SIMATIC TI505/TI500

MODNIM
User Manual

Order Number: PPX:505-8122-1

Manual Assembly Number: 2586546-0083
Original Edition
 Copyright 1993 by Siemens Industrial Automation, Inc.
All Rights Reserved — Printed in USA

Reproduction, transmission or use of this document or Technical data is subject to change.

contents is not permitted without express consent of
Siemens Industrial Automation, Inc. All rights, including rights We check the contents of every manual for accuracy at the
created by patent grant or registration of a utility model or time it is approved for printing; however, there may be
design, are reserved. undetected errors. Any errors found will be corrected in
subsequent editions. Any suggestions for improvement are
Since Siemens Industrial Automation, Inc. does not possess
welcomed.
full access to data concerning all of the uses and applications
of customer’s products, we do not assume responsibility either
for customer product design or for any infringements of patents
or rights of others which may result from our assistance.

01/21/92
MANUAL PUBLICATION HISTORY
SIMATIC TI505/TI500 MODNIM User Manual
Order Manual Number: PPX:505-8122-1

Refer to this history in all correspondence and/or discussion about this manual.

Event Date Description

Original Issue 03/93 Original Issue (2801280–0001), Software Release 3.0

LIST OF EFFECTIVE PAGES

Pages Description Pages Description

Cover/Copyright Original
History/Effective Pages Original
iii — ix Original
1-1 — 1-20 Original
2-1 — 2-39 Original
A-1 — A-4 Original
B-1 — B-2 Original
C-1 — C-3 Original
D-1 — D-6 Original
Index-1 — Index-3 Original
Registration Original
 Contents
Preface
Chapter 1 Installation and Set-up
1.1 Modbus Communications Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Modbus Network Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Modbus Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Transmission Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
1.2 Quick Reference Installation Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
General Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Handling the Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Inspecting the Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Getting Started with Configuration and Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
1.3 Setting the Dipswitches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Dipswitch Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Setting the Network Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Selecting Network Configuration Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Data Transmission Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Stopbit Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Parity/No Parity Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Odd/Even Parity Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
ASCII/RTU Mode Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
RTS/CTS Handshaking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Y/C Coil Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
1.4 Installing the MODNIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10
Installing the Series 505 MODNIM in the I/O Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10
Installing the Series 500 MODNIM in the I/O Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-12
1.5 Switches and Indicator Lights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Switches and Buttons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Reset Button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Test Button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Local/Remote Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Status Indicator Lights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-15
1.6 Diagnostic Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-16
Built-in Diagnostic Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-16
Power-up Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-16
Run-time Self Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-17
User-Initiated Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-18

Contents iii
1.7 Establishing Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-19
Verifying that the MODNIM is Logged into the PLC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-19
Connecting the Network Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-20
Recommended Communication Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-20
Building a Cable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-20

Chapter 2 Modbus Commands

2.1 Modbus Protocol Overview — ASCII Transmission Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
Modbus Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
The ASCII Transmission Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
The Start Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
The Address Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
The Function Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
The Data Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
The LRC Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
The EOF Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
The Ready Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
2.2 Modbus Protocol Overview — RTU Transmission Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
The RTU Transmission Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
The RTU Frame Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Message Delineation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Checksum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5
Invalid Characters and Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5
2.3 Comparing Modbus Functions with TIWAY I Network Commands . . . . . . . . . . . . . . . . . . . 2-6
Modbus Functions vs. TIWAY Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6
Addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7
Address Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7
2.4 Modbus Function Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8
Code 01 — Read Coil Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8
Code 02 — Read Input Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-10
Code 03 — Read Output Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-12
Code 04 — Read Input Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-13
Code 05 — Write a Single Coil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-14
Code 06 — Write a Single Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-16
Code 07 — Read Exception Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-17
Code 08 — Execute Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-19
Code 11 — Get Comms Event Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-30
Code 12 — Get Comms Event Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-31
Code 15 — Write Multiple Coils . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-33
Code 16 — Write Multiple Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-35
Code 17 — Report Slave ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-36
2.5 Error Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-38

iv Contents
Appendix A Network Cable Communications
A.1 Network Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
Recommended Communication Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
Building Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
Cable Pinouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
A.2 Communications Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4
RS-232-C Pin Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4
Recommended Communications Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4

Appendix B Exception Codes

B.1 Exception Codes Supported by the MODNIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-2

Appendix C Specifications
C.1 Environmental Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-2

C.2 MODNIM Communications Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-3

Appendix D Using the MODASST Program

D.1 Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2
Hardware Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2
Running the Program from the Floppy Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2
Running the Program from the Hard Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-3
D.2 Starting Program Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4
Setting the Communication Port Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4
Setting the Remaining Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4
D.3 Using Program Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-5
Setup Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-5
Run Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-5
Find Module Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-6
Talk to Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-6
Batch Send from File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-6
Verifying Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-6

Contents v
List of Figures

Figure 1-1 Multidrop and Point-to-point Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3

Figure 1-2 Quick Reference Installation Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Figure 1-3 Address Setting Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Figure 1-4 Dipswitch Settings for Network Data Transmission Rates . . . . . . . . . . . . . . . . . . . . . . . 1-7
Figure 1-5 Series 505 MODNIM Switches and LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-8
Figure 1-6 Series 500 MODNIM Switches and LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9
Figure 1-7 Installing the Series 505 MODNIM in the I/O Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10
Figure 1-8 Series 505 MODNIM Example Dipswitch Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-11
Figure 1-9 Keying the I/O Base Slot for the Series 500 MODNIM . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-12
Figure 1-10 Installing the Series 500 MODNIM in the I/O Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-13
Figure 1-11 Series 505 and 500 MODNIM Indicator Lights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-15
Figure 1-12 LED Status during Power-Up Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-16
Figure 1-13 LED Status during Normal Run-Time Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-17
Figure 1-14 Sample I/O Definition Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-19

Figure 2-1 ASCII Transmission Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2

Figure 2-2 RTU Transmission Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Figure 2-3 Bit Orientation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6
Figure 2-4 Read Coil Status Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8
Figure 2-5 Read Coil Status Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-9
Figure 2-6 Read Coil Status Example — Data Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-9
Figure 2-7 Read Input Status Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-10
Figure 2-8 Read Input Status Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-10
Figure 2-9 Read Input Status Example — Data Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-11
Figure 2-10 Read Output Register Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-12
Figure 2-11 Read Output Register Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-12
Figure 2-12 Read Input Register Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-13
Figure 2-13 Read Input Register Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-13
Figure 2-14 Write a Single Coil Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-14
Figure 2-15 Read Input Register Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-15
Figure 2-16 Write a Single Register Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-16
Figure 2-17 Write a Single Register Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-16
Figure 2-18 Read Exception Status Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-17
Figure 2-19 Read Exception Status Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-17
Figure 2-20 Exception Status Bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-18
Figure 2-21 Execute Diagnostics Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-19
Figure 2-22 Execute Diagnostics Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-19
Figure 2-23 Get Comms Event Counter Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-30
Figure 2-24 Get Comms Event Counter Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-30
Figure 2-25 Get Comms Event Log Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-31
Figure 2-26 Get Comms Event Log Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-31
Figure 2-27 Write Multiple Coils Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-33

vi Contents
Figure 2-28 Coil Bit Pattern . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-34
Figure 2-29 Write Multiple Coils Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-34
Figure 2-30 Write Multiple Registers Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-35
Figure 2-31 Write Multiple Registers Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-35
Figure 2-32 Report Slave ID Example — Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-36
Figure 2-33 Report Slave ID Example — Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-36
Figure 2-34 Exception Response Frame— ASCII Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-38
Figure 2-35 Exception Response Frame — RTU Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-38

Figure A-1 MODNIM to Host (without Handshaking) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2

Figure A-2 MODNIM to Host (with Handshaking) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-3
Figure A-3 MODNIM to Commercial Modem (with Handshaking) . . . . . . . . . . . . . . . . . . . . . . . . A-3

Figure D-1 First Configuration Screen after Start-Up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-3

Figure D-2 MODASST Setup Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-5

Contents vii
List of Tables

Table 1-1 Transmission Mode Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3

Table 1-2 Status of Indicator Lights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-15
Table 1-3 Indicator Status after User-Initiated Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-18
Table 1-4 Standard Communication Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-20

Table 2-1 Modbus Functions Supported . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3

Table 2-2 RTU Mode Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Table 2-3 Terminology Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6
Table 2-4 Diagnostic Codes Supported . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-20
Table 2-5 Diagnostic Bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-22
Table 2-6 Event Byte Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-32
Table 2-7 Function Code 17 Response Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-37
Table 2-8 Exception Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-39

Table A-1 RS-232-C Connector Pin Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4

Table A-2 Communications Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4

Table B-1 Exception Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-2

Table C-1 Environmental Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-2

Table C-2 MODNIM Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-3
Table C-3 Modbus Codes vs. TIWAY Primitives Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-3

viii Contents
 Preface
Purpose of this This manual provides the following information on the Series 505 and
Manual Series 500 MODNIM (Modbus Network Interface Module), model
numbers PPX:505–5184 and PPX:500–5184.

• Basic features of the MODNIM

• Installation and configuration

• Diagnostic self-testing procedures

• Operating instructions

• Modbus commands and error responses

• MODNIM specifications

Related Manuals The following publications contain related information which supplement
this manual.

Series 505 Manuals

• SIMATIC
TI505 Programming Reference Manual

• SIMATIC TI505 TISOFT User Manual
• SIMATIC
TI525/TI535 Hardware and Installation Manual
• SIMATIC
TI545 System Manual

Series 500 Manuals

• SIMATIC
TI520C/TI530C Programmable Controller Manual

• Series 500 I/O Base User’s Manual
• SIMATIC
TI560/TI565 Programming Manual

The following Gould Modicon publications are also recommended.

• Gould Modbus Protocol (part no. PI-MBUS-300 Rev B)

• Modbus System Planning (part no. PI-MBUS-PLN)
• Gould Modicon J474/J475 Interface (part no. PI-J475-001 Rev B)

Technical If you need information that is not included in this manual, or if you have
Assistance problems using the module, contact your Siemens Industrial Automation,
Inc. distributor or sales office. If you need assistance in contacting your
distributor or sales office in the United States, call 1–800–964-4114.

SIMATIC TI505/TI500 MODNIM User Manual Preface ix

 Chapter 1
Installation and Set-up
1.1 Modbus Communications Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Modbus Network Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Modbus Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Transmission Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
1.2 Quick Reference Installation Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
General Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Handling the Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Inspecting the Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Getting Started with Configuration and Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
1.3 Setting the Dipswitches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Dipswitch Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Setting the Network Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Selecting Network Configuration Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Data Transmission Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Stopbit Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Parity/No Parity Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Odd/Even Parity Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
ASCII/RTU Mode Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
RTS/CTS Handshaking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Y/C Coil Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
1.4 Installing the MODNIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10
Installing the Series 505 MODNIM in the I/O Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-10
Installing the Series 500 MODNIM in the I/O Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-12
1.5 Switches and Indicator Lights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Switches and Buttons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Reset Button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Test Button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Local/Remote Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-14
Status Indicator Lights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-15
1.6 Diagnostic Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-16
Built-in Diagnostic Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-16
Power-up Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-16
Run-time Self Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-17
User-Initiated Self Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-18
1.7 Establishing Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-19
Verifying that the MODNIM is Logged into the PLC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-19
Connecting the Network Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-20
Recommended Communication Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-20
Building a Cable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-20

SIMATIC TI505/TI500 MODNIM User Manual Installation and Set-up 1-1

1.1 Modbus Communications Overview

Modbus Network The Modbus system is a Local Area Network (LAN) designed to work in an
Characteristics industrial environment. It is a master/slave network in which a number of
slave nodes (e.g., Programmable Logic Controllers, or PLCs) are connected
to a Master Node, which is a host computer.

Modbus Protocol The Modbus protocol determines how messages are passed between the host
computer and the secondary nodes. Up to 247 slaves can reside on a single
network. Each node in that network must have a unique address ranging
from 1 to 247.

Because it is a master/slave network, each request is paired to one response.

The exception to this is broadcast mode, when no response is returned. This
mode is only valid for Modbus functions 5, 6, 8, 15, and 16.

NOTE: Only the master can initiate a message in a Modbus network.

The following two types of messages are used.

• The Request/Response type, where a single node is addressed.

• The Broadcast/No Response type, where all nodes are addressed but
none respond.

The Modbus message consists of an “envelope” which contains different

types of data. The envelope enables the data to be directed to the correct
address on the network. It also contains information to determine if the
contents were received correctly and instructions about what to do with the
data.

Transmission Two modes of data transmission are available for a given network; however,
Modes only one mode can be selected at a given time, and every node on the
network must conform to that mode. Usually, the requirements of the host
computer determine which mode should be selected. The two modes are the
following.

• ASCII (American Standard Code for Information Interchange)

• RTU (Remote Terminal Unit)

The MODNIM can be set to operate in either mode.

1-2 Installation and Set-up SIMATIC TI505/TI500 MODNIM User Manual

 Details of the ASCII and RTU modes of transmission are listed in Table 1-1.

