Modbus TCP configuration

Description

Modbus is available in masters as an interface with the following features:

• Read/write process data

• Port configuration

• Port/device diagnostics

• Read/write ISDU data

Access is via the TCP/IP interface using the IP address of the device and Port 502 (example: 192.168.1.1:502). The response time depends on the data written/read.

Structure of a Modbus TCP message

A Modbus TCP message is structured as follows:

The protocol ID must be 0, as it indicates that the message is a Modbus message.

The unit ID can be arbitrary. It is not used because the IP address already identifies a device.

General

• All numbers are decimal numbers, unless they are specified with 0x = hexadecimal, e.g.: 0x1B.

• All data is organized as UINT16 unless otherwise specified.

• The length is organized in UINT16 by default, unless otherwise specified, e.g. length in [bytes] or bit length.

• The mapping of the byte sequence uses Big Endianness, see example in Index 10.

The Profile ID

Index overview

• Profile ID = 2

• Available from Firmware 1.3.1

Identification

The byte array from/to IO-Link is converted as follows in the MODBUS index:

Example

The ASCII coded text of the manufacturer nameBalluff(length = 7) is converted into four (4) Word UINT16 indices as follows:

Read ISDU data

1. Write the port number, index and subindex to the corresponding registers (30,31,32).

2. Write the selected command to the upper byte of register 33.

Write ISDU data

1. Write the port number, index and subindex to the corresponding registers (30,31,32).

2. Write data to registers 35…51 and the desired data length.

3. Write the selected command to the upper byte of register 33.

Function Codes

The following function codes are implemented:

• Read holding register (0x03)

• Write several registers (0x10)

Error Responses

The following responses are reported in the event of an error:

Even if the start register is valid, reading too many registers leads to Bad Register Address.

Slave errors occur when the IO-Link interface triggers errors.

Modbus TCP configurations

Digital Input / Output State

When a port (X01…X08) is configured as SIO mode (Standard Input or Output) following Digital Input / Output State can be accessed.

Registers 2000, 2001 and 2047, 2048 – Digital Input / Output State

There are two register locations which can be used for Digital Input and Output. Those are working completly the same and are just mirrored location for compatibility.

The digital output works if the port is configured as an output.

Values – Digital Input / Output State (data)

Bits – Digital Input / Output State (data)

Detailed view – Digital Input / Output State (data)

IO-Link Process Data

When a port (X01…X08) is configured as IO-Link mode following Process Data Input and Output can be accessed.

There are two ways of handling the Process Data

• Using fixed length 32 Bytes, accessing port-by-port allows simple, port organized access, however it requires multiple commands to perform

• Using customizable variable lenght provides accessing content in one step, but pre-configuration is required

Registers 1100…1800 - IO-Link Process Data (fixed length)

Read out an IO-Link port once.

Reading back the process data output is used for feedback (control).

Details – IO-Link Process Data 1100…1800

Port numbers – IO-Link Process Data 1100…1800

Registers 11000…11257 - Variable Processdata Registers

The registers mirror the registers 1100…1800. While the standard processdata registers are always 32-Bytes long for input and output processdata the variable processdata register adapt to the configured length.

• The variable processdata registers mirror the standard processdata registers (1100…1800), but adapt to the configured input/output length per port.

• Input and output data lengths are defined by the port configuration.

• Reserved bytes must be zero when written and will always read as zero.

• If a port is not configured to IO-Link the complete processdata will be omitted in this registers (see example).

Variable Processdata Layout

The variable processdata registers are organized as follows:

1. Input Processdata for Ports 1–8 (read-only)

2. Output Processdata for Ports 1–8 (read/write)

If the configured processdata length for a port does not align to a full word (2 bytes), a padding byte is added to ensure the next port’s processdata starts at the correct word boundary.

Note:

• The Input Processdata section is read-only. Any write attempt will result in an error.

Example

Suppose the following configuration:

• Port 1 Input: 3 bytes

• Port 3 Input: 2 bytes

• Port 4 Input: 5 bytes

• Port 1 Output: 4 bytes

• Port 3 Output: 1 byte

The layout will be:

This ensures each port’s processdata starts at a word boundary, with padding bytes added as needed. Ports which have zero length configured or are not in IO-Link mode will not reserve space in the register.

IO-Link ISDU Data

Registers 100, 300 – Acyclic Command Channel (including ISDU Read/Write Request)

Details – Registers 100…220 Command Request Channel = ISDU Read/Write Request

Details - Registers 300…421 Command Response Channel = ISDU Read/Write Response

Error codes

Diagnostic

Details – Diagnostic

Registers 3000…3009 – Module and Port Diagnostic

Registers 3010…3080 – IO-Link Port Diagnostic

Detailed information about the connected IO-Link device.

Port numbers – Registers 3010…3080

IOL coded Event Qualifier – Registers 3010…3080

Configuration

Registers 9100…9800 – Port Configuration

Please see the following tables for information on the structure of the port configuration.

Port numbers – Registers 9100…9800

Coding of the master cycle time of the IO-Link specification

Register 20000 - Module Settings

Global configuration registers for the Module (Device).

(1) Only available for the XG5-538 Variants