#4 modbus rtu tcp

Confidential / Property of Danfoss Drives A/S

2009-June-22

Flemming Huusmann DD-SMPM 1Drives Division

Modbus for VLTModbus for VLT®®FC-seriesFC-series66


2009-June-22


Agenda

• OverviewOverview • Modbus ASCII/RTUModbus ASCII/RTU• Frame Structure Frame Structure • Exception codesException codes• Function codesFunction codes• CoilsCoils• Holding registersHolding registers• Drive parametersDrive parameters• RS-485RS-485

Modbus RTU for FC 100Modbus RTU for FC 100


2009-June-22


Overview


• MODBUS Protocol is a messaging structure created by MODICONMODBUS Protocol is a messaging structure created by MODICON

company to connect PLC to programming tools.company to connect PLC to programming tools.

• It is now widely used to establish master-slave communication betweenIt is now widely used to establish master-slave communication between

intelligent devices.intelligent devices.

• MODBUS is independent of the physical layer.MODBUS is independent of the physical layer.

• It can be implemented using RS232, RS422, or RS485 or over a varietyIt can be implemented using RS232, RS422, or RS485 or over a variety

of media (e.g. fibre, radio, cellular, etc...). of media (e.g. fibre, radio, cellular, etc...).


2009-June-22


MODBUS is independent of the physical layer:


Modbus Application LayerModbus Application Layer

OtherOther

OtherOther

Modbus+/HDLCModbus+/HDLC

RS-485RS-485

Master/SlaveMaster/Slave

RS-485/RS-232RS-485/RS-232

Ethernet II Ethernet II 802.3802.3

Ethernet Ethernet physical layerphysical layer

Modbus on TCPModbus on TCP

TCPTCP

IPIP

Modbus +Modbus + Modbus RTUModbus RTU


2009-June-22


Modbus ASCII and Modbus RTU


The MODBUS protocol comes in 2 versions :The MODBUS protocol comes in 2 versions :

• ASCII transmission mode:ASCII transmission mode:

Each eight-bit byte in a message is sent as 2 ASCII characters. Each eight-bit byte in a message is sent as 2 ASCII characters.

• RTU transmission modeRTU transmission mode

Each eight-bit byte in a message is sent as two four-bit hexadecimal characters. Each eight-bit byte in a message is sent as two four-bit hexadecimal characters.

The main advantage of the RTU mode is that it achieves higher throughput.The main advantage of the RTU mode is that it achieves higher throughput.

ASCII mode allows time intervals of up to 1 second to occur between characters without ASCII mode allows time intervals of up to 1 second to occur between characters without causing an error (e.g. bar-code scanners).causing an error (e.g. bar-code scanners).


2009-June-22


Modbus frame structure


The Modbus frame structure is the same for requests (master -> slave) and responses The Modbus frame structure is the same for requests (master -> slave) and responses (slave -> master):(slave -> master):

Address ChecksumDataFunction

Modbus ASCII:Modbus ASCII:

Start CR LF

Address ChecksumDataFunctionsilence silence

Silence >= 3.5 characters

Modbus RTU:Modbus RTU:

3A hex 0D hex 0A hex


2009-June-22


Address field


• Valid slave device addresses are in the range of 0 ... 247 decimal.Valid slave device addresses are in the range of 0 ... 247 decimal.

• The individual slave devices are assigned addresses in the range of 1 ... 247.The individual slave devices are assigned addresses in the range of 1 ... 247.

• Value 0 is reserved for broadcast messages (no response). Value 0 is reserved for broadcast messages (no response).

Request:Request:

A master addresses a slave by placing the slave address in the address field ofA master addresses a slave by placing the slave address in the address field of

the message. the message.

Response:Response:

When the slave sends its response, it places its own address in this address fieldWhen the slave sends its response, it places its own address in this address field

of the response to let the master know which slave is responding.of the response to let the master know which slave is responding.



2009-June-22


Function Field


• Valid codes are in the range of 1 -> FF hex.Valid codes are in the range of 1 -> FF hex.