Table 1-1 Transmission Mode Characteristics

Characteristic ASCII RTU

7 bits hexadecimal
Code used: 8 bits binary
(ASCII printable)
Bits per character:
Start 1 1
Data 7 8
Stop 1 or 2 1 or 2
Parity Optional Optional
Checksum LRC CRC

NOTE: On multidrop networks, the MODNIM requires a commercial modem

to connect to the Modbus network, as shown in Figure 1-1. The MODNIM
connected to a Series 505 PLC is equivalent to the use of the Modicon J475
modem interface with a Modicon PLC.

Modbus host Modbus host

Modem

Modbus Network
Modem Modem

Programmable Controllers

MODNIM MODNIM
Multidrop Configuration Point-to-point

Figure 1-1 Multidrop and Point-to-point Configurations

SIMATIC TI505/TI500 MODNIM User Manual Installation and Set-up 1-3

1.2 Quick Reference Installation Steps

General In order to install and use the MODNIM module correctly, you must meet
Requirements the following requirements.

• Ensure that you have the appropriate MODNIM model.

• The communications configurations of all devices attached to the

network must match; i.e., they must all have the same baud rate, stop
bits, parity, handshaking, and transmission mode (ASCII or RTU).

Procedures Figure 1-2 provides a quick reference list of the basic steps for installing the
MODNIM.

Install power and I/O cabling.

Disconnect power to the I/O base.

Set configuration dipswitches.

Insert module into selected I/O slot (Series 505) or two adjacent slots (Series 500).

Power up the I/O base.

Check MODNIM indicator lights.

Verify MODNIM is logged into PLC.

Connect network cables.

Figure 1-2 Quick Reference Installation Procedures

1-4 Installation and Set-up SIMATIC TI505/TI500 MODNIM User Manual

Handling the Many integrated circuit (IC) devices are susceptible to damage by the
Module discharge of static electricity. Follow the suggestions listed below to reduce
the probability of damage to these devices when you are handling this
Network Interface module, the PLC, a base controller, or any of the I/O
modules.

Both the module and the person handling the module should be at the same
ground potential. Also, follow these guidelines.

• Transport the module in an anti-static container or antistatic material.

• Ensure that the work area has a conductive pad with a lead connecting
it to a common ground.

• Ground yourself by making contact with the conductive pad and/or by

wearing a grounded wrist strap.

Inspecting the Inspect the module for any visible damage before setting any selectable
Module features. If damage is detected, contact your distributor or sales office for
further instructions.

Getting Started The following sections describe the procedures for configuring the module,
with Configuration installing the module in the base, connecting the communications cables to
and Installation the MODNIM, and initializing the system for operation. Before installing
the MODNIM, make sure that the PLC is installed and the programming
device is connected to the system.

SIMATIC TI505/TI500 MODNIM User Manual Installation and Set-up 1-5

1.3 Setting the Dipswitches

Dipswitch The MODNIM module has two blocks of dipswitches.

Functions
• The block of 8 dipswitches is used to select the MODNIM’s address on
the network.

• The block of 10 dipswitches is used to configure the network

communications parameters.

NOTE: The configuration and address switch settings are read only once
following a power-up or RESET. Be sure to reset the MODNIM following
any change in dipswitch settings or PLC memory configuration. In addition,
be aware that when the MODNIM is reset, no communication can occur
from the host to the module for several seconds.

Setting the Network Each node on a Modbus network must have a unique address. The range of
Address valid addresses is 1 to 247 (0000 0001 to 1111 0111). The address is set in
binary numbers using the block of 8 dipswitches.

NOTE: Addresses 0 or 248 to 255 (0000 0000 or 1111 1000 to 1111 1111) are
invalid addresses and, if selected, cause the module to go into Test mode.

Figure 1-3 shows examples of network addresses and their corresponding

dipswitch settings. (With the Series 505 MODNIM, hold the module with
the faceplate pointing upward, as shown in Figure 1-5. For the Series 500
MODNIM, refer to Figure 1-6 for dipswitch orientation.)

Address Address Address

1 25 203
(0000 0001) (0001 1001) (1100 1011)

1 1 1
1 2 3 4 5 6 7 8

0 0 0 0 0 0 0 1

1 2 3 4 5 6 7 8

0 0 0 1 1 0 0 1

1 2 3 4 5 6 7 8

1 1 0 0 1 0 1 1

2 2 2
4 4 4
Bit 8 8 8
Weight
16 16 16
32 32 32
64 64 64
128 128 128
0 1 0 1 0 1

= Represents direction to slide a sliding-type switch, or

side of switch to press down on a rocker-type switch
on Series 505 MODNIM.

Figure 1-3 Address Setting Examples

1-6 Installation and Set-up SIMATIC TI505/TI500 MODNIM User Manual

Selecting Network The block of 10 dipswitches is used to configure the network communication
Configuration parameters, which include data transmission rate, stopbit selection, parity,
Parameters transmission mode, RTS/CTS handshaking, and output coil mapping.
(NOTE: For all Series 500 MODNIM dipswitch settings, see Figure 1-6.)

Data Transmission Switches 1 through 4 are used to set the data transmission rate. All devices
Rate on the network must be configured to communicate at the same data rate.
Switch settings for each of the available data rates are shown in Figure 1-4.

Switches
Network Configuration 1 2 3 4 Baud
Dipswitches
0 0 0 0 – 50
10 0 0 0 1 – 50
9 0 0 1 0 – 75
8 0 0 1 1 – 110
7 0 1 0 0 – 150
6 0 1 0 1 – 200
5 0 1 1 0 – 300
4 0 1 1 1 – 600
3 Data 1 0 0 0 – 1200
2 Rate 1 0 0 1 – 1800
1 1 0 1 0 – 2400
1 0 1 1 – 3600
For Series 505: 0 1 1 1 0 0 – 4800
1 1 0 1 – 7200
For Series 500: 1 0 1 1 1 0 – 9600
1 1 1 1 – 19200

Figure 1-4 Dipswitch Settings for Network Data Transmission Rates

Stopbit Selection Switch 5 is used to select 1 or 2 stopbits. Set switch to the left for 1 stopbit,
to the right for 2 stopbits (on Series 505; for Series 500, see Figure 1-6).

Parity/No Parity Switch 6 is used to select Parity or No Parity when communicating over an
Selection RS-232-C data link. To select Parity, set switch to the left, then determine
whether you need odd or even parity and set switch 7 accordingly.

Odd/Even Parity If you selected Parity with switch 6, then you must also select either Odd or
Selection Even Parity using switch 7. This switch is active only if switch 6 is set to
Parity. Set switch to the left for Even parity, to the right for Odd parity.

ASCII/RTU Mode Switch 8 is used to select ASCII or RTU mode of transmission. Slide switch
Selection to the left for ASCII mode, to the right for RTU mode.

RTS/CTS Switch 9 is used to enable or disable RTS/CTS handshaking. If you are

Handshaking using point-to-point connections without using modems, you can disable
RTS/CTS handshaking by setting switch 9 to the left. Set switch 9 to the
right to select RTS/CTS handshaking for use with modems.

Y/C Coil Selection Switch 10 is used to determine whether the MODNIM collects data from the
PLC’s Discrete Output (Y) memory or the Control Relay (C) memory. Set
switch to the left for C coils, to the right for Y outputs.

SIMATIC TI505/TI500 MODNIM User Manual Installation and Set-up 1-7

Setting the Dipswitches (continued)

Series 505 MODNIM

MODNIM
NIM GOOD — PC GOOD —
Base power and NIM PC
PLC/MODNIM
MODNIM operating status GOOD GOOD communication
link status
XMT REC REC —
XMT — Receiving Data
Data Transmit indicator ON indicator
LINE TEST
ON LINE — TEST —
Connected to the Modbus network. Test mode status
Continuous ON indicates remote mode;
flashing indicates local mode REMOTE

LOCAL
Side View of Module,
Faceplate Up TEST

RESET
Network
Configuration

Network
PORT A
Address

Dipswitches

Dipswitch Settings Data Transmission

Push Down Push Down Rate Settings
Left Right Switches
1234 Baud
C COILS 10 Y OUTPUT
RTS/CTS: OFF 9 RTS/CTS: ON 0000 – 50 PORT B
ASCII MODE 8 RTU MODE 0001 – 50
PARITY: EVEN 7 PARITY: ODD 0010 – 75
PARITY: ON 6 PARITY: OFF
STOPBITS: 1 5 STOPBITS: 2 0011 – 110
0 4 1 0100 – 150
0 3 1 DATA 0101 – 200
0 2 1 RATE
SELECT
0110 – 300
0 1 1
0111 – 600
1 0 0 0 – 1200
8 1 1 0 0 1 – 1800
7 2 1 0 1 0 – 2400
6 4 1 0 1 1 – 3600
5 8 Network 1 1 0 0 – 4800
0 4 16 Address 1 1 0 1 – 7200 505-5184
3 32
2 64 1 1 1 0 – 9600
1 128 1 1 1 1 – 19200

Figure 1-5 Series 505 MODNIM Switches and LEDs

1-8 Installation and Set-up SIMATIC TI505/TI500 MODNIM User Manual

 Series 500 MODNIM

NIM GOOD

PC/NIM COMM GOOD

ONLINE

Reset • Push to reset

RECEIVE
1. Select Local control
TRANSMIT
2. Remove network cables
Self-Test 3. Install Loopback connectors
TEST MODE 4. Press Reset and Self-Test
together and hold 5 seconds.

Remote control (on-line)

Local/Remote
Local control (off-line)

Reset

Self-Test
DIPSWITCH Settings Data Transmission Rates
Switches
1 2 3 4 Baud
1 0
Local/Remote 0 0 0 0 – 50
Y OUTPUTS 10 C COILS 0 0 0 1 – 50
RTS/CTS: ON 9 RTS/CTS: OFF 0 0 1 0 – 75
RTU MODE 8 ASCII MODE
PARITY: ODD 7 PARITY: EVEN 0 0 1 1 – 110
PARITY: OFF 6 PARITY: ON 0 1 0 0 – 150
STOPBITS: 2 5 STOPBITS: 1
1 4 0
0 1 0 1 – 200
Configuration 1 3 0 DATA 0 1 1 0 – 300
Switches 1 2 0 RATE
1 1 0 SELECT 0 1 1 1 – 600
1 0 0 0 – 1200
1 0 0 1 – 1800
1 8 1 0 1 0 – 2400
2 7
Network 4 6 1 0 1 1 – 3600
Address Network 8 5 1 1 0 0 – 4800
16 4
0
Switches Address 1 1 0 1 – 7200
32 3
64 2 1 1 1 0 – 9600
128 1
1 1 1 1 – 19200

Figure 1-6 Series 500 MODNIM Switches and LEDs

SIMATIC TI505/TI500 MODNIM User Manual Installation and Set-up 1-9

1.4 Installing the MODNIM

Installing the To install the Series 505 MODNIM in the selected slot of the I/O base, follow
Series 505 MODNIM these steps.
in the I/O Base

! WARNING To avoid the possibility of personal injury, damage to the module,

altering the PLC memory, or causing a PLC fatal error, disconnect
power to the base’s power supply and to any modules installed in
the base before inserting or removing the MODNIM.

1. Disconnect power to the I/O base.

2. Set the dipswitches, as described in Section 1.3. (See also Figure 1-8 for
example dipswitch configuration settings.)

3. Position the module so that the front bezel is facing you.

4. Hold the top and bottom of the bezel and carefully slide the module into
the slot, pushing it all the way into the base connector. (See Figure 1-7.)

5. Ensure that the edge card connector is firmly seated in the I/O base
connector.

6. Tighten the screws at the top and bottom of the faceplate with a flat-
bladed screwdriver. (These screws also ground the module to the base.)

Minimum torque: 2.61 in-lb (0.3 N-m)

Maximum torque: 5.22 in-lb (0.6 N-m)

Figure 1-7 Installing the Series 505 MODNIM in the I/O Base

1-10 Installation and Set-up SIMATIC TI505/TI500 MODNIM User Manual

 Network Network Address
Configuration

1 1 2 4 8 16 32 64 128

0
Network address is
determined by the
sum of the values of
Baud Rate selected switches.
(19200 shown)
(Address 2 shown)
Stop bits 2 or 1
Parity OFF/ON
Parity ODD/EVEN
Mode RTU/ASCII
RTS/CTS: OFF/ON
C coils/Y outputs Note: D = side of
switch to press down.

Figure 1-8 Series 505 MODNIM Example Dipswitch Settings

SIMATIC TI505/TI500 MODNIM User Manual Installation and Set-up 1-11

Installing the MODNIM (continued)

Installing the You can key the Series 500 MODNIM module to prevent another I/O module
Series 500 MODNIM from being inserted by mistake into the two slots reserved for the MODNIM
in the I/O Base module.

To do this, insert the three keys provided in the right slot of the two slots
occupied by the module so that they fit into the notches in the edge card of
the module. (See Figure 1-9.)

