Omron CP1W-MODTCP61 CP1L / CP1H / CJ2M Modbus /TCP Adapter Application and Setup Guide

Revision 2.00a 7/29/2011

1

Section 1: Introduction
This document explains the theory, operation, and setup of the Omron CP1WMODTCP61 Modbus/TCP adapter. The CP1W- MODTCP61 is an adapter that allows a CP1L or CP1H PLC to operate in 1 of 2 modes, but not both at the same time. For clarity, the discussion of the setup and operation of each of these 2 modes is handled in separate sections of this document. The adapter also allows a CJ2M-CPU3x series PLC to operate in Slave mode only. The two modes of operation are: Mode 1: Modbus TCP Slave / Server. In this mode, the adapter functions as a slave device, allowing other Modbus TCP Master devices to send commands to and receive responses from the adapter using the Modbus TCP protocol. Mode 2: Modbus TCP Master / Client. In this mode, the adapter functions as a master device, sending Modbus TCP commands to and receiving responses from other slave devices, such as IO blocks, inverters, PLCs, etc. Note: this mode is not applicable to CJ2M-CPU3x series PLCs. Mounting an adapter in a PLC CP1 Series: The adapter mounts in the Option Board Slot on the front of a CP1L or CP1H PLC, and can be used in all CP1L / CP1H PLCs with an available Option Board Slot. A CP1L or CP1H PLC with 2 option board slots can use 2 CP1W-MODTCP61 adapters, with 1 functioning as a Modbus TCP Master / Client and 1 functioning as a Modbus TCP Slave / Server. CJ2M Series: The adapter mounts in the Option Board Slot on the front of a CJ2MCPU3x PLC. When used in a CJ2M-CPU3x series PLC, the adapter will only function as a Modbus TCP Slave / Server. The adapter is not applicable for CJ2M-CPU1x series PLCs.

Section 2 - Modbus TCP Slave / Server

2.1 Modbus TCP Slave / Server Overview When configured for Modbus TCP Slave / Server mode, the adapter functions as a slave node, allowing other Modbus TCP Master / Client devices to send commands to and receive responses from the adapter. These master devices include PCs with software that uses the Modbus TCP protocol, as well as PLCs and other hardware devices functioning as Modbus TCP masters. The adapter uses the standard Modbus/TCP port 502, and supports the following Modbus function codes: 01 Read Coil Status 03 Read Holding Registers 05 Force Single Coil 0F Force Multiple Coils 02 Read Input Status 04 Read Input Registers 06 Preset Single Register 10 Preset Multiple Registers

The supported Modbus/TCP commands access the PLC memory areas as shown. All supported Bit (coil) read / write operations access the CIO memory area from CIO1000 to CIO1199. All supported Channel (register) read / write commands access the DM memory area from D1000 D1199. This provides 3200 coils and 200 registers to be accessed in the PLC via the Modbus TCP protocol.

2.2 Modbus Addressing in the PLC When addressing the PLC memory map using the Modbus TCP protocol, D1000 is considered the first register, and CIO 1000.00 is considered the first coil. To determine the Modbus TCP register number for a PLC address, simply subtract 1000 from the PLC Data Memory location. Register Examples: PLC Memory Location D1000 D1050 D1099 D1199 Modbus Register 0 50 99 199 Calculation (1000 1000) = 0 (1500 1000) = 50 (1099 1000) = 99 (1199 1000) = 199

To determine the Modbus TCP coil for a PLC bit, subtract 1000 from the CIO Channel number, multiply by 16, and add the bit number. Coil Examples: PLC Memory Location CIO 1000.00 CIO 1100.12 CIO 1122.07 CIO 1199.15 Modbus Register 0 1612 1959 3199 Calculation ((1000 1000) * 16) + 0 = 0 ((1100 1000) * 16) + 12 = 1612 ((1122 1000) * 16) + 7 = 1959 ((1199 1000) * 16) + 15 = 3199

2.3 Command Size Limits: Function Code(s) 03,04 10 06 01, 02 0F 05 Read / Write Size Limit 125 Registers (PLC Words) 123 Registers (PLC Words) 1 Register (PLC Word) 998 Coils (PLC Bits) 998 Coils (PLC Bits) 1Coil (PLC Bit)

2.4 Modbus TCP Slave / Server Applications The CP1W- MODTCP61 allows Omron CP1L , CP1H, and CJ2M-CPU3x PLCs to function as programmable I/O modules. The CP1W-MODTCP61 will not function in a CP1E PLC in Modbus TCP Slave / Server mode. The adapter is a Modbus/TCP slave device, meaning the adapter cannot establish a connection to another device. A device, such as a PC or PLC, functioning as Modbus/TCP Master, must be the device used to establish the TCP connection, and control the communications to the CP1W- MODTCP61. When using the adapter in Modbus TCP Slave/Server mode, the adapter will also function as a FINS slave device, allowing the use of an NS Series HMI and / or CX Programmer programming software. Up to 2 Modbus TCP Master / Client devices can communicate simultaneously with the adapter, in addition to 2 FINS devices. When using Modbus TCP clients to connect to the PLC through the CP1W-MODTCP61, the client will be automatically disconnected after 30 seconds of inactivity to allow other clients to connect. To maintain a TCP connection from a client, send at least 1 command at intervals of less than 30 seconds.

