Modbus TCP Fanuc
Modbus TCP Fanuc
(RCS2 V1.7)
Machine Translated by Google
Revision history
Wang Zhengqian
[1,100] is still the original definition ÿ
Instructions section
Table of contents
2.4.1 GetModConState.............................................................................................. 6
2.4.3 WriteModbusReg.............................................................................................. 7
2.5.1 ER_RobModbusCnctState................................................................................ 8
2.5.3 WriteModbusReg.............................................................................................. 9
Preface
Overview
This manual is applicable to the control system RCS2 V1.31 and above, describing the Eston second generation controller
ModBusTcp protocol interface function introduction, including function introduction, protocol introduction, interface debugging and function point table.
Readership
This manual is intended only for those who are trained and familiar with various applicable national standards for "Control, Automation and Drive Engineering"
Field professionals.
ÿSystem manufacturer: Technical personnel who design the functions of automation systems.
Precautions
ÿWhen installing and debugging these components, operators must strictly follow the instructions and explanations in this document.
ÿRelevant responsible persons must ensure that the application or use of the product meets all safety requirements, including relevant legal
ÿAlthough this document has been carefully prepared, since the products described in it are still being continuously updated, we may not check that the product
performance data, standards or other characteristics described in the document are always consistent with the actual ones after each update. Products are
consistent.
ÿThere will inevitably be some technical or editing errors in this document. We reserve the right to modify the document information at any time without prior notice. For
products that have changed, if the data, charts and text descriptions in this document have not been modified, we will no longer make a special statement.
ÿNo one is allowed to modify the software and hardware configurations other than those specified in the text document. ESTUN will not
ÿWhen the units shown in the illustrations in this document are not specifically marked, the default unit is millimeters mm.
safety instructions
comply with the safety instructions associated with this sign will endanger personal life and health.
Failure to comply with the safety instructions related to this sign may significantly harm the environment and equipment safety.
Instructions or Tips
This symbol indicates that the information can help you better understand the safety instructions.
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
ModBusTcp protocol interface refers to the external logic controller (PLC, etc.)
(ModBusTCP) communicates with the robot, a communication method for reading and writing the virtual IO port of the robot. machine
The robot can interact with external devices through ModBusTCP without additional expansion of IO ports.
ModBus is one of the most widely used fieldbuses at present. In 1999, it was launched with Ethernet operation.
Frames are embedded in TCP frames. IANA assigns TCP port number 502 to the ModBus protocol, which is the same as other industries.
Ethernet protocol does not have. ModBusTCP also has support for other industrial control equipment, such as industrial human-machine interfaces,
Frequency converters, soft starters, motor control centers, Ethernet I/O, various fieldbus bridges, etc.
ModBusTCP uses TCP/IP and Ethernet protocols to transmit ModBus information, so it is compatible with ModBus
Similar to the serial link data unit, the application data unit of ModBusTCP is the ModBus simple protocol data unit.
The data unit (PDU) is encapsulated according to the TCP/IP protocol. A TCP frame can only transmit one
ModBusADU, it is recommended not to send multiple ModBus requests or responses in the same PDU.
The following table shows the request and response messages of ModBusTCP:
Request: Transmission flag protocol flag length slave station number function code register starting address register length
length
2 2 2 1 1 2 2
(Byte)
Response: Transmission flag protocol flag length slave station number function code length data value…
length
2 2 2 1 1 1
(Byte)
4
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
The data structure of ModBus divides data into the following four types:
Holding registers (Input Registers) readable and writable WORD type (16-bit) variables
Eston's ModBusTCP communication interface currently only supports reading and writing holding registers, that is, the following function codes:
Portÿ502
Acquisition cycle>200ms
The server determines whether a connection exists by detecting the client's request. If after connecting to the client, the
If no request from the client is received after 5 seconds, the server will automatically disconnect and re-listen to port 502.