! WARNING To avoid the possibility of personal injury, damage to the module,

altering the PLC memory, or causing a PLC fatal error, disconnect
power to the base’s power supply and to any modules installed in
the base before inserting or removing the MODNIM or the I/O slot
keys.

Figure 1-9 Keying the I/O Base Slot for the Series 500 MODNIM

1-12 Installation and Set-up SIMATIC TI505/TI500 MODNIM User Manual

 Once the I/O slot keys are in place, you can insert the module as follows.

1. Set the dipswitches, described in Section 1.3.

2. Position the module so that the front bezel is facing you.

3. Hold the top and bottom of the bezel and carefully slide the module into
the slot, pushing it all the way into the base connector. When the
module is fully seated in the I/O base, locking tabs will hold the module
in place. (See Figure 1-10.)

Locking tabs

Locking tabs

Figure 1-10 Installing the Series 500 MODNIM in the I/O Base

4. To remove the module, pull the tabs away from the module and slide it
out of the base, being careful not to damage the edge card.

SIMATIC TI505/TI500 MODNIM User Manual Installation and Set-up 1-13

1.5 Switches and Indicator Lights

Switches and The three switches located on the face of the module behind the access door
Buttons are Reset, Self Test, and Local/Remote, and are described in the following
paragraphs.

Reset Button The Reset button is a momentary-contact switch which initializes the
MODNIM and initiates the power-up self test. When you press Reset, all the
indicators turn on for approximately 1 second. Then, all indicators except
TEST go off for about 5 seconds. During this time, the MODNIM runs a
series of diagnostic tests to verify that the hardware components of the
module are operating properly. In addition, buffers and counters that
service the Modbus Diagnostic Functions are initialized.

If the tests have been successfully completed, only the NIM GOOD and the
PC GOOD (PC/NIM COMM GOOD) indicators will turn back on, while the
TEST indicator turns off. If, however, the TEST indicator remains on, run
the User Initiated Self-Test to determine the source of the error.

NOTE: Always press the Reset button after you change any of the
configuration dipswitches or address selection dipswitches. In addition, be
aware that when the MODNIM is reset, no communication can occur from
the host to the module for several seconds.

Test Button The Test button initiates a series of diagnostic tests when it is held down for
3 seconds after a Reset operation. Before running the diagnostic tests,
disconnect all communications cables and install loopback connectors on the
RS-232-C communications ports. These tests are described in more detail in
Section 1.6.

Local/Remote When set to Remote, this two-position toggle switch enables the MODNIM
Switch to perform write operations to PLC memory. In the Local position, the
MODNIM cannot write to the PLC.

In either position, the MODNIM can monitor PLC memory and mode of
operation. After the MODNIM is set to Online state, local or remote status
is indicated as follows.

• Local mode is indicated by a flashing ONLINE indicator.

• Remote mode is indicated by a steady ONLINE indicator.

When set to Local mode, only the Read functions 1, 2, 3, 4, 7, 11, 12, and 17
plus diagnostics function 8 can be performed. All other functions (write
operations) will be rejected with Exception Code 01.

1-14 Installation and Set-up SIMATIC TI505/TI500 MODNIM User Manual

Status Indicator The MODNIM has six indicator lights (or LEDs) located on the faceplate of
Lights the module (see Figure 1-11). These lights indicate the operational or
diagnostic status of the module as described below.

Series 505 MODNIM Series 500 MODNIM

NIM PC NIM GOOD

GOOD GOOD
PC/NIM COMM GOOD

ONLINE
XMT REC

ON RECEIVE
LINE TEST
TRANSMIT

TEST MODE

Figure 1-11 Series 505 and 500 MODNIM Indicator Lights

Table 1-2 shows how to interpret the status of the six indicator lights on the
faceplate of the MODNIM during normal operation. Section 1.6 describes
additional interpretations of the indicator lights during diagnostic testing.

Table 1-2 Status of Indicator Lights

Indicator Status Description

All power-on, reset, or run-time diagnostic
NIM GOOD On tests have been passed successfully;
MODNIM operating correctly.
PC/NIM COMM GOOD
On Communicating successfully with PLC
(PC GOOD)
On Connected to the network: Remote mode
ONLINE
Flashing Connected to the network: Local mode
RECEIVE (REC) On Receiving data over the network
TRANSMIT (XMT) On Transmitting data over the network
On MODNIM in Test mode
TEST MODE (TEST) On Failure detected after power-up diagnostics
Flashing Tests completed

SIMATIC TI505/TI500 MODNIM User Manual Installation and Set-up 1-15

1.6 Diagnostic Tests

Built-in Diagnostic The MODNIM has the following three levels of self tests available.
Tests
• Power-up Self Tests

• Run-time Self Tests

• User-initiated Self Tests

Power-up Self Test The MODNIM executes a Power-up Self Test in the following cases.

• Immediately after you apply +5 VDC power from the I/O base as part of
initialization.

• Any time the Reset button is pressed.

The Power-up Self Test checks the processor and performs a test of on-board
RAM and ROM. At the start of the test, all MODNIM indicators are turned
on for approximately 1 second, then all except the TEST MODE indicator go
off for about 5 seconds.

If the Power-up Self Test is successful, the NIM GOOD light turns on, and
the MODNIM attempts to establish communications with the PLC. If this is
successful, the PC GOOD (PC/NIM COMM GOOD) light turns on and the
MODNIM is ready for normal network control (see Figure 1-12).

If the Power-up Self Test fails, the TEST MODE indicator remains on and
the MODNIM will not respond to any communication attempts.

If the PLC does not respond, the PC GOOD (PC/NIM COMM GOOD)
indicator remains off, and the MODNIM will issue an exception response
with Error Code 04 (failure in associated device) to any host computer
initiating an interactive request to this MODNIM. In addition, the TEST
MODE indicator flashes at a 3-second interval, remaining on for 1 second.

NIM PC NIM PC NIM PC NIM PC

GOOD GOOD GOOD GOOD GOOD GOOD GOOD GOOD

XMT REC XMT REC XMT REC XMT REC

Reset or
Power-up
ON ON ON ON
LINE TEST LINE TEST LINE TEST LINE TEST

Successful Communicating
1 second 5 seconds
internal tests with PLC

Figure 1-12 LED Status during Power-Up Self Test

1-16 Installation and Set-up SIMATIC TI505/TI500 MODNIM User Manual

Run-time Self Tests The MODNIM monitors itself continuously during normal operation as
follows.

• The operating system continuously performs a ROM integrity test as a

background process.

• The MODNIM periodically verifies that it is capable of communicating

with the PLC.

• A Watchdog Timer circuit in the MODNIM guards against software

lockup.

If any failures are detected in the ROM integrity test, the NIM GOOD
indicator light turns off and the MODNIM is forced into the failed state. In
this condition, the module goes into the Offline Mode and will not respond to
any requests. (See Figure 1-13.)

When the MODNIM is in its normal operating mode but fails to

communicate with the PLC, it reports this failure to the host computer with
an exception response. Error code 04 (failure in associated device) is sent,
and the PC GOOD (PC/NIM COMM GOOD) indicator goes out. (See
Figure 1-13.) If communication is re-established, the MODNIM returns to
normal mode and the PC GOOD indicator goes back on.

NOTE: The first time a valid request is received, the ON LINE indicator
goes on and remains on as long as everything is operating properly.

NIM PC NIM PC NIM PC

GOOD GOOD GOOD GOOD GOOD GOOD

XMT REC XMT REC XMT REC

ON ON ON
LINE TEST LINE TEST LINE TEST

All Run-time ROM Integrity Failure: Not Communicating with

tests OK goes to Offline Mode PLC: reports Error Code 04

Figure 1-13 LED Status during Normal Run-Time Operation

The Watchdog Timer circuit provides an extra measure of protection against

network lockup due to a failed MODNIM. This circuit will force a RESET if
the operating software fails to execute normally.

SIMATIC TI505/TI500 MODNIM User Manual Installation and Set-up 1-17

Diagnostic Tests (continued)

User-Initiated The User-Initiated Self Test performs a complete test of the MODNIM
Self Test hardware, including the communications ports. To run this test, follow the
steps listed below.

NOTE: Since this test includes the communications ports, be sure to

disconnect the MODNIM from the network.

1. Disconnect network cables from both network ports of the MODNIM.

2. Install the loopback connectors supplied with your module on ports A

and B of the MODNIM.

3. Press the RESET button and, at the same time, press and hold the
TEST button for about 5 seconds.

The TEST MODE indicator light turns on to signal the start of the test,
while all other indicators go off. After about six seconds, all LED indicators
will flash on and off for approximately two seconds. When the test has
finished executing, the TEST MODE indicator flashes at a rate of 2 Hz.

Table 1-3 shows how to interpret the results of the user-initiated diagnostic
test according to the status of the indicator lights on the MODNIM. The
indicators show the pass or fail status of each of the tests conducted.

Table 1-3 Indicator Status after User-Initiated Test

Indicator Pass Fail Diagnostic Tests Included

NIM GOOD On Off ROM, RAM, watchdog timer

PC/NIM COMM GOOD On Off Communications with PLC
Network Port A: media
RECEIVE On Off
interface; loopback connector
Network Port B: media
TRANSMIT On Off
interface; loopback connector
TEST MODE Flashing Flashing Tests completed

If the User-Initiated Self Test is completed successfully, then you can

reconnect the network cable to the MODNIM and press the Reset button.
The MODNIM will re-initialize and be ready for normal operation.

1-18 Installation and Set-up SIMATIC TI505/TI500 MODNIM User Manual

1.7 Establishing Communications

Verifying that the After installing and configuring the MODNIM, you should verify that the
MODNIM is Logged module is properly logged into the PLC I/O map.
into the PLC

NOTE: The PLC I/O map is the first thing to check if the PC GOOD
(PC/NIM COMM GOOD) indicator light is off.

Connect your programming device to the PLC to verify PLC-to-MODNIM

module communication by following these steps.

1. Access the Configure I/O function menu, then execute Show.

2. Execute the Read Base function.

3. Check all the I/O points on the base that the MODNIM is installed in.

Once you have entered the appropriate commands, the programming

device displays a chart listing all slots on the base and the inputs and
outputs associated with each slot. If a row on the chart is blank, then
the corresponding base slot does not contain a module. Figure 1-14
shows a sample I/O definition chart with a MODNIM installed in Slot 1
of a four-slot base. (Refer to your TISOFT manual for detailed
instructions.)

I/O Address Base Number

The module is logged in Displays number
as eight outputs (Ys). of the current base.

I/O MODULE DEFINITION FOR : CHANNEL 1 BASE 00

I/O Number of Bit and Word I/O Special

Slot Address X Y WX WY Function

1 ..... 0001 ..... 00 .. 08 .. 00 .. 00 ....... Yes

2 ..... 0000 ..... 00 .. 00 .. 00 .. 00 ....... No
3 ..... 0000 ..... 00 .. 00 .. 00 .. 00 ....... No
4 ..... 0000 ..... 00 .. 00 .. 00 .. 00 ....... No

Slot Number SF Module

Install the module into any The MODNIM is logged in as
available I/O slot in the I/O base. a Special Function Module.

Figure 1-14 Sample I/O Definition Chart

SIMATIC TI505/TI500 MODNIM User Manual Installation and Set-up 1-19

Establishing Communications (continued)

4. Look at the chart for the number corresponding to the slot occupied by
the MODNIM module. If an S or SF (Special Function) and word
memory locations (or 8 Ys) appear on this line, the module is registered
in the PLC memory. Assign a unique I/O address to the module and
execute a Write PC function. You can now begin to communicate with
the MODNIM.

If the data on the line is incorrect, first check to see if the module is
firmly seated in the I/O base and enter the command again. If you still
cannot verify the module login, contact your local Siemens Industrial
Automation, Inc. distributor.

Connecting the Network cabling should already be in place before you begin installing the
Network Cables MODNIM.

The MODNIM has two communication ports. Only one port communicates
at a time, but two are provided for cabling redundancy.

Recommended For high-noise environments, it is recommended that you use a standard

Communication Siemens communications cable with your MODNIM. (Refer to Table 1-4.)
Cables Either cable is compatible with the MODNIM; the requirements of your host
computer may determine which cable you should select. These cables are
available through your Siemens Industrial Automation, Inc. distributor.

Table 1-4 Standard Communication Cables

Cable Description Cable P/N Adapter at Module

9-pin to 9-pin Standard 9-pin null modem 2601094–8001 9F–to–25M pin port adapter
25-pin serial Standard 25-pin null modem VPU200–3605 None required

Building a Cable If you prefer to build your own 25-pin cable, refer to Appendix A for the
pinouts. Ensure that the following requirements are met.

