Overview
This application note describes the necessary configurations and settings to establish communications with the HE599ETX200 via ModbusTCP client applications. This document covers:
- Boot-P
- Modbus addressing.
- ModbusTCP rules specific to the ETX200.
- Configuration words of individual I/O modules.
- Setup example using Modbus Poll software.
Section 1
Modbus Addressing
Input and Output I/O mapping
| I/O Data Locations | ||||
| Data | Offset | Address | Function Code Read | Funtion Code Write |
| Input Data (all) | 0x000 | 30001 (Input) | 4 | N/A |
| Output Data (all) | 0x000 | 40001 (Holding) | 3 | 6 single 16 multiple |
Table 1
All input data whether it be analog or digital is accessed in the 30001 address range.
The input data is mapped in the order the modules are stacked on the ETX200.
For example: With modules DIM610 in the first slot and THM100 in the second slot,
30001 contains the digital input data (bits 1-16) of the DIM610.
30002 through 30005 contains the analog input data of the THM100. Channels 1-4.
All output data starts at 40001 whether it is analog or digital.
As with the input data, the address mapping is in order according to the order of the output modules stacked on the ETX200.
I/O modules can be added in any order.
Configuration Words
This is the mapping for the configuration words for each SmartRail I/O module.
See Section 2 for config word mapping for individual SmartRail I/O.
| Configuration Data Locations (2w/slot) | ||||
| Slot | Offset | Holding Register Address | Function Code Read | Function Code Write |
| 1 | 0x100 | 40257 – 40258 | 3 | 16 |
| 2 | 0x102 | 40259 – 40260 | 3 | 16 |
| 3 | 0x104 | 40261 – 40262 | 3 | 16 |
| 4 | 0x106 | 40263 – 40264 | 3 | 16 |
| 5 | 0x108 | 40265 – 40266 | 3 | 16 |
| 6 | 0x10A | 40267 – 40268 | 3 | 16 |
| 7 | 0x10C | 40269 – 40270 | 3 | 16 |
| 8 | 0x10E | 40271 – 40272 | 3 | 16 |
Table 2
ModbusTCP rules specific to the ETX200.
When it comes to addressing the SmartRail ETX200 the rule is All or Nothing.
This means that individual modbus addresses are not available by themselves. All addresses of one type must be scanned as a complete block of addresses. Types are inputs, outputs, and config words. Attempting to poll a single address out of a block will result in the ETX200 sending an exception error code to the client (master).
For example, if we have an ETX200 with a DIM610 (1 word digital inputs), THM100 (4 channels, in) and a MIX116 (2 channels, in), the Modbus addressing used for the inputs is 30001 through 30007. If we try to scan only 30001 set to a length of 1, this results with the ETX200 sending exception error code sent and no data.
In this example we have to set up a scan item to address 30001 with a length of 7 so that all available input addresses are polled as one item. All or nothing.
The all or nothing rule applies equally to analog and digital ouputs as well as the configuration words. They all have to be read or written to as complete blocks of data.
Modbus function codes for writing data to the ETX200 are:
6 (single word write)
16 (multiple word write)
Note: Based on the all or nothing rule, the only situation where a function code 6 could be used is when writing the digital outputs of only a single installed digital output module and the number of ouputs is 16 or less.
Section 2
I/O module config words mapped:
HE599DIM510, DIM610, & DIM710
| Configuration Word 1 (low word) | Bit 9 – 12 Input Filter0000: 3ms 0001: 1ms 0010: 5ms 0011: 10ms 0100: 20ms 0101: 70ms 0110: 100ms |
|||||||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | |||||
| n/a | n/a | n/a | n/a | All Inputs | n/a | n/a | n/a | n/a | ||||||||||||
| n/a | Input Filter | n/a | ||||||||||||||||||
| Configuration Word 2 | ||||||||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | |||||
| n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a | |||||||||
| n/a | n/a | n/a | ||||||||||||||||||
HE599DIQ512, DQM506, DQM606, DQM706, DQM 502, & DQM 602
| Configuration Word 1 (low word) |
Bit 9 – 12 Input Filter 0000: 3ms 0001: 1ms 0010: 5ms 0011: 10ms 0100: 20ms 0101: 70ms 0110: 100ms |
|||||||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | |||||
| n/a | n/a | n/a | n/a | All Inputs | Hold Last State | |||||||||||||||
| n/a | Input Filter | 0: disabled 1: enabled | ||||||||||||||||||
| Configuration Word 2 | ||||||||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | |||||
| 57~ 64 |