The ER series robot encapsulates a layer of data structure in the ModBusTCP holding register.
address definition
5
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
40101
General … For users (the register has been opened to the internal PLC)
41500
ÿ GetModConState
ÿ WriteModbusReg
2.4.1 GetModConState
This command is used to obtain the connection status of the robot and the outside world using modbus communication. Explain the command parameters
bright:
GetModConState IsConnected
ÿ IsConnected: connection status (Is Connected)
6
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
Example 1:
GetModConState(BOOL0)
2.4.2 ReadModbusReg
This instruction is used to read the value of the specified Modbus register. Describe the command parameters:
Example 1:
2.4.3 WriteModbusReg
This instruction is used to set the value of the specified Modbus register. Describe the command parameters:
Example 1:
INT0.value = 100
WriteModbusReg(101, INT0) //Change the value of register 101 to 100
7
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
The ER_ModbusTCP function library provides the function of reading and writing Modbus registers. The readable and writable index numbers are
The register values of 101-1500 can be used for data interaction with robot controllers and external Modbus devices.
2.5.1 ER_RobModbusCnctState
Input parameters:
Output parameters:
2.5.2 ReadModbusReg
Input parameters:
RegIndex (INT): Register ID number, supports input values in the range of 101-1500.
8
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
Output parameters:
IndexError (BOOL): TRUE indicates that the index number is out of range.
2.5.3 WriteModbusReg
Input parameters:
EnWrite (BOOL): The rising edge executes the operation of writing the value to the specified register.
RegIndex (INT): Register ID to be written, supports input value in the range of 101-1500.
Output parameters:
IndexError (BOOL): TRUE indicates that the index number is out of range.
9
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
This section takes the ModBus debugging assistant ModScan as an example to explain how to use ModBusTCP communication.
The interface interacts with the robot, ModScan simulates the communication master station, and the robot serves as the communication slave station.
Special note: The command interaction in this chapter is a secure handshake mechanism.
1. Connect the local computer to the robot control system. (You can ping the real-time system IP192.168.6.68)
Click ConnectionÿConnect to enter the following interface and configure the robot IP and port number.
First click protocol selection to configure the connection parameters, then click OK to complete the configuration and connect to the robot.
3. Set Address (starting address) to 1, set Length (length) to 100, and select 03 from the function code drop-down menu:
11
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
By looking at the ModBus Tcp point table in Chapter 5 of this article, we can see that SimDI20 corresponds to robot register 40065
bit4.
12
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
After communication interaction: Double-click the 40065 register corresponding to ModScan to pop up the value writing window, check bit4 and click Update
13
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
By looking at the ModBus Tcp point table in Chapter 5 of this article, we can see that SimAI1 corresponds to robot registers 40068 and
40069, the analog channel transmits floating-point data, and one analog channel corresponds to two register addresses.
The ModScan side needs to be set as shown in the figure below, the display format is changed to 32-bit floating point number, and the starting value is changed to 2.
In this way, the two registers 40068 and 40069 can display a floating point number (in practical applications with external devices
After communication interaction: Double-click the 40068 register corresponding to ModScan to pop up the value writing window, and write Value to 25. Click
Update, the teach pendant side SAin[1] receives the value 25, and the communication is successful.
14
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
ÿ ModScan (PLC) sends a command to start the running program to the robot (the stop and reset operation is similar to this);
By looking at the ModBus Tcp point table in Chapter 5 of this article, we can see that all operations that send commands to the robot must
There are two: ÿ The robot is in remote excitation state; ÿ All command operations are coordinated with the read and write flag register 40100
And the rising edge trigger is valid, the command register corresponding to remote start is 40052, and the value is 0x4.
ÿ Turn the key switch of the robot teach pendant to the remote state, and the robot will automatically activate the excitation and load the set
15
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
ÿ Make sure the values in the 40100 and 40052 registers are 0, first write 0x11 into the 40100 register,
At this time, the 40019 register status changes to 0x801 (this value indicates that the current system is waiting for commands),
Then write 0x4 into the 40052 register. At this time, the robot program starts and the 40019 register status changes.
is 0x404 (this value indicates that the startup command is executed successfully and continues to wait for new control rights). If the subsequent
Before sending other commands to the robot, the contents of registers 40100 and 40052 should be cleared to 0 first.
