Configuring the Control Parameter for Modbus TCP Explicit Messaging

Configuring the Control Parameter for Modbus TCP Explicit Messaging

(Original Document)

Overview

The CONTROL and DATABUF output parameters define the operation performed by the MBP_MSTR function block. For the Modbus TCP protocol, both the structure and the content of the CONTROL output parameter vary, depending upon the function code.

The structure of the CONTROL parameter is described, below, for each supported function code.

Control Parameter Routing Register

The CONTROL[5] routing register specifies the source and destination node addresses for network data transfer, and consists of the following 2 bytes:

Most Significant Byte (MSB): contains the source node address, for example, the slot number of the 140 NOC 771 01
Least Significant Byte (LSB): contains the destination node address—a value representing either a direct or a bridge address. The LSB is required for devices reached through a bridge, for example, an Ethernet to Modbus bridge or an Ethernet to Modbus Plus bridge. The values of the LSB are as follows:
- If no bridge is used: LSB is set to zero(0).
- If a bridge is used: LSB contains the Modbus Plus on Ethernet Transporter (MET) mapping index value. This value, also known as the Unit ID, indicates the device to which the message is directed.

The CONTROL[5] routing register:

When the Ethernet communication module acts as a server, the LSB indicates the destination of a message received by the communication module:

messages with an LSB value from 0 to 254 are forwarded to and processed by the CPU
messages with an LSB value of 255 are retained and processed by the Ethernet communication module

NOTE: Use unit ID 255 when requesting diagnostic data from the Ethernet communication module.

Write Data

The Control parameter consists of 9 contiguous words, as described below:

Register	Function	Description
CONTROL[1]	Operation	1 = write data
CONTROL[2]	Error status	Holds the event code (read-only)
CONTROL[3]	Data buffer length	Number of addresses sent to the slave
CONTROL[4]	Starting register	Start address of the slave to which the data is written, in 16-bit words
CONTROL[5]	Routing register	High byte = Ethernet communication module slot
CONTROL[5]	Routing register	Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6] 1	IP address	Byte 4 of the IP address (MSB)
CONTROL[7] 1		Byte 3 of the IP address
CONTROL[8] 1		Byte 2 of the IP address
CONTROL[9] 1		Byte 1 of the IP address (LSB)
1. For example, the Control parameter handles the IP address 192.168.1.7 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 = 7.

Read Data

The Control parameter consists of 9 contiguous words, as described below:

Register	Function	Description
CONTROL[1]	Operation	2 = read data
CONTROL[2]	Error status	Holds the event code (read-only)
CONTROL[3]	Data buffer length	Number of addresses to be read from the slave
CONTROL[4]	Starting register	Determines the %MW starting register in the slave from which the data is read. For example: 1 = %MW1, 49 = %MW49)
CONTROL[5]	Routing register	High byte = Ethernet communication module slot
CONTROL[5]	Routing register	Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6] 1	IP address	Byte 4 of the IP address (MSB)
CONTROL[7] 1		Byte 3 of the IP address
CONTROL[8] 1		Byte 2 of the IP address
CONTROL[9] 1		Byte 1 of the IP address (LSB)
1. For example, the Control parameter handles the IP address 192.168.1.7 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 = 7.

Get Local Statistics

The Control parameter consists of 9 contiguous words, as described below:

Register	Function	Description
CONTROL[1]	Operation	3 = read local statistics
CONTROL[2]	Error status	Holds the event code (read-only)
CONTROL[3]	Data buffer length	Number of addresses to be read from local statistics (0...37)
CONTROL[4]	Starting register	First address from which the statistics table is read (Reg1=0)
CONTROL[5]	Routing register	High byte = Ethernet communication module slot
CONTROL[5]	Routing register	Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6]	(not used)	—
CONTROL[7]
CONTROL[8]
CONTROL[9]

Module Response: A TCP/IP Ethernet module responds to the Get Local Statistics command with the following information:

Word	Description
00...02	MAC Address
03	Board Status—this word contains the following bits:
	Bit 15	0 = Link LED off; 1 = Link LED ON	Bit 3	Reserved
	Bits 14...13	Reserved	Bit 2	0 = half duplex; 1 = full duplex
	Bit 12	0 = 10 Mbit; 1 = 100 Mbit	Bit 1	0 = not configured; 1 = configured
	Bits 11...9	Reserved	Bit 0	0 = PLC not running; 1 = PLC or NOC running
	Bits 8...4	Module Type—this bit presents the following values:
	Bits 8...4	0 = NOE 2x1 1 = ENT 2 = M1E 3 = NOE 771 00 4 = ETY 5 = CIP 6 = (reserved) 7 = 140 CPU 651 x0 8...9 = (reserved)		10 = 140 NOE 771 10 11 = 140 NOE 771 01 12 = 140 NOE 771 11 13...16 = (reserved) 17 = M340 CPU 18 = M340 NOE 19 = BMX NOC 0401 20 = TSX ETC 101 21 = 140 NOC 771 01
04 and 05	Number of receiver interrupts
06 and 07	Number of transmitter interrupts
08 and 09	Transmit_timeout error count
10 and 11	Collision_detect error count
12 and 13	Missed packets
14 and 15	(reserved)
16 and 17	Number of times driver has restarted
18 and 19	Receive framing error detected
20 and 21	Receiver overflow error detected
22 and 23	Receive CRC error detected
24 and 25	Receive buffer error detected
26 and 27	Transmit buffer error detected
28 and 29	Transmit silo underflow
30 and 31	Late collision
32 and 33	Lost carrier
34 and 35	Number of retries
36 and 37	IP address

Clear Local Statistics

The Control parameter consists of 9 contiguous words, as described below:

Register	Function	Description
CONTROL[1]	Operation	4 = clear local statistics
CONTROL[2]	Error status	Holds the event code (read-only)
CONTROL[3]	(not used)	—
CONTROL[4]	(not used)	—
CONTROL[5]	Routing register	High byte = Ethernet communication module slot
CONTROL[5]	Routing register	Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6]	(not used)	—
CONTROL[7]
CONTROL[8]
CONTROL[9]

Get Remote Statistics

The Control parameter consists of 9 contiguous words, as described below:

Register	Function	Description
CONTROL[1]	Operation	7 = get remote statistics
CONTROL[2]	Error status	Holds the event code (read-only)
CONTROL[3]	Data buffer length	Number of addresses to be read from the statistics data field (0...37)
CONTROL[4]	Starting register	First address from which the node statistics table is read
CONTROL[5]	Routing register	High byte = Ethernet communication module slot
CONTROL[5]	Routing register	Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6] 1	IP address	Byte 4 of the IP address (MSB)
CONTROL[7] 1		Byte 3 of the IP address
CONTROL[8] 1		Byte 2 of the IP address
CONTROL[9] 1		Byte 1 of the IP address (LSB)
1. For example, the Control parameter handles the IP address 192.168.1.7 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 = 7.

Clear Remote Statistics

The Control parameter consists of 9 contiguous words, as described below:

Register	Function	Description
CONTROL[1]	Operation	8 = clear remote statistics
CONTROL[2]	Error status	Holds the event code (read-only)
CONTROL[3]	(not used)	—
CONTROL[4]	(not used)	—
CONTROL[5]	Routing register	High byte = Ethernet communication module slot
CONTROL[5]	Routing register	Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6] 1	IP address	Byte 4 of the IP address (MSB)
CONTROL[7] 1		Byte 3 of the IP address
CONTROL[8] 1		Byte 2 of the IP address
CONTROL[9] 1		Byte 1 of the IP address (LSB)
1. For example, the Control parameter handles the IP address 192.168.1.7 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 = 7.

Reset Module

The Control parameter consists of 9 contiguous words, as described below:

Register	Function	Description
CONTROL[1]	Operation	10 = reset module
CONTROL[2]	Error status	Holds the event code (read-only)
CONTROL[3]	(not used)	—
CONTROL[4]	(not used)	—
CONTROL[5]	Routing register	High byte = Ethernet communication module slot
CONTROL[5]	Routing register	Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6]	(not used)	—
CONTROL[7]
CONTROL[8]
CONTROL[9]

Read/Write Data

The Control parameter consists of 11 contiguous words, as described below:

Register	Function	Description
CONTROL[1]	Operation	23 = read / write data
CONTROL[2]	Error status	Holds the event code (read-only)
CONTROL[3]	Data buffer length	Number of addresses sent to the slave
CONTROL[4]	Starting register	Determines the %MW starting register in the slave to which the data will be written. For example: 1 = %MW1, 49 = %MW49)
CONTROL[5]	Routing register	High byte = Ethernet communication module slot
CONTROL[5]	Routing register	Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6] 1	IP address	Byte 4 of the IP address (MSB)
CONTROL[7] 1		Byte 3 of the IP address
CONTROL[8] 1		Byte 2 of the IP address
CONTROL[9] 1		Byte 1 of the IP address (LSB)
CONTROL[10]	Data buffer length	Number of addresses to be read from the slave
CONTROL[11]	Starting register	Determines the %MW starting register in the slave from which the data is read. For example: 1 = %MW1, 49 = %MW49)
1. For example, the Control parameter handles the IP address 192.168.1.7 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 = 7.

© 2018 Schneider Electric. All rights reserved.