• Cable conductors — 26 AWG, tinned and stranded copper wire, with

one uninsulated 26 AWG tinned copper drain wire

• Cable shield — AL foil or aluminum-polyester foil and a 65% minimum

tinned copper braid shield

• Outer jacket — polyvinyl chloride (PVC) or equivalent material, with a

UL rating of 30V, 60°C minimum

• Connectors — 25-pin male D-connector, with contact pins of copper

alloy with gold flashing over nickel plate

1-20 Installation and Set-up SIMATIC TI505/TI500 MODNIM User Manual

 Chapter 2
Modbus Commands
2.1 Modbus Protocol Overview — ASCII Transmission Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
Modbus Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
The ASCII Transmission Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
The Start Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
The Address Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
The Function Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
The Data Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
The LRC Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
The EOF Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
The Ready Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
2.2 Modbus Protocol Overview — RTU Transmission Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
The RTU Transmission Frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
The RTU Frame Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Message Delineation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Checksum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5
Invalid Characters and Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5
2.3 Comparing Modbus Functions with TIWAY I Network Commands . . . . . . . . . . . . . . . . . . . 2-6
Modbus Functions vs. TIWAY Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6
Addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7
Address Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7
2.4 Modbus Function Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8
Code 01 — Read Coil Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8
Code 02 — Read Input Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-10
Code 03 — Read Output Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-12
Code 04 — Read Input Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-13
Code 05 — Write a Single Coil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-14
Code 06 — Write a Single Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-16
Code 07 — Read Exception Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-17
Code 08 — Execute Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-19
Code 11 — Get Comms Event Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-30
Code 12 — Get Comms Event Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-31
Code 15 — Write Multiple Coils . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-33
Code 16 — Write Multiple Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-35
Code 17 — Report Slave ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-36
2.5 Error Responses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-38

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-1

2.1 Modbus Protocol Overview — ASCII Transmission Mode

Modbus Protocol This chapter examines the Modbus protocol for both ASCII and RTU modes
of transmission. The MODNIM-supported functions are then described in
detail, with examples of requests and responses for each function code.

The ASCII Each frame in the ASCII transmission mode begins with a colon ( : ) and
Transmission Frame ends with CR LF (Carriage Return/Line Feed), shown in Figure 2-1.

Start Address Function Data LRC EOF Ready

2 characters 2 characters n x 2 char 2 char CR LF

Figure 2-1 ASCII Transmission Frame

Each of the fields in the transmission frame is described in the paragraphs

below.

The Start Field The Start field is a colon (: = 3A hex), and marks the start of the message.
This is the first character transmitted.

The Address Field The Address field identifies the node to which this message is being sent
and is a number in the range of 1 to 247. Each node on any one network
must have a unique address. Only those nodes addressed will respond
unless the broadcast address 0 is used. In that case, each slave will read
and act on the message but not respond.

The Function Field The Function field is a 2-character (16-bit) code that determines the action
that a slave takes when receiving the message. The function codes
supported by the MODNIM are summarized in Table 2-1 and described in
more detail with examples in section 2.4.

2-2 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 Table 2-1 Modbus Functions Supported

Code Type Description

01 Read Coil Status Get current status of a group of coils.
02 Read Input Status Get current status of a group of discrete
inputs.
03 Read Holding Register Get current values from holding registers.
04 Read Input Register Get current values from input registers.
05 Force a Single Coil Change the state of a logic coil to On or Off,
forced On or forced Off, or unforced.
06 Write a Single Register Write a value into a holding register.
07 Read Exception Status Get the 8 internal status coil values.
08 Execute Diagnostics Send diagnostic tests to a slave.
11 Get Communications Enable the success or failure of a query to
Event Counter be determined.
12 Get Communications Get the communications log for Modbus
Event Log network transactions.
15 Write Multiple Coils Change a number of consecutive coils.
16 Write Multiple Registers Write values into a series of consecutive
holding registers.
17 Report Slave I.D. Get the slave type and the condition of its
run light.
Note: The highlighted function codes (5, 6, 8, 15, and 16) are supported by Broadcast mode,
for which no response is returned.

The Data Field The Data field contains the information needed by the specified node to
perform the required operation, or the information returned by the node to
the host computer. The data is in multiple bytes, with two ASCII character
bytes representing a hexadecimal value (1 . . . 9 and A . . . F or a . . . f).

The LRC Field The Longitudinal Redundancy Checking (LRC) is the method employed by
ASCII mode to ensure that the message transmitted by the host is the same
as the one that arrives at the secondary (and vice versa). The characters are
passed to a mathematical algorithm creating a checksum of 2 characters in
length that can be duplicated at either end for comparison. The calculation
of this checksum is described in the Modbus Protocol Reference Manual.

The EOF Field The End of File (EOF) marker, CR (carriage return) indicates the end of the
data and is the point up to which the LRC is generated.

The Ready Field The Ready field, LF (line feed) indicates that the sender is now ready for
any reply. This character can be changed using Function Code 08, with
Diagnostic code 03. Unless there is a compelling reason to change this
character, it should be left as the default value (LF).

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-3

2.2 Modbus Protocol Overview — RTU Transmission Mode

The RTU The RTU mode determines the start and finish of a message based on a time
Transmission Frame period of silence (no transmission) equivalent to the time it would take to
transmit 3.5 characters at the chosen baud rate. The RTU transmission
frame is shown in Figure 2-2.

Address Function Data Checksum No data

8 bits 8 bits n x 8 bits 16 bits T1 T2 T3

T1 T2 T3 . . . represents a time of 3.5 characters at given baud rate.

Figure 2-2 RTU Transmission Frame

The RTU Frame The RTU mode of transmission is more efficient than the ASCII mode as it
Fields only uses 8 bits for each field (except for the checksum) and the end of the
message is detected by timing. The body of the message (address, function
code, and data field) is the same with both modes; therefore, only the
message delineation and the checksum are discussed in the following
paragraphs.

Message The start and finish of a message is determined by timing in RTU mode.
Delineation Any time period longer than 3.5 character lengths marks the end of a
transmission. The next character after that would then mark the start of
the next message. This time period is dependent on the baud rate. Table 2-2
shows the effect of baud rate on the time delay period.

Table 2-2 RTU Mode Timing

Baud Rate 3.5 Character Time Delay (ms)*

19200 2.2
9600 4.4
7200 5.9
4800 8.8
3600 11.7
2400 17.5
1800 23.3
1200 35.0
600 70.0
300 140.0
200 210.0
150 280.0
110 381.8
75 560.0
50 840.0
*Assuming longest delay with 2 stop bits & parity enabled

2-4 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

Checksum The checksum needs 16 bits and uses the Cyclic Redundancy Checksum
(CRC) method. The calculation of this checksum is described in the Modbus
Protocol Reference Manual.

Invalid Characters The MODNIM ignores messages that contain invalid characters. Messages
and Messages containing the following errors are also ignored.

• Incorrect checksum

• Parity error

• Framing errors

• Frame too long

• Incomplete transmission

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-5

2.3 Comparing Modbus Functions with TIWAY I Network Commands

Modbus Functions This section outlines some of the differences between Modbus and
vs. TIWAY TIWAY I network commands.
Commands
• Whereas Modbus uses Functions Codes, TIWAY I uses Primitives.
Primitives differ from Function codes in one important way: primitives
use TT-types to allow one primitive to address different types of data.
With Modbus a different function code is required for each type of data.

• With SIMATIC
TI
PLCs, the first address for each type of memory is
always 1. By comparison, Modbus PLCs allow 0 as the first legal
address.

• If each system were to return one byte (8 bits) representing eight

discrete coils, they would each be positioned as shown in Figure 2-3.

Modbus PLCs SIMATIC TI PLCs

or SIMATIC TI PLCs via MODNIM via TIWAY
Coil No. Coil No.

8 7 6 5 4 3 2 1 1 2 3 4 5 6 7 8

MSB <<< LSB MSB <<< LSB

Figure 2-3 Bit Orientation

• Terminology is another area in which differences occur. Some of the

differences in terms are given in Table 2-3. (Refer also to Appendix C,
Table C-3 for a list of the TIWAY primitive equivalents to the Modbus
function codes.)

Table 2-3 Terminology Differences

Modbus-based PLCs SIMATIC TI PLCs

Coil Discrete output (Y) or Control Relay (C)
Input Register Word Image Register (WX/WY)
Holding Register Variable Memory (V-memory)
Slave Secondary Node
P/C (Programmable Controller) PLC
Function code Primitive
Modbus TIWAY I
Disabled (coil) Forced
Enabled (coil) Unforced

2-6 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

Addressing The MODNIM uses the absolute position of the data for the address. That
is, if you want to address the 3066th coil, then that is the address you pass
with the command (as hexadecimal value BFA). The maximum address is
65535 (FFFF hex). All current PLCs are within this limit.

For example, if you want to access 1000 coils starting at the 703rd coil, the
Function Code 01 would be as follows:

: 01 01 02 BF 03 E8 52 CR LF [ASCII mode]
01 01 02 BF 03 E8 0C E8 [RTU mode]

Address Limits Modbus imposes a buffer size limit of 256 bytes. Because of this restriction,
MODNIM requests have been limited to the following values.

Function Code Quantity

01 2000 coils
02 2000 discrete inputs
03 125 output registers
04 125 input registers
15 800 coils
16 100 registers

In the process of mapping Modbus commands against those used by

SIMATIC TI PLCs, when an appropriate command was absent, it has
become necessary to make multiple passes with a single command. In
practical terms, this means that when the maximum amount of data for a
particular command is requested, the MODNIM must wait for several PLC
cycles before sufficient data can be collected. This latent time increases for
addresses greater than 1024 (extended addressing).

The command checking will reject requests for data greater than the limits
shown above. What the checking does not do is check the request against
the available PLC memory. When a request goes beyond the memory of a
particular PLC, the command will be rejected by the PLC and the MODNIM
will notify the host computer with Exception Code 02.

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-7

2.4 Modbus Function Descriptions

Introduction In the descriptions that follow, each function starts on a separate page and
includes the TIWAY primitive sent to the secondary in square brackets. For
each function, an example of request and response is given.

NOTE: As Mode-specific data is not given, each of these examples omits the
header ( : ) and tail (CR/LF) of ASCII mode.

Code 01 — Read Code 01 enables the user to read the On/Off values of logic coils. The data
Coil Status passed with this command is the start address and the number of coils to be
read. Addressing is sequential up to the maximum memory size for a
particular PLC. The maximum number of coils that can be addressed with
one command is 2000. If more are requested, the whole command will be
rejected with an Exception code 03.

! CAUTION SIMATIC TI PLCs number memory locations starting at address 1.

Modbus PLCs number areas of memory starting from address 0.
Failure to alter host computer application programs may result in
the wrong bits being read.

Example:

Request: 07 01 000A 0005 XXXX

Checksum (XXXX)
Number of points (0005)
Start point (000A)
Function code (01)
Slave address (07)

Figure 2-4 Read Coil Status Example — Request

This request is asking the MODNIM to return the data from 5 coils (On/Off)
starting at the 10th coil.

[This is equivalent to sending a TIWAY Primitive 20 request using TT-type 7

(Packed Discrete Outputs or Ys) or TT-type 8 (Packed Cs), depending on the
position of Switch 10 of the network dipswitch bank in the MODNIM.]

2-8 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 Response: 07 01 01 1A XXXX
Checksum (XXXX)
Data (1A)
Number of bytes (01)
Function code (01)
Slave address (07)

Figure 2-5 Read Coil Status Example — Response

The response returns in the data field a single byte (1A) which contains the
1’s or 0’s for the 5 coils, packed out with zeros for the three high bits.

1A = 0001 1010
Coil 0A (OFF)
Coil 0B (ON)
Coil 0C (OFF)
Coil 0D (ON)
Coil 0E (ON)
Packed with zeros (000)

Figure 2-6 Read Coil Status Example — Data Field

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-9

Modbus Function Descriptions (continued)

Code 02 — Read Code 02 allows the application to read a series of discrete inputs. The
Input Status command includes the start address and the number of points to be read.

Addressing is sequential up to the maximum memory size for a particular

PLC. The maximum number of inputs that can be addressed with one
command is 2000. If more are requested, the whole command will be
rejected with an Exception code 03.

Example:

Request: 07 02 000A 0005 XXXX

Checksum (XXXX)
Number of points (0005)
Start point (000A)
Function code (02)
Slave address (07)

Figure 2-7 Read Input Status Example — Request

This request is for the data from 5 discrete inputs (On/Off) starting at the
10th input.

[This command is equivalent to sending a TIWAY I Primitive 20 request

using TT-type 6 (Packed Discrete Inputs, or Packed Xs)].

Response: 07 02 01 1A XXXX
Checksum (XXXX)
Data (1A)
Number of bytes (01)
Function code (02)
Slave address (07)

Figure 2-8 Read Input Status Example — Response

2-10 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 The response returns in the data field a single byte (1A) containing the 1’s
or 0’s for the 5 discrete inputs, packed out with zeros for the three high bits.

1A = 0001 1010
Input 0A (OFF)
Input 0B (ON)
Input 0C (OFF)
Input 0D (ON)
Input 0E (ON)
Packed with zeros (000)

Figure 2-9 Read Input Status Example — Data Field

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-11

Modbus Function Descriptions (continued)

Code 03 — Read Code 03 allows you to read the contents of holding registers in the attached
Output Registers secondary device. The data field of this command includes the start address
of the registers and the number of registers to be read.

