TCPIP Communication Based On Ethernet Xinje
TCPIP Communication Based On Ethernet Xinje
TCPIP Communication Based On Ethernet Xinje
User manual
Responsibility declaration
The manual content has been checked carefully, however, mistakes may happen.
We often check the manual and will correct the problems in subsequent version. Welcome to
offer advices to us.
Excuse us that we will not inform you if manual is changed.
Contact information
If you have any problem about products, please contact the agent or Xinje company.
Tel: 0086 510-85134136 85123803
Fax: 0086 510-85111290
Address: Building 7 fourth floor, No.100, Dicui Rd, Wuxi, China.
Code : 214072
Before the Ethernet communication, let’s understand some Ethernet concepts such as IP address
allocation, PC network address and settings.
1-1-1.IP allocation
If programmable devices (such as PC) using LAN network card to connect to the factory (or the
Internet), the PLC and programming device must be in the same subnet. Combination of IP
address and subnet mask can be specified subnet of the equipment.
Network ID is the IP address of the first part, the top three 8-bit groups (such as IP addresses for
211.154.184.16, 211.154.184 represents network ID) decided the user's IP network. The value of
the subnet mask is usually 255.255.255.0. However, because of your computer is in the local
area network (LAN), subnet mask (for example, 255.255.254.0) may have different values to set
the unique subnet. Subnet mask and the equipment IP address will do logic AND operation to
define the boundary of the IP subnet.
1
2. Click the Ethernet connections, choose properties:
2
1-1-3.PING command
Through the PING command, you can check the local TCP/IP protocol, and whether it can be
normal connection to other computer local area network (LAN).
2. input “ping 127.0.0.1” to check the local TCP/IP protocol, it is normal when the receiving and
sending data are same.
3
4. input ‘ping network device ip” command to check whether the PC can connect to other
PC in the LAN.
(1) input the command “ping 192.168.40.146”, if the result shows “0% loss”, this PC
can connect the PC with IP 192.168.40.146.
(2) input the command “ping 192.168.40.127”, it shows “100% loss”, which means cannot
connect to the PC with IP 192.168.40.127.
Note: in the ping statistics information, only 0% loss means communication normal.
1-2.TCP IP protocol
TCP/IP protocol is a popular Ethernet communication protocol, compared with ISO open
interconnection model, adopts a more open way, it has been recognized by the U.S. department
of defense, and is widely used in practical engineering. TCP/IP protocol can be used in a variety
of channels and the underlying protocol (such as T1, X.25 and RS232 serial interface).
Specifically, TCP/IP protocol is including TCP protocol, IP protocol, the UDP protocol, ICMP
protocol and some other groups.
1-2-1.Port number
In Ethernet, the communication based on TCP or UDP must use the port number to communicate
with the upper application, port range is from 0 to 65535, some port numbers have default
4
functions, such as port 80 for browsing the web service, port 21 for FTP service, port 502 for
MODBUS TCP communications, and so on.
1-2-2.UDP protocol
UDP is the user data protocol, which is a simple connectionless transmission model with min
protocol . UDP protocol doesn’t have handshake mechanism, so the reliability of protocol is only
equal to the underlying network. It cannot provide protection for receiving and sending message.
UDP also provides checksum to ensure the integrity of data, and addresses different functions via
different port numbers.
1-2-3.TCP protocol
5
service.
6
client server
Socket ( ) Socket ( )
Bind monitoring
Bind ( )
port
Set listening
Listen ( )
queue
While (true)
Create {
connection Loop wait client
Connect ( ) Accept ( )
connection
}
Send data
Send ( ) Receive ( )
Receive data
Receive ( ) Send ( )
Send data
Catch error
Close ( ) Close ( )
()
In above diagram, the server socket is in the listening state, client connection requests to the
server, the server receives a connection request and sends the reply to confirm the information to
the client, after the client received message, it sends confirmation information to the server. After
completion of the allocation of resources, a TCP connection is established successfully, this
process is called "three-way handshake".
After the connection is established, the client and the server can send and receive data, after data
transceiver is completed, the client or the server can request to close the connection, after the
fourth "handshake", TCP connection is closed, all data transceiver interrupts.
7
2 Ethernet parameters
2-1.Ethernet parameters
It needs to set the IP address in the Ethernet communication as the unique identification of each
device. There are four parameters, the following charts are the IP setting interface of
programming software.
Obtain the IP
Support obtain the IP address automatically, static setting function, PLC initial setting is
automatical obtain.
