ProSoft Technology, Inc. RTU-5/03 Processor for Allen ... · RTU-5/03 Processor for Allen-Bradley SLC Modular Racks Catalog Numbers : 3250-L532M RTU-5/03 Processor with 16 K RAM ...

Revision : 1.2 Updated : 6/30/04 ____________________________________________________________________________________________ ProSoft Technology, Inc. RTU-5/03 Processor for Allen-Bradley SLC Modular Racks Catalog Numbers :

3250-L532M RTU-5/03 Processor with 16 K RAM

This manual is provided in to assist with the issues specific to the implementation of Modbus Slave communications with the RTU-5/03 processor. To obtain information relating to the physical installation of the processor or other information relating to the programming of processors in the Allen-Bradley SLC product family, please refer to the Allen-Bradley document shipped with this manual, Publication 1747-5.27.

Inside this Manual

1 Product Overview ..................................................................................................................................................2 1.1 Channel 0 Functionality ..............................................................................................................................2 1.2 General Specifications ...............................................................................................................................2 1.3 Modbus Slave Protocol Specifications .......................................................................................................3

2 Quick Start Guide ..................................................................................................................................................4 2.1 Installation Procedure.................................................................................................................................4 2.2 Testing the Modbus Slave Port ..................................................................................................................5

3 Modbus Memory Map............................................................................................................................................7 4 N100: Modbus Configuration and Diagnostic File................................................................................................11

4.1 Creating the N100 Modbus Configuration and Diagnostic File .................................................................11 4.2 The Structure of the Modbus Configuration and Diagnostic File ..............................................................11

4.2.1 Communication Configuration Parameters.......................................................................................11 4.2.2 Status and Diagnostic Data (Output values from Modbus Driver) ....................................................15

4.3 Modbus Diagnostic File Error Code values ..............................................................................................18 4.3 Activating the Modbus Slave Driver..........................................................................................................19

4.3.2 Manual Modbus Driver Start and Stop..............................................................................................19 4.3.2 AutoSwitch Mode .............................................................................................................................19

5 Supported Modbus Function Codes ....................................................................................................................20 5.1 Modbus Read Function Codes .................................................................................................................20 5.2 Modbus Write Commands........................................................................................................................20

6 Troubleshooting...................................................................................................................................................22 6.1 RTU-5/03 ‘Modbus’ LED Indicator............................................................................................................22 6.2 Processor Faults ......................................................................................................................................22 6.3 Troubleshooting Tips................................................................................................................................22 6.3 Modbus Diagnostic File Error Code values ..............................................................................................23

7 Cable Connection – Channel 0............................................................................................................................25 7.1 Cable configuration for Modbus Communications ....................................................................................25

8 Technical Support................................................................................................................................................26 8.1 Modbus on Channel 0 Related Issues......................................................................................................26 8.2 Non-Modbus Related Issues ....................................................................................................................26

Additional Information

Modbus Protocol Specification ProSoft Technology has placed the Modbus Protocol specification on the web site at http://www.prosoft-technology.com.

RTU-5/03 Application Notes ProSoft Technology has an example Application Note for the RTU-5/03 processor on the web site, or available by fax upon request.

Product Overview

1 Product Overview The ProSoft Technology, Inc. RTU-5/03 is a processor for the 1746 family of hardware that has been enabled with the Modbus protocol on Channel 0. The product family has been developed to address the needs of industries and applications that regularly apply the Modbus protocol. Two versions of the RTU-5/03 are available:

3250-L532M RTU-5/03 processor with 16K RAM

These processors are fully functional SLC 5/03 processors, and as such implement the full suite of ladder logic commands normally supported by the SLC-5/03 processors. WARNING: Storage to the EEPROM is only supported through the DF1, Channel 0 port. Attempting to use the DH-485 port for burning an EEPROM will erase processor memory and fault the processor. The processor is Version OS302 and therefore does not support the M13 EPROM, nor the BTR/BTW instruction.

1.1 Channel 0 Functionality As in the SLC 5/03, Channel 0 is a 9-pin RS-232C port on the front of the processor. In addition to supporting the Slave and Master versions of the DF1 protocol (for programming purposes), the RTU-5/03 processor can communicate as a Modbus Slave on Channel 0. DF1 Functionality The DF1 protocol is supported on Channel 0 ‘out of the box’. The normal shipping communication defaults (19200 baud, CRC, DF1 Full Duplex, 8,N,1) will enable the connection of a programming package to Channel 0. Note that Channel 1 (DH-485 port) can also be used for programming purposes while the Modbus Driver is operational. Modbus Functionality Modbus Slave functionality is enabled by the User creating and configuring an Integer file at N100 in the RTU-5/03 processors data table. Once configured correctly, the RTU-5/03 can be setup to swap automatically (via the Autoswitch Mode) between the DF1 and the Modbus drivers. User Mode Functionality The Channel 0 User Mode is also available to the RTU-5/03. However, if this mode is configured, the Modbus Driver is disabled.

1.2 General Specifications The ProSoft Technology, Inc. RTU-5/03 processor product includes the following features:

• Channel 0 port capable of supporting Modbus Slave protocol • Modbus Read and Write of binary, integer and floating point data types • Modbus Master can read processor Status File (S2) • RS-232C handshaking for SCADA radio/modem applications • Satellite and Packet Radio support with a configurable Inter-Character Timeout • Channel 0 Modbus Port configuration through entry of configuration values in Modbus

Configuration and Diagnostic File (N100):

Slave Addr : 1 to 127 (0 is broadcast) Parity : None, odd, or even, Stop Bit : 1 or 2 Baud Rate : 300 TO 19,200 RTS Send Delay: 0-2500 ms RTS Off Delay : 0-2500 ms Pre-Send Delay : 0-2500 ms Inter-character : 0-2500 ms

