MBP_MSTR Example – Write Modbus Object
(Original Document)
About us
Overview
The following unconnected explicit messaging example shows you how to use the MBP_MSTR function block to write data to a remote device, for example a 140 NOC 771 01, a TSX ETC 101, or a BMX NOC 0401 Ethernet communication module at IP address 192.168.1.12 using the Write_Holding_Registers service of the Modbus object.
You can perform the same explicit messaging service using the EtherNet/IP Explicit Message Window of the Control Expert Ethernet Configuration Tool.
Implementing the MBP_MSTR Function Block
To implement the MBP_MSTR function block, you need to create and assign variables, and connect it to an OR block. In the following example, the logic will continuously send an explicit message upon receiving notice of success or detected error.
Input Variables
Variables need to be created and assigned to input pins. For the purpose of this example, variables have been created — and named — as described below. (You can use different variable names in your explicit messaging configurations.)
Input Pin
Variable
Data Type
ENABLE
Enable
BOOL
ABORT
StopEM
BOOL
Output Variables
Variables also need to be created and assigned to output pins. (The names assigned to output variables apply only to this example, and can be changed in your explicit messaging configurations.)
Output Pin
Variable
Data Type
ACTIVE
EMActive
BOOL
ERROR
EMError
BOOL
SUCCESS
EMSuccess
BOOL
CONTROL
EIP_ControlBuf
Array of 10 INT
DATABUF
EIP_DataBuf
Array of 100 INT
NOTE: To simplify configuration, you can assign the CONTROL and DATABUF output pins to a byte array consisting of located variables. When configured in this manner, you will not need to be aware of the location of data within a word (for example, high versus low byte, and big or little endian format).
Control Array
The control array parameter (EIP_ControlBuf) consists of 9 contiguous words. You need to configure only some control words; other control words are read-only and are written to by the operation. In this example, the control array defines the operation as an unconnected explicit message, and identifies the target device:
Register
Description
Configure
Setting (hex)
CONTROL[0]
Operation:
High byte = 00 (unconnected)
Low byte = 0E (CIP explicit message)
Yes
16#000E
CONTROL[1]
Error status: read-only (written by operation)
No
16#0000
CONTROL[2]
Data buffer length = 20 (words)
Yes
16#0014
CONTROL[3]
Response offset: offset—in words (10)—for the beginning of the explicit message response in the databuffer
Yes
16#000A
CONTROL[4]
High byte = slot location (4) of the communication module in the backplane
Low byte = 00 (not used)
Yes
16#0400
CONTROL[5]1
IP address of the Ethernet communication module:
High byte = IP address byte 4 (192)
Low byte = IP address byte 3 (168)
Yes
16#C0A8
CONTROL[6]1
IP address of the Ethernet communication module:
High byte = IP address byte 2 (001)
Low byte = IP address byte 1 (012)
Yes
16#010C
CONTROL[7]
CIP request length (20) in bytes
Yes
16#0014
CONTROL[8]
Length of received response (written by operation)
No
16#0000
1. In this example, the control parameter handles the IP address 192.168.1.12 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 - 12.
CIP Request
The CIP request is located at the beginning of the databuffer and is followed by the CIP response. In this example, the CIP request calls for the writing of 5 contiguous words beginning at position 2, and describes the request path through the target device’s object structure leading to the target attribute The values to be written in sequence are 111, 222, 333, 444, and 555:
Request word
High byte
Low byte
Description
Value (hex)
Description
Value (hex)
1
Request path size (in words)
16#02
EM Service: Write_Holding_Register
16#50
2
Request path: class assembly object (Modbus Object)
16#44
Request path: logical class segment (indicates an 8-bit object)
16#20
3
Request path: instance
16#01
Request path: logical instance segment (indicates an 8-bit instance)
16#24
4
First word to write (not used)
16#00
First word to write: value + %MW1 (i.e. start at zero based second word)
16#02
5
Number of words to write
16#00
Number of words to write: 5
16#05
6
Data words 1
16#00
Data words 1
16#6F
7
Data words 2
16#00
Data words 2
16#DE
8
Data words 3
16#01
Data words 3
16#4D
9
Data words 4
16#01
Data words 4
16#BC
10
Data words 5
16#02
Data words 5
16#2B
11
Service Code + response bit (read-only)
16#00
Service Code + response bit (read-only) response = D0
16#000
12
Service response (read only)
16#00
Service response (read only) success = 0
16#00
13
Location of first word to write response (read only)
16#00
Location of first word to write response (read only)
16#00
14
Number of words to write response (read only)
16#00
Number of words to write response (read only)
16#00
Combining the high and low bytes, above, the CIP request would look like this:
Request word
Value
1
16#0250
2
16#4420
3
16#0124
4
16#0002
5
16#0005
6
16#006F
7
16#00DE
8
16#014D
9
16#01BC
10
16#022B
11
16#0000
12
16#0000
13
16#0000
14
16#0000
Viewing the Response
Use a Control Expert Animation table to display the EIP_DataBuf variable array. Note that the EIP_DataBuf variable array consists of the entire data buffer, which includes the:
To display the CIP response, follow these steps:
Step
Action
1
In Control Expert, select Tools → Project Browser to open the Project Browser.
2
In the Project Browser, right-click Animation Tables → New Animation Table.
Result: A new animation table opens.
3
In the New Animation Table dialog, edit the following values:
Name
Type in a table name. For this example: EIP_DataBuf.
Functional Mode
Accept the default <None>.
Comment
Leave blank.
Number of animated characters
Type 100, representing the size of the data buffer in words.
4
The completed dialog looks like this:
Click OK to close the dialog.
5
In the animation table’s Name column, type in the name of the variable assigned to the databuffer: EIP_DataBuf and press Enter. The animation table displays the EIP_DataBuf variable.
6
Expand the EIP_DataBuf variable to display its word array, where you can view the CIP response at words EIP_DataBuf(7-16):
Note: Each word presents 2 bytes of data in little endian format, where the least significant byte is stored in the smallest memory address. For example, ‘50’ in EIP_DataBuf[0] is the low byte, and ‘02’ is the high byte.