FIELDBUS APPENDIX

ANYBUS-S ETHERNET
MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91

HMS INDUSTRIAL NETWORKS AB PHONE: +46 35 17 29 00

PIELEFELTSGATAN 93 - 95 FAX: +46 35 17 29 09
S - 302 50 HALMSTAD e-mail: [email protected]
SWEDEN web: www.hms.se
FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

Revision notes

Index Date Chapter Author Revision Notes

1 1999-10-20 - JPa 0.80 Created
2 1999-10-29 - JPa 0.81 Changed mailbox command numbers
3 1999-11-09 - JPa 0.82 Changed configuration methods
4 2000-01-04 - JPa 0.83 Minor changes, added some mailbox messages
5 2000-01-19 - JPa 0.84 Added mailbox error code “Can’t send more” and
“Socket Data Available flag” in the fieldbus specific
area
6 2000-02-03 - JPa 1.00 Added electrical specification
7 2000- All TTh 1.90 Transferred to FrameMaker
8 2001-07-31 2, 8 Edk 1.91 Added drawings

Preface
The data and illustrations found in this manual are not binding. We reserve the right to modify our products in line
with our policy of continuous product development. The information in this manual is subject to change without
notice and should not be considered as a commitment by HMS Industrial Networks AB.

HMS Industrial Networks AB assumes no responsibility for any errors that may appear in this document.

The product and technology described in this document is patented or patent pending in the following countries:
USA, Canada, Japan, Belgium, Denmark, Finland, France, Greece, Ireland, Italy, Luxemburg, Monaco, Netherlands,
Portugal, Switzerland, Lichtenstein, Spain, United Kingdom, Sweden, Germany, Austria and others.

ANYBUS is a registered trademark of HMS Industrial Networks AB.

All other trademarks are the property of their respective holders.

HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

Table of contents
1 Fieldbus introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1 Introduction to Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 Network overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.3 Technical features for Ethernet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.4 Modbus/TCP conformance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.5 Related documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2 Module overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.1 Functional overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2 Mechanical overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.3 Application interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.3.1 Dual-Port RAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.3.2 Asynchronous interface (not yet available) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.3.3 AnyBus Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
3 Installation and configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.1 Fieldbus connector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.1.1 RJ45 connector. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.1.2 2 mm connector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.1.3 D-SUB connector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2.1 Node address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2.2 Termination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.3 LED indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
4 Functions and operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4.1 Memory structure for the AnyBus-S Ethernet module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4.1.1 IN area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4.1.2 OUT area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4.1.3 Control area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4.1.4 Fieldbus specific area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
4.2 Initialisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.2.1 Use default settings + DIP switches. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.2.2 Send mailbox message SET_ETN_CONFIG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.2.3 Load configuration from FLASH. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.2.4 Configuration chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.3 Data exchange. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
5 Mailbox interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
5.1 Fieldbus specific mailbox messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
5.1.1 Set Ethernet configuration (SET_ETN_CONFIG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
5.1.2 Read Ethernet configuration (READ_ETN_CONFIG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
5.1.3 Connect timeout (CONNECT_TIMEOUT). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
5.1.4 Disable web server configuration (DISABLE_WEB_CONFIG) . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5.1.5 Enable web server configuration (ENABLE_WEB_CONFIG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.1.6 Modbus Connection Timeout (MB_CONN_TIMEOUT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
5.1.7 Disable Modbus/TCP server (DISABLE_MB_TCP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
5.1.8 Write exception status (WR_EXP_STAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
5.2 Transparent mailbox interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5.2.1 Socket (SOCKET) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
5.2.2 Listen (LISTEN) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
5.2.3 Connect (CONNECT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

HMS INDUSTRIAL NETWORKS AB 1

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.4 Send (SEND) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

5.2.5 Receive (RECV) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.2.6 Send To (SEND_TO). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.2.7 Receive from (RECV_FROM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.2.8 Close (CLOSE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
5.2.9 Send Fragment (SEND_FRAG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
5.2.10 Receive Fragment (RECV_FRAG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
5.3 Fault information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
6 Fieldbus specific tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.1 Supported Modbus commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.2 Exception codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
7 Electrical specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
7.1 Current consumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
8 Mechanical specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
8.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
8.2 Mechanical drawings in this manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
9 List of figures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
10 List of tables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

2 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

1 Fieldbus introduction
This section provides information about the Ethernet network. and the Modbus/TCP protocol.

1.1 Introduction to Ethernet

Ethernet is one of the most popular network technologies in use today. The major reasons for Ethernet’s popularity it
a suitable mix of speed, cost and ease of installation. These benefits, the market acceptance, and the possibility to
support, more or less, any non-real-time critical protocol, makes the Ethernet an ideal networking technology for
most systems.

More information, as well as links can be found at the web site ‘www.industrialethernet.com’ .

1.2 Network overview

A standard Ethernet installation today uses a bit rate of 10 Mbps on a dual, twisted-pair, non-shielded copper wire.
This type of cable works well in office environments, but for industrial wiring well-shielded cables is highly rec-
comended. Ethernet only specifies the lower layers in the network, so additional protocols like TCP/IP together with
Modbus/TCP is needed to form an environment that is more easy to use.

1.3 Technical features for Ethernet

A standard 10BASE-T network allows a maximum cable length of 100 meters. Since every cable is a separate seg-
ment, only two nodes per segment is possible. Repeaters, hubs, routers and switches are used to connect the individ-
ual segments to larger networks.

1.4 Modbus/TCP conformance

The Modbus protocol in the module is conform to the Modbus/TCP specification 1.0.

More information about the Modbus/TCP protocol can be found at the following web page:
‘http://www.modicon.com/openmbus/index.html’

1.5 Related documents

Table 1: Documents related to this manual

Name Description Document number

AnyBus-S Parallel AnyBus-S Design Guide for Parallel Interface ABS-DGP-1.13
Design Guide

HMS INDUSTRIAL NETWORKS AB 3

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

2 Module overview
This section provides an overview of the AnyBus-S Ethernet Modbus/TCP module.

2.1 Functional overview

The module works as a Modbus/TCP server according to the Modbus/TCP specification 1.0. It's possible to use up to
eight Modbus/TCP connections simultaneously. The module supports all the Modbus commands according to class 0
and class 1, and some of the commands in class 2.

For a complete listing of the supported Modbus commands, see Table 65

The modules mailbox interface provides the possibility to transparently send and receive data directly on a socket
level over an Ethernet with both TCP/IP and UDP/IP. This allows the application to use “their own” protocol “on top”
of TCP/IP or UDP/IP.

2.2 Mechanical overview

Application interface

Ethernet connector

Configuration switches

Status LED’S

Figure 1: Mechanical overview

4 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

2.3 Application interface

This section describes the two access methods available from the application side between the AnyBus-S Ethernet
Modbus/TCP module and the application.

• Parallel: Through a Dual Port RAM memory (DPRAM).

• Serial: Through an asynchronous interface (not available yet)

Application side DPRAM 2kB ANYBUS side

IN
512 Byte

OUT
Extended IN
512 Byte
0 - 2048 Byte

Mailbox IN
Alternative 1
288 Byte

Address & Data bus Mailbox OUT

288 Byte

Fieldbus Specific Area

384 Byte
Extended OUT
Control Area 0 - 2048 Byte
62 Byte

Alternative 2 Handshake Registers

RX

TX
SCI To ANYBUS electronics
DE

Figure 2: AnyBus-S access methods

2.3.1 Dual-Port RAM

The easiest way to use the AnyBus-S module is to integrate it into the system microprocessor bus. This is achieved
using the parallel DPRAM interface. All relevant access and handshaking procedures are achieved through this inter-
face. The handshake procedure is used to ensure that there will always be consistent data available on the host appli-
cation side as well as on the fieldbus side. In the handshaking procedure, it will generally be the host side that initiates
the start of the handshaking and the AnyBus-S module will respond to it.

For more information about designing with the Parallel interface, please consult the AnyBus-S Design Guide for par-
allel interface.