2

Product Overview

1.3 Modbus Slave Protocol Specifications The RTU-5/03 has the following Modbus Slave specifications:

• Protocol modes: RTU mode with CRC-16 error checking ASCII mode with LRC error checking (7 and 8 bit formats) • Supported Modbus Function codes:

1 Read Output Status 2 Read Input Status 3 Read Multiple Data Registers 4 Read Input Registers 5 Force Single Coil (Latch/Unlatch) 6 Preset (Write) Single Data Register 8 Loopback Test (Test 0 only) 15 Multiple Coil Latch/Unlatch 16 Preset (Write) Multiple Data Register

• Supports broadcast commands from Modbus Master • Error Status and Communication Statistics returned to the ladder processor through Modbus

Configuration and Diagnostics File (N100)

3

Quick Start Guide

2 Quick Start Guide The following step-by-step guide has been designed to help get you operational as quickly as possible. Please follow the instructions carefully. At the end of the procedure, if the RTU-5/03 is not working properly, read the troubleshooting section of this manual or call ProSoft Technology’s Technical Support phone.

2.1 Installation Procedure

Step Name Instructions 1 Connect Battery Connect the battery cable as shown in the following

diagram.

2 Install the processor Making sure power is off, insert the processor into slot 0 of the 1746 chassis. The processor must be inserted into the left slot (slot 0), as shown below, while care is taken to remove the plastic wrap from the power supply after installing the RTU-5/03.

3 Apply Power to the Rack

Energize the chassis power supply. Verify that the chassis power supply and processor LEDs are in their correct states:

Installation Procedure (Cont’d)

4

Quick Start Guide

4 Copy sample files to disk

Copy the ladder logic files from the sample diskette to the appropriate subdirectory on the programming station. The following files should be copied using Windows Explorer or the DOS COPY command: Software Source Path Dest Path (Default) APS a:\aps\rtu_smpl.* c:\ipds\arch\slc500 RSLogix 500 a:\rsi\rtu_smpl.* c:\rsi\logix500\project

5 Configure sample program file

The sample program has the following defaults which may be configured by the user prior to downloading to the processor: Parameter Default I/O Rack Size 4 slot Additional I/O None N100 File Autoswitch On Run on Fail Continue comm. Coil Base File 10 (B10/0 to B10/4096) Inputs Base File 12 (B12/0 to B12/4096) Input Reg Base File 14 (N14:0 to N14:255) Holding Reg Base File 16 (N16:0 to N16:255) Float Hold Reg Base File 18 (F18:0 to F18:99) Slave Address 1 Modbus Mode RTU Baud Rate 9600 Stop Bits 1 Parity None Pre-Send Delay 0 RTS Send Delay 0 RTS Off Delay 0 Intercharacter Timeout 0

6 Establish communications to the processor and download program to RTU-5/03

Connect the programming station to the RTU-5/03 processor via one of the standard methods: Channel 0: DF1 Full Duplex 19200 CRC Error Checking Duplicate detect on No parity Channel 1: DH-485 19200 Node Address = 1 Once communicating with the processor, download the program to the RTU-5/03.

7 Place processor in RUN or REM RUN mode

Using the key switch or the programming station, place the processor into the RUN or REM RUN mode. Once in one of these modes, the Modbus driver will be available to operate on Channel 0.

8 Verify LED Status If the RUN LED is in the ON state, the Installation Procedure has been successful. If the FLT LED is ON, the Processor Configuration values (Rack size and I/O modules) must be verified. If any other state, verify that the key switch is not in the PROG position.

2.2 Testing the Modbus Slave Port The simplest test tool we have found for testing a Modbus Slave device such as the RTU-5/03 processor is a Windows based application available off the Internet.

5

Quick Start Guide

We have provided the shareware version of the program on the sample logic diskette under the ‘modscan’ subdirectory. Simply copy this file to your hard drive and ‘Run’ the program from Windows. Operating instructions are available through the Help File along with purchasing instructions. The following cable diagram will show how to connect the RTU-5/03 processor to a PC port to test with the Modscan software.

RTS-CTS jumper must beinstalled on RTU-5/03 to communicate

3

2

7

8

5

4

TxD

RxD

RTS

CTS

GND

DTR

RTU-5/03DB-9 Pin Male

PC PortDB-9 Pin Male

3

2

7

8

5

4

TxD

RxD

RTS

CTS

GND

DTR

6

Modbus Memory Map

3 Modbus Memory Map Although discussed in more detail within other sections of this manual, the following discussion gives an overview of the Modbus memory map in the RTU-5/03. To control the relationship between Modbus Addressing and data table addressing in the RTU-5/03 processor, five (5) configuration values have been provided. These values, called Base File Addresses, act as Modbus Function Code pointers into the data table file structure.

Specifically, the Base File Address value is used to establish the relationship between the Function Code (Modbus Command) and the data table

in the processor with which to read or write data

Output Coil Map: 0xxxx Data Space Output Coils (0xxxx)Base File : [N100:2]

(Example: N100:2 = 10)

[N100:2](Example: B10)

[N100:2] + 1(Example: B11)

0001 up to 4096

4097 up to 8192

SLC File Address Modbus Addressing

1. Sequential files can be addressed on multiples of 4096 (+1) boundaries2. Unused files can be skipped over, but they still consume 4096 bits in the Modbus address range3. Files sizes can range from 1 bit to 4096 bits, but any sequential files are still addressed on the multiple of 4096 (+1) boundary 4. The File Type can be binary(B type) or integer (N type)

Binary Data File

Binary Data File

Command

From Host

BaseFile

Address

Modbus Addressin CommandFrom Host

Data FileAccessed

by Command

FC 1FC 5

FC 15

N100:2(Ex: = 10)

0001 - 40964097 - 8192

B10/0 to B10/4095B11/0 to B11/4095

Discrete Input Map: 1xxxx Data Space

Discrete Inputs (1xxxx)Base File : [N100:3]

(Example: N100:3 = 12)