ÿ ModScan (PLC) sends the loader command to the robot. The program name is estun.main, and then
By looking at the ModBus Tcp point table in Chapter 5 of this article, we can see that all operations that send commands to the robot must
There are two: ÿ The robot is in remote excitation state; ÿ All command operations are coordinated with the read and write flag register 40100
And the rising edge trigger is valid. The corresponding command register for remote loading is 40052, the value is 0x80, and the value to be loaded is
The program name is stored in the next 10 registers starting with register 40054.
ÿ The hexadecimal values corresponding to the robot program name estun.main are 0x7365, 0x7574,
0x2E6E, 0x616D and 0x6E69, store the above values into 5 addresses starting with 40054.
ÿ Make sure the values in the 40100 and 40052 registers are 0, first write 0x11 into the 40100 register,
At this time, the 40019 register status changes to 0x801 (this value indicates that the current system is waiting for commands),
Then write 0x80 into the 40052 register. At this time, estun.main is loaded on the teaching pendant, and the 40019 register status changes to
0x480 (this value indicates that the engineering command is loaded successfully and continues to wait for new control rights). If
16
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
To subsequently send other commands to the robot, you should first clear the contents of registers 40100 and 40052.
0ÿ
Note: The name of the robot program is estun.main. There are two ways to know its corresponding hexadecimal value:
ÿ Manually load the estun.main program on the teach pendant, which will be in the 10 registers headed by 40005.
ÿ Install Notepad++ software, which is a very useful text software. Create a new page and type in it.
ASCII->HEX, convert it into a hexadecimal number, then separate it every four digits, and separate the high and low words of each word
After changing the order of the sections, we get the result we need, as shown below:
17
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
ÿ ModScan (PLC) sends a reset program pointer command to the robot, and the robot reloads and starts
program to return the PC pointer to the first line (if the robot is currently in motion, it will also respond to this
command, first stop the current motion and then reload the self-starting program).
By looking at the ModBus Tcp point table in Chapter 5 of this article, we can see that all operations that send commands to the robot must
There are two: ÿ The robot is in remote excitation state; ÿ All command operations are coordinated with the read and write flag register 40100
And the rising edge trigger is valid, the command register corresponding to the remote reset program pointer is 40052, and the value is 0x4000.
ÿ Set estun.main as the startup program, and the current PC pointer stays on line 5.
ÿ Make sure the values in the 40100 and 40052 registers are 0, first write 0x11 into the 40100 register,
At this time, the 40019 register status changes to 0x801 (this value indicates that the current system is waiting for commands),
Then write 0x4000 into the 40052 register. At this time, the robot reloads the estun.main program.
The PC pointer returns to the first line, and the 40019 register status changes to 0x4400 (this value indicates that the program pointer is reset
The command is successful and continues to wait for new control). If you subsequently send other commands to the robot, you should
18
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
ÿ This article introduces the default robot as a Modbus Tcp communication slave, and the external device as a Modbus Tcp
Communication master station. The robot only accepts connections from one master station. Multiple clients cannot connect to the machine at the same time.
(If you have this requirement, please contact Eston technical personnel); if the communication protocol part of the external device master station
It is compiled by individuals. You can use ModSim to test that the function is available before connecting to the robot.
ÿ In the IO communication part, whether the robot is in manual, automatic or remote mode, the system will respond to the processing, and
In the command operation part, the robot must be in remote and excitation state, and the triggering methods are all rising edge triggers.
To take effect, first open the control permission (40100) in order and then issue the corresponding command (40052).
ÿ During communication interaction, you should first make sure that the communication register addresses of the devices at both ends are correct, otherwise it will definitely not succeed.
achievement. When an external device sends data to the robot, you can first determine the register corresponding to SimDI.
Because it is most intuitive to see the SimDI signal reception from the teaching pendant. When the external device corresponding to SimDI
When the mail address is determined, other communication addresses can be determined based on the sequence offset of the robot communication point table.
When the external device receives the robot data, it can also determine the address through SimDO.
site.
ÿ When interacting with an external device, the external device can determine whether the command is based on the status information returned by the robot.