2.3.2 Asynchronous interface (not yet available)

The asynchronous serial interface allows the AnyBus-S module to exchange data asynchronously with external
microprocessors. Some applications cannot access the Dual Port RAM via address and data bus, but have a free serial
link. It is therefore possible to operate through the serial interface. The initialisation procedure will be held in a simi-
lar way to the Dual Port RAM solution, except the addresses are different and the telegrams are now sent on a serial
link.

For more information about designing with the serial interface, please consult the AnyBus-S Design Guide for serial
interface.

2.3.3 AnyBus Memory Map

When using Alternative 1 access method (DPRAM), the memory area is a linear data area of 2kByte. When using
version 2 (Serial Interface), the information is located in the same structure but with other addresses and it must be
accessed via serial telegrams.

Note: since different hardware is required for the different interfaces, only one of the above mentioned access methods is possible to use in one
module.

HMS INDUSTRIAL NETWORKS AB 5

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

3 Installation and configuration

3.1 Fieldbus connector
The supported fieldbus connectors are described below.

3.1.1 RJ45 connector

Table 2: RJ45 Ethernet connector

Connector Signal Description

pin
1 TD+ Positive Transmit Data
2 TD- Negative Transmit Data
3 RD+ Positive Receive Data
4 NC No connection
5 NC No connection
6 RD- Negative Receive Data
7 NC No connection
8 NC No connection
Casing PE Protective earth

3.1.2 2 mm connector
Table 3: 10 pin 2 mm Ethernet connector

Connector Signal Description

pin
1 PE Protective earth
2 PE Protective earth
Pin 1 is the pin closest to the corner
3 NC No connection of the card. It has a square-shaped
4 NC No connection soldering pad on the circuit board,
where pins 2-10 have circular sol-
5 TD+ Positive Transmit Data
dering pads. See Figure 12 for
6 TD- Negative Transmit Data more information.
7 RD+ Positive Receive Data
8 NC No connection
9 RD- Negative Receive Data
10 PE Protective earth

6 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

3.1.3 D-SUB connector

Table 4: 9 pin D-SUB Ethernet connector

Connector Signal Description

pin
1 NC No connection
5 4 3 2 1
2 RD- Negative Receive Data
3 TD- Negative Transmit Data
4 NC No connection
5 NC No connection
9 8 7 6
6 NC No connection
7 RD+ Positive Receive Data
8 TD+ Positive Transmit Data
9 NC No connection

Note:
The pin configuration in this connector is unique for this module.
It may not be compatible with other 9-pin D-SUB Ethernet connectors.

3.2 Configuration
3.2.1 Node address
The Ethernet MAC ID is permanent and cannot be changed by the user. The IP-address is configured at the initialisa-
tion of the module. For more information about how to set the IP-address for the module, se chapter 4.2.

3.2.2 Termination
The Ethernet module uses twisted-pair cables, and do not need an external terminator.

3.3 LED indicators

The module is equipped with four bi-color status and indication LED's mounted at the front of the module.

Figure 3: AnyBus-S LED’s, with 90° angle mounting (A), and 180° straight mounting (B).

There is also one additional bi-color Watchdog LED on the AnyBus-S module. The function of the watchdog LED is
the same for all modules, and information about it can be found in the AnyBus-S Design Guide.

Table 5: LED 1 - Link LED

Color Frequency Description

Green Steady on Indicates that the module is connected to an Ethernet network

HMS INDUSTRIAL NETWORKS AB 7

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

Table 6: LED 2 - Status LED

Color Frequency Description

Green 1 Hz Indicates that the used IP address not is set by the values on the dip-
switches.
Red 1 Hz The Ethernet MAC address is not correct. The module will not be
able to initialise. Please contact your supplier.
Red 2 Hz The module failed to load Ethernet configuration from the FLASH.
Red 4 Hz Internal error. Please contact your supplier.

Table 7: LED 3 - Modbus/TCP connection LED

Color Frequency Description

Green - Indicates the number of Modbus/TCP connections that is established
to the module. The LED flashes to indicate the number of connec-
tions.
Ex: If three connections is established then this LED flashes three
times, the led is off for a short period and then the led flashes three
times again, and so on.

Table 8: LED 4 - Activity LED

Color Frequency Description

Green - Flashes from green to off when a packet is received or transmitted.

8 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

4 Functions and operations

4.1 Memory structure for the AnyBus-S Ethernet module
4.1.1 IN area
The IN area, which can be configured to maximum 2048 bytes, can be read by Modbus command 1, 2, 3, 4 and 23. It
is not possible to write data to the IN area from the bus.

Command 1 and 2 uses a bit oriented address information and command 3, 4 and 23 uses word oriented address infor-
mation. To address individual bits within a 16-bit word, add four bits after the LSB in the “word” address to form a
“bit” address. Do note that a bit address nibble value of 0h points to the MSB, while a value of Fh points to the LSB.
E.g, bit 11 in word 123h will be 1234h.

The possible bit and word addresses are described below:

Table 9: IN area word/bit addresses

Word b15 b14 b13 b12 ... b3 b2 b1 b0

address (MSB) (LSB)
0000h 0000h 0001h 0002h 0003h ... 000Ch 000Dh 000Eh 000Fh
0001h 0010h 0011h 0012h 0013h ... 001Ch 001Dh 001Eh 001Fh
… …0h …1h …2h …3h ... …Ch …Dh …Eh …Fh
03FEh 3FE0h 3FE1h 3FE2h 3FE3h ... 3FECh 3FEDh 3FEEh 3FEFh
03FFh 3FF8h 3FF9h 3FFAh 3FFBh ... 3FFCh 3FFDh 3FFEh 3FFFh

4.1.2 OUT area

The OUT area, which can be configured to maximum 2048 byte, can be written to by Modbus commands 5, 6, 15, 16,
22 and 23. The OUT area can be read by the Modbus commands 1, 2, 3, 4, and 23.

Command 1, 2, 5 and 6 uses a bit oriented address information and command 3, 4, 15, 16, 21 and 23 uses word ori-
ented address information. To address individual bits within a 16-bit word, add four bits after the LSB in the “word”
address to form a “bit” address. Do note that a bit address nibble value of 0h points to the MSB, while a value of Fh
points to the LSB. E.g, bit 14 in word 432h will be 4321h.

The possible bit and word addresses are described below:

Table 10: OUT area word/bit addresses

Word b15 b14 b13 b12 ... b3 b2 b1 b0

address (MSB) (LSB)
0400h 4000h 4001h 4002h 4003h ... 400Ch 400Dh 400Eh 400Fh
0401h 4010h 4011h 4012h 4013h ... 401Ch 401Dh 401Eh 401Fh
… …0h …1h …2h …3h ... …Ch …Dh …Eh …Fh
07FEh 7FE0h 7FE1h 7FE2h 7FE3h ... 7FECh 7FEDh 7FEEh 7FEFh
07FFh 7FF8h 7FF9h 7FFAh 7FFBh ... 7FFCh 7FFDh 7FFEh 7FFFh

4.1.3 Control area

The ‘Module Type’ field in the Control area is 0x0080 for an Ethernet Modbus/TCP module.

HMS INDUSTRIAL NETWORKS AB 9

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

4.1.4 Fieldbus specific area

The module can handle 16 sockets simultaneously, which can be accessed with the mailbox interface to send and
receive transparent data over the network. Information about these 16 sockets can be viewed in the fieldbus specific
area.

Note: This does not refers to the Modbus/TCP sockets. They are handled internally by the module, and is not represented in the fieldbus specific
memory area.

Each socket uses 12 bytes of memory. Socket 0 starts on address 640h, socket 1 starts on address 64Ch, socket 2 starts
on address 658h, and so on. The layout of the data, for each socket entry in the memory, can be found in Table 13
below.