Addressing is sequential up to the maximum memory size for a particular

PLC. The maximum number of registers that can be addressed with one
command is 125. If more are requested, the whole command will be rejected
with an Exception code 03.

[This command is equivalent to issuing a TIWAY I Primitive 20 request with

a TT-type 01 (Variable Memory)].

Example:

Request: 07 03 0064 0003 XXXX

Checksum (XXXX)
Number of registers (0003)
Address of first register (0064)
Function code (03)
Slave address (07)

Figure 2-10 Read Output Register Example — Request

This request is for secondary address 7 to read the contents of registers

0064, 0065, and 0066 (100, 101, and 102 decimal).

Response: 07 03 06 032C 0001 0030 XXXX

Checksum (XXXX)
3rd register value (0030)
2nd register value (0001)
1st register value (032C)
Number of bytes (06)
Function code (03)
Slave address (07)

Figure 2-11 Read Output Register Example — Response

The response has returned the number of bytes of data (06) and the values
for the requested registers; these are 032C, 0001, and 0030 respectively
(812, 1, and 48 decimal).

2-12 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

Code 04 — Read Code 04 allows you to read the contents of input registers in the attached
Input Registers PLC. These registers hold the values returned by the I/O devices. The data
field of this command includes the start address of the registers and the
number of registers to be read.

Addressing is sequential up to the maximum memory size for a particular

PLC. The maximum number of registers that can be addressed with one
command is 125. If more are requested, the whole command will be rejected
with an Exception code 03.

[This command is equivalent to issuing a TIWAY I Primitive 20 request with

a TT-type 09 (Word input WX)].

Example:

Request: 07 04 0008 0001 XXXX

Checksum (XXXX)
Number of registers (0001)
Address of first register (0008)
Function code (04)
Slave address (07)

Figure 2-12 Read Input Register Example — Request

This request is for secondary address 7 to read and return the value stored
in input register 0008.

Response: 07 04 02 0020 XXXX

Checksum (XXXX)
Input register value (0020)
Number of bytes (02)
Function code (04)
Slave address (07)

Figure 2-13 Read Input Register Example — Response

The response has returned the number of bytes of data (02) and the value
0020 (32 decimal) from the requested input register (0008).

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-13

Modbus Function Descriptions (continued)

Code 05 — Write a Code 05 allows a designated coil (discrete output Y or C) to be written.

Single Coil Depending on the code in the data field, it can be changed to On (1) or
Off (0), forced On or Off, or unforced. The two-byte codes are the following.

FF00 (hex) . . . . . . . ON
0000 (hex) . . . . . . . . OFF
1100 (hex) . . . . . . . . forced ON
2200 (hex) . . . . . . . . forced OFF
3300 (hex) . . . . . . . . unforced

NOTE: All other values are illegal and will result in error response 03.

Where the Broadcast address (00) is used, the MODNIM will send the
change coil command to all attached secondaries.

[This command is comparable to Primitive 30, using TT-type 4 (Y coils) or

type 5 (Cs), depending on the position of configuration Switch 10.]

! WARNING Because of differences in memory mapping between Modbus PLCs

and SIMATIC TI PLCs, you should be quite certain of the effects of
the broadcast command before issuing it.

Example:

Request: 07 05 0064 FF00 XXXX

Checksum (XXXX)
OFF/ON code (FF00 = On)
Coil address (0064)
Function code (05)
Slave address (07)

Figure 2-14 Write a Single Coil Example — Request

This request to secondary 7 is asking for coil 0064 (100 decimal) to be

changed to the ON state.

2-14 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 Response: 07 05 0064 FF00 XXXX
Checksum (XXXX)
OFF/ON code (FF00 = ON)
Coil address (0064)
Function code (05)
Slave address (07)

Figure 2-15 Read Input Register Example — Response

The response to Function Code 05 is to return the request as received. In

the case of a broadcast request, there is no response.

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-15

Modbus Function Descriptions (continued)

Code 06 — Write a Code 06 allows the contents of a holding register to be changed. Addressing
Single Register is sequential up to the maximum memory size for a particular PLC. This
function is limited to integer values contained in V-memory. The MODNIM
will also direct any broadcast address (00) to all attached secondaries.

[This command is comparable to a TIWAY I request using Primitive 30 and

TT-type 01 (Variable memory)].

! WARNING Because of differences in memory mapping between Modbus PLCs

and SIMATIC TI PLCs, you should be quite certain of the effects of
the broadcast command before issuing it.

Example:

Request: 07 06 0064 0220 XXXX

Checksum (XXXX)
Data value (0220)
Register address (0064)
Function code (06)
Slave address (07)

Figure 2-16 Write a Single Register Example — Request

This request to secondary 7 is asking for the value of holding register 0064
(100 decimal) to be changed to 0220 (544 decimal).

Response: 07 06 0064 0220 XXXX

Checksum (XXXX)
Data value (0220)
Register address (0064)
Function code (06)
Slave address (07)

Figure 2-17 Write a Single Register Example — Response

The response to Function Code 06 is to return the request as received. In

the case of a broadcast request, there is no response.

2-16 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

Code 07 — Read Code 07 instructs the MODNIM to read 8 predefined coils within a
Exception Status secondary.

This implementation will read the first 8 coils (first 8 Ys or first 8 Cs,
depending on the position of the dipswitch) in the discrete image register in
a secondary and pack them into one data byte.

NOTE: The programmer of a non-Modbus PLC must make certain that the
application program running within the PLC will place meaningful data in
these locations. This data can reflect status information.

[This command is equivalent to TIWAY Primitive 20 using TT types 04, 07

(Y unpacked, packed) or TT types 05, 08 (C unpacked, packed), from
locations 1 – 8, depending on the position of configuration Switch 10.]

Example:

Request: 11 07 XXXX

Checksum (XXXX)
Function code (07)
Slave address (11)

Figure 2-18 Read Exception Status Example — Request

This request to secondary 17 (decimal) is asking for exception status data.

Response: 11 07 3B XXXX

Checksum (XXXX)
Data value (3B)
Function code (07)
Slave address (11)

Figure 2-19 Read Exception Status Example — Response

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-17

Modbus Function Descriptions (continued)

The response shows that 3B (hex) has been returned. If the individual bits
are examined, they indicate the status of each bit.

Coils
3B (hex)

0 0 1 1 1 0 1 1

Coil 1 (ON)
Coil 2 (ON)
Coil 3 (OFF)
Coil 4 (ON
Coil 5 (ON)
Coil 6 (ON)
Coil 7 (OFF)
Coil 8 (OFF)

Figure 2-20 Exception Status Bits

2-18 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

Code 08 — Code 08 enables diagnostic information to be retrieved to conduct network
Execute testing. This function does not affect the operation of the PLC, but may have
Diagnostics significant effects on the operation of the MODNIM. Where these effects
impact upon the operation of the MODNIM, they are described with the
details for that diagnostic code.

! WARNING Because of differences in memory mapping between Modbus PLCs

and SIMATIC TI PLCs, you should be quite certain of the effects of
the broadcast command before issuing it.

Example:

Request: 02 08 0000 B405 XXXX

Checksum (XXXX)
Information Field (B405)
Diagnostic code (0000)
Function code (08)
Slave address (02)

Figure 2-21 Execute Diagnostics Example — Request

This example shows a request to conduct diagnostic test 0000. This is the
loopback query, where the outgoing message field is returned unchanged.

Response: 02 08 0000 B405 XXXX

Checksum (XXXX)
Information Field (B405)
Diagnostic code (0000)
Function code (08)
Slave address (02)

Figure 2-22 Execute Diagnostics Example — Response

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-19

Modbus Function Descriptions (continued)

Table 2-4 details the diagnostic codes supported.

Table 2-4 Diagnostic Codes Supported

Code Diagnostic Description Is Code

(hex) Supported?
00 Return request message Yes
01 Restart communications with the slave Yes
02 Return diagnostics register Yes
03 Change message end character Yes
04 Set slave in Listen Only Mode Yes
0A Clear counters and diagnostics Yes
0B Return message count Yes
0C Return checksum error count Yes
0D Return exception count Yes
0E Return slave message count Yes
0F Return slave no-response count No
10 Return slave NAK count No
11 Return slave busy count No
12 Return character overrun count Yes
13 Return overrun error count No
14 Clear character overrun count Yes

2-20 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 The diagnostics codes supported are described in the following paragraphs.

Diagnostic Code — 00

0000 | any data

Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 0000, any data passed in the
information field is returned to the host computer by the addressed
secondary node without change.

The purpose of this command is to determine if the communications are

functioning correctly, and may be used in conjunction with diagnostic tests
described later.

This code has no effect on the functioning of the MODNIM.

Diagnostic Code — 01

0001 | 00 00
or 0001 | FF 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 0001, the information frame
can contain 0000 or FF00.

This function causes the MODNIM to clear all internal counters and
registers. If the MODNIM had been in Listen Only Mode (LOM), it will be
returned to normal operating mode at the successful conclusion of the
command. If the information frame contains FF00, the Communications
Event Log will be cleared. If any other value is passed in the information
field, the Communications Event Log will not be cleared, and no response
will be returned.

This code has significant effect on the functioning of the MODNIM.

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-21

Modbus Function Descriptions (continued)

Diagnostic Code — 02

0002 | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 0002, the information field
may contain any value (00 00 shown). The MODNIM returns a 16-bit word
containing diagnostic data about the attached device. The meaning of each
bit is given in Table 2-5.

Table 2-5 Diagnostic Bits

Bit Description

0 O. S. RAM parity error

1 Program RAM parity error
2 O. S. fatal error
3 Watchdog timeout error
4 Dynamic program memory diagnostic
5 Illegal Op code
6 RAM diagnostics failure
7 ROM diagnostics failure
8 Scan diagnostic failure
9 I/O fatal error
10 Scan overrun error
11 Abnormal power loss
12 Unidentified board failure
13 EEPROM card RAM download error
14 Not used
15 Not used

If the bit contains a 1, then the error associated with that bit is current.

This code has no effect on the functioning of the MODNIM.

2-22 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 Diagnostic Code — 03

0003 | Char 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 0003, the ASCII character
given in the information field is then used as the delimiter of an ASCII
mode message replacing the standard LF (line feed) character.

NOTE: Avoid using the following characters as alternative ‘Ready’ field

markers:
:, 0 to 9, a to f, A to F, or CR

You also need to be aware that while the request must be sent with the
existing ‘ready’ character (default: LF), this response, and all future ones
will be returned with the new character until a RESET or a power cycle.

This code has significant effects on the operation of the MODNIM.

Diagnostic Code — 04

0004 | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 0004 and any value in the
information field (00 00 shown), the secondary node will be forced into
Listen Only Mode. In this mode, while the node may be listening to the
traffic on the network, it will only react to a Function 8, diagnostic code 01
command, which returns the MODNIM to normal operation. The MODNIM
also returns to normal operating mode if the RESET button is pressed or
the power is cycled. When the MODNIM enters Listen Only Mode, the
ONLINE indicator goes off.

This code has a significant effect on the operation of the MODNIM.

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-23

Modbus Function Descriptions (continued)

Diagnostic Code — 0A

000A | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 000A and any value in the
information field (00 00 shown), all diagnostic registers and counters within
the MODNIM will be cleared. This also happens when the power is cycled or
the RESET button is pressed.

This code has a significant effect on the operation of the MODNIM.

Diagnostic Code — 0B

000B | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 000B and any value in the
information field (00 00 shown), the information field will return the
number of processed messages received by the MODNIM since the last
RESET or power-up. The counter will increment to a value of FFFF (65535)
and will then return to zero (0).

This code has no effect on the operation of the MODNIM.

2-24 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 Diagnostic Code — 0C

000C | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 000C and any value in the
information field (00 00 shown), the information field will return the
number of checksum errors detected by the MODNIM since the last RESET
or power-up. The counter will increment to a value of FFFF (65535) and will
then return to zero (0).

This code has no effect on the operation of the MODNIM.

Diagnostic Code — 0D

000D | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 000D and any value in the
information field (00 00 shown), the information field will return the
number of exceptions detected by the MODNIM since the last RESET or
power-up. The counter will increment to a value of FFFF (65535) and will
then return to zero (0).

This code has no effect on the operation of the MODNIM.

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-25

Modbus Function Descriptions (continued)

Diagnostic Code — 0E

000E | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 000E and any value in the
information field (00 00 shown), the information field will return the
number of messages addressed to the MODNIM since the last RESET or
power-up. The counter will increment to a value of FFFF (65535) and will
then return to zero (0).

This code has no effect on the operation of the MODNIM.

Diagnostic Code — 0F

000F | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 000F and any value in the
information field (00 00 shown), the MODNIM will return 0000 in the
information field.