Request:Request:

The function code field tells the slave what kind of action to perform.The function code field tells the slave what kind of action to perform.

Response:Response:

For a normal response, the slave simply echoes the original function code.For a normal response, the slave simply echoes the original function code.

For an exception response, the slave returns a code that is equivalent to the original For an exception response, the slave returns a code that is equivalent to the original function code with its most significant bit set to a logic 1.function code with its most significant bit set to a logic 1.



2009-June-22


Data Field


Request:Request:

The data field contains additional information which the slave must use to take the action The data field contains additional information which the slave must use to take the action defined by the function code. This can include items like register addresses, quantity of defined by the function code. This can include items like register addresses, quantity of items to be handled, etc... items to be handled, etc...

Response:Response:

If no error occurs, the data field contains the data requested.If no error occurs, the data field contains the data requested.

If an error occurs, the field contains an exception code that the master application can use If an error occurs, the field contains an exception code that the master application can use to determine the next action to be taken.to determine the next action to be taken.



2009-June-22


FC 100 Modbus Exception Codes


code in data field

Exception code description

0x00 The parameter number does not exist

0x01 There is no write access to the parameter

0x02 The data value exceeds the parameter limits

0x03 The sub-index in use does not exist

0x04 The parameter is not of the array type

0x05 The data type does not match the parameter called

0x06 Only reset

0x07 Not changeable

0xB No write access

0x11 Data change in the parameter called is not possible in the present mode

0x12 Other error

0x40 Invalid data address

0x41 Invalid message length

0x42 Invalid data length or value

0x43 Invalid function code

0x82 There is no bus access to the parameter called

0x83 Data change is not possible because factory set-up is selected


2009-June-22


Checksum Field


• Modbus RTU uses CRC:Modbus RTU uses CRC: Cyclical Redundancy Check (2 byte) Cyclical Redundancy Check (2 byte)

• Modbus ASCII uses LRC: Modbus ASCII uses LRC: Longitudinal Redundancy Check (1 bytes) Longitudinal Redundancy Check (1 bytes)

Request:Request:

The checksum is calculated by the master and sends to the slave.The checksum is calculated by the master and sends to the slave.

Response:Response:

The checksum is re-calculated by the slave and compared to the value sent by the master.The checksum is re-calculated by the slave and compared to the value sent by the master.

If a difference is detected, the slave will not construct a response to the master.If a difference is detected, the slave will not construct a response to the master.



2009-June-22


Modbus RTU Frame example:


Function code = 03hex : Read Holding Registers...Function code = 03hex : Read Holding Registers...

SlaveAddress

CRC16First word address

Function code=0x03

Number of words to read

1 byte 1 byte 2 bytes 2 bytes 2 bytes

Response :Response :

SlaveAddress

CRC16Number of bytes read

Function code=0x03

Value of the first word


Value of the last word

2 bytes

Request :Request :


2009-June-22




Function code = 06hex : Write single RegisterFunction code = 06hex : Write single Register

SlaveAddress

CRC16Word

addressFunction

code=0x06Value of word



SlaveAddress

CRC16Word addressFunction

code=0x06Value of word


Request :Request :


2009-June-22




Function code = 10hex : Write Multiple RegistersFunction code = 10hex : Write Multiple Registers


Request :Request :

SlaveAddress


Function code=0x10

Number of words to write



Number of bytes

1 byte 2 bytes

SlaveAddress

CRC16Function

code=0x10


First word address



2009-June-22


Supported Modbus Function Codes in FC 100


• The Function Code tells what type of Modbus telegram it is...The Function Code tells what type of Modbus telegram it is...