Table 11: Socket field base addresses, sockets 0 - 7

No. 00 No. 01 No. 02 No. 03 No. 04 No. 05 No. 06 No. 07

640h 64Ch 658h 664h 670h 67Ch 688h 694h

Table 12: Socket field base addresses, sockets 8 - 15

No. 8 No. 9 No. 10 No. 11 No. 12 No. 13 No. 14 No. 15

6A0h 6ACh 6B8h 6C4h 6D0h 6DCh 6E8h 6F4H

Table 13: Socket field memory layout

Offset Type Contents

0h Byte Socket type
1h Byte Socket status
2h - 3h Word Socket information
4h - 5h Word Local port number
6h - 7h Word Host port number
8h - Bh Long Host IP-address

Socket type R/O

Table 14: Socket type register

Offset Description
b7 b6 b5 b4 b3 b2 b1 b0

0h Socket type

Table 15: Listing of socket type values

Socket type value Description

0x00 No active socket (free to use)
0x01 TCP socket
0x02 UDP socket
0x03 - 0xFF Reserved

10 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

Socket status R/O

Table 16: Socket status register

Offset Description
b7 b6 b5 b4 b3 b2 b1 b0

1h Socket status

Table 17: Listing of socket status values

Socket status value Description

0x00 Not active
0x01 Listening
0x02 Connecting
0x03 Connected
0x04 Connection refused
0x05 Connection timed out
0x06 Connection failed
0x07 - 0xFF Reserved

Note that if a host closes a TCP connection while there is still data available to read on the socket in the client, the cli-
ent socket will be indicated as connected until all data is read. In this case, if the client tries to send data the mailbox
response will report ‘Can’t send more’.

If a socket is listening and a host connects to that socket a new socket will be created in the first free position. The sta-
tus of this socket will be connected and the listening socket will still be listening. This means that multiple hosts can
connect to one listening socket simultaneously.

Socket information R/O

Table 18: Socket information register

Offset Description
b7 b6 b5 b4 b3 b2 b1 b0

2h - - - - - - - - Socket information - high byte

3h - - - - - - - DA Socket information - low byte

Note: Bits 1 - 15 are reserved

Table 19: Data available bit

Bit value Description

0 Data not available
1 Data available

HMS INDUSTRIAL NETWORKS AB 11

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

Local port number R/O

This is the local port number that the socket is associated with.

Table 20: Local port number register

Offset Description
b7 b6 b5 b4 b3 b2 b1 b0

4h Local port number - high byte

5h Local port number - low byte

Host port number R/O

This is the host port number that the socket is associated or connected with.

Table 21: Host port number register

Offset Description
b7 b6 b5 b4 b3 b2 b1 b0

6h Host number port - high byte

7h Host number port - low byte

Host IP-address R/O

This is the host IP-address that the socket is associated with or connected to.

Table 22: Host IP-address register

Offset Description
b7 b6 b5 b4 b3 b2 b1 b0

8h IP-address - MSB
9h
Ah
Bh IP-address - LSB

12 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

4.2 Initialisation
There are three different methods to set the IP-address, subnet mask and gateway address to the module.
1. Use default settings + DIP switches.
2. Send mailbox message SET_ETN_CONFIG.
3. Load configuration from FLASH.

The different methods are described below.

4.2.1 Use default settings + DIP switches

This method is an easy way to configure the module for intranet use. Note that these settings not can be used on the
Internet.

If the DIP switch value is set between 1-255 and the mailbox message SET_ETN_CONFIG not is sent to the module
the default settings below will be used

IP address: 192.168.0.X
Subnet mask: 255.255.255.0
Gateway address: 0.0.0.0

The last byte (X) in the IP address is set between 1-255 with the DIP switch on the module. Switch 1 is the MSB in
the byte, and switch 8 is the LSB. When a switch is in the “On” or “Closed” position, it is interpreted as a logic “1”.

4.2.2 Send mailbox message SET_ETN_CONFIG

If the mailbox message SET_ETN_CONFIG is sent to the module during initialisation the IP-address, subnet mask
and gateway address sent with this mailbox will be used regardless of the value of the DIP switch. For more informa-
tion about SET_ETN_CONFIG, please see chapter 5.1.1

4.2.3 Load configuration from FLASH

If the DIP switch value is set to 0 and SET_ETN_CONFIG not is sent. Then the settings that is stored in the FLASH
memory will be used.

If no settings are stored in the FLASH memory then the module will not accept END_INIT. The status led will also
start to flash with 2Hz red to indicate that an attempt to load settings from FLASH did failure.

The settings are stored to the FLASH memory through a web page in the module. This web page can be disabled with
mailbox command DISABLE_WEB_CONFIG.

HMS INDUSTRIAL NETWORKS AB 13

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

4.2.4 Configuration chart

When the module receives END_INIT the module is configured according to the chart below.

END_INIT received

Yes SET_ETN_CONFIG
received ?

No

Read DIP switch

Yes
DIP switch = 0 ?

No

Use default settings Read setings from

+ DIP switches FLASH memory

Initialise module

Figure 4: AnyBus-S Ethernet Modbus/TCP configuration chart

4.3 Data exchange

The module support both I/O data and parameter data, but the data is handled in the same way on the Modbus/TCP
bus side. If both I/O data and parameter data is configured the data area size on the bus side will be I/O data size +
parameter data size.

14 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5 Mailbox interface
5.1 Fieldbus specific mailbox messages
Table 23: Fieldbus specific mailbox messages

Message name ID Section

Set Ethernet configuration 0x0001 5.1.1
Read Ethernet configuration 0x0002 5.1.2
Connect timeout 0x0003 5.1.3
Disable web server configura- 0x0004 5.1.4
tion
Enable web server configuration 0x0005 5.1.5
Modbus connection timeout 0x0020 5.1.6
Disable Modbus/TCP server 0x0021 5.1.7
Write exception status 0x0022 5.1.8

HMS INDUSTRIAL NETWORKS AB 15

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.1.1 Set Ethernet configuration (SET_ETN_CONFIG)

The module must be assigned with some configuration data before it can be used in an Ethernet network. The values
that must be assigned are IP address, subnet mask and gateway address. The SET_ETN_CONFIG mailbox message
can only be sent to the module during initialisation, between the START_INIT and END_INIT mailbox message.

If this message not is sent to the module during initialisation the module will either use default settings combined
with the DIP switches on the module or the configuration will be loaded from FLASH. Please see chapter 4.2 for
more information.

Table 24: Mailbox message SET_ETN_CONFIG summary

Parameter Description
Command initiator Application
Message Name SET_ETN_CONFIG
Message type 0x02
Command number 0x0001
Fragmented No
Extended header data No extended header data is associated with this command
Message data Contains IP address, subnet mask and gateway address
Response message The response indicates if the command was accepted. The response
data is a copy of the command data

Command and response layout:

Table 25: Mailbox message SET_ETN_CONFIG memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0001 0x0001
Data size 0x000C 0x000C
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 - - No message header is used
Extended word 2 - - “
Extended word 3 - - “
Extended word 4 - - “
Extended word 5 - - “
Extended word 6 - - “
Extended word 7 - - “
Extended word 8 - Fault information See Table 64
Message data word 1 IP address, high word IP address, high word See example below
Message data word 2 IP address, low word IP address, low word “
Message data word 3 Subnet mask, high word 1 Subnet mask, high word “
Message data word 4 Subnet mask, low word Subnet mask, low word “
Message data word 5 Gateway address, high word Gateway address, high word “
Message data word 6 Gateway address, low word Gateway address, low word “

16 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

Configuration example:

IP address 10.10.12.51 will be IP address, high word = 0x0A0A

IP address, low word = 0x0C33

Subnet mask 2555.255.255.0 will be Subnet mask, high word = 0xFFFF

Subnet mask, low word = 0xFF00

Gateway address 10.10.12.1 will be Gateway address, high word = 0x0A0A

Gateway address, low word = 0x0C01

HMS INDUSTRIAL NETWORKS AB 17

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.1.2 Read Ethernet configuration (READ_ETN_CONFIG)

With this mailbox message it is possible to read the used Ethernet settings.