This code has no effect on the operation of the MODNIM.

This Modbus diagnostic code has no equivalent in Series 500 or Series 505
PLCs. In this application, 0000 is always returned.

2-26 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 Diagnostic Code — 10

0010 | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 0010 and any value in the
information field (00 00 shown), the MODNIM will return 0000 in the
information field.

This code has no effect on the operation of the MODNIM.

This Modbus diagnostic code has no equivalent in Series 500 or Series 505
PLCs. In this application, 0000 is always returned.

Diagnostic Code — 11

0011 | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 0011 and any value in the
information field (00 00 shown), the MODNIM will return 0000 in the
information field.

This code has no effect on the operation of the MODNIM.

This Modbus diagnostic code has no equivalent in Series 500 or Series 505
PLCs. In this application, 0000 is always returned.

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-27

Modbus Function Descriptions (continued)

Diagnostic Code — 12

0012 | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 0012 and any value in the
information field (00 00 shown), the information field will return the
number of character overruns detected by the MODNIM since the last
RESET or power-up. This indicates the number of times that characters
have arrived faster than the UART can store them without loss. The
counter will increment to a value of FFFF (65535) and will then return to
zero (0).

This code has no effect on the operation of the MODNIM.

Diagnostic Code — 13

0013 | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 0013 and any value in the
information field (00 00 shown), the MODNIM will return 0000 in the
information field.

This code has no effect on the operation of the MODNIM.

This Modbus diagnostic code has no equivalent in Series 500 or Series 505
PLCs. In this application, 0000 is always returned.

2-28 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 Diagnostic Code — 14

0014 | 00 00
Information frame
Diagnostic code

When Function Code 08 uses diagnostic code 0014 and any value in the
information field (00 00 shown), the MODNIM will clear the character
overrun counter.

This command affects the operation of the MODNIM.

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-29

Modbus Function Descriptions (continued)

Code 11 — Get Code 11 returns a 2-byte status word and an associated 2-byte event
Comms Event counter. The status word is defined in the Modbus Protocol Reference
Counter Specification as being 0 for no command in progress and FFFF if a previous
command is in progress. The status will always be 0 in the MODNIM.

The event counter is incremented for every successful message; it is not

incremented for exceptions or polls, or for this code or Code 12. This code
can be used to determine if a single command was successful when a
communication error occurred during the request or response.

The event counter will increment to the value FFFF (65535 decimal), then
begin again from zero.

Example:

Request: 15 0B XXXX

Checksum (XXXX)
Function code 11 (0B hex)
Slave address 21 (15 hex)

Figure 2-23 Get Comms Event Counter Example — Request

In this example, secondary node 21 (15 hex) has been asked to return the
event counter and the associated status word.

Response: 15 0B 0000 0143 XXXX

Checksum (XXXX)
Number of events (0143)
Status word (0000)
Function code 11 (0B hex)
Slave address 21 (15 hex)

Figure 2-24 Get Comms Event Counter Example — Response

The response shows that the status word is 0000 and that 323 (decimal)
events have occurred.

2-30 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

Code 12 — Get Code 12 returns the same information as Function Code 11 plus a message
Comms Event Log count and an additional 64-event byte. This means that a 2-byte status
word, a 2-byte event counter, a message count, and the most recent 64
events are returned. A buffer records each send or receive operation and
overwrites the oldest event with the latest event. No events are recorded for
this code or Code 11. The Event Byte types are shown in Table 2-6.

Example:

Request: 10 0C XXXX

Checksum (XXXX)
Function code 12 (0C hex)
Slave address (10)

Figure 2-25 Get Comms Event Log Example — Request

This request to address 16 (decimal) is for the Exception Event Log.

Response: 10 0C 46 0000 0204 020B C0 00 XXXX

Checksum (XXXX)
2nd latest event (00)
Latest event (C0)
Message count (020B)
Event count (0204)
Status word (0000)
Byte count (46)
Function code 12 (0C hex)
Slave address (10)

Figure 2-26 Get Comms Event Log Example — Response

The response has returned 70 bytes of data (2 status bytes + 2 event counter
bytes + 2 message counts + 64 event bytes). Only two of the event bytes are
shown; these indicate the secondary node was reset (00) and then received a
broadcast message (C0). The most recent events are returned first.

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-31

Modbus Function Descriptions (continued)

Table 2-6 Event Byte Types

Event Byte Bit Definitions

Slave Bus Receive. Byte Bit 0 – Reserved
stored on receipt of message Bit 1 – Set if communications error
Bit 2 – Reserved
Bit 3 – Reserved
Bit 4 – Set if character overrun
Bit 5 – Set if in Listen Only mode
Bit 6 – Set if Broadcast
Bit 7 – 1
Slave Bus Transmit. Byte Bit 0 – Set if an exception (1–3) is sent
stored when message sent Bit 1 – Set if secondary abort exception (6) is sent
Bit 2 – Set if secondary busy exception (6) is sent
Bit 3 – Not used
Bit 4 – Set if write timeout occurred
Bit 5 – Set if in Listen Only mode
Bit 6 – 1
Bit 7 – 0
Entered Listen Only Bit 0 – 0
Mode. Byte stored when Bit 1 – 0
LOM mode entered Bit 2 – 1
Bit 3 – 0
Bit 4 – 0
Bit 5 – 0
Bit 6 – 0
Bit 7 – 0
Initiate Communications Bit 0 – 0
RESET. Complete log is set Bit 1 – 0
to zeros. Bit 2 – 0
Bit 3 – 0
Bit 4 – 0
Bit 5 – 0

2-32 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

Code 15 — Write Code 15 allows the host computer to write multiple coils. When this
Multiple Coils command is given, successive coils are changed by an associated bit pattern
to the indicated state, where each bit indicates: 1 = ON 0 = OFF

Addressing is sequential up to the maximum memory size for a particular

secondary. The maximum number of coils that can be addressed with one
command is 800. If more are given, the whole command will be rejected with
an Exception code 03.

The broadcast address (00) can be used to change the same coils in all
networked programmable controllers.

[This command is equivalent to TIWAY Primitive 30 using data types 04, 07

(Y unpacked, packed) or data types 05, 08 (C unpacked, packed), depending
on the position of configuration Switch 10.]

! WARNING Because of differences in memory mapping between Modbus PLCs

and SIMATIC TI PLCs, you should be quite certain of the effects of
the broadcast command before issuing it.

Example:

Request: 07 0F 0012 000C 02 DC08 XXXX

Checksum (XXXX)
Coil status (DC08)
Number of bytes (02)
Number of coils (000C)
Start coil address (0012)
Function code 15 (0F hex)
Slave address (07)

Figure 2-27 Write Multiple Coils Example — Request

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-33

Modbus Function Descriptions (continued)

This request is for the secondary node to change the values of 12 (0C hex)
coils starting at address 12 (18 decimal) to the states given by the following
bit pattern.

D C 0 8
1 1 0 1 1 1 1 0 0 0 0 0 1 0 0 0
25 24 23 22 21 20 19 18 33 32 31 30 29 28 27 26

Coil 26 (OFF)
Coil 25 (ON) Coil 18 (OFF) Coil 29 (ON)

Figure 2-28 Coil Bit Pattern

The bit pattern indicates that coils 19, 20, 21, 22, 24, 25, and 29 are to be
changed to ON and 18, 23, 26, 27, and 28 changed to OFF.

Response: 07 0F 0012 000C XXXX

Checksum (XXXX)
Number of coils (000C)
Start coil address (0012)
Function code 15 (0F hex)
Slave address (07)

Figure 2-29 Write Multiple Coils Example — Response

2-34 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

Code 16 — Write Code 16 allows the host computer to write multiple values into successive
Multiple Registers registers. Addressing is sequential up to the maximum memory size for a
particular PLC. The maximum number of registers that can be addressed
with one command is 100. If more are given, the whole command will be
rejected with an Exception code 03.

[This command is equivalent to a TIWAY I request using Primitive 30 with

TT-type 01 (Variable memory)].

! WARNING Because of differences in memory mapping between Modbus PLCs

and SIMATIC TI PLCs, you should be quite certain of the effects of
the broadcast command before issuing it.

Example:

Request: 02 10 0078 0002 04 000B 0201 XXXX

Checksum (XXXX)
2nd register data (0201)
1st register data (000B)
Number of bytes (04)
Number of registers (0002)
Start register address (0078)
Function code 16 (10 hex)
Slave address (02)

Figure 2-30 Write Multiple Registers Example — Request

This request to the secondary node is to change the values of 2 holding

registers, starting at address 0078 (120 decimal) to 11 and 513 respectively.

Response: 02 10 0078 0002 XXXX

Checksum (XXXX)
Number of registers (0002)
Start register address (0078)
Function code 16 (10 hex)
Slave address (02)

Figure 2-31 Write Multiple Registers Example — Response

The response to this command is to return the address, code, starting

address, and the numbers of registers to be changed.

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-35

Modbus Function Descriptions (continued)

Code 17 — Report Code 17 permits the user to get information from the slave concerning its
Slave ID type, run mode, and other device-dependent data.

[This command has no direct equivalent to a TIWAY I request, but elements

of this function are contained in Primitives 02 and 03 (Status primitive and
Configuration primitive).]

The MODNIM returns a number in the Slave ID field determined by the

type of PLC connected and responds with the state of the RUN light. In
addition, it returns the HH status field, the EE auxiliary power source field,
the communications port in use, and the software version number.

Example:

Request: 03 11 XXXX

Checksum (XXXX)
Function code 17 (11 hex)
Slave address (03)

Figure 2-32 Report Slave ID Example — Request

This example shows a request to secondary address 03 to report its ID and

associated data.

Response: 03 11 06 3C FF 01 00 0A 30 XXXX
Checksum (XXXX)
Release 3.0
Port A operational (0A)
Auxiliary power (00)
Operational mode (01)
Run light (FF = On)
Slave ID (3C = TI530C)
Number of bytes (06)
Function code 17 (11 hex)
Slave address 030)

Figure 2-33 Report Slave ID Example — Response

This response indicates that 6 bytes have been returned. These bytes show
that the Slave ID is a TI530C PLC, the RUN light is On, the operational
mode is 01, auxiliary power is good, and the operational port is A. The last
byte contains the software version number (see Table 2-7).

2-36 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 The options for each of the fields in the response are listed in Table 2-7.

Table 2-7 Function Code 17 Response Options

Option Code Description

20 SIMATIC
TI520
25 SIMATIC
TI525
Slave ID 2C SIMATIC
TI520C
(Identifies 30 SIMATIC
TI530
SIMATIC TI PLC) 3C SIMATIC
TI530C
(Note: There can be no 35 SIMATIC
TI535
guarantee that these 45 SIMATIC
TI545
codes will not be used 55 SIMATIC
TI555
by other devices on a
Modbus network.)
60 SIMATIC
TI560
65 SIMATIC
TI565
75 SIMATIC
TI575
00 OFF
Run Light
FF ON
00 Operational and performing instruction data type
and loop execution (RUN).
01 Operational and performing instruction data type
and executing with a non-fatal error (RUN with
non-fatal error).
Oper tio
Operational ode
Mode
03 Operational and not performing instruction data
(HH)
type execution or loop execution (PROGRAM).
05 Operational and not performing instruction data
type execution or loop execution and a non-fatal
error is detected (PROGRAM with non-fatal error).
80 Not operational due to fatal error condition.
PLC Auxiliary 00 Auxiliary power source good.
Power Supply 80 Auxiliary power source not good.
Status (EE)
MODNIM 0A Port A is in use.
Operational Port 0B Port B is in use.
00 Release 1.0
Software Version 20 Release 2.0
30 Release 3.0

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-37

2.5 Error Responses

Errors such as illegal addressing or failure of communications with a PLC

are reported by exception responses. Exception responses replace the
expected response to a request and are recognized by the Function Code
with the top bit set high (see examples in Figure 2-34 and Figure 2-35).

Request:
Start Address Function Data LRC EOF Ready

07 01 00000041 AD CR LF

Response:
Start Address Function Except. Code LRC EOF Ready

07 81 02 76 CR LF

Figure 2-34 Exception Response Frame— ASCII Mode

Request:
Address Function Data CRC

07 01 00000041 XXXX

Response:
Address Function Exception Code CRC

07 81 02 XXXX

Figure 2-35 Exception Response Frame — RTU Mode

In this example, the request is for secondary node 07 to return the data for
65 (41 hex) coils starting at address 00, which is an illegal address for a
SIMATIC TI PLC. The response is an exception indicated by the Function
Code 81 (01 with the high bit set), with the exception code 02 indicating that
the data address was illegal.

NOTE: The TIWAY I network uses Exception Primitives. Exceptions sent by

SIMATIC TI PLCs are mapped to Modbus Exception Codes.

2-38 Modbus Commands SIMATIC TI505/TI500 MODNIM User Manual

 Table 2-8 list the exception responses that apply to the functions supported
by the MODNIM.

