0002)
Settings for the Network and Host Ports
Settings for Network Data T
Operation Switches
Lights
Status
ransmission Frame
Orientation
Coil Status Example — Request
Coil Status Example — Response
Coil Status Example — Data Field
Input Status Example — Request
Input Status Example — Response
Input Status Example — Data Field
Output Register Example — Request
Output Register Example — Response
Input Register Example — Request
Input Register Example — Response
a Single Coil Example — Request
Input Register Example — Response
a Single Register Example — Request
a Single Register Example — Response
Exception Status Example — Request
Exception Status Example — Response
Status Bits
Diagnostics Example — Request
Diagnostics Example — Response
Comms Event Counter Example — Request
Comms Event Counter Example — Response
Comms Event Log Example — Request
Comms Event Log Example — Response
manual describes the basic features, operation, and installation of the
TIWAY
SIMATIC TIWAY I network and a distributed control system host using
Modbus protocol.
The TIWAY I Gateway translates Modbus commands from a host into the
TIWA
entirely different in protocol and interface requirements, the Gateway
serves as a protocol translator and as a type of network monitor
I Gateway. The Gateway provides an interface between the
Y I protocol format. Since the Modbus and TIWAY I systems are
.
Gateway System
Capacities
TIWA
Y I Gateway
Models
For example, the TIWAY I Gateway can provide protocol translation for the
following host systems.
•
The Honeywell TDC 2000 Data Highway Port (DHP) with one
Gateway can monitor up to eight programmable controller (PLC)
stations with one Network Interface Module (NIM) for each PLC.
•
The Foxboro SPECTRUM FOXNET Device Interface (FDG) with
one Gateway can monitor up to 64 stations equipped with NIMs.
•
The Fisher PROVOX Programmable Controller Interface Unit
(PCIU)
can monitor up to 8 stations with NIMs.
The TIWAY I Gateway is available in four models, offering a choice of
communication ports and voltage supplies, as listed in T
T
able 1
Model NumberCommunication PortsSupply Voltage
PPX:500–7301RS-232-C/Local Line
PPX:500–7302Dual RS-232-C
PPX:500–7303RS-232-C/Local Line
PPX:500–7304Dual RS-232-C
TIWA
Y I Gateway Models
able 1.
120 V
120 V
240 V
240 V
AC
AC
AC
AC
NOTE: These models replace the previously available model PPX:500–7200
series of the TIW
TIWAY I Gateway User Manual
A
Y I Gateway
.
Preface
ix
Page 12
Related Manuals
The
information in this manual is supplemented by the following Siemens
manuals. Y
when using the TIWAY I Gateway
ou may find it helpful to refer to these or other related manuals
.
•TIWAY
•TIWA
•TIWA
•SIMATIC TI520C
•SIMATIC TI545
•SIMA
I Systems Manual
Y I Series 505 Network Interface User’s Manual
Y I Series 500 Network Interface User’s Manual
/TI530C/TI530T
Manual Set, V
TIC TI545 System Manual
•SIMATIC TI560T/TI565T
•SIMATIC TI500/TI505
(2587871–0001)
(2587871–0053)
(2587871–0054)
Manual Set
olumes 1 and 2
(2462158–0026)
(2586546–0023)
(2586546–0053)
System Manual
(2597773–0035)
TISOFT2 Release 4.2 User Manual
(2588081–0019)
ou should also refer to the appropriate user manual(s) for the Modbus host
TIWAY I Gateway allows a TIWAY I network of PLCs to be hosted by a
Modbus-compatible host system. Figure 1-1 shows the relationship of the
Gateway to one of several possible Modbus-compatible host systems.
The Foxboro SPECTRUM, Fisher PROVOX, and Honeywell TDC 2000 are
distributed control systems which have interfaces to PLCs. These systems
primarily perform supervisory control and data acquisition functions to the
PLCs, using an RS-232-C type of connection into PLC data highways.
For example, the Honeywell TDC 2000 system communicates with the
Gateway by way of a Data Highway Port (DHP), the Fisher PROVOX
system uses a Programmable Controller Interface Unit (PCIU), and the
Foxboro SPECTRUM system uses a FOXNET Device Interface (FDG).
FDG
or
Fisher
PROVOX
or
Honeywell
TDC
2000
or
MODBUS
Compatible
Host System
Figure 1-1 TIWAY
PCIU
DHP
“xyz”
I Gateway as Inter
TIWA
Y I Gateway
TIWA
Y I Network
Programmable Controllers
face Between PLC Network and Host System
I000000
1-2
Product Overview
TIWAY I Gateway User Manual
Page 15
1.2Basic Operating Features
Inter
face Ports
Two
interface ports are located on the bottom of the TIWAY I Gateway unit.
The AC power connections are also located on the bottom, covered by a
protective plate. (See Figure 1-2.)
•
Host: an RS-232-C host interface port (25-pin female D-shell connector)
•TIWA
Y I: the network port (9-pin female D-shell connector)
The host system is connected by cable to the host interface on the Gateway
The communications cable is supplied with the Gateway
. The TIWAY I port
provides communication interface with the TIWAY I network of PLCs or
other secondary devices.
Refer to Chapter 2 for information on TIWAY I network installation.
Chapter 3 describes the procedures for installing and configuring the
TIWA
Y I Gateway and the communications cables.
Status indicators
TIWAY
I
port
.
Host
port
TIWAY I Gateway User Manual
AC Power
Connections
Figure 1-2 TIWAY
I Gateway
Product Overview
I00xxxx
1-3
Page 16
Basic Operating Features (continued)
Translating
Commands
between Host and
PLC Network
Data T
ransmission
Rates Supported
The
Gateway provides protocol and electrical interface conversion. A
command issued by the host system is transmitted to the Gateway
. Once it
receives the command, the Gateway converts the protocol and electrical
signals and then relays the command to the PLC which was addressed.
After the PLC responds, the Gateway re-translates the information and
sends it back to the host system through the interface device.
The primary function of the Gateway
, then, is to translate host commands
into TIWAY I commands. These commands are described in Appendix C.
The TIWAY I Gateway supports data transmission rates from 1
second (bps) to 19.2 kbps with the host, and from 1
the network interface. T
able 1-1 summarizes the baud rates supported by
10 bps to 1
10 bits per
15.2 kbps on
the Foxboro, Honeywell, and Fisher host systems.
T
able 1-1
Host SystemData Transmission Rates Supported
110150300600120024004800960019.2k
Foxboro
Honeywell
Fisher
Data T
ransmission Rates Supported
T
ypes of Data
Accessed
The
Gateway allows access to discrete I/O points and Control Relays
(X, Y
, and C), holding registers (V
-memory), word input and output registers
(WX and WY), as well as performance statistics for each PLC network
interface. Information can be stored in variable (V) memory locations,
retrieved, and changed from the operator’s console of the distributed control
system. Appendix A provides information on the maximum numbers of
discrete inputs and outputs, holding registers, and word input registers.
Examples of data retrieval include the following:
•
If you want to retrieve a process control loop integer value from a PLC,
move this value into a register
, or V
-memory location, corresponding to
the one configured in the distributed control system (refer to the
appropriate DCS manuals).
•
If you want to look at the current value of a counter
into V
-memory (using the ladder logic program) to a location configured
, move this value
as a register in the host system.
Discrete inputs and outputs (Xs, Ys, and Cs) generally do not require special
conditioning in order to be read from the operator
’
s console (as in the Fisher
PROVOX system). See Appendix D for examples.
1-4
Product Overview
TIWAY I Gateway User Manual
Page 17
Chapter 2
2.1TIWAY
2.2Network
I Network and Gateway Installation Checklist
Quick
Refer
Basic
Installation Pr
Requirements
Overview2-4
Local
Line Cable Characteristics
TIWAY
I Network Characteristics
Local
Line Har
Tap
Housing
Terminating
Twisted-Pair
Important
Local
Line T
Basic
Considerations
Primary
Double
Short
Dr
Multidrop Taps2-9.
Cable
Obstructions2-11
Noise Avoidance2-11.
2.1TIWAY I Network and Gateway Installation Checklist
Quick Refer
ence
Installation Steps
Figure 2-1
TIWA
Y I Gateway
is a quick reference list of steps to be taken when installing the
. Refer to Chapter 3 for specific procedures and cautions.
Attach
AC power cable to the Gateway
Run diagnostic tests.
Connect the network and host interface cables.
Configure the host system.
.
Configure the Gateway dipswitches.
Check Gateway indicators for proper operation.
Configure the variable memory of PLCs on the TIWAY I network.
Figure 2-1 Basic
Installation and Set-up Steps
2-2
Network Installation
TIWAY I Gateway User Manual
Page 19
Basic Installation
Procedures
Some
basic procedures to follow when installing a Gateway system include
the following.
•
Be sure you have all components necessary to install the Gateway and
the network cables. (Refer to the checklist below for required parts.)
•
Install the TIWAY I network and host system interface cables (see
Section 2.2). Also refer to the appropriate host system installation
manuals for specific information on cabling between the host and the
Gateway.
•
Install the Gateway in a NEMA panel or other suitable enclosure (see
Chapter 3 for more details).