2.5 Modbus TCP Slave / Server Setup The CP1W- MODTCP61 is assigned a default IP address of 192.168.250.11. The IP address can be changed using a web browser pointed to the IP address of the adapter. A static IP address must be assigned to the PCs Ethernet card for this purpose. Simply enter the IP address of the adapter (192.168.250.11) in the web browsers address field to access the configuration page. Enter the desired new IP address (192.168.1.156 shown as an example), subnet mask, and default gateway (if applicable). Choose Modbus TCP Slave/Server operation mode. The default FINS UDP port (9600) can also be changed if needed. When finished, click Apply Setting.

2.6 Modbus TCP Slave / Server PLC Setup CP1L / CP1H The CP1W- MODTCP61 adapter uses the Toolbus (high speed binary) protocol when operating in the Slave / Server mode. To configure the PLC port, simply turn ON the appropriate DIP switch on the CP1L or CP1H PLC. For CP1L PLCs with 1 Option Board, use DIP Switch 4. For CP1L PLCs with 2 Option Board Slots, or CP1H PLCs, use DIP Switch 4 for Slot 1, and DIP Switch 5 for Slot 2.

CJ2M CPU3x For CJ2M-CPU3x PLCs, turn on DIP switch 5 (located under the flip up cover).

To maximize the throughput of the CP1W- MODTCP61, the amount of time per PLC scan that is allowed for servicing communications ports should be increased. This is accessed through the PLC Settings in CX Programmer. On the Peripheral Service tab, uncheck the default option, and enter 50 (5.0 ms). Transfer these settings to the PLC and cycle power to apply the changes.

2.7 Recovering an IP address If the IP address is forgotten, use CX Programmer to view the IP address in D1200 + D1201 in the following format: D1200 1st and 2nd Octets in Hexadecimal: EX D1200 = C0A8 = 192.168 D1201 3rd and 4th Octets in Hexadecimal: Ex. D1201 = 0119 = 1.25 The IP address would be 192.168.1.25 based on the above values. This feature is only available with the CP1W-MODTCP61 is configured in Modbus TCP Slave / Server Mode.

Section 3 - Modbus TCP Master / Client

3.1 Modbus TCP Master / Client Overview When configured for Modbus TCP Master / Client mode, the adapter functions as a master device, controlling the communications with other slave devices such as IO blocks, inverters, PLCs, etc. The adapter sends Modbus TCP commands to and receives Modbus TCP responses from the slave devices. 3.2 Modbus TCP Master / Client Applications The CP1W- MODTCP61 allows Omron CP1L and CP1H PLCs (but not the CJ2MCPU3x PLCs) to function as control devices for remote IO slaves that use the Modbus TCP protocol. The adapter is a Modbus TCP master device, meaning the adapter will not respond to Modbus TCP commands issued from another Modbus TCP master device. The Easy Modbus function of the PLC is used to send Modbus RTU commands to the adapter, which are converted to Modbus TCP commands and delivered to the remote device. The Modbus RTU Node Number is automatically used as the last octet of the IP address of the destination device, with the first 3 octets of IP address of the adapter used as the first 3 octets of the destination device. Example: CP1W-MODTCP61 Adapter IP address = 192.168.1.25 Modbus RTU command sent to node 2C in the PLC using Easy Modbus Modbus TCP command delivered to 192.168.1.44. 44 (DEC) = 2C (HEX) Note: Disconnected slave nodes will cause timeouts in the PLC Easy Modbus function, slowing the update to the remaining nodes. Note: Unlike the Modbus TCP Slave / Server mode, the FINS protocol is not available when using the adapter as a Modbus TCP Master / Client. If an NS HMI is required, connect via a serial connection, or via a CP1W-ETN61 FINS Ethernet adapter.

3.3 Modbus TCP Master / Client Setup The CP1W- MODTCP61 is assigned a default IP address of 192.168.250.11. The IP address can be changed using a web browser pointed to the IP address of the adapter. A static IP address must be assigned to the PCs Ethernet card for this purpose. Simply enter the IP address of the adapter (192.168.250.11) in the web browsers address field to access the configuration page. Enter the desired new IP address (192.168.1.156 shown as an example), subnet mask, and default gateway (if applicable). Choose Modbus TCP Master / Client operation mode. When finished, click Apply Setting.

10

3.4 Modbus TCP Master / Client PLC Setup CP1L / CP1H Before configuring the PLC port below, turn OFF the appropriate DIP switch on the CP1L or CP1H PLC. For CP1L PLCs with 1 Option Board, use DIP Switch 4. For CP1L PLCs with 2 Option Board Slots, or CP1H PLCs, use DIP Switch 4 for Slot 1, and DIP Switch 5 for Slot 2.