Whether the delivery is successful, each command has a corresponding success flag in the 40019 register. In addition, in the communication
19
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
During the signaling process, if the error bit in the 40019 register is TRUE, you need to issue a reset state machine command.
command to clear the error, otherwise the system will not respond to subsequent commands.
ÿ When the robot communicates with Siemens PLC via ModBus Tcp to exchange analog data, the Siemens
Subdata storage is based on the low address byte as the high byte of the double word, and the high address byte as the low byte of the double word.
Bytes, so special attention needs to be paid to the correspondence during data interaction.
20
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
Chapter 3 of this manual introduces how to operate Modbus registers to realize command exchange with the robot controller.
mutual. For security reasons, the operation method has strict verification; for user convenience, a streamlined command interactive machine has been added
There are two prerequisites for using this mechanism to send command operations to the robot:
ÿ The value 0x88 needs to be written in the read and write flag register 40100;
Use the ModBus debugging assistant ModScan as an example, refer to Section 3.1 , after establishing a connection with the controller.
First, write 0x88 into the 40100 register. The status of the 40003 register changes to 0x88 synchronously. At this time, the command exchange is simplified.
The mutual mechanism takes effect, and then you can execute the corresponding command by assigning the bit bit of the 40052 register, and execute
After the operation is successful, you can observe the changes in the corresponding bits of 40019, as shown in the figure below.
21
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
Use ModScan (PLC) to send running program commands to the robot (the pause reset operation is similar to this); first confirm
Ensure that it is currently in streamlined mode and the robot is in remote excitation state; all command operations must be coordinated with the command register
40052, the value corresponding to the remote startup robot program is 0x04. (If you need to send other commands to the robot, clear the 40052 register to 0)
ÿ Turn the key switch of the robot teach pendant to the remote state, the robot will automatically activate the excitation and load the set
ÿ Make sure that the value of the 40052 register starts with 0x00, and then writes 0x04. At this time, the robot program starts running.
22
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
Use ModScan (PLC) to send the loader command to the robot. The program name is estun.main
Also only need to operate the 40052 register and write the value 0x80.
ÿ The hexadecimal values corresponding to the robot program name estun.main are 0x7365, 0x7574,
0x2E6E, 0x616D and 0x6E69, store the above values into 5 registers starting with 40054 respectively.
ÿ Make sure that the value of the 40052 register starts with 0x00, then writes 0x80, and then loads the
Use ModScan (PLC) to send a reset program pointer command to the robot, and the robot will reload and start remotely
program to return the PC pointer to the first line (if the robot is currently in motion, it will also respond to this command and stop first.
Stop the current movement and reload the remote self-starting program).
23
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
ÿ Set estun.main as a remote self-starting program, and the current PC pointer stays on line 5.
ÿ Make sure that the value of the 40052 register starts with 0x00, then writes 0x4000, and the robot reloads
estun.main program, the PC pointer returns to the first line, and the 40019 register also changes to 0x4000.
24
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
Use ModScan (PLC) to send a clear all alarm command (reset the robot) to the robot, and an error occurs.
There are two situations (for ease of description, shown in binary below):
ÿ Modbus instruction execution error. For example, when executing the loading program, the register corresponding to the program name is empty, or
The program is in running state, and the program is started again; at this time, bit13 of Modbus status register 40019 will be set.
1. When this bit is set to 1, the system does not respond to any command. It is necessary to set the bit10 bit of the 40052 register to 1.
to reset.
After an execution error in the above figure, bit10 of 40052 needs to be assigned to reset.
ÿ An alarm occurs in the robot system, that is, an alarm is displayed in the status bar on the teaching pendant; for example, when starting the program, the safety door
Alarm, because the program is not running, bit13 of 40019 will also be set to 1. Then you first need to send 40052
Set bit10 of the register to 1. When the 40019 register changes to 0x00 again, then reset 40052 to 0x00.
Then write 0x10 to perform the operation of clearing the alarm and resetting it.
25
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
First, you need to set bit10 of 40052 to 1, and clear the 40019 register to 0;
After the 40052 register is cleared to 0 again, write 0x10 (bit4 is set to 1), and execute the command to clear the teaching pendant alarm.