Requir
ements for
Installing the
Gateway
The items below are required to install the TIWAY I Gateway and to connect
it to a host system and the TIWAY I network.
TIWA
Y I Gateway
L-shaped mounting brackets and bracket screws, or optional rack
mount kit.
Host interface cable (included; PPX:2462553–0003)
Mounting screws (customer
AC power cable (customer
Loopback connector(s) for user
-supplied)
-supplied)
-initiated diagnostic test (included;
PPX:2703834–0001)
TIWA
Y I T
ap Housing (for Local Line installation) (PPX:500–5606)
T
ap cable for use with Local Line (customer
-supplied), or
RS-232-C/423 cable for use with modems (both cables and modems are
customer-supplied)
TIWAY I Gateway User Manual
Network Installation
2-3
Page 20
2.2Network Media Installation — Local Line
Overview
Line Cable
Local
Characteristics
TIWAY
I is a multi-drop communications network. It consists of a main
trunk cable (the “spine”) and dropline cables. The network can connect up to
248 secondaries to a host computer
NOTE:
Although addresses can range from 1 to 254 on TIWAY I, addresses
.
248 through 254 cannot be used because of the limitations of the Modbus
protocol.
The selection of the media interface depends primarily upon two criteria:
the distance to be spanned and the cost of installation. The main trunk can
be up to 25,000 feet long, and each dropline can be up to 100 feet long, with
Local Line. For distances exceeding 25,000 feet, the use of RS-232-C media
interfaces and modems is required.
If cable redundancy is required (two TIWAY I cables), you will need two
Gateways, two cables, and two host system interface devices. Refer to the
appropriate host system user manuals for more specific information on
redundant connections.
The TIWAY I Local Line is a physical signalling technique (baseband,
differential current drive) which operates over shielded, twisted-pair
cabling. The Local Line cable may be up to 25,000 feet long. The Local Line
uses tap housings to simplify the addition of connections onto TIWAY I.
The Local Line is designed to operate with shielded twisted-pair cable which
has a characteristic impedance of 124 ohms. The interface is a male, 9-pin
D-type connector with pin assignments as shown in T
T
able 2-1
PinNameDescription
1
2
3
4
5
6
7
8
9
Shield
LLM+
LLM–
Pin Assignments for Local Line Connector
Reserved
Reserved
Cable shield and signal common
Reserved
Reserved
Positive biased signal line
Reserved
Reserved
Negative biased signal line
able 2-1.
2-4
Network Installation
TIWAY I Gateway User Manual
Page 21
TIWA
Y I Network
Characteristics
The
TIWAY I network cable consists of a main cable or spine with droplines
or taps for each secondary
. The maximum main line cable length, cable type,
tap length, tap spacing, number of secondaries, and maximum baud rates
are interrelated network variables and have a direct influence upon
network performance.
Figure 2-2 shows the relationship of cable distance to the number of
secondaries for different baud rates for two types of twisted-pair cable. The
cable distance (in thousands of feet) is shown vertically; the maximum
number of units that may be attached is shown horizontally
.
30
25
20
15
10
8
7
6
5
4
3
Cable Distance (1000’s of feet)
2
1
19.2
kbps
38.4 kbps
57.6 kbps
1
15.2 kbps
1
15.2 kbps or lower
Cable
Figure 2-2 Number
Belden 9860
Belden 9271
1050100250
205
Unit Loading (Number of Stations)
of Local Line Secondaries vs. Cable Distance
I000000
As shown in Figure 2-2, when you use Belden 9860 cable (or its equivalent),
up to 75 stations can be attached to a network operating at 38.4 kbps and
having a spine length of 20,000 feet. At 1
a Local Line network having 248 stations is 10,000 feet.
TIWAY I Gateway User Manual
15.2 kbps, the maximum length of
Network Installation
2-5
Page 22
Network Media Installation — Local Line (continued)
Local Line
Hardware
Components
T
ap Housing
The
hardware components of a Local Line network consist of the following:
TIWA
Y I T
ap Housing (PPX:500–5606)
Shielded, twisted-pair cabling (customer
-supplied)
These components are described in the following sections.
The TIWAY I T
ap Housing, shown in Figure 2-3, is designed specifically for
Local Line networks. The tap housing can be mounted rigidly to a NEMA
panel or other enclosure. It could also be used to splice cables in a cable tray
without being rigidly mounted.
The tap housing contains terminating resistors, and it also provides noise
isolation for attached cabling, resists moisture, and relieves strain, thus
allowing an orderly connection to the TIWAY I network. One tap housing is
provided with each Gateway Local Line connection.
Siemens
NETWORK TAP HOUSING
MODEL 500–5606ASSY 2702766–0001
Siemens Industrial Automation, Inc.
2-6
Network Installation
G
W
B
T
op cover removed to show
cable connections.
Figure 2-3 TIWAY
GWB
I T
ap Housing
G
W
B
I000000
TIWAY I Gateway User Manual
Page 23
Ter
minating the
Main Line Cable
The
terminating resistors must be used to ensure that the main line cable is
properly terminated and biased for improved reliability
. Each tap housing is
supplied with terminating resistors to connect to the ends of the main line
cable. At each end, a terminating resistor must be connected between LLM+
and the cable shield and also between LLM– and the cable shield inside the
tap housing.
Network Cable
InputOutput
Twisted-Pair
Cabling
Important Planning
Considerations
W
G
B
Cable
to Module
Figure 2-4 Terminating
GWB
the Local Line
W
G
B
Termination
Resistors:
68
ohms
5%
1/4 watt
Siemens Industrial Automation recommends Belden 9860 twisted-pair
cabling or its equivalent for use as the Local Line network spine. Belden
9271 or its equivalent should be used for the dropline. Brands other than
those listed here will be specified by Siemens upon request.
Some major points to consider during the planning phase of a Local Line
network are the following.
•
From the start, allow for system growth. Make provisions for the
attachment of additional computing devices by routing cables through
all probable areas of future plant expansion.
I000000
•
•
•
TIWAY I Gateway User Manual
Always make the network flexible enough to allow for re-arrangement
of plant equipment.
Since network system noise is usually picked up by its interconnecting
wiring, take steps during installation to bypass or eliminate noise
sources.
If cable redundancy is required, make sure the two cables are never
routed along the same path, since the environmental and other factors
which disable one cable will very likely disable the second cable.
Network Installation
2-7
Page 24
Network Media Installation — Local Line (continued)
Local Line T
ap
Spacing Rules
Local
Line networks must adhere to specific tap spacing requirements to
maintain signal integrity
. These requirements are outlined in the following
sections.
100′100′
50′ min50′min50′30′
60′
100′
20′
Basic
Considerations
Primary Rule
I000000
Figure 2-5 Basic Tap Spacing Rules
The rules for determining the correct distances between taps exist simply
for the prevention of signal degradation caused by reflections.
Prior to configuring the distances between taps in the network cable, select
a single tap as a physical point to use as reference. This tap should be one of
the taps on the end of the network.
The primary rule is that the minimum distance from one tap to the next
cannot
(drop
be less than one half the distance of the previous tap cable
line) length. This rule should be applied starting at the first tap on the
network all the way to the end. Then, from the last tap on the network, the
same rule should be applied back to the first tap again.
2-8
Network Installation
TIWAY I Gateway User Manual
Page 25
Double Drop
80′
Drop
lines less
than 36 inches
can be ignored.
36″max
100′
max
Double Dr
ops
30′
100′
30″
50′ min
100′
I000000
Figure 2-6 Additional Tap Spacing Rules
If a tap cable is installed
less than the minimum
distance as stated in the
primary rule, then the two drops, the previous one and the one being
installed, are considered a
Double
drops are allowed, but triple drops are not allowed.
double
drop
.
After installing a double drop, the next tap must be placed at the minimum
distance or farther
. In this case, the minimum distance would be one half
the distance of the longest of the two tap lines making up the double drop.
Short Dr
ops
Drops that have a tap line that is
calculating the minimum distance between taps.
Multidr
op T
aps
There is no limit to the number of drop stations that can be connected to the
same tap line.
Each station must have its own tap, and the overall drop line length cannot
exceed 100 feet. The cable used to attach each station to the drop line
cannot
TIWAY I Gateway User Manual
less than 36 inches
exceed the 36-inch maximum.
can be ignored in
Network Installation
2-9
Page 26
Network Media Installation — Local Line (continued)
Cable Routing
!
CAUTION
Cable
routing should be planned as if the path between all stations on the
network were free of obstructions. The next step is to modify the first
routing to account for obstructions, then calculate the amount of cable
needed.
Observe
all local and national electrical and fire codes when
installing wiring.
In
general, there are three types of network cabling routes:
•Under-floor
•In-ceiling
•
Surface ducting
Any combination of these three routes may be used on a single network. The
choice is often determined by whether or not the building (or buildings) in
which the network is being installed is new construction or an existing
building. The following paragraphs describe some of the advantages and
disadvantages of each type of cable routing.
Under-floor
ducts or
in ducts are usually expensive, and while they are better
— For under
-floor routing, the cable can be enclosed within
, with raised flooring, in the “open air
.” Under
-floor systems enclosed
-protected against
unauthorized taps than are open-air systems, they often make future
expansion of the network more difficult and expensive.