Table 2-8 Exception Responses

Code Name Description

01 Illegal Function The function received is not defined for this
application [equivalent to SIMATIC TI
exception codes 00, 01, 06, 15].
02 Illegal Data Address The address contained in the data field is not
valid for the secondary being addressed
[equivalent to SIMATIC TI code 02]
03 Illegal Data Value The value passed in the data field is not
allowable for the secondary being addressed
[equivalent to SIMATIC TI codes 10, 19, 1D].
04 Failure in associated The secondary address has failed to respond, or
device a command has aborted [equivalent to
SIMATIC TI codes 0A, 0B, 0D, 17, 1A].
06 Memory parity error If during a read of memory, a parity error
occurs, this exception response is returned.

SIMATIC TI505/TI500 MODNIM User Manual Modbus Commands 2-39

 Appendix A
Network Cable Communications
A.1 Network Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
Recommended Communication Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
Building Cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
Cable Pinouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
A.2 Communications Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4
RS-232-C Pin Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4
Recommended Communications Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4

SIMATIC TI505/TI500 MODNIM User Manual Network Cable Communications A-1

A.1 Network Cables

Recommended The following cables are available through your Siemens distributor.
Communication
Cables
Cable P/N Description Adapter at Module
2601094–8001 Standard 9-pin null modem 9-pin (F) to 25-pin (M) port adapter
VPU200–3605 Standard 25-pin null modem None required

Building Cables If you prefer to build your own 25-pin cable, ensure that the following
requirements are met to minimize the possibility of noise interference.

• Cable conductors — 26 AWG, tinned and stranded copper wire, with

one uninsulated 26 AWG tinned copper drain wire
• Cable shield — AL foil or aluminum-polyester foil and a 65% minimum
tinned copper braid shield
• Outer jacket — polyvinyl chloride (PVC) or equivalent material, with a
UL rating of 30V, 60°C minimum
• Connectors — 25-pin male D-connector, with contact pins of copper
alloy with gold flashing over nickel plate

Cable Pinouts Figure A-1, Figure A-2, and Figure A-3 show the cable connections which
can be used for both ASCII and RTU modes of transmission.

Host Series 505 or 500 MODNIM

(DTE) (DTE)
Shield
1 1
14 TD TD 14
2 2
RD RD
3 3
RTS RTS
4 4
CTS CTS
5 5
DSR DSR
6 6
7 GND 7
DTR 20 20 DTR
8 8
DCD DCD
9 9
10 10
11 11
12 12
25 25
13 13

Figure A-1 MODNIM to Host (without Handshaking)

A-2 Network Cable Communications SIMATIC TI505/TI500 MODNIM User Manual

 Host Series 505 or 500 MODNIM
(DTE) (DTE)
Shield
1 1
14 TD TD 14
2 2
RD RD
3 3
RTS RTS
4 4
CTS CTS
5 5
DSR DSR
6 6
7 GND 7
DTR 20 20 DTR
8 8
DCD DCD
9 9
10 10
11 11
12 12
25 25
13 13

Figure A-2 MODNIM to Host (with Handshaking)

Commercial Modem Series 505 or 500 MODNIM

(DCE) (DTE)
Shield
1 1
14 RD TD 14
2 2
TD RD
3 3
RTS RTS
4 4
CTS CTS
5 5
DSR DSR
6 6
7 GND 7
DTR 20 20 DTR
8 8
DCD DCD
9 9
10 10
11 11
12 12
25 25
13 13

Figure A-3 MODNIM to Commercial Modem (with Handshaking)

SIMATIC TI505/TI500 MODNIM User Manual Network Cable Communications A-3

A.2 Communications Parameters

RS-232-C Pin The modem interface is a standard Type E DTE configuration as defined in
Assignments the EIA RS-232-C standard. This interface uses a male 25-pin D-type
connector plug on the communication cable. The pin assignments are listed
in Table A-1.

Table A-1 RS-232-C Connector Pin Assignments

Pin # Description
2 Transmit Data (TXD)
3 Receive Data (RXD)
4 Request to Send (RTS)
5 Clear to Send (CTS)
6 Data Set Ready (DSR)
7 Signal Ground
8 Receive Line Signal Detector/Data Carrier Detect (RLSD/DCD)
20 Data Terminal Ready (DTR)

Recommended The following communications parameters are suggested as a starting point

Communications for each mode of transmission when first establishing a connection.
Parameters
Table A-2 Communications Parameters

Parameters RTU ASCII

Baud Rate 19,200 bps 19,200 bps
Parity None Even
Stop bits 1 1
Data bits 8 (auto selected) 7 (auto selected)

A-4 Network Cable Communications SIMATIC TI505/TI500 MODNIM User Manual

 Appendix B
Exception Codes
B.1 Exception Codes Supported by the MODNIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-2

SIMATIC TI505/TI500 MODNIM User Manual Exception Codes B-1

B.1 Exception Codes Supported by the MODNIM

Table B-1 lists the subset of SIMATIC TI Exception Codes that are mapped
to the Modbus exception codes.

Table B-1 Exception Codes

Exception
Definition
Code (hex)

00 The primitive is not implemented.

01 Data type is not defined in the attached device.
02 Data element location is out of range.
06 Device in wrong mode for primitive execution.
07 User program in device has disabled communications to NIM
(Lockout Bit)
0A Device fails to respond.
0B Primitive aborted due to fatal error condition in attached device.
0D Error encountered while executing the requested primitive.
10 The number of locations requested exceeds the maximum allowed.
15 Primitive not allowed while device is in local mode.
17 The attached device did not respond properly (communications
problem).
19 The resulting data element location formed by the starting address
plus the number of data elements to access, is out of range.
1A Communications has not been established with the attached
device.
1D The number of locations to access is zero.

B-2 Exception Codes SIMATIC TI505/TI500 MODNIM User Manual

 Appendix C
Specifications
C.1 Environmental Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-2

C.2 MODNIM Communications Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-3

SIMATIC TI505/TI500 MODNIM User Manual Specifications C-1

C.1 Environmental Specifications

The Series 505 I/O subsystem is tested against some of the most stringent
standards in the world. Table C-1 lists specifications that are common to
Series 505 I/O devices.

Table C-1 Environmental Specifications

Operating Temperature 0° to 60°C (32° to 140°F)

Storage Temperature –40° to +70°C (–40° to 158°F)
Relative Humidity 5% to 95% non-condensing
Pollution Degree 2, IEC 664, 664A
Vibration IEC 68-2-6, Test Fc;
Sinusoidal 0.15 mm, peak-to-peak, 10–57 Hz;
1.0 g 57–150 Hz

Random NAVMAT P-9492 or IEC 68-2-34

Test Fdc with 0.04 g2/Hz, 80–350 Hz, and
3 dB/octave rolloff, 80–20 Hz and
350–2000 Hz at 10 min/axis
Impact Shock IEC, 68-2-27, Test Ea; Half sine, 15 g 11 ms
Electric Noise Immunity
Conducted noise: IEC 801, Part 4, Level 3
MIL STD 461B, Part 4; CS01, CS02, CS06
IEC 255-4
EEC 4517/79 Com(78) 766 Final, Part 4
IEEE 472, 2.5 kV
Radiated noise: IEC 801, Part 3, Level 3
MIL STD 461B, Part 4; RS01, RS02
Electrostatic discharge: IEC 801, Part 2, Level 4, (15 kV)
System Isolation Isolation (user-side to controller-side): 1500 Vrms
Torque for bezel screws 0.3 N-m (2.61 in.-lbs.) minimum
0.6 N-m (5.22 in.-lbs.) maximum
Corrosion Protection All parts are of corrosion resistant material or are
plated or painted as corrosion protection.
Agency Approvals UL
Listed (UL508 industrial control equipment)
CSA
Certified (CSA142 process control equipment)
FM Approved (Class I, Div. 2, Hazardous locations)

C-2 Specifications SIMATIC TI505/TI500 MODNIM User Manual

C.2 MODNIM Communications Specifications

Table C-2 lists communication and other specifications of the MODNIM.

Table C-2 MODNIM Specifications

Item Description

Model Number PPX:505–5184; PPX:500–5184

Media Dual RS-232-C/423
I/O Slots 1 slot (Series 505); 2 slots (Series 500)
Data Rates 50, 75, 110, 150, 200, 300, 600, 1200, 1800,
2400, 3600, 4800, 7200, 9600, 19200
RS-232-C/423 Ports Configured as DTE, asynchronous,
with or without RTS/CTS handshaking;
external modem support
Data Link Protocol ASCII and RTU
Network Media Appropriate cable for RS-232-C
Maximum power from base 8 W, +5 VDC
Weight, dimensions of unpacked 1 lb., 3 oz; 10.5″ × 8.0″ × 0.8″
module
Weight, dimensions of packed module 2 lbs., 9 oz; 12.75″ × 13.5″ × 3.75″

Table C-3 lists the TIWAY primitives that correspond to the Modbus codes.

Table C-3 Modbus Codes vs. TIWAY Primitives Chart

Code Modbus Description Code TIWAY Primitive Description

01 Read Coil Status TT=7 Read discrete outputs packed (Y)
TT=8 Read coils packed (C)
02 Read Input Status TT=6 Read discrete inputs packed (X)
03 Read Holding Register TT=1 Read V memory (V)
04 Read Input Register TT=9 Read word input (WX)
05 Force a Single Coil TT=4 Write a single discrete output (Y)
TT=5 Write a single discrete coil (C)
06 Write a Single Register TT=1 Write a single V memory (V)
07 Read Exception Status TT=4,7 Read 1st 8 discrete outputs (Y)
TT=5,8 Read 1st 8 C coils 1 – 8 (C)
08 Execute Diagnostics
11 Get Comms. Event Cntr.
12 Get Comms. Event Log
15 Write Multiple Coils TT=4,7 Write mult. discr. outputs packed (Y)
TT=5,8 Write mult. discrete coils packed (C)
16 Write Multiple Registers TT=1 Write multiple V memory (V)
17 Report Slave I.D.

SIMATIC TI505/TI500 MODNIM User Manual Specifications C-3

 Appendix D
Using the MODASST Program
D.1 Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2
Hardware Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2
Running the Program from the Floppy Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2
Running the Program from the Hard Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-3
D.2 Starting Program Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4
Setting the Communication Port Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4
Setting the Remaining Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4
D.3 Using Program Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-5
Setup Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-5
Run Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-5
Find Module Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-6
Talk to Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-6
Batch Send from File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-6
Verifying Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-6

SIMATIC TI505/TI500 MODNIM User Manual Using the MODASST Program D-1
D.1 Getting Started

Overview MODASST is a Configuration and Diagnostic Assistant software program

which can be used to help set up and use your MODNIM or TIWAY Gateway
product. This program is provided to assist you in configuring the modules
and verifying that the module is communicating. The program can also help
verify that your MODNIM or TIWAY Gateway is operational when you are
installing it.

The MODASST program provides diagrams of cable pin-outs, dipswitch

settings, and a facility to communicate with the MODNIM or TIWAY
Gateway.

Hardware You will need the following components to run this program.
Requirements
• IBM
PC-compatible computer

• The MODASST program

• Serial communications port on your computer. (A mouse is optional.)

• RS-232-C null-modem cable (the same cable as the one used from
MODNIM to Host, connected directly without modems).

To set up the hardware to use this program, find out the COM port number
you will use to communicate with the module, then follow these steps.

1. Connect the cable from your computer communications port to either

one of the 25-pin connectors on the module.

2. When safe to do so, power up the MODNIM and its associated PLC or
power up the TIWAY Gateway module.

3. Turn on the power on your computer.

Running the This program does not require any special installation to use. You may run
Program from the this program directly from the floppy disk or from a hard drive.
Floppy Disk
To run this program from the floppy disk, follow these steps.

1. Insert the disk into the appropriate slot in your computer.

2. At the DOS prompt on your machine, type:

a: Enter
modasst Enter

You will now see the start-up screen. Press Enter to continue. The program
starts your configuration setup with the screen as shown in Figure D-1.

D-2 Using the MODASST Program SIMATIC TI505/TI500 MODNIM User Manual
Running the To set up this program on your computer’s hard drive, follow these steps.
Program from the
Hard Disk 1. Insert the disk into the appropriate slot in your computer.

2. At the DOS prompt on your machine, type:

c: Enter
cd\ Enter
md\modasst Enter
cd\modasst Enter
copy a:*.* c:\modasst Enter

To run the program on your computer’s hard drive, at the DOS prompt type:

c: Enter
cd\modasst Enter

modasst Enter

You will now see the start-up screen. Press Enter to continue. The program
starts your configuration setup with the screen as shown in Figure D-1.