The READ_ETN_CONFIG mailbox message can only be sent to the module after initialisation

Table 26: Mailbox message READ_ETN_CONFIG summary

Parameter Description
Command initiator Application
Message Name READ_ETN_CONFIG
Message type 0x02
Command number 0x0002
Fragmented No
Extended header data No extended header data is associated with this command
Message data No message data is associated with this command
Response message The response message indicates if the command was accepted
The response data shows the used Ethernet settings

Command and response layout:

Table 27: Mailbox message READ_ETN_CONFIG memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0002 0x0002
Data size 0x0000 0x000C
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 - - No message header data used
Extended word 2 - - “
Extended word 3 - - “
Extended word 4 - - “
Extended word 5 - - “
Extended word 6 - - “
Extended word 7 - - “
Extended word 8 - - “
Message data word 1 IP address, high word See example in section 5.1.1
Message data word 2 IP address, low word “
Message data word 3 Subnet mask, high word “
Message data word 4 Subnet mask, low word “
Message data word 5 Gateway address, high word “
Message data word 6 Gateway address, low word “

18 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.1.3 Connect timeout (CONNECT_TIMEOUT)

This mailbox can be used to change the timeout that is used when an attempt to connect to a host is made. The default
value is 10 seconds but with this mailbox it can be set to a value between 1-255 (±0.5) seconds.

This message can only be sent during initialisation

Table 28: Mailbox message CONNECT_TIMEOUT summary

Parameter Description
Command initiator Application
Message Name CONNECT_TIMEOUT
Message type 0x02
Command number 0x0003
Fragmented No
Extended header data No extended header data is associated with this command
Message data Contains the timeout value
Response message The response indicates if the command was accepted
The response data is a copy of the command data

Command and response layout:

Table 29: Mailbox message CONNECT_TIMEOUT memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0003 0x0003
Data size 0x0001 0x0001
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 - - No message header data used
Extended word 2 - - “
Extended word 3 - - “
Extended word 4 - - “
Extended word 5 - - “
Extended word 6 - - “
Extended word 7 - - “
Extended word 8 - Fault information See Table 64
Message data byte 1 Timeout value Timeout value

HMS INDUSTRIAL NETWORKS AB 19

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.1.4 Disable web server configuration (DISABLE_WEB_CONFIG)

This mailbox message can be sent to disable the web server configuration page. By default the web server configura-
tion is enabled

Table 30: Mailbox message DISABLE_WEB_CONFIG summary

Parameter Description
Command initiator Application
Message Name DISABLE_WEB_CONFIG
Message type 0x02
Command number 0x0004
Fragmented No
Extended header data No header data is associated with this command
Message data No message data is associated with this command
Response message The response indicates if the command was accepted

Command and response layout:

Table 31: Mailbox message DISABLE_WEB_CONFIG memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0004 0x0004
Data size 0x0000 0x0000
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 - - No message header data used
Extended word 2 - - “
Extended word 3 - - “
Extended word 4 - - “
Extended word 5 - - “
Extended word 6 - - “
Extended word 7 - - “
Extended word 8 - - “
Message data - - Not used

20 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.1.5 Enable web server configuration (ENABLE_WEB_CONFIG)

This mailbox message can be sent to enable the web server configuration page.

Table 32: Mailbox message ENABLE_WEB_CONFIG summary

Parameter Description
Command initiator Application
Message Name ENABLE_WEB_CONFIG
Message type 0x02
Command number 0x0005
Fragmented No
Extended header data No header data is associated with this command
Message data No message data is associated with this command
Response message The response indicates if the command was accepted

Command and response layout:

Table 33: Mailbox message ENABLE_WEB_CONFIG memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0005 0x0005
Data size 0x0000 0x0000
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 - - No message header data used
Extended word 2 - - “
Extended word 3 - - “
Extended word 4 - - “
Extended word 5 - - “
Extended word 6 - - “
Extended word 7 - - “
Extended word 8 - - “
Message data - - Not used

HMS INDUSTRIAL NETWORKS AB 21

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.1.6 Modbus Connection Timeout (MB_CONN_TIMEOUT)

This mailbox message is used to set the timeout time for a Modbus connection. If an established Modbus/TCP con-
nection don't receives a request within this time the connection will be shut down by the module.

This message can only be sent during initialisation.

Valid timeout values are:

0 No timeout is used on a Modbus connection.
10 - 65535 Timeout in seconds (± 1 second).

If this message not is sent to the module the default timeout that is 60 seconds will be used.

Table 34: Mailbox message MB_CONN_TIMEOUT summary

Parameter Description
Command initiator Application
Message Name MB_CONN_TIMEOUT
Message type 0x02
Command number 0x0020
Fragmented No
Extended header data No extended header data is associated with this command
Message data Contains the timeout value for the Modbus/TCP connections
Response message The response indicates if the command was accepted

Command and response layout:

Table 35: Mailbox message MB_CONN_TIMEOUT memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0020 0x0020
Data size 0x0002 0x0002
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 - - No message header data used
Extended word 2 - - “
Extended word 3 - - “
Extended word 4 - - “
Extended word 5 - - “
Extended word 6 - - “
Extended word 7 - - “
Extended word 8 - Fault information See Table 64
Message data word 1 Timeout value Timeout value

22 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.1.7 Disable Modbus/TCP server (DISABLE_MB_TCP)

This mailbox message can be sent during initialisation to disable the Modbus/TCP server.

Table 36: Mailbox message DISABLE_MB_TCP summary

Parameter Description
Command initiator Application
Message Name DISABLE_MB_TCP
Message type 0x02
Command number 0x0021
Fragmented No
Extended header data No header data is associated with this command
Message data No message data is associated with this command
Response message The response indicates if the command was accepted

Command and response layout:

Table 37: Mailbox message DISABLE_MB_TCP memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0021 0x0021
Data size 0x0000 0x0000
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 - - No message header data used
Extended word 2 - - “
Extended word 3 - - “
Extended word 4 - - “
Extended word 5 - - “
Extended word 6 - - “
Extended word 7 - - “
Extended word 8 - - “
Message data - - Not used

HMS INDUSTRIAL NETWORKS AB 23

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.1.8 Write exception status (WR_EXP_STAT)

This mailbox message writes the byte value that is read with the modus command ‘Read exception status’ (FC 7).

This means that the exception status value is set by the application, not by the Ethernet module.

Table 38: Mailbox message WR_EXP_STAT summary

Parameter Description
Command initiator Application
Message Name WR_EXP_STAT
Message type 0x02
Command number 0x0022
Fragmented No
Extended header data No extended header data is associated with this command
Message data Contains the exception status byte
Response message The response indicates if the command was accepted

Command and response layout:

Table 39: Mailbox message WR_EXP_STAT memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x4002
Command 0x0022 0x0022
Data size 0x0001 0x0001
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 - - No message header data used
Extended word 2 - - “
Extended word 3 - - “
Extended word 4 - - “
Extended word 5 - - “
Extended word 6 - - “
Extended word 7 - - “
Extended word 8 - - “
Message data byte 1 Exception status Exception status

24 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2 Transparent mailbox interface

The module has a set of mailbox messages, which can be used to send and receive transparent data with TCP/IP or
UDP/IP directly through the socket interface. It is possible to use up to 16 sockets simultaneously. Information about
these 16 sockets can be viewed in the fieldbus specific area, chapter 4.1.4.

Table 40: Transparent data mailbox messages

Message name ID Section

Socket 0x0040 5.2.1
Listen 0x0041 5.2.2
Connect 0x0042 5.2.3
Send 0x0043 5.2.4
Receive 0x0044 5.2.5
Send to 0x0045 5.2.6
Receive from 0x0046 5.2.7
Close 0x0047 5.2.8
Send fragment 0x005E 5.2.9
Receive frag- 0x005F 5.2.10
ment

HMS INDUSTRIAL NETWORKS AB 25

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.1 Socket (SOCKET)

This mailbox message creates a socket and binds it to a specific port number. If the selected port number is 0 then the
module choose a free port.

A descriptor (0 - 7) and the used port number will be returned in the response message.

Table 41: Mailbox message SOCKET summary

Parameter Description
Command initiator Application
Message Name SOCKET
Message type 0x02
Command number 0x0040
Fragmented No
Extended header data No extended header data is associated with this command
Message data The socket type (TCP or UDP) and the port
Response message The response indicates if the command was accepted
The response indicates which socket descriptor that is used and the
port number the socket is bound to.