Automatic obtain mode: when there is a DHCP server in the subnet, IP, subnet mask, default
gateway are assigned by the DHCP server. Without a DHCP server, network parameters use the
default values:
IP address: 192.168.6.6
Subnet mask: 255.255.255.0
The default gateway: 192.168.6.1
Static specified mode: users assigned IP, subnet mask, default gateway information. Only
supports private IP address information.
8
IP address type IP address range IP device quantity
Class A private address 10.0.0.0-10.255.255.255 16777216
Class B private address 172.16.0.0-172.31.255.255 1048576
Class C private address 192.168.0.0-192.168.255.255 65535
Open the XINJE PLC programming software, click the ethernet in the left side, refer to below
figure. This function is only avaliable for Ethernet model.
Select remote communication in the above figure, you can configure the remote parameter, it no
needs to set the parameters in the local area network (LAN), after completion of all the
parameters, please restart the PLC to make the settings effective.
9
2-3.Configure ethernet parameters in XINJEConfig
Connect the PLC to PC, open the XINJE config tool, click config/find device/xnet find.
Click config/single device/etherport, set the Ethernet parameters. Please refer to chapter 2-1-1 for
details.
10
3 Wiring and communication protocol
3-1.Wiring mode
The physical interface of Ethernet model is RJ45, the wiring cable is recommended to use UTP
and STP cable, single length cannot be more than 100 meters. Switch type is recommended to
use MB/GB adaptive switch.
MODBUS TCP combined standard TCP/IP, Ethernet physical network and MODBUS as the data
representation method of data application protocol. MODBUS TCP communication message is
encapsulated in Ethernet TCP/IP packets, MODBUS protocol one frame maximum length is 256
bytes.
MODBUS TCP/IP has two type of devices: Modbus TCP/IP clinet and server.
MODBUS client:
Client (TCP Client) launched a connection request to the Server (TCP Server), the connection is
established successfully, it only allows the Client to initiate communication request.
When the Ethernet model is the MODBUS TCP client, it establishes a TCP connection through
S_OPEN instruction, initiates MODBUS request by M_TCP instruction.
MODBUS server:
The server listened to port 502, waited for the client connection request, after the connection was
established successfully, it responsed to the data communication request in accordance with the
Modbus TCP protocol specification.
Ethernet devices defaulted open this service when power on, the maximum response is no more
than four TCP connections.
11
3-2-2.MODBUS address
When the programmable controller is seemed as the Modbus server, internal soft component
number and its corresponding Modbus address number can refer to XINJE PLC programming
manual "XD/XL series PLC instruction user manual" and "XG series PLC instruction user
manual.
Ethernet model PLC supports the following Modbus communication function codes:
Freedom communication based on Ethernet is divided into two categories: TCP and UDP,
Ethernet model using TCP communication can be used as a TCP client (TCP client), can also be
used as a TCP server (TCP server).
1. as a TCP client, take the initiative to establish a TCP connection with the TCP server,
and bind socket ID.
2. as the TCP server, waiting for the TCP client and establish a TCP connection, and bind
socket ID.
3. using UDP, listening to the specified local port, and bind socket ID.
Based on the above three forms, which can realize the freedom of Ethernet communication.
Freeform communication in the form of a block of data to transmit data, restricted by PLC cache,
a single to send and receive data volume of 1000 bytes.
Based on the above three forms, it can realize the free communication of Ethernet. Free format
communication transfers the data in the form of data block, be restricted by PLC cache,
single-time sending and receiving data volume is 1000 bytes.
12
Free format communication parameters:
Data buffer mode: 8-bit, 16-bit
1. 8-bit buffer communication: the high byte of the register is invalid, PLC only uses the
low byte of the register to send and receive data.
2. 16-bit buffer communication: for the received data, PLC saves the low byte first, then
saves the high byte; for the sending data, PLC sends the low byte first, then sends the
high byte.
3. When the received data package length is larger than setting length, data will be stored
as 16-bit buffer mode.
13
4 Ethernet communication instruction
1. Overview
Communication task creates the instruction, use together with abort communication task
instruction S_CLOSE.
Create TCP connection /UDP port listening [S_OPEN]
16-bit S_OPEN 32-bit -
instruction instruction
Execution Edge triggered Suitable XDE, XD5E, XG, XL5E
condition model
Firmware V3.5.3 and up Software V3.5.3 and up
2. Operand
Operand Function Type
S1 Socket ID 16-bit, BIN
S2 Communication type 16-bit, BIN
S3 Local device communication mode 16-bit, BIN
S4 Parameter block start address 16-bit, BIN
S5 Flag start position Bit
14
3. Suitable soft component
*Note: D means D HD ;TD means TD HTD ;CD means CD HCD HSCD HSD; DM means DM
DHM;
DS means DS DHS. M means M HM SM;S means S HS; T means T HT;C means C HC.