Open-air under
maximum network expansion and flexibility
In-ceiling
-floor cabling systems usually provide good access, and allow
.
— For in-ceiling routing, network cables are usually supported
in troughs or with hooks and clamps every 10 or 15 feet. Some advantages
of in-ceiling installation are the following.
•Flexibility
•
Low-cost installation
•
Accessibility to cabling
2-10
Network Installation
TIWAY I Gateway User Manual
Page 27
Some
disadvantages are the following.
•
Is is impractical for buildings without drop ceilings
Obstructions
•W
•
Surface
orking in high ceilings can be hazardous
Ceilings often collect dust and other debris
ducting
— Surface ducting for network cabling is usually
installed along the baseboards or is attached to walls at desktop height.
While surface ducting ordinarily protects cables from both physical and EMI
effects, it may also require that network computing devices be positioned
near a wall.
Aside from physical obstructions such as posts, walls, and partitions,
electrical interference should also be avoided. Some sources of interference
are the following.
•
Power distribution mains
•
Arcing motors
•
Fluorescent lighting
•Teletypes
Undesired signal transfer (cross-talk) between adjacent circuits
•
•
Noise A
voidance
In general, network cabling should never come into direct contact with any
electrical conductor
should be grounded in accordance with applicable electrical codes. Keep a
minimum of three feet of distance between all network cabling and the
following sources of noise.
•
•
•Transformers•
•Rectifiers•
TIWAY I Gateway User Manual
Poor cable-to-equipment impedance matching
. If cabling is installed inside a conduit, the conduit
Power lines
Electric motors
•Generators
•
Electric welders
Induction furnaces and heaters
All sources of microwave radiation
Network Installation
2-11
Page 28
2.3Network Media Installation — RS-232-C Modem Interface
Data Transmission
Characteristics
RS-232 Pin
Assignments
The
physical layer in TIWAY I provides a modem interface for synchronous
or asynchronous communications at data transmission rates up to 1
15.2 K
bps. The modem interface provides standard signals for control of two-way
alternate data transmission using both half and full duplex modems.
The modem interface is a standard T
ype E DTE configuration as defined in
the EIA RS-232-C standard. This interface uses a male 25-pin D-type
connector plug on the communication cable. The pin assignments are listed
in T
able 2-2.
T
able 2-2 RS-232-C Connector Pin Assignments
Pin No.Description
1Protective Ground
2Transmit Data
3Receive Data
4Request to Send (RTS)
5Clear to Send (CTS)
6Data Set Ready (DSR)
7Signal Ground
8Receive Line Signal Detector/Data Carrier Detect (RLSD/DCD)
15Transmitter Signal Element Timing
17Receiver Signal Element Timing
20Data Terminal Ready (DTR)
2-12
Network Installation
TIWAY I Gateway User Manual
Page 29
Chapter 3
Gateway
3.1Installing
Basic
Power
3.2Dipswitch
Overview3-6
Dipswitch
Dipswitch
3.3Switches
Online/Offline
Self-Test
Reset
Status
Gateway
Comm
Online3-11
Receive3-11
Transmit3-11
Test
are three possible places on the Gateway where the two L-shaped
mounting brackets can be located. Depending on how you want to mount the
Gateway
, attach the brackets to the appropriate locations, as shown in
Figure 3-1.
Mounting brackets
located at top of
Gateway
!
CAUTION
Gateway mounted behind panel.
Brackets attached at front
Figure 3-1 Possible
Bracket Locations for Mounting Gateway
Mount the Gateway in a suitable enclosure (such as a NEMA panel) to
reduce the possibility of shock hazard resulting from accessibility of live
parts. Protect the Gateway from water or moisture sprays, and ensure that
the temperature does not exceed the range of 0° to 60° C.
Y
ou can also mount the Gateway in a 19-inch rack. A rack mount kit is
available from Siemens with the following order numbers. (Refer to the
Installation Guide shipped with each rack mount kit.)
PPX:500–7205 — for use with Gateway models –7301 and –7303
PPX:500–7206 — for use with Gateway models –7302 and –7304
Be
sure to allow adequate air flow around the air vents of the
Gateway to avoid damage to the unit through overheating.
I00xxxx
3-2
Gateway Installation and Configuration
TIWAY I Gateway User Manual
Page 31
Power Connections
and Initialization
After
mounting the unit in an appropriate location, follow these steps for
connecting the power supply and running diagnostic tests.
1.
Remove the shield covering the three AC terminals (Line, Ground, and
Neutral).
2.W
ith power off, attach all three connections according to Figure 3-2 and
then replace the shield.
3.
4.
5.
TIWAY I Gateway User Manual
AC
Power
Connections
I00xxxx
Figure 3-2 AC
Power Connections
Apply power to the unit.
Install loopback connector on each RS-232 port.
Set the Online/Offline switch on the Gateway to the OFFLINE position.
Gateway Installation and Configuration
3-3
Page 32
Installing the TIWAY I Gateway (continued)
6.Run
7.
8.
9.
10.
11.
the user
Remove loopback connector
-initiated test. (Refer to the Diagnostics T
.
ests section.)
Set the Online/Offline switch on the Gateway to the ONLINE position.
Connect the Local Line or RS-232 interface cable to the TIWAY I port.
Connect the host system interface cable to to the host port.
Configure the communications parameters on the host system. Make
sure that the host system baud rate matches the rate you plan to set on
the Gateway
12.
Set the dipswitches on the Gateway
.
. Be sure to set the parity
and synchronous/asynchronous selections to match the corresponding
settings on the host system. (See Figure 3-3 and Section 3.2.)
13.
Check to see that the GA
TEWA
Y GOOD, TRANSMIT
, and RECEIVE
indicators on the Gateway are on, and that TEST is flashing.
14.
Configure the data and status registers in the variable memory of the
PLCs on the TIW
for more information if necessary
Press the RESET button on the Gateway
15.
A
Y I network. (Refer to the appropriate PLC manuals
banks of dipswitches are located behind the access cover on the front of
the Gateway
. One is for the host port and the other is for the network port.
The following sections define the switches and describe the effect they have
on the Gateway’
s operation.
There are eight configuration switches for the host port, and ten for the
network port. The switch settings are binary coded so that Switch 1
represents the most significant bit (MSB) and Switch 8 or 10 represents the
least significant bit (LSB).
When setting the dipswitches on the Gateway
, check to make sure that the
settings match those on the host system and the network.
NOTE:
Most of the dipswitch settings are read by the Gateway only after a
reset. Any changes made to the dipswitch settings must be followed by a
reset. (Network port switches 7 and 10 are read and updated every scan.)
T
able 3-1
SwitchFunctionConfiguration Settings
Host Port Dipswitch Configuration
1
– 4
SwitchFunctionConfiguration Settings
1
– 4
10Discrete Output type selectSystem-dependent; see page 3-9
Baud Rate:
(1
10 bps to 19.2 kbps)
5Asynchronous/SynchronousAsynchronous
6Full/Half DuplexSystem-dependent; see page 3-7
7Parity On/OffSystem-dependent; match host system
8Even/Odd ParitySystem-dependent; match host system
T
able 3-2
Baud Rate
(1
10 bps to 1
5Asynchronous/SynchronousSystem-dependent; see page 3-8
6Full/Half DuplexSystem-dependent; see page 3-9
7IDT Data Addressing ModeSystem-dependent; see page 3-9
8NRZI/NRZ EncodingAsynch = NRZI; Synch = NRZ or NRZI
9Test/OperateAlways set to Operate (0)
Network
15.2 kbps)
Set these to match baud rate setting of
the host system.
Port Dipswitch Configuration
Set to desired TIWAY I baud rate; see
Figure 3-3.
3-6
Gateway Installation and Configuration
TIWAY I Gateway User Manual
Page 35
Dipswitch Settings
for the Host
Inter
face Port
The
8-switch bank governs the host interface. The following paragraphs
describe the switch-selectable options for setting the host interface
parameters.
Data T
port, T
ransmission Rate Selection
(Switches
1 through 4): For the host
able 3-3 shows what data transmission rates are supported on the
listed host systems. (Refer to Figure 3-3 for the host baud rate dipswitch
settings.)
able 3-3
T
Host SystemData Transmission Rates Supported
110150300600120024004800960019.2k
Foxboro
Honeywell
Fisher
Asynchronous/Synchronous
Data T
ransmission Rates Supported
Operation
(Switch 5):
The Synch/Asynch
switch is used for modem operation. In the synchronous mode, transmitter
signal element timing is used to send
transmit
data. The transmitter and
receiver signal timing elements are supplied by the modem. In the
asynchronous position, the modem does not supply receiver or transmitter
timing elements and the Gateway uses internal clocks to determine
data sample points and to send
transmit
data. Y
ou should use the
receive
asynchronous setting.
Full/Half
selects operation compatible with full or half duplex modems even though
communication with the Gateway is half duplex only
Half-duplex operation, the Gateway does not activate the Request to Send
circuit before Data Carrier Detect becomes inactive. T
between Data Carrier Detect and Request to Send are ignored when full
duplex is selected. When you are using a half-duplex modem, you should use
the Half-duplex setting; with a full-duplex modem, use the Full-duplex
setting.