Command and response layout:

Table 42: Mailbox message SOCKET memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0040 0x0040
Data size 0x0004 0x0004
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 - -
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information See Table 64
Message data word 1 Socket type Socket descriptor Message data
Message data word 2 Port number Port number “

Table 43: Socket types for Message data word 1

Number Socket type

0x01 TCP socket
0x02 UDP socket

26 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.2 Listen (LISTEN)

This mailbox message starts to listen for a connection on a specified socket. This command can only be used on a
TCP socket. If the module detects a connection request on this socket, a new connected socket will be created and this
socket will still be listening. Information about the new connection can be read in the fieldbus specific area chapter
4.1.4.

Table 44: Mailbox message LISTEN summary

Parameter Description
Command initiator Application
Message Name LISTEN
Message type 0x02
Command number 0x0041
Fragmented No
Extended header data Contains the descriptor of the socket this command is affective for
Message data No message data is associated with this command
Response message The response indicates if the command was accepted

Command and response layout:

Table 45: Mailbox message LISTEN memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0041 0x0041
Data size 0x0000 0x0000
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 Socket descriptor Socket descriptor
Extended word 2 Reserved -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information See Table 64
Message data - -

Note: Extended data word 2 is reserved, and must be zero.

HMS INDUSTRIAL NETWORKS AB 27

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.3 Connect (CONNECT)

This mailbox message tries to create a connection to a specified IP-address and port number.

If this command is correctly sent, it will be accepted whether it's possible to establish a connection or not. The result
of the operation must be viewed in the fieldbus specific area chapter 4.1.4.

If the socket that this command is affective for is of UDP type, then this command specifies the peer with which the
socket is to be associated, the address is to which datagrams are sent and the only address from which datagrams are
received. If the socket is of TCP type, then this command attempts to make a connection to another socket. TCP sock-
ets may CONNECT only once, while UDP sockets may use CONNECT multiple times to change their association.

Table 46: Mailbox message CONNECT summary

Parameter Description
Command initiator Application
Message Name CONNECT
Message type 0x02
Command number 0x0042
Fragmented No
Extended header data Contains the descriptor of the socket this command is affective for
Message data Contains IP-address and Port number to connect to
Response message The response indicates if the command was accepted
The response data is a copy of the command data

Command and response layout:

Table 47: Mailbox message CONNECT memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0042 0x0042
Data size 0x0006 0x0006
Frame count 0x0001 0x0001 One Frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 Socket descriptor Socket descriptor
Extended word 2 Reserved -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information See Table 64
Message data word 1 IP address, high word IP address, high word Message data
Message data word 2 IP address, low word IP address, low word “
Message data word 3 Port number Port number “

Note: Extended data word 2 is reserved, and must be zero.

28 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.4 Send (SEND)

This mailbox message writes data to a connected socket. At the moment it's only possible to send 256 bytes with one
command but in the future the fragmentation protocol will give the possibility to send more data.

Table 48: Mailbox message SEND summary

Parameter Description
Command initiator Application
Message Name SEND
Message type 0x02
Command number 0x0043
Fragmented No (will be supported in the future)
Extended header data Contains the descriptor of the socket this command is affective for
Message data Contains the data to send
Response message The response indicates if the command was accepted
The response data is the sent data

Command and response layout:

Table 49: Mailbox message SEND memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0043 0x0043
Data size No. of bytes to send No. of sent bytes
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 Socket descriptor Socket descriptor
Extended word 2 Reserved -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information See Table 64
Message data word 8 Data to send Sent data

Note: Extended data word 2 is reserved, and must be zero.

HMS INDUSTRIAL NETWORKS AB 29

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.5 Receive (RECV)

This mailbox message reads data from a connected socket.

If the socket is of TCP type then this command will return the requested number of bytes from the received data
stream. If the available amount of data is less than the requested amount, then all available data will be returned.

If the socket is of UDP type then this command will return the requested amount of data from the next received data-
gram. If the datagram is a smaller amount of data than the requested amount, then the entire datagram will be
returned. If the datagram is a larger amount of data than the requested amount, the excess bytes will be discarded.

At the moment it's only possible to receive 256 bytes with one command but in the future the fragmentation protocol
will give the possibility to receive more data.

Table 50: Mailbox message RECV summary

Parameter Description
Command initiator Application
Message Name RECV
Message type 0x02
Command number 0x0044
Fragmented No (will be supported in the future)
Extended header data Contains the descriptor of the socket this command is affective for
and how many bytes to receive
Message data No message data is sent in the command
Response message The response indicates if the command was accepted
The response data is the data that was read from the connection

Command and response layout:

Table 51: Mailbox message RECV memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0044 0x0044
Data size 0x0000 No of received bytes
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 Socket descriptor Socket descriptor
Extended word 2 Data size (in bytes) -
Extended word 3 Reserved -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information See Table 64
Message data - Received data

Note: Extended data word 3 is reserved, and must be zero.

30 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.6 Send To (SEND_TO)

This mailbox message sends a UDP datagram to a specified IP-address and a specified port number. At the moment
it's only possible to send 256 bytes with one command but in the future the fragmentation protocol will give the pos-
sibility to send more data.

Table 52: Mailbox message SEND_TO summary

Parameter Description
Command initiator Application
Message Name SEND_TO
Message type 0x02
Command number 0x0045
Fragmented No (will be supported in the future)
Extended header data Contains the descriptor of the socket this command is affective for
and the IP-address and port number to send to
Message data Contains the data to send
Response message The response indicates if the command was accepted
The response data is the data that was sent

Command and response layout:

Table 53: Mailbox message SEND_TO memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0045 0x0045
Data size Data size Data size No additional data
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 Socket descriptor Socket descriptor
Extended word 2 IP-address high word IP-address high word The IP-address to send to
Extended word 3 IP-address low word IP-address low word
Extended word 4 Port number Port number The port number to send to
Extended word 5 Reserved -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information See Table 64
Message data Data to send Sent data

Note: Extended data word 5 is reserved, and must be zero.

HMS INDUSTRIAL NETWORKS AB 31

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.7 Receive from (RECV_FROM)

This mailbox message reads the next received datagram from a UDP socket. The IP-address and the port number of
the datagram sender are returned in the response message.

This mailbox message specifies how many bytes of data to read from the next received datagram. If the datagram is a
smaller amount of data then requested, the command will return the entire datagram. If the datagram is a larger
amount of data than requested, then the excess bytes will be discarded.

At the moment it's only possible to receive 256 bytes with one command but in the future the fragmentation protocol
will give the possibility to receive more data.

Table 54: Mailbox message RECV_FROM summary

Parameter Description
Command initiator Application
Message Name RECV_FROM
Message type 0x02
Command number 0x0046
Fragmented No (will be supported in the future)
Extended header data Contains the descriptor of the socket this command is affective for
and how many bytes to receive
Message data No message data is sent in the command
Response message The response indicates if the command was accepted
Address information about the sender is returned in the extended area
of the response
The response contains the read data

Command and response layout:

Table 55: Mailbox message RECV_FROM memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer data
Message information 0x4002 0x0002
Command 0x0046 0x0046
Data size 0x0000 Data size No additional data
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 Socket descriptor Socket descriptor
Extended word 2 Receive data size IP-address high word The senders IP-address
Extended word 3 Reserved IP-address low word
Extended word 4 - Port number The senders port number
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information See Table 64
Message data - Received data

Note: Extended data word 3 is reserved, and must be zero.

32 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.8 Close (CLOSE)

This mailbox message causes a connected socket to shut down and the socket descriptor is returned to the free
descriptor pool.

Table 56: Mailbox message CLOSE summary

Parameter Description
Command initiator Application
Message Name CLOSE
Message type 0x02
Command number 0x0047
Fragmented No
Extended header data Contains the descriptor of the socket this command is affective for
Message data No message data is sent in the command
Response message The response indicates if the command was accepted

Command and response layout:

Table 57: Mailbox message CLOSE memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x0047 0x0047
Data size 0x0000 0x0000 No additional data
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 Socket descriptor Socket descriptor
Extended word 2 - -
Extended word 3 - -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information See Table 64
Message data - - No additional data used

HMS INDUSTRIAL NETWORKS AB 33

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.9 Send Fragment (SEND_FRAG)

This mailbox message is used to send a fragment of a message that is larger than 256 bytes. This command is
included since the AnyBus-S fragmentation protocol not is implemented yet.

