Function Block

Référence MTCP_CP1L_Server OMRON ELECTRONICS S.A.S.

Révision 2.6 14 Rue de Lisbonne
93561 Rosny-sous-Bois cedex
Auteur JP Viskovic
Date 11/12/2019
+ Support http://support-omron.fr/

Modbus TCP Server for CP1L series

Function Modbus TCP Server

Symbol

File MTCP_CP1L_Server.zip

PLC CP1L-EL, CP1L-EM

Conditions
of use The FB Modbus TCP server provides some read/write features in accordance with the
specifications defined by the Modbus organization.

Restrictions :

- The FB MTCP_CP1L_Server support only one client connection

- Le FB MTCP_CP1L_Server is intended to facilitate data exchange not related to the

control or the safety of machine.

The Modbus TCP Client function block is offered 'as is' and may serve as a basis for
development.
Users should previously test its adequacy to the final application.
Omron could not be held responsible in case of malfunction.
Function Block MTCP_CP1L_Server Modbus TCP Server

Principe The FB MTCP_CP1L_Server is listening for a client connection as soon as the

StartServer input is activated.

TCP TIME-WAIT:
When a TCP connection is closed, the socket pair is placed in a known as TIME-WAIT
state, which ensures that a new connection does not use the same protocol, source
IP address, destination IP address, source port and destination port, until a period of
time sufficient flows to ensure that any segment that may have been incorrectly
routed or delayed are not delivered unexpectedly. The duration of the interval during
which the socket pair cannot be reused is specified in RFC 793 as equal to 2 MSL
(twice the maximum lifetime of a segment), or four minutes (CP1L 2mn) .
To avoid this delay, use another local port on the client side (the server is fixed on
port 502).

If the disconnection occurs on client side, the CP1L cannot detect it.
Then a ‘NoActivity_Delay’ has been added to restart the server in case of no
received request during the connection.

Supported command list

Code Function Name in MODBUS
0x01 ***** NOT SUPPORTED ****** Read Coils
0x02 ***** NOT SUPPORTED ****** Read Discrete Inputs
0x03 I/O memory area (DM) Read Multiple Registers Read Holding Registers
0x04 I/O memory area (CIO) Read Multiple Registers Read Input Registers
0x05 I/O memory area Write Single Coil (CIO) Write Single Coil
0x06 I/O memory area (DM) Write Single Register Write Single Register
0x08 Echo back test Diagnostic
0x0F ***** NOT SUPPORTED ****** Write Multiple Coils
0x10 I/O memory area (DM) Write Multiple Registers Write Multiple Registers
0x17 Read Write Multiple Registers Read Write Registers

The FB uses socket N°1 and TCP port 502

Memory Map
Used by the function Block
Type range Descriptions
Send/Receive Area D32500-32767 store request and prepare response

Socket service flag & command switch

Type range Descriptions
Flag/command A567-A572 For more details see :
Parameter Area D32400–D32437 Socket Service from W516

PLC area accessible by the Modbus TCP request

Address MODBUS PDU Corresponding CS/CJ’s address
Coils 1- 65536 0 - 65535 0–65535 (CIO 0.00– 4095.15)
Input Registers 1- 6144 0 - 6143 0–6143 (CIO 0 – CIO6143)
Holding Registers 1- 32768 0 - 32767 0-32767 (D0 – D32767)

JPV 11/12/2019 Page 2/6

Function Block MTCP_CP1L_Server Modbus TCP Server

Input Variable
Name type Range Description
EN Bool OFF, ON Enable FB execution
LocalPort UINT 1-65535 Local port number (default value 502)
NoActivity_Dealy UINT 0-9999 0: No control, function deactivated
>0: Delay to restart the server in case of no request
received during that time (when connected only)
StartServer Bool OFF, ON ON: open socket in passive mode (listen)
OFF: close the socket

Output Variables
Name type Range Description
ENO Bool OFF, ON Server operational and listening for a client connection
Connected Bool OFF, ON Client connected (last field of IP address)
IP_Client UINT 0-9999
Error_Code Bool OFF, ON See code error list bellow
Except_Counter UINT 0 - FFFF Counter of exception error
Recv_Counter UINT 0 - FFFF Counter of received request (any)

Socket services Error Codes are returned prior to Modbus exception error

Modbus Error Code Description

0001 ILLEGAL FUNCTION
0002 ILLEGAL DATA ADDRESS
0003 ILLEGAL DATA VALUE

Timing charts of related command and flags

PLC Cycle time: 1ms

Etherway utility software can help to debug Modbus TCP communication and can be found here:
https://www.support-omron.fr/rechercher/?r=etherway

JPV 11/12/2019 Page 3/6

Function Block MTCP_CP1L_Server Modbus TCP Server

ANNEXE

Modbus protocol
I/O memory area (CIO) Read Multiple Coils

Example: read 19 bits (CIO 0001.04 to 0002.06)

Request Response
Data Data
Function Code 0x01 Function Code 0x01
Starting Address(H) 0x00 Byte Count 0x03
Starting Address(L) 0x14 Coil Status 27-20 0xCD
Quantity of Coils(H) 0x00 Coil Status 35-28 0x6B
Quantity of Coils(L) 0x13 Coil Status 38-36 0x05

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0CH 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
1CH 31 1 30 0 29 1 28 1 27 1 26 1 25 0 24 0 23 1 22 1 21 0 20 1 19 18 17 16
2CH 47 46 45 44 43 42 41 40 39 38 1 37 0 36 1 35 0 34 1 33 1 32 0
3CH 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48
Italic characters show the ON/OFF(1/0) status of its bit condition.