[N100:3](Example: B12)

[N100:3] + 1(Example: B13)

10001 up to 14096

14097 up to 18192


1. Sequential files can be addressed on multiples of 4096 (+1) boundaries2. Unused files can be skipped over, but they still consume 4096 bits in the Modbus address range3. Files sizes can range from 1 bit to 4096 bits, but any sequential files are still addressed on the multiple of 4096 (+1) boundary 4. The File Type can be binary(B type) or integer (N type)

Binary Data File

Binary Data File

7

Modbus Memory Map

FC 2 N100:3(Ex: = 12)

0001 - 40964097 - 8192

B12/0 to B12/4095B13/0 to B13/4095

CommandFrom Host

BaseFile

Address


Data FileAccessed

by Command

Input Registers: 3xxxx Data Space Input Registers (3xxxx)

Base File : [N100:4](Example: N100:4 = 14)

[N100:4](Example: N14)

N100:0 to N100:49

30001up to 30256

30501up to 30550


N100 Config File(Read Only)

[N100:4] +1(Example: N15)

S2:0 to S2:x 31501up to 315xxS2 Status File(Read Only)

31001up to 31256

Integer Data(Read Only)

Integer Data(Read Only)

[N100:4] +2(Example: N16)

32001up to 32256Integer Data(Read Only)

1. Sequential files can be addressed on multiples of 1000 (+1) boundaries2. Unused files can be skipped over, but they still consume 1000 words in the Modbus address range3. Files sizes can range from 1 to 256 words, but any sequential files are still addressed on the multiple of 1000 (+1) boundary (ie., 3rd file (Base File +2) always begins at 420014. The File Type can be binary (B type), integer (N type), or Float (F type)5 . Floating Point data files must be read with a count of 2 words per float value when the Modbus Address is under 47001 (if >= 47001 then see description for Floating Point Holding Registers (47xxx) )

FC 4 N100:4(Ex: = 14)

30001 -3025630501 -3055031001 -3125631501 -315xx

N14:0 to N14:255N100:0 to N100:49N15:0 to N15:255

S2:0 to S2:X

CommandFrom Host

BaseFile

Address


Data FileAccessed

by Command

8

Modbus Memory Map

Holding Registers: 4xxxx Data Space

Holding Registers (4xxxx)Base File : [N100:5]

(Example: N100:4 = 16)

[N100:5](Example: N16)

N100:0 to N100:49

40001up to 40256

40501up to 40550


1. Sequential files can be addressed on multiples of 1000 (+1) boundaries2. Unused files can be skipped over, but they still consume 1000 words in the Modbus address range3. Files sizes can range from 1 to 256 words, but any sequential files are still addressed on the multiple of 1000 (+1) boundary (ie., 3rd file (Base File +2) always begins at 420014. The File Type can be binary (B type), integer (N type), or Float (F type)5 . Floating Point data files must be read/written with a count of 2 words per float value when the Modbus Address is under 47001 (if >= 47001 then see description for Floating Point Holding Registers (47xxx) )

N100 Config File(Read/Write)

[N100:5] +1(Example: N17)

S2:0 to S2:x 41501up to 415xxS2 Status File(Read/Write)

41001up to 41256

Integer Data(Read/Write)


[N100:5] +2(Example: F18)

42001up to 42256Floating Point Data

(Read/Write)

FC 3FC 6

FC 16

N100:5(Ex: = 16)

40001 -4025640501 -4055041001 -4125641501 -415xx

N16:0 to N16:255N100:0 to N100:49N17:0 to N17:255

S2:0 to S2:X

CommandFrom Host

BaseFile

Address


Data FileAccessed

by Command

9

Modbus Memory Map

Floating Point Holding Registers: 47xxx Data Space

Floating Point Holding Registers (47xxx)

Base File : [N100:6](Example: N100:6 = 18)

[N100:6](Example: F18)

47001up to 47128SLC File Address Modbus Addressing

1. Sequential files can be addressed on multiples of 1000 (+1) boundaries2. Unused files can be skipped over, but they still consume 1000 words in the Modbus address range3. Files sizes can range from 1 to 256 values, but any sequential files are still addressed on the multiple of 1000 (+1) boundary (ie., 3rd file (Base File +2) always begins at 49001)4. The File Type can be Integer (N type), or Float (F type)5. If the Modbus Address is >= 47001 and maps to an N file, then treat as a 16 bit value from a count perspective6. If the Modbus Address is >= 47001 and maps to a F file, then treat as a 32 bit value from a count perspective

[N100:6] +1(Example: F19)

48001up to 48128

Floating Point Data(Read/Write)


[N100:6] +2(Example: N20)

49001up to 49256Integer Data(Read/Write)

FC 3FC 6FC 16

N100:6(Ex: = 18)

47001 -47256 F18:0 to F18:99

CommandFrom Host

BaseFile

Address


Data FileAccessed

by Command

10

N100: Modbus Configuration and Diagnostic File

4 N100: Modbus Configuration and Diagnostic File The RTU-5/03 Channel 0 Modbus Slave driver is configured by values entered into a special N100 integer file. This file, called the Modbus Configuration and Diagnostic File, has a predefined structure that allows the programmer to configure the Modbus communication parameters. In addition the file provides the programmer with Channel 0 Modbus diagnostic status data. The following discussion details the structure of the N100 file and how to create/modify the file.

Cop

mod pr

4.1 Creating the N100 Modbus Configuration and Diagnostic File The N100 Modbus Configuration and Diagnostic File must be created by the RTU-5/03 programmer (See A-B programming documentation if assistance is needed). The following specifications must be followed when creating the file:

File Function

File Type

File Number

File Length

Modbus Config & Diag File N 100 50

Important

If the N100 file is not created with a length greater than or equal to 50 words, and the ‘Modbus’ signature is present in

N100:16 to N100:18, the processor will Major Fault and return a Fault Code of 0xA1.