Internally the fragments will be stored in a buffer until the entire message is received. Then the message will be sent
to the socket. The maximum size of a message that can be sent is 1400 bytes.

Table 58: Mailbox message SEND_FRAG summary

Parameter Description
Command initiator Application
Message Name SEND_FRAG
Message type 0x02
Command number 0x005E
Fragmented No
Extended header data Contains the descriptor of the socket this command is affective for
and the fragment type of this mailbox message
Message data Contains the data to send
Response message The response indicates if the command was accepted
The response data is the data that was sent

Command and response layout:

Table 59: Mailbox message SEND_FRAG memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x005E 0x005E
Data size Data size Data size No additional data
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 Socket descriptor Socket descriptor
Extended word 2 Fragment type Fragment type
Extended word 3 Reserved -
Extended word 4 - -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information See Table 64
Message data Data to send Sent data

Note: Extended data word 3 is reserved, and must be zero.

Table 60: Fragmentation types for Extended data word 2

Fragment type Description

0x0000 First fragment of a new message
0x0001 Subsequent fragment of the message
0x0002 Last fragment of the message. When this fragment is received the
entire message will be sent to the socket

34 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

5.2.10 Receive Fragment (RECV_FRAG)

This mailbox message is used to receive a fragment of a message that is larger than 256 bytes from a connected
socket. This command is included since the AnyBus-S fragmentation protocol not is implemented yet.

If the socket is of TCP type then this command will return the requested number of bytes from the received data
stream. If the available amount of data is less than the requested amount, then all available data will be returned.

If the socket is of UDP type then this command will return the requested amount of data from the next received data-
gram. If the datagram is a smaller amount of data than the requested amount, then the entire datagram will be
returned. If the datagram is a larger amount of data than the requested amount, the excess bytes will be discarded.

Internally the entire message will be read from the socket to a buffer. Then the fragments of the message can be read
with this mailbox command from the buffer.

The maximum size of a message that can be received is 1400 bytes.

Table 61: Mailbox message RECV_FRAG summary

Parameter Description
Command initiator Application
Message Name RECV_FRAG
Message type 0x02
Command number 0x005F
Fragmented No
Extended header data Contains the descriptor of the socket this command is affective for
The response contains the number of bytes that is remaining to read
Message data No message data is sent in the command
Response message The response indicates if the command was accepted

Command and response layout:

Table 62: Mailbox message RECV_FRAG memory layout

Register Name Command Expected response

Message ID 0x0001 0x0001 Any integer value
Message information 0x4002 0x0002
Command 0x005F 0x005F
Data size 0x0000 Data size No additional data
Frame count 0x0001 0x0001 One frame
Frame number 0x0001 0x0001 This is frame 1
Offset high 0x0000 0x0000
Offset low 0x0000 0x0000
Extended word 1 Socket descriptor Socket descriptor
Extended word 2 Fragment type Fragment type
Extended word 3 Receive data size Bytes remaining No. of remaining bytes
Extended word 4 Reserved -
Extended word 5 - -
Extended word 6 - -
Extended word 7 - -
Extended word 8 - Fault information See Table 64
Message data word 8 - Received data

Note: The “Received data size” is only used if the “Fragment type” = 0x0000.
Note: Extended data word 4 is reserved and must be zero.

HMS INDUSTRIAL NETWORKS AB 35

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

Table 63: Fragmentation types for Extended data word 2

Fragment type Description

0x0000 Receive the first fragment of a new message. This receives a new
message from the network. If there are unread fragments from an
earlier received datagram they will be over written.
0x0001 Receive next fragment of the message.

5.3 Fault information

When a fieldbus specific mailbox command is send to the module and the command can't be performed the Message
Information field in the header of the response will indicate that an error occurred. If the error code in the Message
Information field is Invalid Other (0xF) then the error cause can be read in the Fault information (Extended word 8)
in the response.

Table 64: Fault information codes for fieldbus specific mailbox messages

Value Description
0x0001 Invalid IP-address or Subnet mask
0x0002 Invalid socket type
0x0003 No free socket
0x0004 Invalid socket
0x0005 Not connected
0x0006 Command failed
0x0007 Invalid data size
0x0008 Invalid fragment type
0x0009 Fragment error
0x000A Invalid timeout time
0x000B Can't send more

36 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

6 Fieldbus specific tables

6.1 Supported Modbus commands
Table 65: Supported Modbus commands

Function code Function name Class

1 Read coils 1
2 Read input discretes 1
3 Read multiple registers 0
4 Read input registers 1
5 Write coil 1
6 Write single register 1
7 Read exception status 1
15 Force multiple coils 2
16 Write multiple registers 0
22 Mask write register 2
23 Read/Write registers 2

6.2 Exception codes

Table 66: Supported exception codes

Exception Name Description

code
01 Illegal function The module does not support the function code in the query.
02 Illegal data address The data address received in the query is outside the initialised
memory area in the module.
03 Illegal data value The data in the request is illegal.

HMS INDUSTRIAL NETWORKS AB 37

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

7 Electrical specifications
7.1 Current consumption
The module electronics should be supplied with regulated 5V DC. For more information regarding the power supply,
consult the AnyBus-S Design Guide.

Table 67: AnyBus-S Ethernet Modbus/TCP current consumption

Symbol Description Min. Typ. Max. Unit

IINMOD Supply current, module electronics - 140 180 mA
IINBUS Supply current, bus interface - - - mA

The bus interface is powered from the module electronics, and no power feed to pins 1 and 2 in the application con-
nector is necessary.

38 HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

8 Mechanical specifications
8.1 Overview
This section contains mechanical drawings for the AnyBus-S module for Ethernet. The fieldbus interface can be
either side or top mounted (reverse mounting is not allowed on the 9 pin D-SUB connector). For more information
regarding other connectors please contact HMS Fieldbus Systems marketing department.

The mechanical drawings describe the standard configuration of the AnyBus-S Ethernet module.
Article number for Ethernet Modbus/TCP, parallel interface: AB4078
The serial interface is not yet available.

For further information regarding the AnyBus-S module, we refer to the AnyBus-S Design Guide.

8.2 Mechanical drawings in this manual

These drawings are contained in this section:
• AnyBus-S Ethernet module, angled configuration, 3D view
• AnyBus-S Ethernet module, angled configuration, top view
• AnyBus-S Ethernet module, angled configuration, front and side view
• AnyBus-S Ethernet module, angled configuration, PCB connection points
• AnyBus-S Ethernet module, straight configuration, 3D view
• AnyBus-S Ethernet module, straight configuration, top view
• AnyBus-S Ethernet module, straight configuration, front and side view
• AnyBus-S Ethernet module, straight configuration, PCB connection points

HMS INDUSTRIAL NETWORKS AB 39

40
8 7 6 5 4 3 2 1
THE INFORMATION CONTAINED IN THIS DRAWING IS THE SOLE PROPERTY OF
HMS FIELDBUS SYSTEMS AB ANY REPRODUCTION IN PART OR WHOLE WITHOUT
Pos. Revisions Date Sign
THE WRITTEN PERMISSION OF HMS INDUSTRIAL NETWORKS AB IS PROHIBITED.
2001-09-03

D
D
DOC. NO ABS-ETH-MBTCP-1.91

C C

B
B
FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP

Figure 5: AnyBus-S Ethernet module, angled configuration, 3D view

HMS Industrial Networks AB

A Pilefeltsgatan 95-93 A
S-302 50 Halmstad
Tel: +46 (0)35 - 17 29 00
Fax: +46 (0)35 - 17 29 09
UNLESS OTHERWISE SPECIFIED Title:
DIMENSIONS ARE IN AnyBus-S Ethernet Angled Iso-view
MILLIMETERS.
Document nr: REV.
TOLERANCE: + / - 0,1 SIZE
A4L 1.0
DATE Sign:
CAD FILE:
2000-04-26 NiE SCALE 2:1 SHEET 1 OF 4
ABS Ethernet Angled

8 7 6 5 4 3 2 1

HMS INDUSTRIAL NETWORKS AB

 8 7 6 5 4 3 2 1
THE INFORMATION CONTAINED IN THIS DRAWING IS THE SOLE PROPERTY OF
HMS FIELDBUS SYSTEMS AB ANY REPRODUCTION IN PART OR WHOLE WITHOUT
Pos. Revisions Date Sign
THE WRITTEN PERMISSION OF HMS INDUSTRIAL NETWORKS AB IS PROHIBITED.