Setups Run Diags Find Module Settings Talk to Module Batch, Send from File

[G] Comm Port on PC

COMM PORT # ADVANCED OPTIONS

( • ) COM1 ( • ) Std IRQ
( ) COM2 ( ) IRQ2
( ) COM3 ( ) IRQ3
( ) COM4 ( ) IRQ4
( •) Std Address
( ) Addr 0x3F8
( ) Addr 0x2F8
( ) Addr 0x3E8
( ) Addr 0x2E8

OK Cancel Help

Alt-X Exit F10 Top Menu Press F1 for Help

Figure D-1 First Configuration Screen after Start-Up

SIMATIC TI505/TI500 MODNIM User Manual Using the MODASST Program D-3
D.2 Starting Program Operation

Setting the When the program begins, you will be prompted for the communications
Communication port number that you wish to use to communicate from your computer to
Port Options the MODNIM or TIWAY Gateway module.

Use the up and down arrows on your keyboard to select the communications
port from COM1 to COM4. If you don’t need to set up advanced options for
your COM port, press Enter to continue.

If you need to set up advanced options, press TAB to move the cursor from
the COM Port box to the Advanced Options box. Use the up/down arrow
keys to select the desired IRQ, then press TAB to move the cursor to the
address option. Again, select the desired option and press Enter when your
selections are complete.

Setting the After setting the communication port options, the first of seven additional
Remaining Options option windows is displayed to help you complete your configuration
settings. These set-up windows are the following.

• Output Type Mapping: Y outputs or C coils

• RTS/CTS Handshaking Selection: Enable or Disable
• Transmission Mode: RTU or ASCII
• Parity Selection: Even, Odd, or No parity
• Stop Bit Selection: 1 or 2 stop bits
• Baud Rate: 50 to 19200
• Network Address: type in the appropriate address number if other than
the default address 1.

For each of these set-up windows, use the arrow keys if you want to select a
choice other than the highlighted default, then press Enter to continue to the
next selection. You can also press TAB to move the highlight cursor to the
OK, Cancel, or Help options at the bottom of each window.

In each panel, press TAB to move from one field of the screen to the next
and the arrow keys to move the selection dots from one choice to another.
Press Enter to accept your choice and exit the screen. To exit a screen
without choosing anything or to cancel the selections made, press Esc . You
can also use a mouse to select menu options by placing the mouse cursor on
the option or selection and pressing the left mouse button. Press F1 at
any time to access Help screens.

After entering the last set-up option, the screen is empty except for the top
and bottom menus. Press ALT and one of the highlighted letters on the top
row of the screen to select the function option you want. To exit the
MODASST program, press ALT and X together.

D-4 Using the MODASST Program SIMATIC TI505/TI500 MODNIM User Manual
D.3 Using Program Options

Setup Options Figure D-2 shows the first menu and the sub-menu available after pressing
ALT S to choose the Setups option from the top menu. You can also press
F10 to access the top menu, and, since Setups is the default, press Enter .

Setups Run Diags Find Module Settings Talk to Module Batch, Send from File

Port Setup
Communications Parameters
Dip Switch Setup ❯
Cable Pin-Outs ❯

Direct Host to MODNIM

Modem connection to MODNIM
Gateway Direct Host Connection
Gateway Modem Host Connection
TIWAY Connection

Alt-X Exit F10 Top Menu Press F1 for Help

Figure D-2 MODASST Setup Menu

Under Setups, you can choose one of the following options.

• Port Setup allows you to change the computer Com Port that you
selected when the program started.

• Communications Parameters allows you to reset the parameters to

communicate with the MODNIM or TIWAY Gateway module.

• Dip Switch Setup displays the dipswitches that need to be selected to

configure the MODNIM or TIWAY Gateway module for the settings
chosen using the Parameters option.

• Cable Pin-Outs displays the cable pin-outs required to connect the

MODNIM or TIWAY Gateway modules to a host computer or a modem.

Run Diagnostics The Run Diags option lists the MODNIM diagnostics available using
function code 08. You can select and run a diagnostic function by using the
up/down arrows and pressing Enter . This option uses the communications
parameters selected on the Setup menu item to run diagnostics.

SIMATIC TI505/TI500 MODNIM User Manual Using the MODASST Program D-5
Using Program Options (continued)

Find Module The Find Module option is available when you want to communicate with a
Settings MODNIM or TIWAY Gateway module and the communications parameters
are not known. This selection tries the various parameter combinations
until either a successful match of communications parameters is found, or
all combinations have been tried. This option then displays on the screen
the communications parameters determined and an option to choose those
as the parameters to use for module setup.

Talk to Module The Talk to Module option tries to communicate with the MODNIM or the
TIWAY Gateway module using one of the following choices.

• Check Module Communications sends a few read requests to the

module and displays on the screen if communications were successful.

• Prompt for Info to Send prompts for the function to send and for
each of the function fields. (These are described in Chapter 2 of the
user manual.) The function is then packaged properly and sent to the
MODNIM or TIWAY Gateway module.

• Expert, Send Specific Request allows you to type a complete

function request on the screen. Refer to Chapter 2 for request format.
(The start field, LRC or CRC field, and Ready field do not need to be
entered; they will be computed before being sent.) The program then
sends the request to the module. The response from the module is
displayed exactly as it is returned from the module. All fields are
displayed.

Batch Send from This option will Batch Send a file to the module. It prompts for the input file
File name and for the output file name. If you do not change them, it assumes
modasst.tst as the input file name and modasst.log as the output file
name.

Verifying After using the MODASST program to verify that communications with the
Communications MODNIM or Gateway are functional and properly configured, you may still
find that network communications are not operating in your installation. In
that case, the network cabling from the MODNIM or TIWAY Gateway
module to the host computer or the host computer itself may need to be
evaluated to determine the source of the problem.

D-6 Using the MODASST Program SIMATIC TI505/TI500 MODNIM User Manual
 Index
Diagnostic bits, 2-22
A
Diagnostic codes, 2-20–2-29
Address, setting network address, 1-6 Diagnostic tests
Address 0, 2-8 power-up, 1-16
run-time, 1-17
Address 1, 2-8 user-initiated, 1-18, D-2–D-6
Address field, 2-2 Dipswitches
Addressing, limits, 2-7 ASCII/RTU mode selection, 1-7
data transmission rate, 1-7
ASCII transmission mode, 1-2–1-3, 2-2–2-3 example setting, 1-11
ASCII/RTU mode selection, 1-7 handshaking selection, 1-7
location, 1-8, 1-9, 1-11
network address, 1-6
parity selection, 1-7
B Series 500, 1-9, D-2–D-6
Series 505, 1-8, D-2–D-6
Baud rate, 1-8, 1-9 stopbit selection, 1-7
Broadcast mode, 1-2, 2-3, 2-14, 2-16, 2-19, 2-31, Y output/C coil selection, 1-7
2-33, 2-35 Distributor, information, ix
Building communication cables, 1-20, A-2
E
C Environmental specifications, C-2
EOF field, 2-3
Cable connections, A-2–A-3
Error responses, 2-38–2-39
Cables
Event bytes, 2-32
building your own, 1-20, A-2
connecting, 1-20, A-2 Exception codes, B-2
ordering information, 1-20, A-2 Exception responses, 2-39
recommended, 1-20, A-2
Execute diagnostics, 2-19
Checksum, 2-5
Coil type selection (Y/C), 1-7
F
Communications parameters, 1-3, A-4
Function field, 2-2
Communications specifications, C-3
Configuring the module, 1-6–1-9, D-2–D-6
G
Connecting network cables, 1-20, D-2–D-6
Get comms event counter, 2-30
Get comms event log, 2-31
D
Data field, 2-3 H
Data transmission rate, 1-7 Handling the module, 1-5

Index-1
Handshaking Modbus commands
MODNIM to host, A-3 function code descriptions, 2-8–2-37
MODNIM to modem, A-3 protocol, 2-2–2-7
Help Modbus functions supported, 2-3
contacting distributor, 1-5 Modbus manuals, ix
distributor, sales office, ix
Modbus network characteristics, 1-2
Modbus protocol, 1-2
I ASCII transmission mode, 1-2–1-3, 2-2–2-3
RTU transmission mode, 1-2–1-3, 2-4–2-5
I/O definition chart, 1-19–1-21 Modbus vs. TIWAY, 2-6–2-7
I/O slot keys, 1-12 Modems, 1-3, D-5
Inspecting the module, 1-5 Module
handling, 1-5
Installation
inspecting, 1-5
getting started, 1-5
quick reference steps, 1-4 Module log-in verification, 1-19–1-21
Series 500 MODNIM, 1-12 Multi-drop configuration, 1-3
Series 505 MODNIM, 1-10
Invalid characters and messages, 2-5
N
Network cable, A-2–A-3
K
Network configuration, 1-7
Keying I/O base slot, 1-12 NIM Good LED, 1-16, 1-18

L O
LEDs, status indicators, 1-8, 1-9, 1-15 Offline mode, 1-17
Local/remote switch, 1-14 On Line LED, 1-15, 1-17
Loopback Operational mode, 2-36, 2-37
connectors, 1-18 Output type selection (Y/C), 1-7
diagnostics, 1-18
LRC field, 2-3
P
Parameters, communications, 1-3, A-4
M Parity selection, 1-7
Manuals, related, ix PC Good LED, 1-17, 1-18
Master node, 1-2 Pin assignments, RS-232-C, A-4
Message delineation, 2-4 Point-to-point configuration, 1-3
MODASST configuration & diagnostics Power-up test, 1-16
assistant program, D-1–D-6
Primitives, 2-6
Modbus codes vs. TIWAY primitives, C-3 TIWAY, C-3

Index-2
 Switches
Q function, 1-14
Quick reference installation, 1-4 location, 1-8, 1-9
Switches and indicator lights, 1-14–1-15

R
T
Read coil status, 2-8
Read exception status, 2-17 Technical assistance, ix

Read input registers, 2-13 Test button, 1-14

Read input status, 2-10 Test mode LED, 1-15, 1-16, 1-18

Read output registers, 2-12 TISOFT, ix, 1-19

Ready field, 2-3, 2-23 TIWAY

primitives, 2-6, C-3
Receive LED, 1-18 vs. Modbus, 2-6–2-7, C-3
Related manuals, ix Transmission modes
Report slave ID, 2-36–2-37 ASCII, 1-2–1-3
RTU, 1-2–1-3
Reset button, 1-14, 1-18
Transmit LED, 1-18
Response options, 2-37
ROM integrity test, 1-17
RS-232-C cable pin assignments, A-4 U
RTS/CTS handshaking selection, 1-7 User-initiated test, 1-18
RTU transmission mode, 1-2–1-3, 2-4–2-5 Using the MODASST program, D-1–D-6
Run-time test, 1-17

V
S Verifying module log-in, 1-19–1-21
Secondary node, 1-2 Version of software, 2-36, 2-37
Self test, 1-16, 1-17, 1-18
Slave ID report, 2-36, 2-37
W
Slave node, 1-2
Software version, 2-36, 2-37 Write a single coil, 2-14

Specifications Write a single register, 2-16

communications, C-3 Write multiple coils, 2-33
environmental, C-2
Write multiple registers, 2-35
Start field, 2-2
Static electricity, 1-5
Status indicator lights, 1-8, 1-9, 1-15 Y
Stopbit selection, 1-7 Y/C coil selection, 1-7

Index-3
SIMATIC is a registered trademark of Siemens AG.
MODNIM, Series 500, Series 505, 5TI, PM550, PM550C, TISOFT, and TIWAY are trademarks of Siemens Industrial Automation, Inc.
Modbus is a trademark of Modicon, Inc.
Texas Instruments and TI are registered trademarks of Texas Instruments Incorporated.
TI500, TI505, TI520, TI520C, TI530, TI530C, TI525, TI535, TI545, TI555, TI560, TI565, and TI575 are trademarks of Texas Instruments
Incorporated.
IBM is a registered trademark of International Business Machines Corporation.
UL is a registered trademark of Underwriters Laboratories.
CSA is a registered trademark of the Canadian Standards Association.
Customer Registration

We would like to know what you think about our user manuals so that we can serve you better.
How would you rate the quality of our manuals?

Excellent Good Fair Poor

Accuracy
Organization
Clarity
Completeness
Overall design
Size
Index

Would you be interested in giving us more detailed comments about our manuals?

Yes! Please send me a questionnaire.

No. Thanks anyway.

Your Name:

Title:

Telephone Number: ( )

Company Name:

Company Address:

Manual Name: SIMATIC TI505/TI500 MODNIM User Manual Edition: Original

Manual Assembly Number: 2586546-0083 Date: 03/93
Order Number: PPX:505-8122-1
 FOLD

NO POSTAGE
NECESSARY
IF MAILED
IN THE
UNITED STATES

BUSINESS REPLY MAIL

FIRST CLASS PERMIT NO.3 JOHNSON CITY, TN

POSTAGE WILL BE PAID BY ADDRESSEE

SIEMENS INDUSTRIAL AUTOMATION, INC.

3000 BILL GARLAND RD.
P.O. BOX 1255
JOHNSON CITY TN 37605–1255

ATTN: Technical Communications M/S 3519

FOLD