Page 1
SIMATIC TI500/TI505 TIWAY 1 Gateway User Manual Order Number PPX:TIWAY-8104-02 Manual Assembly Number: 2587871-0004 Second Edition...
Page 2
Technical data is subject to change. contents is not permitted without express consent of Siemens Industrial Automation, Inc. All rights, including rights We check the contents of every manual for accuracy at the created by patent grant or registration of a utility model or time it is approved for printing;...
Page 3
MANUAL PUBLICATION HISTORY SIMATIC TI500/TI505 TIWAY I Gateway User Manual Order Manual Number: PPX:TIWAY–8104–2 Refer to this history in all correspondence and/or discussion about this manual. Event Date Description Original Issue 09/85 Original Issue (2491964–0001) Second Edition 09/92 Second Edition (2491964–0002)
Page 4
LIST OF EFFECTIVE PAGES Pages Description Pages Description Cover/Copyright Second History/Effective Pages Second iii — x Second 1-1 — 1-4 Second 2-1 — 2-12 Second 3-1 — 3-14 Second A-1 — A-4 Second B-1 — B-3 Second C-1 — C-28 Second D-1 —...
Page 8
List of Figures TIWAY I Gateway as Interface Between PLC Network and Host System ... . . TIWAY I Gateway ..............Basic Installation and Set-up Steps .
Page 9
C-26 Write Multiple Coils Example — Request ......... . C-23 C-27 Coil Bit Pattern...
Page 10
List of Tables TIWAY I Gateway Models ............Data Transmission Rates Supported .
Preface Purpose of this This manual describes the basic features, operation, and installation of the Manual TIWAY I Gateway . The Gateway provides an interface between the SIMATIC TIWAY I network and a distributed control system host using Modbus protocol. The TIWAY I Gateway translates Modbus commands from a host into the TIWAY I protocol format.
Page 12
Related Manuals The information in this manual is supplemented by the following Siemens manuals. You may find it helpful to refer to these or other related manuals when using the TIWAY I Gateway. TIWAY I Systems Manual (2587871–0001) TIWAY I Series 505 Network Interface User’s Manual (2587871–0053)
Introduction The Gateway The TIWAY I Gateway allows a TIWAY I network of PLCs to be hosted by a Interface Modbus-compatible host system. Figure 1-1 shows the relationship of the Gateway to one of several possible Modbus-compatible host systems. Distributed Control The Foxboro SPECTRUM, Fisher PROVOX, and Honeywell TDC 2000 are Systems distributed control systems which have interfaces to PLCs.
Basic Operating Features Interface Ports Two interface ports are located on the bottom of the TIWAY I Gateway unit. The AC power connections are also located on the bottom, covered by a protective plate. (See Figure 1-2.) Host: an RS-232-C host interface port (25-pin female D-shell connector) TIWAY I: the network port (9-pin female D-shell connector) The host system is connected by cable to the host interface on the Gateway.
Basic Operating Features (continued) Translating The Gateway provides protocol and electrical interface conversion. A Commands command issued by the host system is transmitted to the Gateway. Once it between Host and receives the command, the Gateway converts the protocol and electrical PLC Network signals and then relays the command to the PLC which was addressed.
Page 17
Chapter 2 Network Installation TIWAY I Network and Gateway Installation Checklist ......Quick Reference Installation Steps .
TIWAY I Network and Gateway Installation Checklist Quick Reference Figure 2-1 is a quick reference list of steps to be taken when installing the Installation Steps TIWAY I Gateway. Refer to Chapter 3 for specific procedures and cautions. Attach AC power cable to the Gateway. Run diagnostic tests.
Basic Installation Some basic procedures to follow when installing a Gateway system include Procedures the following. Be sure you have all components necessary to install the Gateway and the network cables. (Refer to the checklist below for required parts.) Install the TIWAY I network and host system interface cables (see Section 2.2).
