Manual BIET - Balogh technical center

BIET 1703 COMMUNICATIONS3.1 ADDRESSES3.1.1 MAC ADDRESSEach BIET 170 unit has a unique predefined 6-byte MAC address (Media Access Control) whichconsists of the following:• upper part: three bytes identifying the Balogh Company (0050C2 h),• lower part: three bytes identifying the specific BIET 170 and indicated on the unit:1 0 8 x x x3.1.2 IP ADDRESSEach BIET 170 unit has an IP address (default address: 192.168.0.1).This address is user-definable (static selection mode) or assigned by a DHCP server.3.2 MESSAGING PROTOCOLSThe supervisor (PLC or PC) is connected to the port (socket) of the BIET.The exchanged messages are encapsulated in the TCP frames.Three messaging protocols are implemented:• Modbus/TCP, which is the simple encapsulation of Modbus messages in a TCP wrapper,• a specialty protocol based on TCP/IP,• EtherNet/IP ®.3.3 ADDITIONAL SERVICES3.3.1 FIRMWARE DOWNLOADING (MAINTENANCE)The ftp protocol provides the downloading of a new code in the Flash memory of the BIET viaEthernet network.3.3.2 MONITORING, CONFIGURATION AND FAULT DIAGNOSISThe http protocol provides:• visualisation for both channels of the tag detection,• display of the current configuration and parameters,• modification of the IP address via a html form,• display of various counters intended for diagnosis.In order to establish a http session, a web browser is required on the user station; this one logs onthe IP address of the BIET.BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 10subject to modification – Ref: M - BIET 170 – 2.4-EN

BIET 1705.2 SOLUTION 2: OVER THE ETHERNET NETWORKUse a PC connected to the local Ethernet network:PCBIETETHERNETEthernet boardEthernetlocalnetwork• open the browser,• type the IP address of the BIET: a home page is displayed:HomeStatus display Display of status for both channels (Modbus/TCP only)Modbus test Visualization of a tag detection (Modbus/TCP)Tcp testVisualization for both channels of a tag detection (TCP/IP)Current Params Display of current configuration & IP address and nb of active connectionsConfiguration IP address setting (protected by password)Troubleshooting Dashboard intended for fault locationHelpSwitches settingContactTechnical support details• select "Configuration": a dialogue box pops up:• skip the field ‘Nom de l’utilisateur’ (User name) and enter the password (balogh)• validate: a configuration form is displayed:• modify the fields if needed,• click the button "Update" to send the parameters to the BIET. The solution 2 does not allow to change the IP selection mode (static or DHCP).BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 15subject to modification – Ref: M - BIET 170 – 2.4-EN

BIET 1706 STARTING UP6.1 SELECTING THE MESSAGING PROTOCOLThree microswitches (behind the LEDs flange) provide the selection of the messaging protocol:Messaging protocols ↓ SW3 SW2 SW1Modbus ® /TCP - direct addressing OFF OFF OFFBalogh TCP/IP OFF OFF ONEtherNet/IP ® 1) OFF ON OFFModbus ® /TCP - indirect addressing 2) OFF ON ON1) Refer for use to the specific manual.2) Register-based tag mapping used in case of the supervisor limiting the address range under 10 000 dec.6.2 INITIALISATIONUpon power-up, the BIET launches a self-test; the following operations occur:• the "24V" led is on,• the result of the self-test is indicated by a visual signal of the ‘‘MOD’’ LED:• the LEDs test. a series of 5 green pulses indicate the absence of errors, a series of 5 red pulses indicates an error,After approximately 22 seconds, the initialisation ends: the "ETHERNET" LED remains on as longas the network connection is provided.In DHCP mode, as long as no IP address is received from the DHCP server, the BIET waits on: theabove procedure starts only when the address is assigned.BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 16subject to modification – Ref: M - BIET 170 – 2.4-EN

BIET 1707 USING MODBUS/TCP MESSAGING PROTOCOL7.1 GENERALThe BIET communicates with clients (2 at the most) using Modbus ® frames.The Modbus ® frames are encapsulated in the TCP/IP protocol messages so that they cancirculate over Ethernet (port number: 502).The requests and responses start with a three-word prefix (6 bytes):• transaction number, entered by the client,• protocol code: 00• length in bytes of the frame that follows (except CRC32 check) ≤ 254 (MSB is 0).In the answer, the transaction number and protocol code are just repeated.Therefore the complete messages have the following format:transaction no. protocol code length Modbus frame TCP check2 bytes 2 bytes 2 bytesSNFC1 byte 1 byteMessageNote: the CRC16 ending the proper Modbus frames is not used because TCP uses its own checkmethod.SN:Modbus Slave Number, called here "unit identifier": this number, repeated in the answer,• is not used in the original protocol,• equals the channel number in the protocol using indirect addressing.FC: Function Code which can only have a limited number of values:• 3: reading n consecutive words,• 16 (10 h): writing n consecutive words,• 23 (17 h): reading n consecutive words and writing m consecutive words (chained),• 43 (2B h) : BIET identification.The Message part of requests consists of an address field (Ad) of two bytes.To simultaneously use both BIET channels, the client opens 1 port per channel.It is possible to know at any time the number of active connections.For this purpose, open in the PC browser the html page Current Params (refer to paragraph 5.2).Update it using the embedded function ‘Refresh this page’:BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 17subject to modification – Ref: M - BIET 170 – 2.4-EN