4.2 The Structure of the Modbus Configuration and Diagnostic File The following table details the structure of the Modbus Configuration and Diagnostic File. This structure is pre-defined and must be adhered to in order for Modbus communications to function properly.

4.2.1 Communication Configuration Parameters

Anytime driver configuration values in the N100 file (words 10 to 19) are changed, the Modbus Driver must either be stopped and

restarted or must be commanded to reconfigure (N100:0 = 4).

These steps are not necessary to accept changes in N100 words 0to 9 as these values are dynamically referenced by the Modbus

Driver.

Use of the N100 file for any other purposes than Modbus onfiguration and Diagnostics may result in the unpredictable eration of the ladder logic program. The Modbus Slave driver ifies the values in N100 during its operation. If the ladder logic

ogram uses N100 for control purposes, the changing values in N100 may cause unexpected and dangerous operation of

equipment.

11


N100 Word

Modbus Addr

Name

Default Value

Valid Range

Description

0 40501 Modbus Command 0 0,1,2,4,8 Value Description 0 Do Nothing 1 Start Modbus 2 Stop Modbus 4 ReRead Configuration 8 Clear Counters

1 40502 AutoSwitch and RunMode Config

0 (Don’t

AutoSwitch and Continue Comm. when

not in run)

0-3 Bit 0 enables the AutoSwitch feature of the Driver.: Bit 0 Description 0 AutoSwitch Off 1 AutoSwitch On When set to 1, if no DH messages are received on Channel 0 in 20 seconds, the Modbus Driver is turned on. If the Modbus driver experiences 5 seconds of communication errors, the Modbus driver is turned off and the DH driver is turned on. Bit 1 determines the failure mode of the Modbus port when the RTU-5/03 is in the PGM/FAULT state : Bit 1 Description 0 Continue communicating 1 Fail the Modbus port When set to 1, Modbus Exception 4 is returned to the Master when the SLC is not in RUN mode.

2 40503 Modbus Data Table Coil Base File Number

0

0 to 255 Selects the first file in the RTU-5/03 that serves as the beginning of the Modbus Coil Area. Modbus address 00001 maps to element 0 bit 0 of this data table. Modbus Functions 1,5,15 use this base file number. An invalid file selection (<0 or >255) will cause a configuration error when the driver is started. If the file does not exist, an error will be generated when a message is received which attempts to reference the nonexistent file.

3 40504 Modbus Data Table Contact Base File Number

0

0 to 255 Selects the first file in the RTU-5/03 that serves as the beginning of the Modbus Contact Area. Modbus address 10001 maps to element 0 bit 0 of this data table. Modbus Function 2 uses this base file number. An invalid file selection (<0 or >256) will cause a configuration error when the driver is started. If the file does not exist, an error will be generated when a message is received which attempts to reference the nonexistent file.

4 40505 Modbus Data Table Input RegisterBase File Number

0

0 to 255 Selects the first file in the RTU-5/03 that serves as the beginning of the Modbus Input Register Area. Modbus address 30001 maps to element 0 of this data table. Modbus Function 4 uses this base file number. An invalid file selection (<0 or >256) will cause a configuration error when the driver is started. If the file does not exist, an error will be generated when a message is received which attempts to reference the nonexistent file.

12


N100 Word

Modbus Addr

Name

Default Value

Valid Range

Description

5 40506 Modbus Data Table Holding Register Base File Number

0

0 to 255 Selects the first file in the RTU-5/03 that serves as the beginning of the Modbus Holding Register Area. Modbus address 40001 maps to element 0 of this data table. Modbus Functions 3,6,16 use this base file number. Addresses larger than 47000 do not use this Base File Number. See word N100:6 Regardless of the File Type, the Number Of Points field is interpreted to mean the number of 2 byte objects. An invalid file selection (<0 or >256) will cause a configuration error when the driver is started. If the file does not exist, an error will be generated when a message is received which attempts to reference the nonexistent file.

6 40507 Modbus Data Table Holding Register Floating Point Base File Number

0

0 to 255 Selects the first file in the RTU-5/03 that serves as the beginning of the Modbus Floating Point Holding Register Area. Modbus address 47001 maps to element of this data table. Modbus Functions 3,6,16 use this base file number if the Address field in the packet is >= 7000. If the file is a Floating Point File, then the Number Of Points field in the packet is interpreted to mean the number of 4 byte Floating Point objects. An invalid file selection (<0 or >256) will cause a configuration error when the driver is started. If the file does not exist, an error will be generated when a message is received which attempts to reference the nonexistent file.

7 40508 Signature1 “Mo” or 19823

19823

8 40509 Signature2 “db” or 25698

25698

9 40510 Signature3 “us” or 30067 30067

“Modbus” Signature. If the word Modbus does not appear in N100:16 through N100:18, the Modbus features of the processor are disabled. No errors are reported in this case. The purpose of this signature is to reduce the chance of unexpected behavior if the processor is accidentally installed in place of a standard SLC 5/03. The signature must be exactly Modbus, including uppercase ‘M’ and lowercase ‘odbus’. ATTENTION: this safety mechanism is not foolproof.

10 40511 Modbus Slave Address

0 (Generates

Configuration Error)

1 – 127 The Modbus Slave Address that the RTU-5/03 will use to determine which commands to respond to. There should not be more than one slave on a network with the same address.