Parity
in all data transmissions.
Even/Odd Parity (Switch 8):
enable parity
TIWAY I Gateway User Manual
Duplex Operation
Enable/Disable
(Switch 6):
(Switch 7):
If Switch 7 (Parity Enable/Disable) is set to
, switch 8 selects even or odd parity
Gateway Installation and Configuration
the Full/Half Duplex switch
. When you select
iming relationships
This will either enable or disable parity
.
3-7
Page 36
Dipswitch Configuration and Function (continued)
Dipswitch Settings
for the Network
Inter
face Port
The
10-dipswitch bank governs the network communications port. The
following paragraphs describe the switch-selectable options available for the
network port.
Data T
network supports the following data transmission rates: 1
1200, 2400, 4800, 9600, 19200, 38400, 57600, and 1
ransmission Rate Selection
(Switches
1 through 4): The TIW
10, 150, 300, 600,
15,200 bits per second.
AY I
Set the dipswitches according to the chart in Figure 3-4.
The Synch/Asynch
switch is used for modem operation. In the Synchronous mode, the Gateway
uses the transmitter signal element timing to transmit data. The
transmitter and receiver signal timing elements are both supplied by the
modem. In the Asynchronous position, the modem does not supply receiver
or transmitter timing elements and the Gateway uses internal clocks to
determine
receive
data sample points and to send
transmit
data. Y
ou should
select Asynchronous operation when you are using the Local Line.
3-8
Gateway Installation and Configuration
TIWAY I Gateway User Manual
Page 37
Full/Half
Duplex Operation
(Switch 6):
the Full/Half Duplex switch
selects operation compatible with full or half-duplex modems even though
communication with the Gateway is half-duplex only
. When you select
Half-duplex operation, the Gateway does not activate the Request to Send
circuit before Data Carrier Detect becomes inactive. T
iming relationships
between Data Carrier Detect and Request to Send are ignored when full
duplex is selected. When you are using a half-duplex modem, you should use
the Half-duplex setting; with a full-duplex modem, select Full-duplex.
Modbus/IDT
Data Addressing
(Switch 7):
Set this switch to the On (1)
position to implement a data addressing scheme for the IDT family of
operator interface products. Set this switch to the Off (0) position to select
standard Modbus data addressing.
NRZI/NRZ Encoding (Switch 8):
The NRZI/NRZ (non-return to zero
inverted/non-return to zero) switch selects the type of encoding to be used
during network communication. The NRZI encoding option is required for
asynchronous operation. Either NRZI or NRZ may be used with
synchronous operation, but NRZ encoding is recommended.
Test/Operate (Switch 9):
Y
ou should always set this switch to Operate.
Y/C Coil T
secondary’
ype Select
s Control Relay (C) memory when set to On (1). In the Off (0)
position, coil information is collected from Discrete Output (Y) memory
This switch selects either T
est or Operate mode.
(Switch 10): This switch collects coil data from a
.
TIWAY I Gateway User Manual
Gateway Installation and Configuration
3-9
Page 38
3.3Switches and Indicator Lights
Reset
Self-Test
Online
Online/Offline
Offline
I000000
Online/Offline
Switch
Self-T
est Button
Reset Button
Figure 3-5 Gateway
Operation Switches
The Online/Offline switch, when placed in the Online position, allows the
Gateway to communicate with the network and the other systems connected
to the Gateway
. In the Offline position, the Gateway is disconnected from
the network. This prevents access to the network while secondaries are
being changed or while maintenance is being performed. The position of this
switch is read before each communication cycle, so a reset of the Gateway is
not necessary each time the Online/Offline switch position is changed.
The Self-T
est button initiates a set of Gateway diagnostic tests, including a
standalone Gateway communications loopback test. This test requires a
special hardware set-up, using the loopback connector supplied with the
Gateway
T
ests. The Gateway must have the Online/Offline switch in the Offline
. This procedure is described more fully in the section on Diagnostic
position to initiate the diagnostic tests.
Pressing the Reset button causes a hardware reset of the Gateway and
initiates the power
more detail in the section on Diagnostic T
-on diagnostic test. The power-on test is explained in
ests.
3-10
Gateway Installation and Configuration
TIWAY I Gateway User Manual
Page 39
GATEWAY
GOOD
COMM ACTIVE
ON
= All tests passed successfully
ON = Communication in progress
Status
Indicator
Lights
Gateway Good
Comm Active
ONLINE
RECEIVE
TRANSMIT
TEST MODE
Figure 3-6 Indicator
ON = Communicating with network
ON = Receiving data
ON = T
ransmitting data
ON = In test mode (test button pressed)
Flashing = T
ests completed successfully
Lights
I000000
The six indicator lights on the front panel of the Gateway show module and
communication status, as described in the following paragraphs.
If the GA
TEWA
Y GOOD indicator is lit, it means that all power
-on/reset or
run-time diagnostic tests have been passed successfully. If the indicator is
flashing or not lit, one of the Gateway components has failed a diagnostic
test, and the Gateway is inoperable. If a reset does not remedy the
situation, you should return the unit for repair
.
The COMM ACTIVE indicator is lit continuously while any communication
is in progress. It is not lit while the Gateway is in T
est mode.
Online
The ONLINE indicator is lit while the Gateway is communicating with the
network. However
Online/Offline switch in the Offline position, the Online indicator will not be
lit at any time.
Receive
The RECEIVE indicator is lit when the Gateway is receiving data on either
port.
Transmit
The TRANSMIT indicator is lit when the Gateway is transmitting data on
either port.
The
T
est Mode
TEST MODE indicator lights when you press the Self-T
the Gateway is in T
tests are being performed, and flashes when they are successfully
completed.
TIWAY I Gateway User Manual
, if you have taken the Gateway off-line by placing the
est button and
est mode. The indicator remains lit while the diagnostic
Gateway Installation and Configuration
3-11
Page 40
3.4Diagnostic Tests
Built-In Diagnostic
Tests
Power
-On T
est
The
Gateway has five levels of built-in tests, three of which are designed for
the user
•Power
•
•User
•
•
The Power
.
-on test
Operational Diagnostic test
-initiated test
Burn-in test
Final test
Used only in quality
assurance tests by
manufacturer
-on test executes the initialization routine following a master
reset. All indicators light for approximately one second before any subtests
begin. The only indicator which will be lit while the tests are running is the
TEST MODE indicator. If the Gateway passes all tests successfully
GATEWA
Y GOOD indicator will light.
, the
The subtests include a RAM data and address integrity test, a ROM CRC
integrity test, and a communications controller internal loopback test.
If the Gateway fails any of the power
indicator will
flash.
-on tests, the GA
TEWA
Y GOOD
Operational
Diagnostic T
est
The
Operational Diagnostic test executes during all normal modes of
Gateway operation, off-line or on-line. The subtests do not disturb normal
operation of the network. They are performed at least once per minute
under all conditions.
An operational diagnostics failure is treated in the same way as a power
test failure. The GA
TEWA
Y GOOD indicator will
flash
if the Gateway fails
any diagnostic test.
-on
3-12
Gateway Installation and Configuration
TIWAY I Gateway User Manual
Page 41
User-Initiated Test
You
should run the user
-initiated test only when the Gateway is in Off-line
mode (that is, when the On-line/Off-line switch is in the OFFLINE position).
Normal Gateway operation is suspended during this test mode.
NOTE: Before initiating the diagnostic routine, make sure that the network
and host computer cables are disconnected from the Gateway
Gateway is in off-line mode. Only the GA
TEWA
Y GOOD indicator should be
, and that the
lit. If ONLINE is lit, you must first reset the Gateway before running the
test.
1.
Install a loopback connector on each RS-232-C port; (without one, the
port will fail the external loopback subtest). T
line connections made by the loopback connector
T
able 3-4
Pin #to Pin #Signalto Signal
23Data outData In
45Request to Send (RTS)Clear to Send (CTS)
206,8Data Terminal Ready (DTR)Data Set Ready (DSR) /
RS-232-C/423 Loopback Connections
able 3-4 shows the signal
.
Data Carrier Detect (DCD)
2.Press
The diagnostics will perform internal and external loopback, jabberstop*,
and data rate subtests to each channel. If a media card is missing or is bad,
the test will fail. The subtests for the user
the following.
•
•
•Serial
•Transmitter/Receiver
•V
•
*The
TIWAY I Gateway User Manual
the SELF-TEST button to start the user
-initiated test.
-initiated diagnostic test include
RAM data and address line verification (internal and external RAM)
ROM integrity using CRC and checksum
Communications Chip (SCC) using internal loopback and baud rate
via external loopback and jabberstop
erification of watchdog timer
Indicator operation
jabberstop is a Gateway feature which prevents a device from monopolizing the network.
Gateway Installation and Configuration
3-13
Page 42
Diagnostic Tests (continued)
T
able 3-5
test according to the status of the indicator lights.
appendix provides information on which Siemens PLCs are supported
by the Gateway
the host systems. Also included in this appendix are a list of features added
to the latest release of the Gateway and a list of hardware specifications.