Network Media Installation — Local Line Overview TIWAY I is a multi-drop communications network. It consists of a main trunk cable (the “spine”) and dropline cables. The network can connect up to 248 secondaries to a host computer. NOTE: Although addresses can range from 1 to 254 on TIWAY I, addresses 248 through 254 cannot be used because of the limitations of the Modbus protocol.
TIWAY I Network The TIWAY I network cable consists of a main cable or spine with droplines Characteristics or taps for each secondary. The maximum main line cable length, cable type, tap length, tap spacing, number of secondaries, and maximum baud rates are interrelated network variables and have a direct influence upon network performance.
TIWAY I network. One tap housing is provided with each Gateway Local Line connection. Siemens NETWORK TAP HOUSING MODEL 500–5606 ASSY 2702766–0001 Siemens Industrial Automation, Inc. Top cover removed to show cable connections. I000000 Figure 2-3 TIWAY I Tap Housing Network Installation...
Local Line network spine. Belden 9271 or its equivalent should be used for the dropline. Brands other than those listed here will be specified by Siemens upon request. Important Planning Some major points to consider during the planning phase of a Local Line Considerations network are the following.
Network Media Installation — Local Line (continued) Local Line Tap Local Line networks must adhere to specific tap spacing requirements to Spacing Rules maintain signal integrity. These requirements are outlined in the following sections. 50 min 50 min I000000 Figure 2-5 Basic Tap Spacing Rules Basic The rules for determining the correct distances between taps exist simply Considerations...
36 max Double Drop Drop lines less than 36 inches can be ignored. 50 min I000000 Figure 2-6 Additional Tap Spacing Rules Double Drops If a tap cable is installed less than the minimum distance as stated in the primary rule, then the two drops, the previous one and the one being installed, are considered a double drop.
Network Media Installation — Local Line (continued) Cable Routing Cable routing should be planned as if the path between all stations on the network were free of obstructions. The next step is to modify the first routing to account for obstructions, then calculate the amount of cable needed.
Some disadvantages are the following. Is is impractical for buildings without drop ceilings Working in high ceilings can be hazardous Ceilings often collect dust and other debris Surface ducting — Surface ducting for network cabling is usually installed along the baseboards or is attached to walls at desktop height. While surface ducting ordinarily protects cables from both physical and EMI effects, it may also require that network computing devices be positioned near a wall.
Network Media Installation — RS-232-C Modem Interface Data Transmission The physical layer in TIWAY I provides a modem interface for synchronous Characteristics or asynchronous communications at data transmission rates up to 115.2 K bps. The modem interface provides standard signals for control of two-way alternate data transmission using both half and full duplex modems.
Page 29
Chapter 3 Gateway Installation and Configuration Installing the TIWAY I Gateway ........... Basic Mounting Guidelines .
0 to 60 C. You can also mount the Gateway in a 19-inch rack. A rack mount kit is available from Siemens with the following order numbers. (Refer to the Installation Guide shipped with each rack mount kit.) PPX:500–7205 —...
Power Connections After mounting the unit in an appropriate location, follow these steps for and Initialization connecting the power supply and running diagnostic tests. Remove the shield covering the three AC terminals (Line, Ground, and Neutral). With power off, attach all three connections according to Figure 3-2 and then replace the shield.
Page 32
Installing the TIWAY I Gateway (continued) Run the user-initiated test. (Refer to the Diagnostics Tests section.) Remove loopback connector. Set the Online/Offline switch on the Gateway to the ONLINE position. Connect the Local Line or RS-232 interface cable to the TIWAY I port. 10.
GATEWAY GOOD COMM ACTIVE ONLINE TIWAY I Gateway shown with switch access cover open RECEIVE TRANSMIT TEST MODE Reset Self-Test Online Online/Offline Offline Network Port Configuration Dipswitches Host Port Configuration Dipswitches Dipswitches for Network and Host Ports NETWORK HOST NETWORK Port Baud Rate Settings Baud Rate Settings Switches...