11 40512 Modbus Mode 0 (RTU Mode)

0 to 2 Selects the Modbus Mode which the port will use to decode commands from a host. The following modes are available: Value Description 0 Modbus RTU (Binary) 1 Modbus ASCII - 7 bit 2 Modbus ASCII - 8 bit

13


N100 Word

Modbus Addr

Name

Default Value

Valid Range

Description

12 40513 Baud Rate 0 (9600 baud)

0 to 6 Selects the baud rate that the port will use to communicate with the host. Value Description 0 9600 1 600 2 1200 3 2400 4 4800 5 9600 6 19200 Note that this value may be different than the value configured for the programming port

13 40514 Stop Bits 0 (1 Stop Bit)

0 to 1 Selects the number of stop bits which the port will use when communicating: Value Description 0 or 1 1 Stop Bit 2 2 Stop Bits

14 40515 Parity 0 (No Parity)

0 to 2 Selects the parity configuration which the port will use when communicating: Value Description 0 None 1 Odd 2 Even

15 40516 Pre-Send Delay 0 (No Delay)

0 to 2500 Pre-Send Delay is the amount of time that the processor adds in front of asserting RTS of a response (ie., the delay before responding). This time begins when the Command Request is received (LF in ASCII or Timeout in RTU). RTS is asserted at the end of this time period.

16 40517 RTS Send Delay 0 (No Delay)

0 to 2500 RTS Send Delay is the time after asserting RTS prior to transmitting the first character. If CTS is on at the end of RTS Send Delay, the first character is transmitted. If CTS is not on, the slave waits up to 1 second for it. If it is not on within 1 second, the packet transmission is aborted. This delay is sometimes used to provide key-up time for radio modems.

17 40518 RTS Off Delay 0 (No Delay after last

character)

0 to 2500 RTS Off Delay is used to increase the time after the last transmitted character before RTS is dropped. This feature is sometimes useful in noisy radio and modem systems when trailing noise will bother the receiving master. The value configured in this parameter should never exceed the Master’s message handling turnaound time (i.e., a slave’s RTS should not be asserted while the Master is transmitting).

14


N100 Word

Modbus Addr

Name

Default Value

Valid Range

Description

18 41519 Inter-character Timeout

0 (RTU – 3.5 characters

ASCII – 1

sec)

0 to 2500 In satellite systems, or really in any packet radio type of system that is used today, a data packet can get broken down into several separate packets when being sent. As a result a time delay of up to 200 ms sometimes can exist between packets on the receiving end when these packets are coming in. The Modbus RTU mode uses a 3.5 character width quiet time to define the end of a message. As an example, at 9600 baud this works out to about 3.5 ms. Without Inter-Character Delay, the slave would timeout in the middle of a message and then error and not respond. With a configurable inter-character timeout, the user can override the 3.5 character delay and enter a new value. Note that often the ASCII mode is also used to overcome this problem since the character timeout in this mode is normally set to 1000 ms.

19 40520 Reserved

4.2.2 Status and Diagnostic Data (Output values from Modbus Driver)

N100 Word

Modbus Addr

Name

Range

Description

20 40521 Status Bits 1,2 Reports the current state of the Modbus Driver: Value Description 1 Modbus Active 2 Modbus Off If N100 is not the right size or the signature is not correct, this field will not be updated, so will not correctly indicate the Modbus Status. To verify that the value is valid, overwrite it manually and see that the Modbus System puts it back to a 1 or 2. Only bits 0 and 1 are affected. Other bits are meaningless and should be set to 0.

21 40522 Error Code for Configuration and Application Layer Errors

0-112 Value Description 0 All Ok 1 Both On and Off Cmd set

2 Bad Baud 3 Bad RTS Send Delay 4 Bad RTS Off Delay 5 Bad Pre Send Delay 6 Bad InterChar Timeout 7 Bad Parity config 8 Bad Stop Bit config 9 Bad Modbus Mode 10 Bad Node Address 11 Channel in User Mode 12 Bad Base File Number 101 Msg too short 102 FNC cant Broadcast 103 FNC not supported 104 Bad length (exceeds data

table end) 105 Bad Data Address 106 No such Data Table 107 Bad Data values 108 Bad Count value 109 Bad Msg Length 110 Not in Run Mode 111 Channel Write Protected 112 Table Write Protected

15


N100 Word

Modbus Addr

Name

Range

Description

22 40523 Application Layer Error Count 0 to 32767 Rollover counter of the number of messages which generated an application layer error.

23 40524 Error FNC code 0 to 255 Value of FNC field of last message that caused an application layer error. This value is updated every time an error code is returned to the host.

24 40525 Last Transmitted Exception Code

1 to 8 Value of Exception code in last Exception Response transmitted to Master. Value Description

1 Illegal Function 2 Illegal Data Address. Perhaps

data table does not exist. 3 Illegal Data Value. Count field

exceeds data table size or Coil Write data not correct.

4 Slave Device Failure. Not in RUN mode or Table/Channel Write protected.

5 Acknowledge. Unused. 6 Slave Device Busy. Unused. 7 Negative Acknowledge.

Unused. 8 Memory Parity Error. Unused.

Look in N100:20 for more details regarding the error which caused an Exception Response. This value is updated every time an error code is returned to the host.

25 40526 Data Table number of Error Request

0 to 255 SLC data table number (file number) which was the attempted target of the last message which caused an application error. Use this field to diagnose Exception 2 and 3 replies, which indicate that the address did not map to a valid location This value is updated every time an error code is returned to the host.

26 40527 Element Number of Error Request

0 to 255 SLC element number (word number) which was the attempted target of the last message that caused an application error. Use this field to diagnose Exception 2 and 3 replies, which indicate that the address did not map to a valid location. Check that the target data table has at least this number of elements. This value is updated every time an error code is returned to the host.

27 40528 Active Function Code Bits 0 to 8 A bit packed word indicating the type of command that was successfully processed by the port for this slave Bit Function 0 1 1 2 2 3 3 4 4 5 5 6 6 8 7 15 8 16

16


N100 Word

Modbus Addr

Name

Range

Description These bits may optionally be cleared in ladder logic or via communication channel write. The bits are updated at the end of ladder scan or during SVC instruction.

28 40529 Reserved 29 40530 Reserved 30 40531 FC 1 Message Counter 0 to 32767 Rollover counter that increments every time a

Function Code 1 is seen addressed to this slave.