S1· S2· S3 S4 S5
M0
S_OPEN K1 K1 K1 HD100 M100
Create the communication task, when M0 rising edge is coming, the instruction will create
one TCP connection or open UDP port listening once.
S1: socket ID, range: K0~K63. Note: the socket quantity cannot be more than 64, TCP
quantity cannot over 32, UDP quantity cannot be more than 32.
S2: communication type, range: K0, K1. K0 is UDP, K1 is TCP.
S3: communication mode. Range: K0, K1. K0 is server, K1 is client.
S4: parameter block start address, occupy 9 registers from S4 to S4+8.
S5: flag start position, occupy 10 coils from S5 to S5+9.
This instruction can be set through the following window
15
Note: the parameters in the red frame will be effective after power on the PLC again.
Ethernet error flag SM1921 is ON when communication is abnormal, the error information
will be stored in SD1920 and SD1921, please refer to chapter 4-3.
Take above image as an example, the address starting from HD0 and flag address starting from
M0 are shown as below:
Parameter explanation:
The communication task created by S_OPEN is divided into three categories: TCP client, TCP
server, UDP. The parameters used by the three types are different, please refer to below table.
Communication Local destination Destination Buffer Received Error
Timeout
type port IP port type bytes code
TCP client - √ √ √ √ √ √
TCP server √ - - √ √ √ √
UDP √ √ √ √ √ √ √
16
1. Local port
The range is 1 to 60000, port 502 and 531 is special port which can not be used. Local port only
can be used by one communication task.
2. Destination IP
The target device IP which is in the same subnet of local device.
3. Destination port
The net port no. of target device. The range is 1 to 65535. The port must be 502 for modbus tcp
communication.
4. Buffer type
When the value is 0, it is 8-bit mode. When the vlaue is non-zero, it is 16-bit mode. If the actual
receiving package is larger than setting length, it will automatical change to 16-bit mode.
5. Timeout
The time from PLC requests data receiving to the receiving data ends. The range is 0 to 65536.
The unit is 10ms. 0 means the timeout is disabled, it will continue receiving data. Non-zero
means the timeout function is enabled. The receiving timeout is effective for S_RCV and
M_TCP.
If the timeout is set to 300ms, it will wait for 300ms when the request begins, and terminate at
once when the data is received successfully. If it hasn’t received data over 300ms, the present
instruction will end and report the receiving timeout error.
8. Error code
The error message of Ethernet free format communication and Modbus TCP communication
please refer to chapter 4-4.
9. Flag bit
The communication flag bits are shown as below (take head address Mn as an example)
17
Bit Flag bit Function
address
Mn Connecting Creating the connection, M(n) is ON
M(n+1) Connected Creating connection completed, M(n+1) is
ON
M(n+1) Sending Data is sending, M(n+2) is ON
M(n+3) Sent Sending data completed, M(n+3) is ON
M(n+4) Receiving Data is receiving, M(n+4)is ON
M(n+5) Received Data receiving completed, M(n+5) is ON
M(n+6) Closing The present connection is closing, M(n+6)is
ON
M(n+7) MODBUS TCP When executing M_TCP instruction, M(n+7)
communicating is ON
M(n+8) TCP abnormal TCP connection is abnormal, M(n+8) is ON
M(n+9) Error flag Communication is error,M(n+9) is ON
1. Instruction overview
Communication termination instruction, please use together with S_OPEN.
Communication termination [S_CLOSE]
16-bit S_CLOSE 32-bit -
Execution Edge triggering Suitable XDE, XD5E, XG, XL5E
condition model
Firmware V3.5.3 and up Software V3.5.3 and up
2. Operand
Operand Function Type
S1 Close socket ID 16-bit, BIN
*Note: D means D HD ;TD means TD HTD ;CD means CD HCD HSCD HSD; DM means DM
DHM; DS means DS DHS.
18
Function and action
S1
M0
S_CLOSE K1
S1: the socket ID which needs to close, the operand can be register or constant, the range is
K0~K63.
After this instruction is executed, the instruction M_TCP, S_SEND, S_RCV based on this
socket ID cannot run anymore.
1. Instruction overview
Free format communication send instruction needs to use together with S_OPEN and S_CLOSE.