27.2 IMPLEMENTED FUNCTIONS7.2.1 READING N WORDSREQUEST:Ad: address of first word to readn : number of words to read ≤ 126.BIET 170SN 3 Ad n1 byte 1 byte 2 bytes 2 bytesRESPONSE :SN 3 BC D 1 D n1 byte 1 byte 1 byte 2 bytes 2 bytesBCD 1D n: number of bytes read – that is, 2n: value of first read word: value of last read word.7.2.2 SPECIFIC CASE: READING THE STATUS BYTEREQUEST:RESPONSE:channel 1 SN 3 7F FE 0 1channel2 SN 3 FF FE 0 1SN 3 2 0 status1 byte 1 byte 1 byte 2 bytes7.2.3 WRITING N WORDSREQUEST:SN 10 Ad n BC D 1 D n1 byte 1 byte 2 bytes 2 bytes 1 byte 2 bytes 2 bytesAd : address of first word to writen : number of words to write (n ≤ 123)BC : number of bytes to write (BC = 2n, therefore BC ≤ 246)D 1 : first value to writeD n : last value to write.RESPONSE:SN 10 Ad n1 byte 1 byte 2 bytes 2 bytesBALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 18subject to modification – Ref: M - BIET 170 – 2.4-EN

BIET 1707.2.4 READING N WORDS AND WRITING M WORDS (CHAINED)REQUEST:SN 23 Read Ad n Write Ad m BC D 1 D m1 byte 1 byte 2 bytes 2 bytes 2 bytes 2 bytes 1 byte 2 bytes 2 bytesAd : address of first word to read / writen : number of words to read (n ≤ 125)m : number of words to write (m ≤ 121)BC : number of bytes to write (BC = 2m, therefore BC ≤ 242)D 1 : first value to writeD m : last value to write.RESPONSE:SN 23 BC D 1 D n1 byte 1 byte 1 byte 2 bytes 2 bytesBCD 1D n: number of bytes read – that is, 2n: value of first read word: value of last read word.7.2.5 BIET IDENTIFICATIONTo retrieve in stream access the Basic Device Identification made up of:• Vendor name (Balogh) : item nr 00,• Product code (BIET170) : item nr 01,• Major.Minor revision (Vx.yz) : item nr 02,place the following request:REQUEST (5 bytes):FunctionAccess/scopeSN 43 MEI type code ID2B 0E 01 00Basic Device Identificationin stream accessstarting item for 1 st transaction(one transaction is sufficient to retrieve the 3 character strings)RESPONSE:Where appropriate:following transactionIdentification elementsSN 43 MEI type code conf. ID nb nr leng th value nr leng th value nr leng th value2B 0E 01 01 0 0 03 00 06 BALOGH 01 07 BIET170 02 05 Vx.yzconformity levelFor further information, visit www.modbus.org/specs.php.BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 19subject to modification – Ref: M - BIET 170 – 2.4-EN

7.2.6 ERROR MESSAGEBIET 170When a fault is detected, the slave replaces its usual answer with the following error message:SN DC EC1 byte 1 byte 1 byteDC : required function code increased by 128 (80 h), that is 83 h and 90 h.EC : error code:• 01 : unauthorized function or recipient not ready• 02 : incorrect address (address-field length incompatibility)• 03 : incorrect data• 06 : busy channel• 08 : tag access in progress.For further information, visit www.modbus.org.7.3 STATUS REGISTERS AND TAG ADDRESSING7.3.1 STATUS BYTEThe status byte is made up of the various service bits:bit no.7Descriptionexecution bit: 1 if the request has been executed0 if the request is being executed6 tag battery fault5 tag presence (tag is present if bit = 1)4 fault bit : set to 1 in case of error (defined by bits 0 ... 3)0 to 3 fault no. (valid if bit 4 = 1): refer to the following tableTake the status into account ONLY IF bit 7 equals 1 (operation completed):B7 B6 B5 B4 B3 à B0Execution Battery fault Tag presence General fault Error code0 //////////////////// //////////////////////// ////////////////////// ///////////////////////////////////////////////////////0 ///////////////////////////////////////////////////////11 Fault nibbleex: the value A0 h means that the request was executed and the tag present.Least significant nibble:hexa 3 2 1 0

