Configuring the Control Parameter for Modbus TCP Explicit Messaging
(Original Document)
About us
Overview
The CONTROL and DATABUF output parameters define the operation performed by the MBP_MSTR function block. For the Modbus TCP protocol, both the structure and the content of the CONTROL output parameter vary, depending upon the function code.
The structure of the CONTROL parameter is described, below, for each supported function code.
Refer to the Quantum EIO System Planning Guide for an example of an MSTR block created in a Control Expert application to read the ports of a dual-ring switch (DRS) to diagnose a sub-ring break.
Control Parameter Routing Register
The CONTROL[5] routing register specifies the source and destination node addresses for network data transfer, and consists of the following 2 bytes:
The CONTROL[5] routing register:
When the 140 NOP 850 00 module acts as a server, the LSB indicates the destination of a message received by the module:
NOTE: Use Unit ID 255 when requesting diagnostic data from the 140 NOP 850 00 module.
Write Data
The control parameter consists of 9 contiguous words, as described below:
Register
Function
Description
CONTROL[1]
Operation
1 = write data
CONTROL[2]
Detected error status
Holds the event code (read-only)
CONTROL[3]
Data buffer length
Number of addresses sent to the slave
CONTROL[4]
Starting register
Start address of the slave to which the data is written, in 16-bit words
CONTROL[5]
Routing register
High byte = Ethernet communication module slot
Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6] 1
IP address
Byte 4 of the IP address (MSB)
CONTROL[7] 1
Byte 3 of the IP address
CONTROL[8] 1
Byte 2 of the IP address
CONTROL[9] 1
Byte 1 of the IP address (LSB)
1. For example, the control parameter handles the IP address 192.168.1.7 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 = 7.
Read Data
The control parameter consists of 9 contiguous words, as described below:
Register
Function
Description
CONTROL[1]
Operation
2 = read data
CONTROL[2]
Detected error status
Holds the event code (read-only)
CONTROL[3]
Data buffer length
Number of addresses to be read from the slave
CONTROL[4]
Starting register
Determines the %MW starting register in the slave from which the data is read. For example: 1 = %MW1, 49 = %MW49)
CONTROL[5]
Routing register
High byte = Ethernet communication module slot
Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6] 1
IP address
Byte 4 of the IP address (MSB)
CONTROL[7] 1
Byte 3 of the IP address
CONTROL[8] 1
Byte 2 of the IP address
CONTROL[9] 1
Byte 1 of the IP address (LSB)
1. For example, the control parameter handles the IP address 192.168.1.7 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 = 7.
Get Local Statistics
The control parameter consists of 9 contiguous words, as described below:
Register
Function
Description
CONTROL[1]
Operation
3 = read local statistics
CONTROL[2]
Detected error status
Holds the event code (read-only)
CONTROL[3]
Data buffer length
Number of addresses to be read from local statistics (0...37)
CONTROL[4]
Starting register
First address from which the statistics table is read (Reg1=0)
CONTROL[5]
Routing register
High byte = Ethernet communication module slot
Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6]
(not used)
—
CONTROL[7]
CONTROL[8]
CONTROL[9]
Module Response: A TCP/IP Ethernet module responds to the Get Local Statistics command with the following information:
Word
Description
00...02
MAC Address
03
Board Status — this word contains the following bits:
Bit 15
0 = Link LED off; 1 = Link LED ON
Bit 3
Reserved
Bits 14...13
Reserved
Bit 2
0 = half duplex; 1 = full duplex
Bit 12
0 = 10 Mbit; 1 = 100 Mbit
Bit 1
0 = not configured; 1 = configured
Bits 11...9
Reserved
Bit 0
0 = PLC not running; 1 = PLC or NOC running
Bits 8...4
Module Type — this bit presents the following values:
  • 0 = NOE 2x1
  • 1 = ENT
  • 2 = M1E
  • 3 = NOE 771 00
  • 4 = ETY
  • 5 = CIP
  • 6 = (reserved)
  • 7 = 140 CPU 651 x0
  • 8 = 140 CRP 312 00
  • 9 = (reserved)
  • 10 = 140 NOE 771 10
  • 11 = 140 NOE 771 01
  • 12 = 140 NOE 771 11
  • 13 = (reserved)
  • 14 = 140 NOC 78• 00
  • 15...16 = (reserved)
  • 17 = M340 CPU
  • 18 = M340 NOE
  • 19 = BMX NOC 0401
  • 20 = TSX ETC 101
  • 21 = 140 NOC 771 01
  • 22 = 140 NOP 850 00
04 and 05
Number of receiver interrupts
06 and 07
Number of transmitter interrupts
08 and 09
Transmit_timeout detected error count
10 and 11
Collision_detect error count
12 and 13
Missed packets
14 and 15
(reserved)
16 and 17
Number of times driver has restarted
18 and 19
Receive framing detected error
20 and 21
Receiver overflow detected error
22 and 23
Receive CRC detected error
24 and 25
Receive buffer detected error
26 and 27
Transmit buffer detected error
28 and 29
Transmit silo underflow
30 and 31
Late collision
32 and 33
Lost carrier
34 and 35
Number of retries
36 and 37
IP address
Clear Local Statistics
The control parameter consists of 9 contiguous words, as described below:
Register
Function
Description
CONTROL[1]
Operation
4 = clear local statistics
CONTROL[2]
Detected error status
Holds the event code (read-only)
CONTROL[3]
(not used)
—
CONTROL[4]
(not used)
—
CONTROL[5]
Routing register
High byte = Ethernet communication module slot
Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6]
(not used)
—
CONTROL[7]
CONTROL[8]
CONTROL[9]
Get Remote Statistics
The control parameter consists of 9 contiguous words, as described below:
Register
Function
Description
CONTROL[1]
Operation
7 = get remote statistics
CONTROL[2]
Detected error status
Holds the event code (read-only)
CONTROL[3]
Data buffer length
Number of addresses to be read from the statistics data field (0...37)
CONTROL[4]
Starting register
First address from which the node statistics table is read
CONTROL[5]
Routing register
High byte = Ethernet communication module slot
Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6] 1
IP address
Byte 4 of the IP address (MSB)
CONTROL[7] 1
Byte 3 of the IP address
CONTROL[8] 1
Byte 2 of the IP address
CONTROL[9] 1
Byte 1 of the IP address (LSB)
1. For example, the control parameter handles the IP address 192.168.1.7 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 = 7.