T
able
A-1 shows the correspondence between data types configured in the
host systems and the data retrieved from SIMA
, and how SIMA
T
able A-1
TIC TI data types correspond to those of
TIC TI PLCs.
Data T
ype Identification
PLC Data TypeFisher
Data Type
V-Memory
(12 LSBs*)
WX-Memory
(12 LSBs*)
Y (discrete outputs) or
C (control relays)
X (discrete inputs)N/ADiscrete ContactsDigital Inputs
V-Memory WordsInput Register
WX-MemoryN/A
V-MemoryN/AN/AAccumulated
*Least
significant bits
N/A12-bit Binary from
N/A12-bit Binary from
Digital PointsDiscrete CoilsDigital Outputs
Foxboro
Data Type
Holding Registers
Input Registers
16-bit W
Holding Registers
16-bit W
Input Registers
ord from
ord from
Honeywell
Data Type
N/A
N/A
Analog Outputs
Analog Inputs
Value
A-2
Data Type Identification
TIWAY I Gateway User Manual
Page 45
A.2SIMATIC TI PLCs Supported by TIWAY I Gateway
T
able
A-2
shows all the PLCs supported by the TIWAY I Gateway and lists
the maximum number of discrete points, V
input memory locations which are accessible from the Gateway
TIWAY I Gateway FeaturesBefore Rel. 1.3 Release 1.3
TIWAY
I Gateway Featur
es
User-defined commands for IDT products
Message resynchronization after timeout
Selectable coil type (Y or C)
IDT data addressing scheme
Command support:
Read inputs
Read outputs
Read holding register
Read input register
Write holding register
Read exception status
Loopback test
Get communications event counter
Get communications event log
Write multiple coils
Write multiple holding registers
T
able A-4
Network Communication1 channel per unit
Compatible PLCs
Host port interfaceRS-232-C/423
Maximum cable length25,000 feet (Local Line); 50 feet (RS-232-C/423)
Network port interfaceRS-232-C/423 or Local Line
Data link protocolHDLC with 16-bit cyclic redundancy error checking (CRC–CCITT)
Network data rates1
Host port data rates1
Modem types supportedAsynchronous/synchronous
Network undetected bit error rate
Unit size
Unit power consumption
Operating temperature
Storage temperature
Operating humidity range0% to 95% relative humidity, noncondensing
Agency approvals
is extremely important to keep complete, up-to-date records on system
configuration. This appendix provides some sample record-keeping forms for
use with a TIWAY I Gateway system.
T
able B-1
System Configuration For
m
ReferencePLC Type &
Number
NIM Base/Slot
Number
Block #Status WordV Offset
1V
2V
3V
4V
5V
6V
7V
8V
B-2
System Configuration Forms
TIWAY I Gateway User Manual
Page 49
B.2V-Memory
Of
fset Tables
T
able B-2
PLC #Base/Slot #Number of WordsV Offset
Word
#
1
2
3
4
5
6
7
8
V-Memory
Moved FromWord/Image RegisterComments
Of
fset T
able (Resident Infor
mation)
T
able B-3
PLC #Base/Slot #Number of WordsV Offset
Word
#
1
2
3
4
5
6
7
8
V-Memory
Moved ToWord/Image RegisterComments
Of
fset T
able (Received Infor
mation)
TIWAY I Gateway User Manual
System Configuration Forms
B-3
Page 50
Appendix C
C.1Modbus
The R
TU T
Message
The
Addr
The
Function Field
The
Data Field
ChecksumC-3
Invalid
Modbus
AddressingC-5
Address
C.2Modbus
IntroductionC-6
Code
01 — Read Coil Status
Code
02 — Read Input Status
Code
03 — Read Output Registers
Code
04 — Read Input Registers
Code 05 — W
Code 06 — W
Code
appendix describes the Modbus protocol in detail. For each of the
Modbus functions described, examples of requests and responses are given.
T
able C-1 describes the Modbus functions supported by the Gateway
.
able C-1
T
CodeTypeDescription
01Read Coil StatusGet current status of a group of coils.
02Read Input StatusGet current status of a group of discrete
03Read Holding RegisterGet current values from holding registers.
04Read Input RegisterGet current values from input registers.
05Force a Single CoilChange the state of a logic coil to On or
06Write a Single RegisterWrite a value into a holding register.
07Read Exception StatusGet the 8 internal status coil values.
08Execute DiagnosticsSend diagnostic tests to a slave.
11Get Communications
Event Counter
12Get Communications
Event Log
15Write Multiple CoilsChange a number of consecutive coils.
16Write Multiple RegistersWrite values into a series of consecutive
Modbus Functions Supported
inputs.
Off, forced On or forced Off, or unforced.
Enable the success or failure of a query to
be determined.
Get the communications log for Modbus
network transactions.
holding registers.
The R
TU
T
ransmission Frame
C-2
Modbus Commands
The
TIWAY I Gateway operates in the RTU transmission mode. The RTU
mode determines the start and finish of a message based on a time period of
silence (no transmission) equivalent to the time it would take to transmit
3.5 characters at the chosen baud rate. The RTU transmission frame is
shown in Figure C-1.
AddressFunctionDataChecksum
8
bits
T1 T2 T3 . . . represents a time of 3.5 characters at given baud rate.
8 bits
Figur
e C-1
n x 8 bits
16 bits
RTU Transmission Frame
TIWAY I Gateway User Manual
No data
T1 T2 T3
I000000
Page 52
Message
Delineation
The
start and finish of a message is determined by timing in RTU mode.
Any time longer than 3.5 character lengths marks the end of a
transmission. The next character after that would then mark the start of
the next message. This time period is dependent on the baud rate. T
able C-2
shows the effect of baud rate on the time period (assuming 2 stop bits).
T
able C-2RTU T
Baud RateTime (ms)
iming
The Addr
ess Field
The Function Field
The Data Field
19200
9600
7200
4800
3600
2400
1800
1200
600
300
200
150
110
The
Address field identifies the node to which this message is being sent
2.2
4.4
5.9
8.8
11.7
17.5
23.4
35.0
70.0
140.0
210.0
280.0
383.0
and is a number in the range of 1 to 247. Each node on any one network
must have a unique address. Only those nodes addressed will respond
unless the broadcast address 0 is used. In that case, each slave will read
and act on the message but not respond.
The Function field is an 8-bit code that determines the action that a slave
takes when receiving the message. These function codes are summarized in
T
able C-1 and described in more detail with examples in section C.2.
The Data field contains the information needed by the specified node to
perform the required operation, or the information returned by the node to
the host computer
.
Checksum
The checksum needs 16 bits and uses the Cyclic Redundancy Checksum
(CRC) method. The calculation of this checksum is described in the
Protocol Reference Manual
TIWAY I Gateway User Manual
Modbus
.
Modbus Commands
C-3
Page 53
Modbus Protocol Overview (continued)
Invalid Characters
and Messages
Modbus Functions
The
Gateway ignores messages that contain invalid characters. Messages
containing the following errors will also be ignored.
•
Incorrect checksum
•
Parity error
•
Framing errors
•
Incomplete transmission
This section outlines some of the differences between Modbus and TIW
network commands.
•
Whereas Modbus uses
Functions Codes, TIWAY I uses
Primitives.
Primitives differ from Function codes in one important way: primitives
use TT
W
•
For all SIMA
-types to allow one primitive to address different types of data.
ith Modbus a different function code is required for each type of data.
TIC TI Series 505 PLCs, the first address for each type of
memory is always 1. Modbus PLCs by comparison allow 0 as the first
legal address.
•
If each system were to return one byte (8 bits) representing eight
discrete coils, they would each be positioned as shown in Figure C-2.
AY I
C-4
Modbus Commands
Modbus PLCsSIMATIC TI PLCs
Coil
No.
8
765432187654321
MSBLSB<
< <
Figur
e C-2
Coil No.
MSBLSB
Bit
Orientation
< < <
TIWAY I Gateway User Manual
I000000
Page 54
Addressing
•Terminology
differences in terms are given in T
Modbus-based PLCsSIMATIC TI PLCs
CoilDiscrete output (Y) or Control Relay (C)
Input RegisterWord Image Register (WX/WY)
Holding RegisterVariable Memory (V-memory)
SlaveSecondary Node
P/C (Programmable Controller)PLC
Function codePrimitive
ModbusTIWAY I
Disabled (coil)Forced
Enabled (coil)Unforced
The
TIWAY I Gateway uses the absolute position of the data for the address.
is another area in which differences occur
able C-3.
T
able C-3
Ter
minology Dif
ferences
. Some of the
That is, if you want to address the 3066th coil, then that is the address you
pass with the command (as hexadecimal value BF
A). The maximum address
is 65535 (FFFF hex). For example, if you want to access 1000 coils starting
at the 703rd coil, the Function Code 01 would be as follows:
Addr
ess Limits
Modbus imposes a buffer size limit of 256 bytes. Because of this restriction,
TIWA
The
shown above. What the checking does
the available PLC memory
particular PLC, the command will be rejected by the PLC and the host
computer will be notified by the Exception Code 02.