Free format communication send [S_SEND]
16-bit S_SEND 32-bit -
Execution Edge triggering Suitable XDE, XD5E, XG, XL5E
condition model
Firmware V3.5.3 and up Software V3.5.3 and up
2. Operand
Operand Function Type
S1 Socket ID 16-bit, BIN
S2 Send data local register head address 16-bit, BIN
S3 Send data quantity 16-bit, BIN
*Note: D means D HD ;TD means TD HTD ;CD means CD HCD HSCD HSD; DM means DM
19
DHM; DS means DS DHS.
S1 S2 S3
M0
S_SEND K1 D100 K10
Free format communication send instruction, it will send data when the M0 rising edge is
coming.
Note: this instruction must be used together with S_OPEN and S_CLOSE.
S1: socket ID, the operand can be register or constant, the range is K0~K63
S2: local register sending head address
S3: send data quantity, the operand can be register or constant
Please input this instruction in the ladder chart
Please pay attention to the S_OPEN data buffer type in the socket ID.
1. Instruction overview
Free format communication receive instruction needs to use together with S_OPEN and
S_CLOSE.
Free format communication receive [S_RCV]
16-bit S_RCV 32-bit -
Execution Normally ON/OFF, edge Suitable XDE, XD5E, XG, XL5E
condition triggering model
Firmware V3.5.3 and up Software V3.5.3 and up
2. Operand
Operand Function Type
S1 Socket ID 16-bit, BIN
S2 Receive data local register head address 16-bit, BIN
S3 Receive data quantity 16-bit, BIN
20
word operand System Constant Module
D FD ED TD CD DX DY DM DS K /H ID QD
S1 ● ●
S2 ●
S3 ● ●
*Note: D means D HD ;TD means TD HTD ;CD means CD HCD HSCD HSD; DM means DM
DHM; DS means DS DHS.
S1 S2 S3
M0
S_RCV K1 D100 K10
Free format communication receive instruction, it will receive data when the M0 rising edge
is coming.
Note: this instruction must be used together with S_OPEN and S_CLOSE.
S1: socket ID, the operand can be register or constant, the range is K0~K63
S2: local register receiving head address
S3: receive data quantity, the operand can be register or constant
Please input this instruction in the ladder chart
Please pay attention to the S_OPEN data buffer type in the socket ID.
21
4-1-5.MODBUS communication [M_TCP]
1. Instruction overview
When PLC is client, receive and send data in modbus tcp protocol. It can be used together with
S_OPEN and S_CLOSE.
MODBUS TCP communication [M_TCP]
16-bit M_TCP 32-bit -
Execution Edge triggering Suitable XDE, XD5E, XG, XL5E
condition model
Firmware V3.5.3 and up Software V3.5.3 and up
2. Operand
Operand Function Model
S1 Remote station no. 16-bit, BIN
S2 Modbus communication function code 16-bit, BIN
S3 Target head address 16-bit, BIN
S4 Register or coil quantity 16-bit, BIN
S5 Local head address 16-bit, BIN
S6 Socket ID 16-bit, BIN
*Note: D means D HD ;TD means TD HTD ;CD means CD HCD HSCD HSD; DM means DM
DHM; DS means DS DHS.
S1 S2 S3 S4 S5 S6
M0
M_TCP K1 K1 K0 K1 M100 K1
MODBUS TCP communication instruction, it will Modbus TCP communicate once when
22
M0 rising edge is coming.
S1: remote communication station no., the range is K0~K247
S2: MODBUS communication function code
S3: target head address, it is Modbus communication address.
S4: communication data quantity
S5: local head address
S6: socket ID, specify the TCP connection, the target port must be 502.
This instruction must be used together with S_OPEN and S_CLOSE.
M_TCP is only effective when PLC is client, and receives and sends the data of Modbus
TCP protocol.
This instruction needs to set through the following window
Function code:
Value Function code Value Function code
K1 Read the coil K3 Read the register
K2 Read the input discrete K4 Read input register
magnitude
K5 Write single coil K6 Write single register
K15 Write multiple coil K16 Write multiple register
23
4-1-6.Ethernet communication example
Example 1:
After PLC power on, automatically create TCP client, TCP server and UDP communication task,
and send and receive data on the basis of each communication task. The IP address of the PLC is
192.168.0.60, the IP address of target device B is 192.168.0.100.