Dipswitch Configuration and Function Overview Two banks of dipswitches are located behind the access cover on the front of the Gateway. One is for the host port and the other is for the network port. The following sections define the switches and describe the effect they have on the Gateway’s operation.
Dipswitch Settings The 8-switch bank governs the host interface. The following paragraphs for the Host describe the switch-selectable options for setting the host interface Interface Port parameters. Data Transmission Rate Selection (Switches 1 through 4): For the host port, Table 3-3 shows what data transmission rates are supported on the listed host systems.
Dipswitch Configuration and Function (continued) Dipswitch Settings The 10-dipswitch bank governs the network communications port. The for the Network following paragraphs describe the switch-selectable options available for the Interface Port network port. Data Transmission Rate Selection (Switches 1 through 4): The TIWAY I network supports the following data transmission rates: 110, 150, 300, 600, 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115,200 bits per second.
Page 37
Full/Half Duplex Operation (Switch 6): the Full/Half Duplex switch selects operation compatible with full or half-duplex modems even though communication with the Gateway is half-duplex only. When you select Half-duplex operation, the Gateway does not activate the Request to Send circuit before Data Carrier Detect becomes inactive.
Switches and Indicator Lights Reset Self-Test Online Online/Offline Offline I000000 Figure 3-5 Gateway Operation Switches Online/Offline The Online/Offline switch, when placed in the Online position, allows the Switch Gateway to communicate with the network and the other systems connected to the Gateway. In the Offline position, the Gateway is disconnected from the network.
GATEWAY GOOD ON = All tests passed successfully COMM ACTIVE ON = Communication in progress ONLINE ON = Communicating with network RECEIVE ON = Receiving data TRANSMIT ON = Transmitting data TEST MODE ON = In test mode (test button pressed) Flashing = Tests completed successfully I000000 Figure 3-6 Indicator Lights...
Diagnostic Tests Built-In Diagnostic The Gateway has five levels of built-in tests, three of which are designed for Tests the user. Power-on test Operational Diagnostic test User-initiated test Burn-in test Used only in quality assurance tests by Final test manufacturer Power-On Test The Power-on test executes the initialization routine following a master reset.
User-Initiated Test You should run the user-initiated test only when the Gateway is in Off-line mode (that is, when the On-line/Off-line switch is in the OFFLINE position). Normal Gateway operation is suspended during this test mode. NOTE: Before initiating the diagnostic routine, make sure that the network and host computer cables are disconnected from the Gateway, and that the Gateway is in off-line mode.
If these indicators are still not on, contact your Siemens Industrial Automation, Inc. distributor for assistance. ON = CPU board tests passed GATEWAY GOOD...
Corresponding Data Types This appendix provides information on which Siemens PLCs are supported by the Gateway, and how SIMATIC TI data types correspond to those of the host systems. Also included in this appendix are a list of features added to the latest release of the Gateway and a list of hardware specifications.
SIMATIC TI PLCs Supported by TIWAY I Gateway Table A-2 shows all the PLCs supported by the TIWAY I Gateway and lists the maximum number of discrete points, V-memory locations, and word input memory locations which are accessible from the Gateway. Table A-2 SIMATIC TI PLCs Supported and Accessible Data SIMATIC TI Discrete Points...
TIWAY I Gateway Specifications Table A-3 TIWAY I Gateway Features TIWAY I Gateway Features Before Rel. 1.3 Release 1.3 User-defined commands for IDT products Message resynchronization after timeout Selectable coil type (Y or C) IDT data addressing scheme Command support: Read inputs Read outputs Read holding register...
System Configuration It is extremely important to keep complete, up-to-date records on system configuration. This appendix provides some sample record-keeping forms for use with a TIWAY I Gateway system. Table B-1 System Configuration Form Reference PLC Type & NIM Base/Slot Block # Status Word V Offset...
V-Memory Offset Tables Table B-2 V-Memory Offset Table (Resident Information) PLC # Base/Slot # Number of Words V Offset Word # Moved From Word/Image Register Comments Table B-3 V-Memory Offset Table (Received Information) PLC # Base/Slot # Number of Words V Offset Word # Moved To...