49~56 | 41~48 | 33~40 | 25~32 | 17~24 | 9~16 | 1~8 | n/a | n/a | n/a | n/a | |||||||||
| Configure Channels to hold last state | n/a | |||||||||||||||||||
HE599ADC170
| Configuration Word 1 (low word) | Bits 1-8 00: 0-10V 01: 0-20mA 10: 4-20mA |
||||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | ||
| n/a | n/a | n/a | n/a | CH4 | Ch3 | Ch2 | Ch1 | Ch 4 | Ch3 | Ch 2 | Ch 1 | ||||||
| Enable Bit 1: enabled | Voltage or Current | ||||||||||||||||
| Configuration Word 2 | |||||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | Bits 9-16 00: 0~4000 01: -2000~2000 10: 0~1000 11: 0~1000 |
|
| Ch4 | CH3 | Ch2 | Ch1 | n/a | n/a | n/a | n/a | ||||||||||
| Designation of output data range | n/a | ||||||||||||||||
HE599RTD100
| Configuration Word 1 (low word) | |||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 |
| n/a | n/a | n/a | n/a | CH4 | Ch3 | Ch2 | Ch1 | Ch 4 | Ch3 | Ch 2 | Ch 1 | ||||
| Enable Bit 1: enabled | *RTD Type | ||||||||||||||
| Configuration Word 2 | |||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 |
| n/a | n/a | n/a | n/a | CH4 | Ch3 | Ch2 | Ch1 | n/a | n/a | n/a | n/a | ||||
| Input Type (C or F) 0: F, 1: C | n/a | ||||||||||||||
* 00: PT100 01: JPT100
HE599THM100
| Configuration Word 1 (low word) | |||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 |
| n/a | n/a | n/a | n/a | Ch4 | Ch3 | Ch2 | Ch1 | Ch 4 | Ch3 | Ch 2 | Ch 1 | ||||
| Enable Bit 1: enabled | *TC Type | ||||||||||||||
| Configuration Word 2 | |||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 |
| n/a | n/a | n/a | n/a | Ch4 | Ch3 | Ch2 | Ch1 | n/a | n/a | n/a | n/a | ||||
| Input Type (C or F) 0: C, 1: F | n/a | ||||||||||||||
* 00: K 01: J 10: T 11: R
HE559MIX116
| Configuration Word 1 (low word) | Bits 1-8 00: 4~20mA 01: 0~20mA 10: 0~5V 11: 0~10V |
||||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | ||
| n/a | n/a | n/a | n/a | Output Ch2 | Output Ch1 | Input Ch2 |
Input Ch1 | Output Ch 2 | Output Ch1 | Input Ch 2 | Input Ch 1 | ||||||
| Enable Bit 1: enabled | Voltage or Current | ||||||||||||||||
| Configuration Word 2 | |||||||||||||||||
| 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | Bits 9-16 00: 0~4000 01: -2000~2000 10: 0~1000** 11: 0~1000 |
|
| Ouput Ch2 |
Output Ch1 |
Input Ch2 |
Input Ch1 |
Output Ch2 |
Output Ch1 |
||||||||||||
| Designation of data range | Configuration of output level by channel | ||||||||||||||||
**10: 0~1000 (400~2000/0~2000 depending on voltage or current settings)
HE559DAC101, DAC106
Section 3
Example configuration using Modbus Poll Software.
ETX200 IP address 192.168.254.120
ETX200 slave ID: any valid ID number 1 to 253 in Modbus Poll.
A Modbus slave ID is not assigned to the ETX200. It will respond to any valid Modbus message sent to it’s IP address regardless of the Modbus slave ID number.
| Module | Description | Address |
| HE559ETX200 | Status | |
| HE559DIM610 16 digital input |
Config | 40257 & 40258 |
| Input Data | 30001 | |
| HE559RTD100 4 CH temperature |
Config | 40259 & 40260 |
| Input Data | 30002 through 30005 | |
| HE559DQM606 16 digital Output |
Config | 40261 & 40262 |
| Output Data | 40001 |
- Define connection.
- Click ‘Setup’ and configure the Write Definition to enable the RTD channels.
Note: the address is 257 and not 40257. Modbus Poll uses generic decimal addressing and not the traditional Modbus address format. Just drop the first two digits from the Modbus address and you have the correct address assigned in Modbuss Poll.
Remember: All or none. In this example there are 3 I/O modules, so 6 config words.
- Write 3840 to the first config word assigned to the RTD100.
This sets high bits 9-12, which enables the 4 RTD channels.
Bit 9 = Channel 1, Bit 10 = Channel 2, etc.
Edit by clicking on the cell and start typing new value.
- Monitor digital and analog inputs.
- Write data to digital outputs.
21 = 10101 in binary.
This is turning on digital outputs 1, 3, and 5.
Edit by clicking on the cell and start typing new value.
Section 2 steps were followed completely.
1. Please follow the application note procedures again and verify that Section 1 and Section 2 steps were followed completely.
2. Try closing and reopening Excel.
3. Try closing and reopening both KepserverEX and Excel. Open KepserverEX first.
4. Verify that the path is typed correctly in Excel. The path can be copied directly from this document and pasted into Excel.
5. Try restarting the PC again.