Function Function code

Read coils 1 hex

Read holding registers 3 hex

Write single coil 5 hex

Write single register 6 hex

Diagnostics* 8 hex

Write multiple coils F hex

Write multiple registers 10 hex

Get comm. event counter B hex

Report slave ID* 11 hex

Read Device Identification* 2B hex

* =* =


2009-June-22


Supported Modbus Function Codes


• Function Code 8: DiagnosticsFunction Code 8: Diagnostics


Sub-function code Sub-function

Diagnostics 8

1 Restart communication

2 Return diagnostic register

10 (0xA) Clear counters and diagnostic register

11 (0xB) Return bus message count

12 (0xC) Return bus communication error count

13 (0xD) Return bus exception error count

14 (0xE) Return slave message count


2009-June-22




• Function Code 8: Diagnostics, sub-function 2 Function Code 8: Diagnostics, sub-function 2 Return diagnostics registerReturn diagnostics register



Diagnostics 8 2 Return diagnostic register

Description Length Data

MSB Function code 1 byte 0x08

Sub-function code 2 bytes 0x0002

4 bytes Alarm word

LSB 4 bytes Warning word

• Response:Response:


2009-June-22







Diagnostics 8 11 Return Bus Message Count



Sub-function code 2 bytes 0x000B

LSB Data 2 bytes Par. 8-80 Bus Message Count



2009-June-22







Diagnostics 8 12 Return bus communication error count




Sub-function code 2 bytes 0x000C

LSB Data 2 bytes Par. 8-81 Bus Error Count


2009-June-22







Diagnostics 8 13 Return slave message count




Sub-function code 2 bytes 0x000D

LSB Data 2 bytes Par. 8-83 Slave Error Message Count


2009-June-22







Diagnostics 8 14 Return slave message count




Sub-function code 2 bytes 0x000E

LSB Data 2 bytes Par. 8-82 Slave Message Count


2009-June-22




• Function Code 11hex: Function Code 11hex: Report Slave IDReport Slave ID

Function Length Data


Byte count 1 byte 1-251(N)

Slave ID 0-250 bytes Slave ID

LSB Run status Indicators 1 bytes 0x00 or 0xFF


FC Parameter

Name

15-40 FC Type

15-41 Power section

15-42 Voltage

15-43 SW version

• 0x00 if coil ‘Stopped / Running’ is 0 (coil no. 44)0x00 if coil ‘Stopped / Running’ is 0 (coil no. 44)

• 0xFF if coil ‘Stopped / Running’ is 1 (coil no. 44)0xFF if coil ‘Stopped / Running’ is 1 (coil no. 44)


2009-June-22




• Function Code 2Bhex: Function Code 2Bhex: Device IdentificationDevice Identification


MSB Function code 1 byte 0x2B

MEI type 1 byte 0x0E

Read device ID code 1 byte 1 or 2 or 3 or 4

Conformity level 1 byte 1 or 2 or 3 or 81 or 82

More Follows 1 byte 0x00 or 0xFF

Next Object ID 1 byte Object ID number

Number of objects 1 byte 0x00 – 0x0F

1st object ID 1 byte

1st object length 1 byte

1st object Value 1st obj. length

...

LSB ...


Device Ident.Device Ident.


2009-June-22


Device Identification


FC Parameter Name Modbus Obj. ID Modbus description

15-51 FC Serial 0x80 Private object

15-60 [0] Option: Slot A 0x81 Private object

15-61 [0] Option SW: Slot A 0x82 Private object

15-62 [0] Opt. ord. no.: Slot A 0x83 Private object

15-60 [1] Option: Slot B 0x84 Private object

15-61 [1] Option SW: Slot B 0x85 Private object

15-62 [1] Opt. ord. no.: Slot B 0x86 Private object

15-60 [2] Option: Slot C0 0x87 Private object

15-61 [2] Option SW: Slot C0 0x88 Private object

15-62 [2] Opt. ord. no.: Slot C0 0x89 Private object

15-60 [3] Option: Slot C1 0x8A Private object

15-61 [3] Option SW: Slot C1 0x8B Private object

15-62 [3] Opt. ord. no.: Slot C1 0x8C Private object

15-45 Option: Slot D 0x8D Private object


2009-June-22


Coils (single bit)


Coil number Description Signal direction

1 – 16 Frequency converter control word Master -> slave

17 – 32 Frequency converter speed or set-point referenceRange 0x0 – 0xFFFF (-200% ... ~200%)

Master -> slave

33 – 48 Frequency converter status word Slave -> master

49 – 64 Open loop mode: Frequency converter output frequencyClosed loop mode: Frequency converter feedback signal

Slave -> master

65 Parameter write control Master -> slave

0 = Parameter changes are written to the RAM of the frequency converter

1 = Parameter changes are written to the RAM and EEPROM of the frequency converter.