Modbus Protocol Overview This appendix describes the Modbus protocol in detail. For each of the Modbus functions described, examples of requests and responses are given. Table C-1 describes the Modbus functions supported by the Gateway. Table C-1 Modbus Functions Supported Code Type Description...
Message The start and finish of a message is determined by timing in RTU mode. Delineation Any time longer than 3.5 character lengths marks the end of a transmission. The next character after that would then mark the start of the next message.
Modbus Protocol Overview (continued) Invalid Characters The Gateway ignores messages that contain invalid characters. Messages and Messages containing the following errors will also be ignored. Incorrect checksum Parity error Framing errors Incomplete transmission Modbus Functions This section outlines some of the differences between Modbus and TIWAY I network commands.
Terminology is another area in which differences occur. Some of the differences in terms are given in Table C-3. Table C-3 Terminology Differences Modbus-based PLCs SIMATIC TI PLCs Coil Discrete output (Y) or Control Relay (C) Input Register Word Image Register (WX/WY) Holding Register Variable Memory (V-memory) Slave...
Modbus Function Descriptions Introduction In the descriptions that follow, each function starts on a separate page and includes the TIWAY primitive sent to the secondary in square brackets. For each function, an example of request and response is given. Code 01 — Read Code 01 enables the user to read the On/Off values of logic coils.
Response: 07 01 01 1A XXXX Checksum (XXXX) Data (1A) Number of bytes (01) Function code (01) Slave address (07) I000000 Figure C-4 Read Coil Status Example — Response The response returns in the data field a single byte (1A) which contains the 1’s or 0’s for the 5 coils, packed out with zeros for the three high bits.
Modbus Function Descriptions (continued) Code 02 — Read Code 02 allows the application to read a series of discrete inputs. The Input Status command includes the start address and the number of points to be read. Addressing is sequential up to the maximum memory size for a particular PLC.
The response returns in the data field a single byte (1A) containing the 1’s or 0’s for the 5 discrete inputs, packed out with zeros for the three high bits. 1A = 0 0 0 1 1 0 1 0 Input 0A (OFF) Input 0B (ON) Input 0C (OFF)
Modbus Function Descriptions (continued) Code 03 — Read Code 03 allows you to read the contents of holding registers in the attached Output Registers secondary device. The data field of this command includes the start address of the registers and the number of registers to be read. Addressing is sequential up to the maximum memory size for a particular PLC.
Code 04 — Read Code 04 allows you to read the contents of input registers in the attached Input Registers PLC. These registers hold the values returned by the I/O devices. The data field of this command includes the start address of the registers and the number of registers to be read.
Modbus Function Descriptions (continued) Code 05 — Write a Code 05 allows a designated coil [discrete output Y or C, depending on the Single Coil position of Switch 10 on the network dipswitches] to be written. Depending on the code passed in the data field, it can be changed to On (1) or Off (0), forced On or Off, or unforced.
Response: 07 05 0064 FF00 XXXX Checksum (XXXX) OFF/ON code (FF00 = ON) Coil address (0064) Function code (05) Slave address (07) I000000 Figure C-14 Read Input Register Example — Response The response to Function Code 05 is to return the request as received. In the case of a broadcast request, there is no response.
Modbus Function Descriptions (continued) Code 06 — Write a Code 06 allows the contents of a holding register to be changed. Addressing Single Register is sequential up to the maximum memory size for a particular PLC. This function is limited to integer values contained in V-memory. The Gateway will also direct any broadcast address (00) to all attached secondaries.
Code 07 — Read Code 07 instructs the Gateway to read 8 predefined Cs within a secondary. Exception Status This implementation will read the first 8 Cs in the discrete image register in a secondary and pack them into one data byte. NOTE: The programmer of a non-Modbus PLC must make certain that the application program running within the PLC will place meaningful data in these locations.