TIWAY I Gateway User Manual
01 01 02 BF 03 E8 0C E8
Y I Gateway requests have been limited to the following values.
command checking will reject requests for data greater than the limits
not
do is check the request against
. When a request goes beyond the memory of a
Modbus Commands
C-5
Page 55
C.2Modbus Function Descriptions
Introduction
Code 01 — Read
Coil Status
!
WARNING
In
the descriptions that follow
, each function starts on a separate page and
includes the TIWAY primitive sent to the secondary in square brackets. For
each function, an example of request and response is given.
Code 01 enables the user to read the On/Off values of logic coils. The data
passed with this command is the start address and the number of coils to be
read. Addressing is sequential up to the maximum memory size for a
particular PLC. The maximum number of coils that can be addressed with
one command is 2000. If more are requested, the whole command will be
rejected with an Exception code 03.
SIMATIC
TI PLCs number memory locations starting at address 1.
Modbus PLCs number areas of memory starting from address 0.
Failure to alter host computer application programs may result in
the wrong bits being read.
Example:
Request:07 01 000A 0005 XXXX
Checksum (XXXX)
Number of points (0005)
Start point (000A)
Function code (01)
Slave address (07)
C-6
This request is asking the Gateway to return the data from 5 coils (On/Off)
starting at the 10th coil.
[This is equivalent to sending a TIWAY Primitive 20 request using TT
(Packed Discrete Outputs) or TT
position of Switch 10 of the network dipswitch bank in the Gateway
Modbus Commands
Figur
e C-3
Read
Coil Status Example — Request
-type 8 (C Packed), depending on the
TIWAY I Gateway User Manual
I000000
-type 7
.]
Page 56
Response:07 01 01 1A XXXX
Checksum (XXXX)
Data (1A)
Number of bytes (01)
Function code (01)
Slave address (07)
I000000
Figur
e C-4
Read
Coil Status Example — Response
The response returns in the data field a single byte (1A) which contains the
1’
s or 0’
s for the 5 coils, packed out with zeros for the three high bits.
02 allows the application to read a series of discrete inputs. The
command includes the start address and the number of points to be read.
Addressing is sequential up to the maximum memory size for a particular
PLC. The maximum number of inputs that can be addressed with one
command is 2000. If more are requested, the whole command will be
rejected with an Exception code 03.
Example:
Request:07 02 000A 0005 XXXX
Checksum (XXXX)
Number of points (0005)
Start point (000A)
Function code (02)
Slave address (07)
I000000
Figur
e C-6
Read
Input Status Example — Request
This request is for the data from 5 discrete inputs (On/Off) starting at the
10th input.
[This command is equivalent to sending a TIWAY I Primitive 20 request
using TT
-type 6 (Packed Discrete Inputs)].
Response:07 02 01 1A XXXX
Figur
e C-7
Read
Input Status Example — Response
Checksum (XXXX)
Data (1A)
Number of bytes (01)
Function code (02)
Slave address (07)
I000000
C-8
Modbus Commands
TIWAY I Gateway User Manual
Page 58
The
response returns in the data field a single byte (1A) containing the 1’
or 0’
s for the 5 discrete inputs, packed out with zeros for the three high bits.
03 allows you to read the contents of holding registers in the attached
secondary device. The data field of this command includes the start address
of the registers and the number of registers to be read.
Addressing is sequential up to the maximum memory size for a particular
PLC. The maximum number of registers that can be addressed with one
command is 125. If more are requested, the whole command will be rejected
with an Exception code 03.
[This command is equivalent to issuing a TIWAY I Primitive 20 request with
a TT
-type 01 (V
ariable Memory)].
Example:
Request:07 03 0064 0003 XXXX
Checksum (XXXX)
Number of registers (0003)
Address of first register (0064)
Function code (03)
Slave address (07)
I000000
Figur
e C-9
Read
Output Register Example — Request
This request is for secondary address 7 to read the contents of registers
0064, 0065, and 0066 (100, 101, and 102 decimal).
Response:07 03 06 032C 0001 0030 XXXX
Checksum (XXXX)
3rd register value (0030)
2nd register value (0001)
1st register value (032C)
Number of bytes (06)
Function code (03)
Slave address (07)
I000000
Figur
e C-10
Read
Output Register Example — Response
The response has returned the number of bytes of data (06) and the values
for the requested registers; these are 032C, 0001, and 0030 respectively
(812, 1, and 48 decimal).
C-10
Modbus Commands
TIWAY I Gateway User Manual
Page 60
Code 04 — Read
Input Registers
Code
04 allows you to read the contents of input registers in the attached
PLC. These registers hold the values returned by the I/O devices. The data
field of this command includes the start address of the registers and the
number of registers to be read.
Addressing is sequential up to the maximum memory size for a particular
PLC. The maximum number of registers that can be addressed with one
command is 125. If more are requested, the whole command will be rejected
with an Exception code 03.
[This command is equivalent to issuing a TIWAY I Primitive 20 request with
a TT
-type 09 (W
ord input WX)].
Example:
Request:07 04 0008 0001 XXXX
Checksum (XXXX)
Number of registers (0001)
Address of first register (0008)
Function code (04)
Slave address (07)
I000000
Figur
e C-11
Read
Input Register Example — Request
This request is for secondary address 7 to read and return the value stored
in input register 0008.
Response:07 04 02 0020 XXXX
Checksum (XXXX)
Input register value (0020)
Number of bytes (02)
Function code (04)
Slave address (07)
I000000
Figur
e C-12
Read
Input Register Example — Response
The response has returned the number of bytes of data (02) and the value
0020 (32 decimal) from the requested input register (0008).
TIWAY I Gateway User Manual
Modbus Commands
C-11
Page 61
Modbus Function Descriptions (continued)
Code 05 — W
Single Coil
!
WARNING
rite a
Code
05 allows a designated coil [discrete output Y or C, depending on the
position of Switch 10 on the network dipswitches] to be written. Depending
on the code passed in the data field, it can be changed to On (1) or Off (0),
forced On or Off, or unforced. The two-byte codes are the following.
FF00 (hex)
0000 (hex)OFF.
. . . . . . . . .
. . . . . . . . . .
ON.
NOTE: All other values are illegal and will result in error response 03.
Where the Broadcast address (00) is used, the Gateway will send the change
coil command to all attached secondaries.
[This command is comparable to Primitive 30, using TT
-type 4 (Y coils) or
type 5 (Cs).]
Because
and SIMA
of differences in memory mapping between Modbus PLCs
TIC TI PLCs, you should be quite certain of the effects of
The response to Function Code 05 is to return the request as received. In
the case of a broadcast request, there is no response.
TIWAY I Gateway User Manual
Modbus Commands
C-13
Page 63
Modbus Function Descriptions (continued)
Code 06 — W
Single Register
rite a
Code
06 allows the contents of a holding register to be changed. Addressing
is sequential up to the maximum memory size for a particular PLC. This
function is limited to integer values contained in V
-memory
. The Gateway
will also direct any broadcast address (00) to all attached secondaries.
[This command is comparable to a TIWAY I request using Primitive 30 and
TT
-type 01 (V
ariable memory)].
Example:
Request:07 06 0064 0220 XXXX
Checksum (XXXX)
Data value (0220)
Register address (0064)
Function code (06)
Slave address (07)
I000000
Figur
e C-15
Write
a Single Register Example — Request
This request to secondary 7 is asking for the value of holding register 0064
(100 decimal) to be changed to 0220 (544 decimal).
Response:07 06 0064 0220 XXXX
Checksum (XXXX)
Data value (0220)
Register address (0064)
Function code (06)
Slave address (07)
I000000
Figur
e C-16
Write
a Single Register Example — Response
The response to Function Code 06 is to return the request as received. In
the case of a broadcast request, there is no response.
C-14
Modbus Commands
TIWAY I Gateway User Manual
Page 64
Code 07 — Read
Exception Status
Code
07 instructs the Gateway to read 8 predefined Cs within a secondary
.
This implementation will read the first 8 Cs in the discrete image register in
a secondary and pack them into one data byte.
NOTE:
The programmer of a non-Modbus PLC must make certain that the
application program running within the PLC will place meaningful data in
these locations. This data can reflect status information.
Example:
Request:11 07 XXXX
Checksum (XXXX)
Function code (07)
Slave address (11)
I000000
Figur
e C-17
Read
Exception Status Example — Request
This request to secondary 17 (decimal) is asking for exception status data.
Response:11 07 3B XXXX
Checksum (XXXX)
Data value (3B)
Function code (07)
Slave address (11)
TIWAY I Gateway User Manual
Figur
e C-18
Read
Exception Status Example — Response
Modbus Commands
I000000
C-15
Page 65
Modbus Function Descriptions (continued)
The
response shows that 3B (hex) has been returned. If the individual bits
are examined, they indicate the status of each bit.
08 enables diagnostic information to be retrieved to conduct network
testing. This function does not affect the operation of the PLC.
Example:
Request:02 08 0000 B405 XXXX
Checksum (XXXX)
Information Field (B405)
Diagnostic code (0000)
Function code (08)
Slave address (02)
I000000
Figur
e C-20
Execute
Diagnostics Example — Request
This example shows a request to conduct diagnostic test 0000. This is the
loopback query
Response:02 08 0000 B405 XXXX
, where the outgoing message field is returned unchanged.