D
D

HMS INDUSTRIAL NETWORKS AB

C C

16,5 18,3
14,1
9,7 15,7 13,7 15,8
8,1

B
B

Figure 6: AnyBus-S Ethernet module, angled configuration, top view

12,4
48,0
75,6

HMS Industrial Networks AB

A Pilefeltsgatan 95-93 A
S-302 50 Halmstad
Tel: +46 (0)35 - 17 29 00
Fax: +46 (0)35 - 17 29 09
UNLESS OTHERWISE SPECIFIED Title:
DIMENSIONS ARE IN AnyBus-S Ethernet Angled Top-view
MILLIMETERS.
Document nr: REV.
TOLERANCE: + / - 0,1 SIZE
A4L 1.0
DATE Sign:
CAD FILE:
2000-04-26 NiE SCALE 2:1 SHEET 2 OF 4
ABS Ethernet Angled

8 7 6 5 4 3 2 1

41
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03
FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
42
8 7 6 5 4 3 2 1
THE INFORMATION CONTAINED IN THIS DRAWING IS THE SOLE PROPERTY OF Pos. Revisions Date Sign
HMS FIELDBUS SYSTEMS AB ANY REPRODUCTION IN PART OR WHOLE WITHOUT
THE WRITTEN PERMISSION OF HMS INDUSTRIAL NETWORKS AB IS PROHIBITED.
2001-09-03

D
D
15,7 21,7 9,2
2,9 4,6

11,8 9,7 5,0 9,7

DOC. NO ABS-ETH-MBTCP-1.91

C C

Application Connector alternatives

B B
FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP

Top side Bottom side

6,4-12,2mm

Figure 7: AnyBus-S Ethernet module, angled configuration, front and side view
HMS Industrial Networks AB
A Pilefeltsgatan 95-93 A
S-302 50 Halmstad
Tel: +46 (0)35 - 17 29 00
Fax: +46 (0)35 - 17 29 09
UNLESS OTHERWISE SPECIFIED Title:
DIMENSIONS ARE IN AnyBus-S Ethernet Angled Front- & Side
MILLIMETERS. REV.
TOLERANCE: + / - 0,1 SIZE Document nr:
A4L 1.0
DATE Sign: CAD FILE:
2000-04-26 NiE SCALE 2:1 ABS Ethernet Angled SHEET 3 OF 4
8 7 6 5 4 3 2 1

HMS INDUSTRIAL NETWORKS AB

 8 7 6 5 4 3 2 1
THE INFORMATION CONTAINED IN THIS DRAWING IS THE SOLE PROPERTY OF
HMS FIELDBUS SYSTEMS AB ANY REPRODUCTION IN PART OR WHOLE WITHOUT
Pos. Revisions Date Sign
THE WRITTEN PERMISSION OF HMS INDUSTRIAL NETWORKS AB IS PROHIBITED.

D
2,0 D

37,3

2,0

HMS INDUSTRIAL NETWORKS AB

54,0
C C
0,8
5,8 A 3x 3,2 A
0,75
0
0,9 2,54

6,2
0,8 2,54

12,9

14,3 2,0

B
B

1,0
2,0
71,8

86,0 1,6

A-A

Figure 8: AnyBus-S Ethernet module, angled configuration, PCB connection points

4,0
7,0
HMS Industrial Networks AB
55,5

A Pilefeltsgatan 95-93 A
S-302 50 Halmstad
Tel: +46 (0)35 - 17 29 00
Fax: +46 (0)35 - 17 29 09
UNLESS OTHERWISE SPECIFIED Title:
DIMENSIONS ARE IN AnyBus-S Ethernet Angled PCB
MILLIMETERS.
Document nr: REV.
TOLERANCE: + / - 0,1 SIZE
A4L 1.0
DATE Sign:
CAD FILE:
2000-04-26 NiE SCALE 1.5:1 ABS Ethernet Angled SHEET 4 OF 4

8 7 6 5 4 3 2 1

43
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03
FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
44
8 7 6 5 4 3 2 1
THE INFORMATION CONTAINED IN THIS DRAWING IS THE SOLE PROPERTY OF
HMS FIELDBUS SYSTEMS AB ANY REPRODUCTION IN PART OR WHOLE WITHOUT
Pos. Revisions Date Sign
THE WRITTEN PERMISSION OF HMS INDUSTRIAL NETWORKS AB IS PROHIBITED.
2001-09-03

D
D
DOC. NO ABS-ETH-MBTCP-1.91

C C

B
B
FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP

Figure 9: AnyBus-S Ethernet module, straight configuration, 3D view

HMS Industrial Networks AB

A Pilefeltsgatan 95-93 A
S-302 50 Halmstad
Tel: +46 (0)35 - 17 29 00
Fax: +46 (0)35 - 17 29 09
UNLESS OTHERWISE SPECIFIED Title:
DIMENSIONS ARE IN AnyBus-S Ethernet Straight Iso-view
MILLIMETERS.
Document nr: REV.
TOLERANCE: + / - 0,1 SIZE
A4L 1.0
DATE Sign:
CAD FILE:
2000-04-26 NiE SCALE 2:1 SHEET 1 OF 4
ABS Ethernet Straight

8 7 6 5 4 3 2 1

HMS INDUSTRIAL NETWORKS AB

 8 7 6 5 4 3 2 1
THE INFORMATION CONTAINED IN THIS DRAWING IS THE SOLE PROPERTY OF
HMS FIELDBUS SYSTEMS AB ANY REPRODUCTION IN PART OR WHOLE WITHOUT
Pos. Revisions Date Sign
THE WRITTEN PERMISSION OF HMS INDUSTRIAL NETWORKS AB IS PROHIBITED.

D
D

HMS INDUSTRIAL NETWORKS AB

C C

4,6
2,9

16,9 15,1
13,6
9,6 14,1 5,0 9,7

B
B

0
12,4
47,9
75,6

Figure 10: AnyBus-S Ethernet module, straight configuration, top view

HMS Industrial Networks AB

A Pilefeltsgatan 95-93 A
S-302 50 Halmstad
Tel: +46 (0)35 - 17 29 00
Fax: +46 (0)35 - 17 29 09
UNLESS OTHERWISE SPECIFIED Title:
DIMENSIONS ARE IN AnyBus-S Ethernet Straight Top-view
MILLIMETERS.
Document nr: REV.
TOLERANCE: + / - 0,1 SIZE
A4L 1.0
DATE Sign:
CAD FILE:
2000-04-26 NiE SCALE 2:1 SHEET 2 OF 4
ABS Ethernet Straight

8 7 6 5 4 3 2 1

45
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03
FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
46
8 7 6 5 4 3 2 1
THE INFORMATION CONTAINED IN THIS DRAWING IS THE SOLE PROPERTY OF Pos. Revisions Date Sign
HMS FIELDBUS SYSTEMS AB ANY REPRODUCTION IN PART OR WHOLE WITHOUT
THE WRITTEN PERMISSION OF HMS INDUSTRIAL NETWORKS AB IS PROHIBITED.
2001-09-03

D
15,9 21,7 9,2 D

15,7
5,5 6,7 8,1 10,2
DOC. NO ABS-ETH-MBTCP-1.91

C C

Application Connector alternatives

B B
FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP

Bottom side Top side

6,4-12,2mm

Figure 11: AnyBus-S Ethernet module, straight configuration, front and side view
HMS Industrial Networks AB
A Pilefeltsgatan 95-93 A
S-302 50 Halmstad
Tel: +46 (0)35 - 17 29 00
Fax: +46 (0)35 - 17 29 09
UNLESS OTHERWISE SPECIFIED Title:
DIMENSIONS ARE IN AnyBus-S Ethernet Straight Front & Side
MILLIMETERS. REV.
TOLERANCE: + / - 0,1 SIZE Document nr:
A4L 1.0
DATE Sign: CAD FILE:
2000-04-26 NiE SCALE 2:1 ABS Ethernet Straight SHEET 3 OF 4
8 7 6 5 4 3 2 1

HMS INDUSTRIAL NETWORKS AB

 8 7 6 5 4 3 2 1
THE INFORMATION CONTAINED IN THIS DRAWING IS THE SOLE PROPERTY OF
HMS FIELDBUS SYSTEMS AB ANY REPRODUCTION IN PART OR WHOLE WITHOUT
Pos. Revisions Date Sign
THE WRITTEN PERMISSION OF HMS INDUSTRIAL NETWORKS AB IS PROHIBITED.