66 - 65536 Reserved


2009-June-22


Holding registers (words)


Register number Description

00001 – 00006 Reserved

00007 Last error code from an FC data object interface

00008 Reserved

00009 Parameter index*

00010 – 00999 000 parameter group (parameters 001 through 099)





… …


50000 Input data: Frequency converter control word register (CTW).

50010 Input data: Bus reference register (REF).

… …

50200 Output data: Frequency converter status word register (STW).

50210 Output data: Frequency converter main actual value register (MAV).


2009-June-22


Holding registers (words), addressing


• Holding register 00001 is addressed as register 40001 in the data address Holding register 00001 is addressed as register 40001 in the data address field of the message.field of the message.

• The function code field already specifies a ‘holding register’ operation. The function code field already specifies a ‘holding register’ operation. Therefore, the ‘4XXXX’ reference is implicit. Therefore, the ‘4XXXX’ reference is implicit.

Example:Example: Par 0-01 Par 0-01 Language:Language:

Example:Example: Par 20-21 Par 20-21 Feedback: Feedback: (NB: 32 bit)(NB: 32 bit)

• Holding reg. 00010, addressed as: Holding reg. 00010, addressed as: 4001040010

• Holding reg. 020210, addressed as: Holding reg. 020210, addressed as: 420210 420210 (high (high word)word)

• Holding reg. 020211, addressed as: Holding reg. 020211, addressed as: 420211 420211 (low (low word)word)


2009-June-22


FC 100 Frequency Converter Set-up


To enable Modbus RTU on the FC 100, set the following parameters:To enable Modbus RTU on the FC 100, set the following parameters:

Parameter no.

Parameter name

Setting

8-30 Protocol Modbus RTU

8-31 Address 1 – 247

8-32 Baud rate 2400 - 115200

8-33 Parity / Stop bits Even parity, 1 stop bit (default)


2009-June-22


RS-485 physics


Master

Slave 1 Slave 2

D1

D0Common

5 V

650

650

120 1 nF

120 1 nF

Maximum length of busMaximum length of bus 1000 m at 19200 bps1000 m at 19200 bps

Maximum number of stations (without repeater)Maximum number of stations (without repeater) 32 (31 slaves)32 (31 slaves)

Maximum length of tap linksMaximum length of tap links 20 m for one tap link 20 m for one tap link 40 m divided by the number of tap links40 m divided by the number of tap links

Bus polarisationBus polarisation 650 650 at 5V and common for the master at 5V and common for the master

Line terminatorLine terminator 120 120 - 0,25Wm in series with 1nF 10V - 0,25Wm in series with 1nF 10V

Common polarityCommon polarity Yes (Common) connected to the PGYes (Common) connected to the PG


2009-June-22


MCA 122

Modbus TCPModbus TCP

• Modbus TCP is the oldest Industrial Ethernet Modbus TCP is the oldest Industrial Ethernet ProtocolProtocol

•Was introduced by Modicon back in 1999. Was introduced by Modicon back in 1999.

• The Protocol is widely used inside:The Protocol is widely used inside:

• Water/Wastewater and inside companies Water/Wastewater and inside companies standardizing their PLC system on standardizing their PLC system on Modicon/Group Schneider PLC’sModicon/Group Schneider PLC’s


2009-June-22


MCA 122

Modbus TCPModbus TCP

• Modbus RTU to Modbus TCP Modbus RTU to Modbus TCP

•Easy connection to Group Schneider PLC’s and leading Easy connection to Group Schneider PLC’s and leading SCADA systemsSCADA systems

• High performance option, capable of execute High performance option, capable of execute commands in 5mSec ratecommands in 5mSec rate

• Two Ethernet ports with build in switch, enabling line Two Ethernet ports with build in switch, enabling line structure.structure.