Checksum (XXXX)
Information Field (B405)
Diagnostic code (0000)
Function code (08)
Slave address (02)
TIWAY I Gateway User Manual
Figur
e C-21
Execute
Diagnostics Example — Response
Modbus Commands
I000000
C-17
Page 67
Modbus Function Descriptions (continued)
T
able C-4
details the diagnostic codes supported.
T
able C-4
Diagnostic Codes Supported
Code
(hex)
00Return request messageYes
01Restart communications with the slaveYes
02Return diagnostics registerNo
03Change message end characterNo
04Set slave in listen only modeNo
0AClear counters and diagnosticsNo
0BReturn message countNo
0CReturn checksum error countNo
0DReturn exception countNo
0EReturn slave message countNo
0FReturn slave no response countNo
10Return slave NAK countNo
11Return slave busy countNo
12Return character overrun countNo
13Return overrun error countNo
14Clear character overrun countNo
Diagnostic DescriptionIs Code
Supported?
C-18
Modbus Commands
TIWAY I Gateway User Manual
Page 68
The
diagnostics codes supported are described in the following paragraphs.
Diagnostic
When
information field is returned to the host computer by the Gateway
Gateway will send Primitive 02 to the secondary
fatal error
Code — 00
0000 | any
data
Information frame
Diagnostic code
Function Code 08 uses diagnostic code 0000, any data passed in the
. The
. If the secondary has a
, communications loopback is not performed to indicate fatal error
The purpose of this command is to determine if the communications are
functioning correctly
described later
Diagnostic
Code — 01
, and may be used in conjunction with diagnostic tests
.
0001 | 00
or
0001 |
00
FF 00
Information frame
Diagnostic code
I000000
.
When
can contain 0000 or FF00. This function causes the Gateway to clear all
internal counters and registers. If the information frame contains FF00, the
Communications Event Log will be cleared. If any other value is passed in
the information field, the Communications Event Log will not be cleared,
and no response will be returned.
TIWAY I Gateway User Manual
I000000
Function Code 08 uses diagnostic code 0001, the information frame
Modbus Commands
C-19
Page 69
Modbus Function Descriptions (continued)
Code 11 — Get
Comms Event
Counter
Code 11 returns a 2-byte status word and an associated 2-byte event
counter
. The status word is defined in the Modbus Protocol Reference
Specification as being 0 for no command in progress and FFFF if a previous
command is in progress. The status will always be 0 in the Gateway
.
The event counter is incremented for every successful message; it is not
incremented for exceptions or polls, or for this code or Code 12. This code
can be used to determine if a single command was successful when a
communication error occurred during the request or response.
The event counter will increment to the value FFFF (65535 decimal), then
begin again from zero.
Example:
Request:15 0B XXXX
Checksum (XXXX)
Function code (0B)
Slave address (15)
I000000
Figur
e C-22
Get
Comms Event Counter Example — Request
In this example, secondary node 21 (15 hex) has been asked to return the
event counter and the associated status word.
Response:15 0B 0000 0143 XXXX
Checksum (XXXX)
Number of events (0143)
Status word (0000)
Figur
e C-23
Function code 1
Slave address 21 (15 hex)
Get
Comms Event Counter Example — Response
1 (0B hex)
I000000
The response shows that the status word is 0000 and that 323 (decimal)
events have occurred.
C-20
Modbus Commands
TIWAY I Gateway User Manual
Page 70
Code 12 — Get
Comms Event Log
Code
12 returns the same information as Function Code 1
1 plus a message
count and an additional 64-event byte. This means that a 2-byte status
word, a 2-byte event counter
, a message count, and the most recent 64
events are returned. A buffer records each send or receive operation and
overwrites the oldest event with the latest event. No events are recorded for
this code or Code 1
Request:10 0C XXXX
Figur
1. The Event Byte types are shown in T
Checksum (XXXX)
Function code (0C)
Slave address (10)
e C-24
Get
Comms Event Log Example — Request
able C-5.
I000000
This request to address 16 (decimal) is for the Exception Event Log.
Response:
Figur
10 0C 46 0000 0204 020B C0 00
e C-25
Get
Comms Event Log Example — Response
. . . XXXX
Checksum (XXXX)
2nd latest event (00)
Latest event (C0)
Message count (020B)
Event count (0204)
Status word (0000)
Byte count (46)
Function code 12 (0C hex)
Slave address (10)
I000000
The response has returned 70 bytes of data (2 status bytes + 2 event counter
bytes + 2 message counts + 64 event bytes). Only two of the event bytes are
shown; these indicate the secondary node was reset (00) and then received a
broadcast message (C0). The most recent events are returned first.
TIWAY I Gateway User Manual
Modbus Commands
C-21
Page 71
Modbus Function Descriptions (continued)
T
able C-5
Event ByteBit Definitions
Event
Byte T
ypes
Slave Bus Receive. Byte
stored on receipt of message
Slave Bus Transmit. Byte
stored when message sent
Initiate Communications
Reset. Complete log is set
to zeros.
Bit 0 – Reserved
Bit 1 – Set if communications error
Bit 2 – Reserved
Bit 3 – Reserved
Bit 4 – Set if character overrun
Bit 5 – Set if in Listen Only mode
Bit 6 – Set if Broadcast
Bit 7 – 1
Bit 0 – Set if an exception (1–3) is sent
Bit 1 – Set if secondary abort exception (6) is sent
Bit 2 – Set if secondary busy exception (6) is sent
Bit 3 – Not used
Bit 4 – Set if write timeout occurred
Bit 5 – Set if in Listen Only mode
Bit 6 – 1
Bit 7 – 0
Bit 0 – 0
Bit 1 – 0
Bit 2 – 0
Bit 3 – 0
Bit 4 – 0
Bit 5 – 0
C-22
Modbus Commands
TIWAY I Gateway User Manual
Page 72
Code 15 — W
Multiple Coils
rite
Code
15 allows the host computer to write multiple coils. When this
command is given, successive coils are changed, by an associated bit
pattern, to the indicated state; where each bit indicates:
1 = ON 0 = OFF
Addressing
secondary
is sequential up to the maximum memory size for a particular
. The maximum number of coils that can be addressed with one
command is 800. If more are given, the whole command will be rejected with
an Exception code 03.
The broadcast address (00) can be used to change the same coils in all
networked programmable controllers.
[This command is equivalent to TIWAY Primitive 30 using data types 04, 07
(Y unpacked, packed) or data types 05, 08 (C unpacked, packed), depending
on the position of network port Switch 10.]
Request: 07 0F 0012 000C 02 DC08 XXXX
Checksum (XXXX)
Coil status (DC08)
Number of bytes (02)
Number of coils (000C)
Start coil address (0012)
Function code (0F)
Slave address (07)
I000000
Figur
e C-26
Write
Multiple Coils Example — Request
This request is for the secondary node to change the values of 12 (0C hex)
coils starting at address 12 (18 decimal) to the states given by the following
bit pattern.
The bit pattern indicates that coils 19, 20, 21, 22, 24, 25, and 29 are to be
changed to ON and 18, 23, 26, 27, and 28 changed to OFF
TIWAY I Gateway User Manual
8
1 101D1 110C0 00001 000
Coil 25 (ON)
Figur
Coil 18 (OFF)
e C-27
Coil
Bit Patter
Coil 29 (ON)
n
.
Modbus Commands
Coil 26 (OFF)
I000000
C-23
Page 73
Modbus Function Descriptions (continued)
Response:07 0F 0012 000C XXXX
Figur
e C-28
Write
Checksum (XXXX)
Number of coils (000C)
Start coil address (0012)
Function code (0F)
Slave address (07)
I000000
Multiple Coils Example — Response
C-24
Modbus Commands
TIWAY I Gateway User Manual
Page 74
Code 16 — W
rite
Multiple Registers
Code
16 allows the host computer to write multiple values into successive
registers. Addressing is sequential up to the maximum memory size for a
particular PLC. The maximum number of registers that can be addressed
with one command is 100. If more are given, the whole command will be
rejected with an Exception code 03.
[This command is equivalent to a TIWAY I request using Primitive 30 with
TT
-type 01 (V
ariable memory)].
Request:
02 10 0078 0002 04 000B 0201 XXXX
Figur
e C-29
Write
Multiple Registers Example — Request
Checksum (XXXX)
2nd register data (0201)
1st register data (000B)
Number of bytes (04)
Number of registers (0002)
Start register address (0078)
Function code 16 (10 hex)
Slave address (02)
This request is to the secondary node to change the values of 2 holding
registers, starting at address 0078 (120 decimal) to 1
Response:02 10 0078 0002 XXXX
1 and 513 respectively
Checksum (XXXX)
Number of registers (0002)
Start register address (0078)
Function code 16 (10 hex)
Slave address (02)
I000000
.
The response to this command is to return the address, code, starting
address, and the numbers of registers to be changed.
TIWAY I Gateway User Manual
Figur
e C-30
Write
Multiple Registers Example — Response
Modbus Commands
I000000
C-25
Page 75
C.3User-Defined Modbus Commands
There
are three user
Gateway
. These commands, described below
with the IDT operator interface family of products.