The CP1W- MODTCP61 adapter uses the Serial Gateway function of the PLC when operating in the Master / Client mode. The CP1W- MODTCP61 adapter uses 115,200, 8,1,N as the communications parameters for the interface to the PLC. Configure the socket that is being used for the CP1W- MODTCP61 (Serial Port 1 = Socket 1, Serial Port 2 = Socket 2) as shown. Be certain to set the Response Timeout value to 20 x 100ms (2 seconds) to optimize communications recovery when a timeout occurs. This is configured through the Settings of CX Programmer on the Serial Port 1 or Serial Port 2 tab. Although the adapter can be used in either Socket 1 or Socket 2, Modbus RTU Master Ladder code is available from Omron to make Modbus TCP Master / Client communications easier, and this code uses Socket 1 in PLCs with only 1 socket, and Socket 2 in PLCs that have 2 sockets.

11

To maximize the throughput of the CP1W- MODTCP61, the amount of time per PLC scan that is allowed for servicing communications ports should be increased. This is accessed through the PLC Settings in CX Programmer. On the Peripheral Service tab, uncheck the default option, and enter 50 (5.0 ms). Transfer these settings to the PLC and cycle power to apply the changes.

12

Section 4: Command Examples Modbus TCP Server / Slave

Function Code 01: Read Coil Status. Example: Reading 10 Coils starting at CIO 1002.00 (CIO 1002.00 CIO 1002.09) PLC Data: CIO 1002 = 0000000000110010 (0032 HEX) Command Function Code Starting Address Hi Starting Address Lo Number of Coils Hi Number of Coils Low

01 00 20 00 0A

Response Function Code Byte Count Coils 0 -7 Coils 8 - 9

01 02 32 00

Function Code 02: Read Input Status. Identical to Function Code 01 Function Code 03: Read Holding Registers Example: Reading 4 channels starting at D1050. D1050 = 1234, D1051 = 5678, D1052 = 90AB, D1053 = CDEF Command Function Code Starting Address Hi Starting Address Lo Number of Registers Hi Number of Registers Low 03 00 32 00 04 Response Function Code Byte Count Register Hi D1050 Register Lo D1050 Register Hi D1051 Register Lo D1051 Register Hi D1052 Register Lo D1052 Register Hi D1053 Register Lo D1053 03 08 12 34 56 78 90 AB CD EF

Function Code 04: Read Input Registers. Identical to Function Code 03

13

Function Code 05: Write Single Coil. To turn a bit ON, set the Output Value to FF00. To turn a bit OFF, set the Output Value to 0000. Example: Turn on CIO 1040.05. Command Function Code Starting Address Hi Starting Address Lo Output Value Hi Output Value Lo

05 02 85 FF 00

Response Function Code Starting Address Hi Starting Address Lo Output Value Hi Output Value Lo

05 02 85 FF 00

Function Code 06: Write Single Register. Example: Write 1467 (hex) to D1099. Command Function Code Starting Address Hi Starting Address Lo Register Value Hi Register Value Lo

06 00 63 14 67

Response Function Code Starting Address Hi Starting Address Lo Register Value Hi Register Value Lo

06 00 63 14 67

Function Code 0F: Write Multiple Coils. Example: Set the values of CIO 1045.11 1045.00 to 011110000011 (hex 783) PLC Data: CIO 1045 = x783. x = unaffected by the command Command Function Code Starting Address Hi Starting Address Lo Number of Coils Hi Number of Coils Lo Byte Count Output Value Hi Output Value Lo

0F 02 D0 00 0C 02 83 07

Response Function Code Starting Address Hi Starting Address Lo Number of Coils Hi Number of Coils Lo

0F 02 D0 00 0C

14

Function Code 10: Write Multiple Registers. Example: Write following data into the PLC D1125 = FEED (hex) D1126 = DEAD (hex) D1127 = BEEF (hex) Command Function Code Starting Address Hi Starting Address Lo Number of Registers Hi Number of Registers Lo Byte Count Register Value Hi (D1125) Register Value Lo (D1125) Register Value Hi (D1126) Register Value Lo (D1126) Register Value Hi (D1127) Register Value Lo (D1127)

10 00 7D 00 03 06 FE ED DE AD BE EF

Response Function Code Starting Address Hi Starting Address Lo Number of Registers Hi Number of Registers Lo

10 00 7D 00 03

Section 4: Connecting with CX Programmer

When connecting with CX Programmer to CP1L, CP1H, or CJ2M-CPU3x CPUs, specify the communications method as follows: Network Type = Ethernet Frame Length = 500 (bytes) IP Address = IP address of the CP1W-MODTCP61.

15

Section 5: Additional Literature

Additional literature can be obtained from www.omron247.com. R08I CP1 Series Brochure W450 CP1H Operation Manual W451 CP1L / CP1H Programming Manual W462 CP1L Operation Manual W472 CJ2 Hardware Users Manual W473 CJ2 Software Users Manual V227 W4S Ethernet Switch

16