31 40532 FC 2 Message Counter 0 to 32767 Rollover counter that increments every time a Function Code 2 is seen addressed to this slave.








39 40540 Reserved 40 40541 Modem Status Bit map of Modem Control Line status 41 40542 Link Layer Error 0 to 200 Last error encountered by Link Layer

Value Description 0 No receive buffers available 1 Unexpected ‘:’ 2 Unexpected char (usually a non-

hex digit in ASCII mode). 3 Msg too long 4 UART Error. Framing,Parity,

Break. Check bit, baud, parity settings.

5 Bad LRC or CRC 6 Msg too short 7 Invalid Receive State 8 Interchar timeout 100 CTS timeout 101 CTS drop mid packet 102 Driver shutdown mid-packet

42 40543 Link Layer Error Count 0 to 32767 Count of Link Layer Errors 43 40544 Messages to this slave 0 to 32767 This rollover counter increments every time a

command is received which has a slave address which matches the configured Modbus slave address

44 40545 Total messages seen 0 to 32767 This rollover counter increments every time a command is seen on the Modbus port, no matter who the command is for. This counter may be used as a network activity counter.

17


N100 Word

Modbus Addr

Name

Range

Description

45 40546 Messages responded by this slave

0 to 32767 This rollover counter increments every time a response is issued by the RTU-5/03. Note that this counter increments whether the response is a data response or an error code response.

46 40547 Reserved 47 40548 Reserved 48 40549 Reserved 49 40550 Reserved

Note that all counters are rollover counters and are reset when the Modbus Driver is started (on AutoSwitch following RTU-5/03 power up or download), when N100:0/0 Start bit or N100:0/4 Clear Counters Bit is set

4.3 Modbus Diagnostic File Error Code values The Modbus Slave driver returns error codes to the Diagnostic file. This data will be useful for diagnosing the status of the Modbus Slave port communications. Note that in all cases, if a zero is returned, there was not an error. Valid Error Status Codes are as follows:

Code Name Description

0 All OK The port is operating as desired 1 Illegal Function An illegal function code request is being attempted 2 Bad Data Address The address, or the range of addresses, covered by a

request from the host is not within allowed limits 3 Bad Data Value The value in the data field of the command from the

host is not allowed. 4 Incomplete Response

Detected This error indicates that an incomplete query was received from a host query. This indicates that the slave port is timing out too quickly (i.e., application may require some Inter-character Timeout Delay) or that the host query is getting abbreviated, possibly by the transmitting modem (last character getting dropped).

6 Module Busy The module busy status code is returned when a write command from the master cannot be completed.

8 Timeout Error Communications with the addressed slave have been unsuccessful due to a lack of response from the slave. The Master port will attempt a command three times before moving onto the next command.

10 Buffer Overflow The receive buffer has overflowed and reset the character count to 0. If this condition occurs try reading fewer parameters at one time

16 Port Configuration Error

One or more of the serial port configuration values has been mis-configured. To determine the exact source of the problem, verify the following:

- Slave Address - Parity Configuration - Stop Bit Configuration - Baud Rate Configuration - Modbus Data Table First File

254 Checksum Error The slave determined that the message checksum

was in error, and therefore discarded the message 255 TX Hardware Timeout A transmit timeout condition has occurred indicating

that the port was not able to begin transmiit prior to the RTS Send Delay timing out. Verify that the RTS-CTS jumper on the port is still connected

18

N100: Modbus Configuration and Diagnostic File 4.3 Activating the Modbus Slave Driver

Two mechanisms are available for turning on and off the Modbus Slave Driver. - Manual Start/Stop - AutoSwitch

4.3.2 Manual Modbus Driver Start and Stop

To configure the driver for Manual Start Stop, clear bit N100:1/0 (Disable AutoSwitch) to 0. When you want to use Modbus protocol, instead of the configured DataHighway protocol on channel 0, set bit N100:0/0 to 1. If the configuration file is valid, N100:0/0 will be reset to 0 and N100:20/0 will be set. This indicates that the Modbus driver is active. When you want to cease Modbus communication and resume Data Highway (for example for updating or monitoring the ladder program), Set bit N100:0/1 to 1 (i.e. write the N100:0 word to 2). N100:0/1 and N100:20/0 will be reset and N100:20/1 will be set. This indicates the Modbus driver is no longer active. If the driver does not start when commanded, look for configuration errors reported in N100:21. If the N100:0/0 bit does not get set back to zero, make sure the N100 file is at least 50 words long and has the word “Modbus” at word N100:7 through 9. See also Troubleshooting section. To get the Modbus driver to automatically start when the Ladder Program starts, use the First Pass Bit (S:1/15) to latch N100:0/0. The Start/Stop bits may be manipulated using ladder logic, data table monitoring software or physical inputs from an input card.

4.3.2 AutoSwitch Mode AutoSwitch attempts to automatically install the correct driver based on Channel 0 activity. To configure the driver for AutoSwitch, set bit N100:1/0 (Enable AutoSwitch) to 1. When the SLC starts (following powerup or download, or driver configuration), the selected Channel 0 System Mode driver is active. If no Data Highway messages are received on Channel 0 for 20 seconds, the Modbus driver is automatically installed. Bit N100:20/0 is ON when the Modbus driver is installed. If there is either no activity, or valid Modbus messages, the Modbus driver remains installed. If the Modbus driver detects non-Modbus activity for 5 seconds, with no intervening valid Modbus activity, the Modbus driver is turned off and the Data Highway driver is automatically reinstalled. The cycle repeats as needed. The Modbus and Data Highway drivers need not use the same protocol settings (baud, bits, parity). When configured for AutoSwitch, Note that bits N100:0/0 and /1 can still be used, but the driver will switch back after a brief time if the AutoSwitch criteria are met. Note that the driver will not AutoSwitch (or manual switch) from the User Mode Channel 0 Driver. Channel 0 must be configured for System Mode. If using programming software such as RSLogix, several On-line requests may be necessary to get Modbus to switch off and Data Highway to switch on. This is because 5 seconds of non-Modbus activity are required, and the DF1 driver will only retry a message 2 or 3 times before giving up. If you ask to go On-line again, it will try 2 or 3 times again. Usually within 3 On-line requests the Modbus Driver will AutoSwitch to Data Highway.