Modbus Function Descriptions (continued) The response shows that 3B (hex) has been returned. If the individual bits are examined, they indicate the status of each bit. Coils 3B (hex) Coil 1 (ON) Coil 2 (ON) Coil 3 (OFF) Coil 4 (ON Coil 5 (ON) Coil 6 (ON) Coil 7 (OFF)
Code 08 — Code 08 enables diagnostic information to be retrieved to conduct network Execute testing. This function does not affect the operation of the PLC. Diagnostics Example: Request: 02 08 0000 B405 XXXX Checksum (XXXX) Information Field (B405) Diagnostic code (0000) Function code (08) Slave address (02) I000000...
Modbus Function Descriptions (continued) Table C-4 details the diagnostic codes supported. Table C-4 Diagnostic Codes Supported Code Diagnostic Description Is Code (hex) Supported? Return request message Restart communications with the slave Return diagnostics register Change message end character Set slave in listen only mode Clear counters and diagnostics Return message count Return checksum error count...
Page 68
The diagnostics codes supported are described in the following paragraphs. Diagnostic Code — 00 0000 | any data Information frame Diagnostic code I000000 When Function Code 08 uses diagnostic code 0000, any data passed in the information field is returned to the host computer by the Gateway. The Gateway will send Primitive 02 to the secondary.
Modbus Function Descriptions (continued) Code 11 — Get Code 11 returns a 2-byte status word and an associated 2-byte event Comms Event counter. The status word is defined in the Modbus Protocol Reference Counter Specification as being 0 for no command in progress and FFFF if a previous command is in progress.
Code 12 — Get Code 12 returns the same information as Function Code 11 plus a message Comms Event Log count and an additional 64-event byte. This means that a 2-byte status word, a 2-byte event counter, a message count, and the most recent 64 events are returned.
Modbus Function Descriptions (continued) Table C-5 Event Byte Types Event Byte Bit Definitions Slave Bus Receive. Byte Bit 0 – Reserved stored on receipt of message Bit 1 – Set if communications error Bit 2 – Reserved Bit 3 – Reserved Bit 4 –...
Code 15 — Write Code 15 allows the host computer to write multiple coils. When this Multiple Coils command is given, successive coils are changed, by an associated bit pattern, to the indicated state; where each bit indicates: 1 = ON 0 = OFF Addressing is sequential up to the maximum memory size for a particular secondary.
Code 16 — Write Code 16 allows the host computer to write multiple values into successive Multiple Registers registers. Addressing is sequential up to the maximum memory size for a particular PLC. The maximum number of registers that can be addressed with one command is 100.
User-Defined Modbus Commands There are three user-defined commands implemented in the TIWAY I Gateway. These commands, described below, allow the Gateway to work with the IDT operator interface family of products. Command 65 — This command permits the collection of Control Relay (C) data. The format Read C Memory of the command is as follows.
Command 66 — This command permits the collection of constant (K) memory. The formats of Read K Memory the command and response are as follows. Request: aa 42 llll nnnn XXXX Checksum (XXXX) Number of locations to collect (nnnn) Starting location to collect from (llll) Command 66 (42 hex) Address (aa) I000000...
Error Responses Errors such as illegal addressing or failure of communications with a PLC are reported by exception responses. Exception responses replace the expected response to a request and are recognized by the returned Function Code with the top bit set high (see example in Figure C-37). Request: Address Function...
Page 78
Appendix D Configuring the PLC for Fisher PROVOX Considerations for Configuring a TIWAY I/PROVOX System ......PLC Configuration Requirements .
Considerations for Configuring a TIWAY I/PROVOX System PLC Configuration To configure the PLC to operate with the Fisher PROVOX Programmable Requirements Controller Interface Unit (PCIU), you need to consider the following restrictions and requirements. A maximum of eight PLCs can be networked with each PCIU on a PROVOX system.
PLC Programming Considerations Blocking Network The restrictions on data types and numbers of contiguous data blocks that Data can be accessed by a PCIU influence the design of the PLC programs to be used in a PROVOX environment. To increase the number of secondaries that can be supported by a single PCIU, you should group together the data to be read by the network into a single contiguous block.