Clear Remote Statistics
The control parameter consists of 9 contiguous words, as described below:
Register
Function
Description
CONTROL[1]
Operation
8 = clear remote statistics
CONTROL[2]
Detected error status
Holds the event code (read-only)
CONTROL[3]
(not used)
—
CONTROL[4]
(not used)
—
CONTROL[5]
Routing register
High byte = Ethernet communication module slot
Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6] 1
IP address
Byte 4 of the IP address (MSB)
CONTROL[7] 1
Byte 3 of the IP address
CONTROL[8] 1
Byte 2 of the IP address
CONTROL[9] 1
Byte 1 of the IP address (LSB)
1. For example, the control parameter handles the IP address 192.168.1.7 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 = 7.
Reset Module
The control parameter consists of 9 contiguous words, as described below:
Register
Function
Description
CONTROL[1]
Operation
10 = reset module
CONTROL[2]
Detected error status
Holds the event code (read-only)
CONTROL[3]
(not used)
—
CONTROL[4]
(not used)
—
CONTROL[5]
Routing register
High byte = Ethernet communication module slot
Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6]
(not used)
—
CONTROL[7]
CONTROL[8]
CONTROL[9]
Read/Write Data
The control parameter consists of 11 contiguous words, as described below:
Register
Function
Description
CONTROL[1]
Operation
23 = read / write data
CONTROL[2]
Detected error status
Holds the event code (read-only)
CONTROL[3]
Data buffer length
Number of addresses sent to the slave
CONTROL[4]
Starting register
Determines the %MW starting register in the slave to which the data will be written. For example: 1 = %MW1, 49 = %MW49)
CONTROL[5]
Routing register
High byte = Ethernet communication module slot
Low byte = MBP on Ethernet transporter (MET) mapping index
CONTROL[6] 1
IP address
Byte 4 of the IP address (MSB)
CONTROL[7] 1
Byte 3 of the IP address
CONTROL[8] 1
Byte 2 of the IP address
CONTROL[9] 1
Byte 1 of the IP address (LSB)
CONTROL[10]
Data buffer length
Number of addresses to be read from the slave
CONTROL[11]
Starting register
Determines the %MW starting register in the slave from which the data is read. For example: 1 = %MW1, 49 = %MW49)
1. For example, the control parameter handles the IP address 192.168.1.7 in the following order: Byte 4 = 192, Byte 3 = 168, Byte 2 = 1, Byte 1 = 7.
Enable/Disable FTP Services
When FTP has been enabled using Control Expert configuration tools, an MSTR block can be used to change the enabled state of the service while the application is running. The MSTR block cannot change the state of the FTP service if the service was disabled using one of the configuration tools.
The control parameter consists of 9 contiguous words, as described below:
Register
Function
Description
CONTROL[1]
Operation
FFF0 (hex) 65520 (dec) = enable / disable FTP
CONTROL[2]
Detected error status
Holds the event code (read-only). Codes returned include:
0x000 (Success): MSTR block with operational code 0xFFF0 was called and the enabled state of FTP was changed.
0x5068 (Busy): MSTR block with operational code 0xFFF0 was called within 2 seconds of the previous call (regardless of return code from previous call).
0x4001 (Same state): MSTR block with operational code 0xFFF0 was called to change the enabled state of FTP to the states they were already in.
0x2004 (Invalid data): MSTR block with operational code 0xFFF0 was called and the data in the control block did not match the specifications.
0x5069 (Disabled): If the FTP service was already disabled via the Control Expert interface when the MSTR block with operational code 0xFFF0 was called to change the state of the disabled service.
CONTROL[3]
Set this register to 1.
CONTROL[4]
CONTROL[5]
Module slot number and destination ID
High byte = Module slot number communication module slot
Low byte = Destination ID
CONTROL[6]
Request mode
Bit 0 (LSB) = 1: Enable FTP
Bit 0 (LSB) = 0: Disable FTP
CONTROL[7]
Set this register to 0.
CONTROL[8]
CONTROL[9]
FTP service state changes made by MSTR with operation code FFF0 (hex) are overridden by the configured value when the module is power-cycled or reset and when a new application is downloaded to the module.
Here are some examples:
State Configured By Control Expert
Action attempted using MSTR with operation code FFF0 (hex)
Result
Disabled
Any
MSTR returns detected error code 0x5069 (service was already disabled by configuration)
Enabled
Disable
MSTR returns code 0x000 (success).
  • Another MSTR block action enables the service
    --OR--
  • The module is reset or power-cycled
    --OR--
  • A new application is downloaded with the service disabled by configuration
Enable
MSTR returns detected error code 0x4001 (same state). No change made.