19

Supported Modbus Function Codes

5 Supported Modbus Function Codes The Modbus Function Codes that are supported by the RTU-5/03 can be broken down into read and write commands. The Function Code issued by the host to determine the range of addresses that are either read or written to. This section details the RTU-5/03 data table addresses that are accessed by each Function Code.

5.1 Modbus Read Function Codes The following table details the Modbus Read commands that are supported by the RTU-5/03:

Function Code

Command Name

Modbus Addressing

Description

1 Read Coil Image

0001 to 4096-File 1 4097 to 8192-File 2 etc.

This command returns bit level data in response to queries for coil data. Key points about this command includes: 1) The host can address multiple files on a 4097 bit

address boundary 2) The host can issue read commands which cross

file boudaries 3) Binary and Integer files can be addressed

2 Read Input Image


This command returns bit level data in response to queries for Discrete Input data. Key points about this command includes: 1) The host can address multiple files on a 4097 bit

address boundary 2) The host can issue read commands which cross

file boudaries 3) Binary and Integer files can be addressed

Read Holding Registers - Integers (Under 47001)

40001 to 40256-File 1 40501 to 40550-N100 41001 to 41256-File 2 41501 to 415xx-S2 42001 to 42256-File 3 etc.

This command gives read access to integer values in the data table. Valid file types include N, B, F (if the count value is two words per float). Note that the driver gives read and write access to two special locations in the data table memory: 1) The N100 file is addressable starting at 40501 2) The S2 file is addressable starting at 41501

3

Read Holding Registers - Floating Point (GEQ 47001)


When a FC 3 command is addressed at 47001 or above, the Modbus driver will return the following: 1) If the file is a floating point type, the driver will

return two words per count requested 2) If the file is an integer type, the driver will return

one word per count requested 4 Read Input

Registers 30001 to 30256-File 1 30501 to 30550-N100 31001 to 31256-File 2 31501 to 315xx-S2 32001 to 32256-File 3 etc.

This command gives read access to integer values in the data table. Valid file types inclide N, B and F (if the count value is two words per float).

5.2 Modbus Write Commands The following details the Modbus Write commands that are supported by the RTU-5/03:

Function Code

Command Name

Modbus Addressing

Description

5 Set/Reset Coils


This command will set/reset a single bit in a B or N file.

20

Supported Modbus Function Codes

Write Single Register- Integers (Under 47001)

40001 to 40256-File 1 40501 to 40550-N100 41001 to 41256-File 2 41501 to 415xx-S2 42001 to 42256-File 3 etc.

This command gives read access to integer values in the data table. Valid file types include N, B, F (if the count value is two words per float). Note that the driver gives read and write access to two special locations in the data table memory: 1) The N100 file is addressable starting at 40501 2) The S2 file is addressable starting at 41501

6 Single Regs

16

Multiple Regs

Write Holding Registers - Floating Point (GEQ 47001)


When one of these commands is addressed at 47001 or above, the Modbus driver will allow the following: 1) If the file is a floating point type, the driver will

expect two words per count requested 2) If the file is an integer type, the driver will expect

one word per count requested 15 Write Multiple

Coils 0001 to 4096-File 1 4097 to 8192-File 2 etc.

This command will set/reset multiple bits in a B or N file.

21

Troubleshooting

6 Troubleshooting The following sections provide the information necessary for a programmer to troubleshoot the Modbus port on the RTU-5/03.

6.1 RTU-5/03 ‘Modbus’ LED Indicator When the RTU-5/03 Modbus port is active, the ‘Modbus’ LED Indicator on the front of the processor can provide some visual indication of the Modbus port status.

Note The behavior of the Modbus LED only applies when the Modbus Driver is active, otherwise refer to SLC documentation for LED

operation

LED Action Description Off The Modbus is not receiving a command with a Modbus Slave

address matching the value configured in the N100 file

Toggling The LED will toggle under two conditions: 1. When a command is received which matches the RTU-

5/03’s Modbus Slave address, the LED will toggle, whether the command is legal or not.

2. When the RTU-5/03 generates a response, the LED will stay for the duration of the response (i.e., until the transmit buffer is emptied)

6.2 Processor Faults

In addition to the Major Fault code documented in the SLC Fault Codes (See SLC documentation), the RTU-5/03 will generate several unique fault codes under certain conditions. The new fault codes that have been added are:

Fault Code Description 0xA0 Indicates that an internal firmware error has occurred within

the Modbus driver code. If this fault code occurs, the contents of the N100 file ( words 0 to 49) should be documented and reported to ProSoft (See Section 7 or contact information)

0XA1 This fault code will be generated under the following condition: If the ‘Modbus’ signature is found in words 7 to 9 in the N100 file, but the length of the file is not greater than or equal to 50 words

6.3 Troubleshooting Tips The following table details some of the conditions that can cause problems in the operation of the Modbus Slave port. Suggested solutions are also provided. If the suggested solution does not clear the problem, please contact ProSoft directly for assistance.

Error Condition Description Items to Check Processor Major Fault Code 0xA1

The RTU-5/03 will return a Major Fault (Non-recoverable) code of 0xA1 if the processor is placed in RUN with the ‘Modbus’ signature in N100:16 to N100:18 with an

1. Verify that the file N100 has a length of at least 50 words.

22

Troubleshooting

N100 length of less than 50 words.

Error Condition Description Items to Check Fault, BATT and Modbus LEDs blink at once

If these three LEDs blink it means that the RTU-5/03 hardware is not compatible with the OS which has been loaded in the 5/03 flash. The RTU-5/03 will not run with standard SLC 5/03 OS firmware.