• No need for expensive switches, due to the build in No need for expensive switches, due to the build in switch,switch,

• Build in web server, for easy status from remote PCBuild in web server, for easy status from remote PC

• E-mail notify, that can send E-mail if Warning/alarm E-mail notify, that can send E-mail if Warning/alarm occursoccurs

• Register mapping equal to Modbus RTU, which allows a Register mapping equal to Modbus RTU, which allows a easy upgrade fromeasy upgrade from

•High speed access from MCT-10 Setup Software via High speed access from MCT-10 Setup Software via EthernetEthernet


2009-June-22


Read/write block of data (Process data)

Modbus RTU/TCPModbus RTU/TCP

Function code = 03hex : Read Holding Registers...Function code = 03hex : Read Holding Registers...

SlaveAddress


Function code=0x03

Number of words to read


Request :Request :

Function code = 10hex : Write Multiple RegistersFunction code = 10hex : Write Multiple Registers

Request :Request :

SlaveAddress


Function code=0x10




Number of bytes

1 byte 2 bytes

This is only possible with consecutive registers (no “holes” in the range)This is only possible with consecutive registers (no “holes” in the range)


2009-June-22




• Since parameters are organized in registers Since parameters are organized in registers with jumps of 10, it is not possible to make with jumps of 10, it is not possible to make block-read/write.block-read/write.

Register # Data10 Par. 0-0111 …12 …13 …14 …15 …16 …17 …18 …1920 Par. 0-0221


2009-June-22




• To enable block-read/write, a block of process-To enable block-read/write, a block of process-data has been defined.data has been defined.

• Par. 281 and 291 is not used.Par. 281 and 291 is not used.

• Block is below reg. #10,000 which is Block is below reg. #10,000 which is accessible for all PLC’saccessible for all PLC’s

• Can also be used for down-mapping of Can also be used for down-mapping of parameters…parameters…

• Available on Modbus TCPAvailable on Modbus TCP

• Will also be available on Modbus RTUWill also be available on Modbus RTU

Register #Register # DataDataModbus TCPModbus TCP Modbus RTUModbus RTU

Mapping parameterMapping parameter

WR

ITE

2810 CTW 12-21[0] 8-43[0]

2811 REF 12-21[1] 8-43[1]

2812 PCD 3 12-21[2] 8-43[2]

2813 PCD 4 12-21[3] 8-43[3]

2814 PCD 5 12-21[4] 8-43[4]

2815 PCD 6 12-21[5] 8-43[5]

2816 PCD 7 12-21[6] 8-43[6]

2817 PCD 8 12-21[7] 8-43[7]

2818 PCD 9 12-21[8] 8-43[8]

2719 PCD 10 12-21[9] 8-43[9]

… … …

REA

D

2910 STW 21-22[0] 8-44[0]

2911 MAV 21-22[1] 8-44[1]

2912 PCD 3 21-22[2] 8-44[2]

2913 PCD 4 21-22[3] 8-44[3]

2914 PCD 5 21-22[4] 8-44[4]

2915 PCD 6 21-22[5] 8-44[5]

2916 PCD 7 21-22[6] 8-44[6]

2917 PCD 8 21-22[7] 8-44[7]

2918 PCD 9 21-22[8] 8-44[8]

2919 PCD 10 21-22[9] 8-44[9]


2009-June-22




......


2009-June-22


Want to know more?

ModbusModbus

VLTVLT® ® FC 100 LonWorks:FC 100 LonWorks:

MG.11.E1.02 MG.11.E1.02

www.modbus.orgwww.modbus.org

#4 modbus rtu tcp

Engineering