Reads registers in I/O memory area

Example: read 3 words (DM 1000 to DM 1002)

Request Response
Data Data
Function Code 0x03 Function Code 0x03
Starting Address(H) 0x03 Byte Count 0x06
Starting Address(L) 0xE8 Register Value(H)DM1000 0xAB
Quantity of Registers(H) 0x00 Register Value(L) DM1000 0x12
Quantity of Registers(L) 0x03 Register Value(H)DM1001 0x56
Register Value(L) DM1001 0x78
Register Value(H)DM1002 0x97
Register Value(L) DM1002 0x13

DM 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
1000 A B 1 2
1001 5 6 7 8
1002 9 7 1 3

Writes single coil.

Example: write 1 coil. (CIO 0002.02 ON)

Request Response
Data Data
Function Code 0x05 Function Code 0x05
Output Address(H) 0x00 Output Address(H) 0x00
Output Address(L) 0x22 Output Address(L) 0x22
Output Value(H) 0xFF Output Value(H) 0xFF
Output Value(L) 0x00 Output Value(L) 0x00

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0CH 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
JPV 11/12/2019 Page 4/6
Function Block MTCP_CP1L_Server Modbus TCP Server

1CH 31 1 30 0 29 1 28 1 27 1 26 1 25 0 24 0 23 1 22 1 21 0 20 1 19 18 17 16
2CH 47 46 45 44 43 42 41 40 39 38 1 37 0 36 1 35 0 34 1 33 1 32 0
3CH 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48
Italic characters show the ON/OFF(1/0) status of its bit condition.

Writes single register.

Example: write &h3AC5 to DM 2000.

Request Response
Data Data
Function Code 0x06 Function Code 0x06
Register Address(H) 0x07 Register Address(H) 0x07
Register Address(L) 0xD0 Register Address(L) 0xD0
Register Value(H) 0x3A Register Value(H) 0x3A
Register Value(L) 0xC5 Register Value(L) 0xC5

DM 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
2000 3 A C 5
2001
2002

Writes registers.

Example: write 2 words into DM1000-1001.

Request Response
Data Data
Function Code 0x10 Function Code 0x10
Starting Address(H) 0x03 Starting Address(H) 0x03
Starting Address(L) 0xE8 Starting Address(L) 0xE8
Quantity of Registers(H) 0x00 Quantity of Registers(H) 0x00
Quantity of Registers(L) 0x02 Quantity of Registers(L) 0x02
Byte Count 0x04
Registers Value(H) 0x3A
Registers Value(L) 0xC5
Registers Value(H) 0x97
Registers Value(L) 0x13

DM 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
1000 3 A C 5
1001 9 7 1 3

Writes Multiple coils.

Example: In the case of writing 10 bits ( xxxx xx11 1100 1101) to CIO 0001.04.
(X = ignored.)
Request Response
Data Data
Function Code 0x0F Function Code 0x0F
Starting Address(H) 0x00 Starting Address(H) 0x00

JPV 11/12/2019 Page 5/6

Function Block MTCP_CP1L_Server Modbus TCP Server

Starting Address(L) 0x13 Starting Address(L) 0x13

Quantity of Outputs(H) 0x00 Quantity of Outputs(H) 0x00
Quantity of Outputs(L) 0x0A Quantity of Outputs(L) 0x0A
Byte Count 0x02
Output Value(H) 0x3A
Output Value(L) 0x01

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0CH 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
1CH 31 0 30 0 29 0 28 1 27 0 26 0 25 1 24 1 23 1 22 0 21 1 20 0 19 0 18 0 17 0 16 0
Italic characters show the ON/OFF(1/0) status of its bit condition.

Read and Write multiple registers Fn17

Example: read registers 1 & 2 (1001-2002) and write CAFE into register 0003.
Requête Réponse
Donnée Donnée
Function Code 0x17 Fonction Code 0x17
Starting Address(H) to read 0x00 Nbre of byte 0x04
Starting Address(L) to read 0x01 Valeur du register 1 (poids faible) 0x10
Quantity of Registers(H) to read 0x00 Valeur du registre 1 (poids fort) 0x01
Quantity of Registers(L) to read 0x02 Valeur du register 2 (poids faible) 0x20
Starting Address(H) to write 0x00 Valeur du registre 2 (poids fort) 0x02
Starting Address(L) to write 0x03
Nbre of registers (H) to write 0x00
Nbre of registers (L) to write 0x01
Nbre of byted’octets à écrire 0x02
1ère valeur (poids fort) 0xCA
1ère valeur (poids faible) 0xFE

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0000 3 A C 5
0001 1 0 0 1
0002 2 0 0 2
0003 C A F E

JPV 11/12/2019 Page 6/6