BIET 1707.3.2 MODBUS/TCP USING DIRECT ADDRESSINGBoth bytes in the Ad field are used to address 64 Kwords:channel 1 : 0 to 7FFD h (32 Kwords)status byte: 7FFE hchannel 2 : 8000 h to FFFD h (32 Kwords) status byte: FFFE h.The address ranges depend on the tag capacity:tag type memory type capacity (bytes) address in words - ch. 1 address in words - ch. 2OF EEPROM 7 0 - 3 h 8000 h - 8003 hOL EEPROM 2 0 h 8000 hOMA (D) internal FRAM 64 400 h - 41F h 8400 h - 841F hOMA (D) 2Kexternal FRAMinternal FRAM2 K640 - 3FF h400 h - 41F h8000 h - 83FF h8400 h - 841F hOMA (D) 8Kinternal FRAMexternal FRAM648 K400 h - 41F h1000 h - 1FFF h8400 h - 841F h9000 h - 9FFF hOMX FRAM 8 K 0 - FFF h 8000 h - 8FFF hOMX FRAM 32 K 0 - 3FFF h 8000 h - BFFF hOIR, OIB RAM 64 K 0 - 7FFE h 8000 h - FFFE hGIE FRAM 512 0 - FF h 8000 h - 80FF hGIE FRAM 2 K 0 - 3FF h 8000 h - 83FF hGIE FRAM 8 K 1000 h - 1FFF h 9000 h - 9FFF hF#/32 EEPROM 32 bits / 5 0 - 2 h 8000 h - 8002 hE#/116EEPROM64 accessible perblock of 40 - 1F h (reading)6 h - 25 h (writing)8000 h - 801F h (reading)8006 h - 8025 h (writing)TAIEEPROM48 accessible perblock of 48 - 1E h and even 8008 - 801E h and evenTAFFRAM2 k access. perblock of 80 - 3E6 hmultiple of 48000 - 83E6 hmultiple of 47.3.3 MODBUS/TCP USING INDIRECT ADDRESSINGSome client software products or some PLCs cannot address beyond 9 999 dec.The Ad field is filled in with an register address (Register-based tag mapping).Available addresses are split up like this:Channel 1Channel 2PLC register nr Address Tag word addressR40001 0000 h 0000 dec 0000 dec: : : :R45000 1387 h 4 999 dec 4 999 decR45001 1388 h 5 000 dec 0000 dec: : : :R49997 270C h 9 996 dec 4 996 decPLC register nr Register address LSBChannel 1 status R49998 270D h 9 997 dec statusChannel 2 status R49999 270E h 9 998 dec statusTags storing more than 8 Kbytes cannot be addressed entirely.BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 21subject to modification – Ref: M - BIET 170 – 2.4-EN

BIET 1708 USING THE SPECIALTY MESSAGING PROTOCOL8.1 GENERALThe specialty protocol is based upon a client – server type dialogue through TCP sockets: the portnumber is 2001. A socket connection must be created, opened and managed for each channel.Therefore each channel must have its own dedicated socket.A socket can manage a maximum of 10 socket connections. If more than ten connections areestablished the MOD led blinks red (till the number is 10 or less). In consequence a maximum of 5clients are allowed to connect.A request is addressed to a single channel at a time.The dialogue is initialised by sending a Reset request on both channels.Once the connection is established, each server status change (e.g. a tag entering or leaving thetransmission zone of the R/W head) provides unsolicited automatic forwarding of a report to theclient (no polling is needed).It is not advisable that several clients put requests to the same channel unless they inform oneanother about the channel use.The maximum number of bytes to read or write is 8 Kbytes per operation.The general format of the request frames is as follows:0 FC 0 channel no. N Ad not used T D 1 D N2 bytes 2 bytes 2 bytes 2 bytesnumber of bytesto read or writewhere appropriate01h : channel 1 data address if operation with wait, T=002h : channel 2 in tag otherwise, T= time out (ms) x 10Function code: execution aborted: error code 15.01 h : writing n consecutive bytes,02 h : reading n consecutive bytes,04 h : filling in an area with the same value,05 h : resetting one channel (e.g. to cancel a command being executed on this channel)08h : power on/off an R/W head.The general format of response and status frames is:FC status 0 channel no. D 1 D Nread only (read data)CF = 0 for an unsolicited event-triggered report; CF echoes the function code in the response to a request.It is possible to know at any time the number of active connections.For this purpose, open in the PC browser the html page Current Params (refer to paragraph 5.2).Update it using the embedded function ‘Refresh this page’:BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 22subject to modification – Ref: M - BIET 170 – 2.4-EN