-defined commands implemented in the TIW
AY I
, allow the Gateway to work
Command 65 —
Read C Memory
This command permits the collection of Control Relay (C) data. The format
of the command is as follows.
Request:aa 41 llll nnnn XXXX
Checksum (XXXX)
Number of points to collect (nnnn)
Starting point to collect from (llll)
Command 65 (41 hex)
Address (aa)
I000000
Figur
e C-31
Command
65 — Request
The response for this command is as follows.
Response:aa 41 bb dd
dd . . .
XXXX
Checksum (XXXX)
C data: 0 – of
Number of data bytes to follow (bb)
Command 65 (41 hex)
PLC TIWAY network address (aa)
f, 1 – on
C-26
Modbus Commands
Figur
e C-32
Command
I000000
65 — Response
TIWAY I Gateway User Manual
Page 76
Command 66 —
Read K Memory
This
command permits the collection of constant (K) memory
the command and response are as follows.
Request:aa 42 llll nnnn XXXX
Checksum (XXXX)
Number of locations to collect (nnnn)
Starting location to collect from (llll)
Command 66 (42 hex)
Address (aa)
Figur
e C-33
Response:aa 42 bb dddd . . . XXXX
Figur
e C-34
Command
Checksum (XXXX)
K-memory data
Number of data bytes to follow (bb)
Command 66 (42 hex)
PLC TIWAY network address (aa)
Command
66 — Request
66 — Response
. The formats of
I000000
I000000
Command 67 —
Read WY Memory
This command permits the collection of W
ord Output memory
of the command and response are as follows.
Request:aa 43 llll nnnn XXXX
Checksum (XXXX)
Number of locations to collect (nnnn)
Starting location to collect from (llll)
Command 67 (43 hex)
Address (aa)
Figur
e C-35
Response:aa 43 bb dddd . . . XXXX
Figur
e C-36
Command
Checksum (XXXX)
WY memory data
Number of data bytes to follow (bb)
Command 67 (43 hex)
PLC TIWAY network address (aa)
Command
. The formats
I000000
67 — Request
I000000
67 — Response
TIWAY I Gateway User Manual
Modbus Commands
C-27
Page 77
C.4Error Responses
Errors
such as illegal addressing or failure of communications with a PLC
are reported by exception responses. Exception responses replace the
expected response to a request and are recognized by the returned Function
Code with the top bit set high (see example in Figure C-37).
Request:
Response:
AddressFunctionDataChecksum
070100000041XXXX
AddressFunctionException
078102XXXX
Figur
e C-37
Exception
Code
Response Frame
Checksum
I000000
In this example, the request is for secondary node 07 to return the data for
65 (41 hex) coils starting at address 00, which is an illegal address for a
SIMA
TIC TI PLC. The response is an exception indicated by the Function
Code 81 (01 with the high bit set), with the exception code 02 indicating that
the data address was illegal.
NOTE:
SIMA
T
by the TIWAY I Gateway
The TIWAY I network uses Exception Primitives. Exceptions sent by
TIC TI PLCs are mapped to Modbus Exception Codes.
able C-6 list the exception responses that apply to the functions supported
.
T
able C-6
CodeNameDescription
01Illegal FunctionThe function received is not defined for this
02Illegal Data AddressThe address contained in the data field is not
03Illegal Data ValueThe value passed in the data field is not
Exception Responses
application [equivalent to SIMATIC TI
exception codes 00, 01, 06, 15].
valid for the secondary being addressed
[equivalent to SIMATIC TI code 02]
allowable for the secondary being addressed
[equivalent to SIMATIC TI codes 10, 19, 1D].
D.1Considerations for Configuring a TIWAY I/PROVOX System
PLC Configuration
Requirements
To
configure the PLC to operate with the Fisher PROVOX Programmable
Controller Interface Unit (PCIU), you need to consider the following
restrictions and requirements.
•
A maximum of eight PLCs can be networked with each PCIU on a
PROVOX system.
•
A total of 64 data registers can be distributed in V
-memory across one
to eight PLCs on the PCIU.
•
The PCIU can be configured to access up to 8 blocks of contiguous
V-memory
. These blocks may encompass up to 64 words of data. The
network cannot access any data that is not defined in one of these
blocks.
•
Data can be read from and written to contiguous blocks of V
•W
ords within a block of V
-memory may be defined as integer or discrete
-memory.
registers. The values of the discrete registers correspond to the values
of a contiguous block of 16 Y points.
•
For each V
-memory block in a PLC that the PCIU is configured to read,
the first word in the block must be reserved as a status register
word does not count toward the 64-word limit.
. This
Network Design
Considerations
•
All registers should be defined in the V
starting V
-memory address for each PLC register block must be
-memory of the PLC. The
configured in the PCIU.
•
Each PLC should have an address assigned to it ranging from 1 to 247.
These requirements have several important consequences in network and
PLC program design.
The restriction to 8 contiguous memory blocks defined for a given PCIU
means that there is a maximum of 8 PLCs that the PROVOX system can
access on a single TIWAY I network. However
, if more than one contiguous
block is defined within a single PLC, then for every block after the first in
the PLC, one less PLC on the TIWAY I network can be accessed by the
PCIU. For example, if 3 V
-memory blocks were defined for each PLC
connected to the PROVOX system, then a maximum of 2 PLCs could be
attached to each PCIU, with each PCIU having 2 unused memory blocks.
D-2
Configuring the PLC for Fisher PROVOX
TIWAY I Gateway User Manual
Page 80
D.2PLC Programming Considerations
Blocking Network
Data
W
riting to Integer
Registers
The
restrictions on data types and numbers of contiguous data blocks that
can be accessed by a PCIU influence the design of the PLC programs to be
used in a PROVOX environment. T
o increase the number of secondaries
that can be supported by a single PCIU, you should group together the data
to be read by the network into a single contiguous block. Similarly
, data
supplied to the PLC from the network should be written into a single
contiguous block. In most cases, data is read from and written to the same
block of memory
. This puts the burden of blocking and unblocking the
network data on the PLC.
Box functions in Series 500, Series 505, and PM550 PLCs make this
blocking and unblocking of data a relatively easy task. Refer to the
appropriate user manuals for more information about this function.
Another important consideration is that the network writes values into the
PLC memory; it does not force the memory to the given value. This
distinction implies that if, after a value has been written into a memory
location, the PLC program writes a value to the same location, the network
data will be overwritten.
NOTE:
The PLC ladder logic program must be carefully designed to avoid
this problem.
W
riting to Discr
ete
Points
PLC Status Register
The PROVOX system allows you to write discrete values to any Y point that
is defined in a discrete register
. However
, the PCIU expects the contents of
the discrete register to accurately reflect the status of the Y points defined
in it. The ladder logic program must be designed to ensure that this is the
case. This can be accomplished by moving the contents of the Y points to the
discrete register
The first word of each contiguous V
register
. This register is used to pass information about the state of the PLC
.
-memory block serves as the PLC status
and the process it is controlling to the PROVOX system. The exact contents
of this register are user
-definable.
Section D.3 provides an example of network and PLC program design for a
Fisher PROVOX system.
TIWAY I Gateway User Manual
Configuring the PLC for Fisher PROVOX
D-3
Page 81
D.3PLC Programming Example
Data to be
Accessed
Assume
PLCs which need to be attached to a PROVOX system. Y
that you have several Series 500 or Series 505 PLCs and PM550
NOTE: The contents column is defined in terms of Series 500/505 data; for
PM550s, you should substitute the corresponding PM550 data.
D-4
Configuring the PLC for Fisher PROVOX
TIWAY I Gateway User Manual
Page 82
The V-memory block now has 9 data words (plus the status register) in each
PLC. From the 64-register limit, you would calculate that there could be a
maximum of 7 PLCs (64/9 = 7) configured like this and connected to a single
PCIU.
Relay
Ladder Logic
Program
The following Relay Ladder Logic (RLL) programs for your Series 500/505 or
PM550 PLC will block and unblock data to be accessed by way of the
network.
I. Series 500 or Series 505 PLC Example Program
C1C1
C1
C1
BITP
A: STW1
= 10
N
C1C4
BITP 1
A: STW1
N = 1
1
C3
TIWAY I Gateway User Manual
C1C5
BITP 2
A: STW1
N = 12
C1C6
BITP 3
A: STW1
N = 13
Configuring the PLC for Fisher PROVOX
(cont’d)
D-5
Page 83
PLC Programming Example (continued)
C1
BITP
4
A: STW1
N = 14
C1C8
BITP 5
A: STW1
N = 15
C1C9
BITP 6
A: STW1
N = 16
C1C2
MIR
W 7
Copy STW01 from Image Register
to V200 (status register)
C7
IR = C3
A: V200
N = 7
C1C2
MIRW
IR = Y1
A: V201
N = 16
Y22Y800
X41Y801
X42Y802
Place Y22, X41–X44, into contiguous Image Register locations
Copy Y1–Y16 to V201
(cont’d)
D-6
Configuring the PLC for Fisher PROVOX
TIWAY I Gateway User Manual
Page 84
X43
Y803
X44
Y805
Y806
Y807
Y808
C1
C1
Copy discrete values written via network to C29–C32