1. Contact ProSoft Technology technical support

Modbus Error Code 1 returned to Host

This value is returned whenever a Function Code is received from a host which is not supported by the RTU-5/03

1. Verify that the Host is sending a Function Code which is supported by the RTU/5-03


This value is returned when the Start Address in the request from the Host exceeds the length of the data file in the RTU-5/03

1. Verify that the RTU-5/03 data file addressed by the command exists and with sufficient length to meet the needs of the requests from the host.


This value is returned when the Count field in a request causes the file boundary in the RTU-5/03 to be exceeded, or when the request exceeds the length supported by the protocol

1. Verify that the length of the read or write request from the host does not cause a file boundary to be crossed. The RTU-5/03 will not cross file boundaries to satisfy data requests

2. Verify that the lenght of the request does not exceed that allowed by the Modbus protocol or the driver implementation:

Coils 2000 Registers 125


This value is returned when the host has attempted to write to a data table in the RTU-5/03 that is Protected (either Static or constant)

1. Verify that the data location being addressed by the host is correct

2. If the data memory is to have write access, then verify the Protection state.

6.3 Modbus Diagnostic File Error Code values The Modbus Slave driver returns error codes to the Diagnostic file. This data will be useful for diagnosing the status of the Modbus Slave port communications. Note that in all cases, if a zero is returned, there was not an error. Valid Error Status Codes are as follows:

Code Name Description 0 All OK The port is operating as desired 1 Illegal Function An illegal function code request is being attempted 2 Bad Data Address The address, or the range of addresses, covered by a

request from the host is not within allowed limits 3 Bad Data Value The value in the data field of the command from the

host is not allowed. 4 Incomplete Response

Detected This error indicates that an incomplete query was received from a host query. This indicates that the slave port is timing out too quickly (i.e., application may require some Inter-character Timeout Delay) or that the host query is getting abbreviated, possibly by the transmitting modem (last character getting dropped).

6 Module Busy The module busy status code is returned when a write command from the master cannot be completed.

8 Timeout Error Communications with the addressed slave have been unsuccessful due to a lack of response from the slave. The Master port will attempt a command three times before moving onto the next command.

23

Troubleshooting

Code Name Description 10 Buffer Overflow The receive buffer has overflowed and reset the

character count to 0. If this condition occurs try reading fewer parameters at one time

16 Port Configuration Error

One or more of the serial port configuration values has been mis-configured. To determine the exact source of the problem, verify the following:

- Slave Address - Parity Configuration - Stop Bit Configuration - Baud Rate Configuration - Modbus Data Table First File

254 Checksum Error The slave determined that the message checksum

was in error, and therefore discarded the message 255 TX Hardware Timeout A transmit timeout condition has occurred indicating

that the port was not able to begin transmit prior to the RTS Send Delay timing out. Verify that the RTS-CTS jumper on the port is still connected

24

Cable Connections

7 Cable Connection – Channel 0 The following diagrams details the physical connection to the Channel 0 port when the port is active as a Modbus Slave and when the port is being used as a programming port.

7.1 Cable configuration for Modbus Communications The following cable diagrams identify the pin out on the RTU-5/03 RS-232 port and the cable configuration using the most common connections.

Important Note The RTU-5/03 absolutely requires that CTS be activated in order to transmit. This requirement is independent of whether connected to a

modem network or point-point with a PC. If in doubt, jumper RTS to CTS (Pin 7 to 8)

The direct connection diagram should be used when connecting the port directly to another DTE device (i.e., another computer or similar device). The direct connection diagram can also be used under some circumstances with ‘soft-keyed’ radios and/or modems.

Direct Connection Diagram Need to verify this port connection diagram on pins 2 & 3.

RTS-CTS jumper must beinstalled on RTU-5/03 to communicate

3

2

7

8

5

4

TxD

RxD

RTS

CTS

GND

DTR

RTU-5/03DB-9 Pin Male

PC PortDB-9 Pin Male

3

2

7

8

5

4

TxD

RxD

RTS

CTS

GND

DTR

The modem connection should be used when interfacing the RTU-5/03 port to a modem and/or radio modem which requires hardware handshaking signals. Under most circumstances, the important signals to connect will be the RTS/CTS signals, which will control the transmit state of the modem.

25

Troubleshooting

8 Technical Support Technical support for the ProSoft Technology RTU-5/03 processor can be broken down into two categories to help clarify who to call for support:

1. Modbus on Channel 0 related issues 2. All other issues

8.1 Modbus on Channel 0 Related Issues

If any technical support issues relating to the application of the Channel 0 Modbus port arise, these should be directed to ProSoft Technology, Inc. Examples of issues that should be directed to ProSoft include:

1. RTU-5/03 Hardware warranty issues 2. Modbus Configuration and Diagnostic File questions 3. Modbus port not functioning 4. Modbus Error Codes being returned 5. Processor returning Major Fault Code XX (See Troubleshooting section) 6. Modbus addressing questions

Contact information for ProSoft Technology, Inc. is as follows:

ProSoft Technology, Inc. 1675 Chester Avenue, 4th Floor

Bakersfield, CA 93301 (661) 716-5100 Phone

(661) 716-5101 Fax [email protected]

http://www.prosoft-technology.com

8.2 Non-Modbus Related Issues All non-Modbus related technical support issues should be directed to the local A-B Technical Support office. Examples of the type of questions and issues which should be directed to the A-B Technical Support resource include:

1. Ladder logic programming questions 2. Rack and hardware configuration questions

26

ProSoft Technology, Inc. RTU-5/03 Processor for Allen ... · RTU-5/03 Processor for Allen-Bradley SLC Modular Racks Catalog Numbers : 3250-L532M RTU-5/03 Processor with 16 K RAM ...

Documents