4.6 Precautions
(1) The simplified command interaction mechanism does not conflict with the original mechanism. When 0x11 is written into the 40100 register, the original
The mechanism takes effect. For usage, please refer to Chapter 3 ; when 0x88 is written to the 40100 register, the simplified command interaction mechanism takes effect.
26
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
(2) When a command execution error occurs, bit13 of the 40019 register will be set to 1. At this time, the command can no longer be executed.
According to the command, bit10 of the 40052 register needs to be set to 1 to clear the instruction error and reset 40019 to 0x00.
(3) Each command is triggered by the rising edge. When executing the command, you first need to ensure that the value of the 40052 register is 0x00.
Only when a certain bit is assigned a value will there be a response; and only one command type can be responded to in the same cycle, that is, 40052 registration
The device can only have one bit with signal. When multiple bits have signals, the command will not respond.
(4) The pause signal is not affected by multiple signals and can be executed at any time.
27
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
As a server for ModbusTCP communication, Rob defines a data register area of 3000 bytes.
Among them, MBDataBuffer[0]~MBDataBuffer[50] is the sending area of the Server (that is, the external PLC needs
Among them, MBDataBuffer[51]~MBDataBuffer[99] is the receiving area of the Server (i.e. external PLC
Among them, MBDataBuffer[100]~MBDataBuffer[1499] are general read and write areas of registers (can be found in
40002 ÿ
is[3] breath
do
40005
is[4] Current loader File name: estun.test,
20 bytes
MBDataBuff Cheng name Then the value of each register is as follows:
40006
is[5] Down:
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
MBDataBuff [4]0x6573,
40007
is[6] [5]0x7475,
MBDataBuff [6]0x6E2E,
40008
is[7] [7]0x6D61,
MBDataBuff [8]0x696E
40009
is[8]
MBDataBuff
40010
is[9]
MBDataBuff
40011
is[10]
MBDataBuff
40012
is[11]
MBDataBuff
40013
is[12]
MBDataBuff
40014
is[13]
MBDataBuff SimDout[1-1
40015 DO 1-16 ÿ
is[14] 6]
is[15] 32]
is[16] 48]
is[17] 64]
29
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
bit0: command is 0
success
success
When , bit[0] is 0
bit6: The next enable command is
After the command is executed successfully,
success
zero
success
Therefore, the command can be issued
line complete
error
bit15: reserved
6]
…… ÿ
dot type)
30
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
MBDataBuff
40051
is[50]
MBDataBuff Rob operation finger Load project files When 40019 is 0x801
40052
is[51] make bit8 (0ÿ0x100): Can issue instructions)
Unregister the current project file Special: when the instruction is executed
Recei Instruction state machine reset device before it can be distributed again.
MBDataBuff
40053 Global speed value -
ÿ
is[52]
MBDataBuff
40054
is[53]
MBDataBuff
40055
is[54]
MBDataBuff
40056 Set the project name to 20 bytes
ÿ
is[55]
MBDataBuff
40057
is[56]
MBDataBuff
40058
is[57]
31
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
MBDataBuff
40059
is[58]
MBDataBuff
40060
is[59]
MBDataBuff
40061
is[60]
MBDataBuff
40062
is[61]
MBDataBuff
40063
is[62]
MBDataBuff
40064 SimDI[1-16] DI 1-16
ÿ
is[63]
MBDataBuff
40065 SimDI[17-32] DI 17-32
ÿ
is[64]
MBDataBuff
40066 SimDI[33-48] DI 33-48
ÿ
is[65]
MBDataBuff
40067 SimDI[49-64] DI 48-64
ÿ
is[66]
MBDataBuff
40068
is[67] Each two registers correspond to
……
SimAI[1-16] AI 1-16 An analog point (floating
MBDataBuff
40101
is[100] For user (storage
Gener
… … Device value is open Read and write permissions
al
… … to internal PLC)
… …
32
Machine Translated by Google
ER Series Industrial Robot ModBusTCP Interface Debugging Manual
MBDataBuff
41500
is[1499]
33