BIET 1708.2 IMPLEMENTED FUNCTIONS8.2.1 WRITING N BYTESREQUEST:0 1 0 channel no. N Ad 0000 T D 1 D N8.2.2 READING N BYTESREQUEST (12 bytes):0 2 0 channel no. N Ad 0000 T8.2.3 FILLING IN AN AREA WITH THE SAME VALUEREQUEST (12 bytes):0 4 0 channel no. N Ad D T8.2.4 CHANNEL RESETREQUEST(12 bytes):0 5 0 channel no. 0000 0000 0000 00008.2.5 POWERING ON/OFF AN R/W HEADPOWER-ON REQUEST (12 bytes):0 8 0 channel no. 0000 0000 FFFF 0000POWER-OFF REQUEST (12 bytes):0 8 0 channel no. 0000 0000 0000 00008.3 STATUS BYTEThe status byte is made up of the various service bits:bit no.7Descriptionexecution bit: 1 if the request has been executed0 if the request is being executed6 tag battery fault5 tag presence (tag is present if bit = 1)4 fault bit : set to 1 in case of error (defined by bits 0 ... 3)0 to 3 fault no. (valid if bit 4 = 1): refer to the following tableTake the status into account ONLY IF bit 7 equals 1 (operation completed):B7 B6 B5 B4 B3 à B0Execution Battery fault Tag presence General fault Error code0 //////////////////// //////////////////////// ////////////////////// ///////////////////////////////////////////////////////0 ///////////////////////////////////////////////////////11 Fault nibblep 23BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEsubject to modification – Ref: M - BIET 170 – 2.4-EN

BIET 170ex: the value A0 h means that the request was executed and the tag present.Fault nibble:hexa 3 2 1 0

BIET 170Click onto Send to place a request; the next screen is:Click onto the button >> to expand the dialogue box:Tick the box Binary data preceded by “\”: the frames can then typed in hex with “\” to separate thebytes.Click onto Send to launch the request: the EXE led related to the selected channel lights till therequest is completed.Click onto Close: the request is logged in the history box (first screenshot).BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 25subject to modification – Ref: M - BIET 170 – 2.4-EN

BIET 1708.5 TAG ADDRESS RANGEStag type memory type capacity (bytes) adress in bytesOF EEPROM 7 0 - 6 hOL EEPROM 2 0 - 1 hOMA (D) internal FRAM 64 800 h - 83F hOMA (D) 2Kexternal FRAMinternal FRAM2 K640 - 7FF h800 h - 83F hOMA (D) 8Kinternal FRAMexternal FRAM648 K800 h - 83F h2000 h - 3FFF hOMX 931 FRAM 8 K 0 - 1FFF hOMX 931 FRAM 32 K 0 - 7FFF hOIR, OIB RAM 64 K 0 - FFFD hGIE FRAM 512 0 - 1FF hGIE FRAM 2 K 0 - 7FF hGIE FRAM 8 K 2000 h - 3FFF hFE ou FA EEPROM 32 bits / 5 0 - 4 hEE ou EAEEPROM64 accessible perblock of 40 - 3F h (reading)C h - 4C h (writing)TAIEEPROM48 accessible perblock of 410 - 2F hmultiple of 4TAFFRAM2 k accessible perblock of 80 - 7CF hmultiple of 8BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 26subject to modification – Ref: M - BIET 170 – 2.4-EN

BIET 1709 FAULT LOCATIONUse a PC connected to the local Ethernet network; the http protocol gives access to countersintended for fault location:and also• open the browser,• type the IP address of the BIET: a home page is displayed,• click "BIET170 Troubleshooting": a html page shows dynamically a table of variouscounters featuring for both channels since their last reset: the number of detected tags,the number of operations achieved on tags,the number of detected errors (overall, then according to the error type),the hexa code of the last error (LSNibble of the last status byte indicating an error),the hexa code of the current status byte,the bit Operation in progress (visualized by led EXE),the current step nr (internal process).Update it using the embedded function ‘Refresh this page’:Least significant status nibble is interpreted like this:hexa 3 2 1 0

BIET 170Appendix: example of Ethernet architecturetrunk line 100 Mbit/sPLClocal clientsegment 2segment 1Router *Hub 10 Mbit/s192.168.0.1192.168.0.2Subnetnr 1192.168.1.1Subnetnr 2Hub 100 Mbit/s192.168.1.2Internetnetworkdistant clientweb server* erroneously referred to as “gateway”Max. segment length: 100 mMax. number of stations per segment: 254Max. length of a hub - BIET link: straight part : 90 m, patch : 10 m.Connections to the four BIETs are possible only if the local client IP address block is appropriate –that is, in this example:• IP address: 192.168.0.X,• Subnet mask: 255.255.255.0,• Gateway: router address.BALOGH SA, 189 rue d’Aubervilliers C.P. 97 75886 PARIS Cedex 18 FRANCEp 28subject to modification – Ref: M - BIET 170 – 2.4-EN