D
2,0 D

37,3

2,0

HMS INDUSTRIAL NETWORKS AB

54,0
C 0,8 C

5,8 A A
3,2
0,75
0
0,9 2,54

6,2
0,8 2,54

12,9

14,3 2,0

B
B

1,0
2,0
71,8

86,0 1,6

A-A

4,0
7,0

Figure 12: AnyBus-S Ethernet module, straight configuration, PCB connection points
HMS Industrial Networks AB
55,5

A Pilefeltsgatan 95-93 A
S-302 50 Halmstad
Tel: +46 (0)35 - 17 29 00
Fax: +46 (0)35 - 17 29 09
UNLESS OTHERWISE SPECIFIED Title:
DIMENSIONS ARE IN AnyBus-S Ethernet Straight PCB
MILLIMETERS.
Document nr: REV.
TOLERANCE: + / - 0,1 SIZE
A4L 1.0
DATE Sign:
CAD FILE:
2000-04-26 NiE SCALE 1.5:1 ABS Ethernet Straight SHEET 4 OF 4

8 7 6 5 4 3 2 1

47
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03
FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

9 List of figures
Figure 1: Mechanical overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Figure 2: AnyBus-S access methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Figure 3: AnyBus-S LED’s, with 90× angle mounting (A), and 180× straight mounting (B). . . . . . . . . . . . . . . . . . 7
Figure 4: AnyBus-S Ethernet Modbus/TCP configuration chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Figure 5: AnyBus-S Ethernet module, angled configuration, 3D view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Figure 6: AnyBus-S Ethernet module, angled configuration, top view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Figure 7: AnyBus-S Ethernet module, angled configuration, front and side view . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Figure 8: AnyBus-S Ethernet module, angled configuration, PCB connection points . . . . . . . . . . . . . . . . . . . . . . . 43
Figure 9: AnyBus-S Ethernet module, straight configuration, 3D view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Figure 10: AnyBus-S Ethernet module, straight configuration, top view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Figure 11: AnyBus-S Ethernet module, straight configuration, front and side view . . . . . . . . . . . . . . . . . . . . . . . . 46
Figure 12: AnyBus-S Ethernet module, straight configuration, PCB connection points . . . . . . . . . . . . . . . . . . . . . 47

HMS INDUSTRIAL NETWORKS AB

 FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

10 List of tables
Table 1: Documents related to this manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Table 2: RJ45 Ethernet connector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Table 3: 10 pin 2 mm Ethernet connector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Table 4: 9 pin D-SUB Ethernet connector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Table 5: LED 1 - Link LED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Table 6: LED 2 - Status LED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Table 7: LED 3 - Modbus/TCP connection LED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Table 8: LED 4 - Activity LED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Table 9: IN area word/bit addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Table 10: OUT area word/bit addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Table 11: Socket field base addresses, sockets 0 - 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Table 12: Socket field base addresses, sockets 8 - 15 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Table 13: Socket field memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Table 14: Socket type register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Table 15: Listing of socket type values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Table 16: Socket status register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Table 17: Listing of socket status values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Table 18: Socket information register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Table 19: Data available bit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Table 20: Local port number register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Table 21: Host port number register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Table 22: Host IP-address register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Table 23: Fieldbus specific mailbox messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Table 24: Mailbox message SET_ETN_CONFIG summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Table 25: Mailbox message SET_ETN_CONFIG memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Table 26: Mailbox message READ_ETN_CONFIG summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Table 27: Mailbox message READ_ETN_CONFIG memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Table 28: Mailbox message CONNECT_TIMEOUT summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Table 29: Mailbox message CONNECT_TIMEOUT memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Table 30: Mailbox message DISABLE_WEB_CONFIG summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Table 31: Mailbox message DISABLE_WEB_CONFIG memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Table 32: Mailbox message ENABLE_WEB_CONFIG summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Table 33: Mailbox message ENABLE_WEB_CONFIG memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Table 34: Mailbox message MB_CONN_TIMEOUT summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Table 35: Mailbox message MB_CONN_TIMEOUT memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Table 36: Mailbox message DISABLE_MB_TCP summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Table 37: Mailbox message DISABLE_MB_TCP memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Table 38: Mailbox message WR_EXP_STAT summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Table 39: Mailbox message WR_EXP_STAT memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Table 40: Transparent data mailbox messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Table 41: Mailbox message SOCKET summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Table 42: Mailbox message SOCKET memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Table 43: Socket types for Message data word 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Table 44: Mailbox message LISTEN summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Table 45: Mailbox message LISTEN memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Table 46: Mailbox message CONNECT summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Table 47: Mailbox message CONNECT memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

HMS INDUSTRIAL NETWORKS AB

FIELDBUS APPENDIX - ANYBUS-S ETHERNET MODBUS/TCP
DOC. NO ABS-ETH-MBTCP-1.91
2001-09-03

Table 48: Mailbox message SEND summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Table 49: Mailbox message SEND memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Table 50: Mailbox message RECV summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Table 51: Mailbox message RECV memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Table 52: Mailbox message SEND_TO summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Table 53: Mailbox message SEND_TO memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Table 54: Mailbox message RECV_FROM summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Table 55: Mailbox message RECV_FROM memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Table 56: Mailbox message CLOSE summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Table 57: Mailbox message CLOSE memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Table 58: Mailbox message SEND_FRAG summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Table 59: Mailbox message SEND_FRAG memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Table 60: Fragmentation types for Extended data word 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Table 61: Mailbox message RECV_FRAG summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Table 62: Mailbox message RECV_FRAG memory layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Table 63: Fragmentation types for Extended data word 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table 64: Fault information codes for fieldbus specific mailbox messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table 65: Supported Modbus commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Table 66: Supported exception codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Table 67: AnyBus-S Ethernet Modbus/TCP current consumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

HMS INDUSTRIAL NETWORKS AB

If you have any comments about this documentation, please take a few minutes to fill out this form, and let
us know about your opinions. These comments will help us improve our work, and make us aware of what
customers of our products may find good, faulty or even missing.

Document title and revision:_________________________________________________________________

Your name and company:____________________________________________________________________

Phone:___________________________________________________________________________________

E-mail:___________________________________________________________________________________

Comments:

Text and illustrations:

_________________________________________________________________________________________

_________________________________________________________________________________________

_________________________________________________________________________________________

_________________________________________________________________________________________

What information is missing or unclear?:

_________________________________________________________________________________________

_________________________________________________________________________________________

_________________________________________________________________________________________

_________________________________________________________________________________________

Other comments:
_________________________________________________________________________________________

_________________________________________________________________________________________

_________________________________________________________________________________________

_________________________________________________________________________________________

Send your comments to: You may also mail or fax your comments:

HMS Industrial Networks AB E-mail: [email protected]

Support Department Fax: +46 (0)35 172909
Pilefeltsgatan 93-95
302 50 Halmstad
SWEDEN