Program operation:
(1) after PLC powers on, the PLC which is TCP client creates TCP connection with TCP server
port 1000 of device B and binds the socket ID1. After the connection is created, it sends low
8-bit data of D1000 to D1549 to device B every 1 second, and receives the data and saves in low
8-bit of D1600 to D1999. When the TCP connection is abnormal, it will close the TCP
connection and create again.
(2) after PLC powers on, the PLC which is TCP server listens port 1001, waits TCP client
creating TCP connection and binds socket ID2. After the connection is created, it sends low 8-bit
data of D2000 to D2549 to connected device every 1 second, and receives the data and saves in
low 8-bit of D2600 to D2999. When the TCP connection is abnormal, it will close the TCP
connection and create again.
(3) after PLC powers on, it communicates in UDP mode, the local device port is 1002, target IP
is 192.168.0.100, target port is 3000, binds the socket ID3. After the connection is created, it
sends low 8-bit data of D3000 to D3549 to connected device every 1 second, and receives the
data and saves in low 8-bit of D3600 to D3999.
PLC program:
24
Socket ID1 connection
25
Socket ID2 crea te connection
26
Socket ID1 S_OPEN setting:
27
Example 2:
After PLC power on, it will communicate with Modbus TCp server device A and B, the PLC IP
is 192.168.0.60, device A IP is 192.168.0.40, Modbus station no. is 1, device B IP is
192.168.0.70, Modbus station no. is 1.
Program operation:
(1) After PLC power on, as the TCP client, it will create TCP connection with TCP server
port 502 of device A, and bind the socket ID1, after the connection is created
successfully, it will write the value of D1000 to D1019 to device A address 4x100 to
4x119 every 100ms. When the TCP connection is abnormal, it will close the TCP
connection and create again.
(2) After PLC power on, as the TCP client, it will create TCP connection with TCP server
port 502 of device B, and bind the socket ID2, after the connection is created
successfully, it will write the value of D2000 to D2019 to device B address 4x200 to
4x219 every 100ms. When the TCP connection is abnormal, it will close the TCP
connection and create again.
Program:
28
Socket ID1 crea te connection
29
Socket ID1 S_OPEN setting:
30
Socket 2 M_TCP setting:
When Ethernet communication is carried out, in order to ensure the normal realization of
communication, it is recommended to use communication port parameter reading instruction
[CFGCR] and writing instruction [CFGCW] when making communication program.
First, by calling the CFGCR instruction, the corresponding parameters of the communication
port are read into the specified register group, and then the user modifies the corresponding
values in the register group as required, and then writes the modified values of the register group
into the corresponding communication port configuration through the CFGCW instruction. Refer
to section 6-5 of XD/XL series programmable controller user manual [basic instructions] .
Example 1:
Through parameter reading instruction [CFGCR] and writing instruction [CFGCW], the network
parameters of PLC are read into register D10~D18, and the network parameters of register
D10~D18 are written into the serial port setting of PLC after modification.
PLC program:
M1
CFGCR D10 K9 K9
M2
CFGCW D10 K9 K9
31
When M1 is set on, the network parameters of PLC are triggered to read. After modifying the
network parameters, set on M2, and the modified network parameters can be written into the
PLC. After the writing, the PLC power off and power on again, the serial port parameters take
effect.
Communication registers:
Address Format Function Explanation
SD1905 Hex IP net number The first two bytes of IP address
SD1906 Hex IP station no. The last two bytes of IP address
SD1907 Hex The first two bytes of subnet mask
Subnet mask
SD1908 Hex The last two bytes of subnet mask
SD1909 Hex The first two bytes of defaulted gateway
Defaulted gateway
SD1910 Hex The last two bytes of defaulted gateway
Abnormal socket ID, only be effective
SD1920 Decimal Abnormal socket ID
when the connection is not created
1: the socket ID is over the range
2: not registered socket ID sends a
communication request
3: communication type error, out of the
range
0---TCP 1---UDP
SD1921 Decimal Error code
4: TCP connection quantity out of the
range, max is 32
5: UDP connection quantity out of the
range, max is 32
6: communication mode error, out of the
range, 0---Server 1---Client
Communication coils:
Address Function Explanation
SM1900 Log in remote server successfully flag Set on when the remote connection
succeeded
SM1901 Ethernet initialization completed flag MODBUS TCP Server/TCP IP/ XNET
SM1902 Connect net device flag Such as swither/router/ other net devices
SM1921 Ethernet error flag Set on when the error in any of the SD1921
generated
32
4-4.Ethernet communication error list
33
WUXI XINJE ELECTRIC CO., LTD.
Jiangsu Province
214072
Tel: 400-885-0136