PLC Programming Example Data to be Assume that you have several Series 500 or Series 505 PLCs and PM550 Accessed PLCs which need to be attached to a PROVOX system. You need to access the following data from each PLC in the network. Table D-1 PLC Data to be Accessed Series 500/505 PLCs PM550 PLCs...
The V-memory block now has 9 data words (plus the status register) in each PLC. From the 64-register limit, you would calculate that there could be a maximum of 7 PLCs (64/9 = 7) configured like this and connected to a single PCIU.
Page 83
PLC Programming Example (continued) BITP 4 A: STW1 N = 14 BITP 5 A: STW1 N = 15 BITP 6 A: STW1 N = 16 Copy STW01 from Image Register to V200 (status register) MIRW 7 IR = C3 A: V200 N = 7 Copy Y1–Y16 to V201 MIRW...
Page 84
Y803 Y804 Y805 Copy discrete values written via network to C29–C32 Y806 Y807 Y808 Copy discrete points to V202 MIRW 1 IR = Y800 A: V202 N = 9 Copy V14–V16 to V203–V205 MOVW 2 A: V14 B: V203 N = 3 Copy WX17 to V206 MOVW 3 A: WX17...
Page 85
PLC Programming Example (continued) II. PM550 Example Program (cont’d) Configuring the PLC for Fisher PROVOX TIWAY I Gateway User Manual...
Page 86
PLC Programming Example (continued) Y247 CR30 Y248 CR31 Copy discrete points to V202 C224 Copy V13-V15 to V203-V205 V203 V204 V205 Copy A101 to V206 A101 V206 Copy C100 to V207 C100 V207 Copy value written via network to V50 V208 (cont’d) TIWAY I Gateway User Manual...
Page 88
SPECIAL FUNCTION 15 I/O MOVE START ADDRESS: C220 NEXT ADDRESS: C224 ERROR OUTPUT? ..........ERROR OUTPUT DESIGNATOR: .
Page 89
Index Distributed control systems, ix, 1-2 AC power connections, 1-3, 3-3 Double drop taps, 2-9 Addressing, limits, C-5 Error responses, C-28 Baud rates, 3-4–3-8 Exception responses, C-28 Bracket locations, 3-2 Burn-in test, 3-14 Features, Gateway Release 1.3, A-4 Cable routing in ceiling, 2-10 surface ducting, 2-11 under floor, 2-10...
Page 90
Local Line Pin assignments cable characteristics, 2-4 local line connector, 2-4 cable routing, 2-10 RS-232-C interface, 2-12 hardware components, 2-6 PLC configuration installation, 2-4–2-11 programming, D-3 tap housing, 2-6 requirements, D-2 tap spacing, 2-8–2-9 terminating, 2-7 PLC programming, example, D-4–D-11 Loopback Power connections, 3-3 connections, 3-13...
Page 91
Tap housing, 2-6 Terminating, main line cable, 2-7 Test mode indicator, 3-11 Test/operate switch, 3-9 Transmit indicator, 3-11 Twisted-pair cable, 2-7 User-initiated test, 3-13 V-memory, offset tables, B-3 Y/C coil selection switch, 3-9 Index-3...
Page 93
Customer Registration We would like to know what you think about our user manuals so that we can serve you better. How would you rate the quality of our manuals? Excellent Good Fair Poor Accuracy Organization Clarity Completeness Overall design Size Index Would you be interested in giving us more detailed comments about our manuals?
Page 94
IN THE UNITED STATES BUSINESS REPLY MAIL PERMIT NO.3 FIRST CLASS JOHNSON CITY, TN POSTAGE WILL BE PAID BY ADDRESSEE SIEMENS INDUSTRIAL AUTOMATION, INC. 3000 BILL GARLAND RD. P.O. BOX 1255 JOHNSON CITY TN 37605–1255 ATTN: Technical Communications M/S 3519 FOLD...