Протокол Modbus
Протокол Modbus
TABLE OF CONTENTS
May 1997 i
CONTENTS CG39FDI-3
LIST OF FIGURES
LIST OF TABLES
ii May 1997
CG39FDI-3 CONTENTS
Significant changes for rev. 2 are indicated by change bars located in the page margins. These changes are
listed here.
1.0 INTRODUCTION - This section has been updated to accommodate the QUADLOG version of
the library. Section descriptions were updated to include the new appendices outlined below.
1.2.2 PRODUCT SUPPORT - This section has been enhanced with the addition of a telephone listing
of international subsidiaries.
2.0 SOFTWARE INSTALLATION - This section has been rewritten to accommodate the different
versions of MS-Windows (i.e. Windows 3.x, Windows 95, and Windows NT).
4.0 FUNCTION BLOCKS - This section has updated graphics for the Modbus Slave
(MODBUS_S) and Serial (SERIAL) function blocks. Also, two new soft list parameters
(WriteSecurity and ExtendedAddress) have been added to the MODBUS_S block.
A.0 APPENDIX A, APPLICATION EXAMPLE 1 - This section has been revised with updates to
graphics which show examples of on-line display information.
B.0 APPENDIX B, APPLICATION EXAMPLE 2 - This section has been revised with updates to graphics
which show examples of on-line display information.
C.0 APPENDIX C, ERROR CODES - This section has been expanded. It now lists the error code messages
that appear at the error code (E_CODE) output of the MODBUS_S function block, a description of each
code, and recommended user actions.
D.0 APPENDIX D, SPECIFICATIONS - This section has been updated to include the latest general
specifications of the Modbus Slave Function Block Library.
H.0 APPENDIX H, USING MODBUS_ S BLOCK AS A SERIAL ANALYZER - This is a new section
that describes the configuration of a MODBUS_S block for use as a serial protocol analyzer.
Moore Products Co. assumes no liability for errors or omissions in this document or for the application and use of information included in this
document. The information herein is subject to change without notice.
The Moore logo, APACS, the APACS logo, QUADLOG, the QUADLOG logo, and 4-mation are trademarks of Moore Products Co.
All other trademarks are the property of the respective owners.
iv May 1997
CG39FDI-3 INTRODUCTION
1.0 INTRODUCTION
The Modbus Slave Function Block Library is add-on software for use with the 4-mation™ configuration *
software, version 3.00 or higher. The library software is available in both APACS® and QUADLOG® *
versions. The APACS version (P/N 15939-624V4.xx) is for use with the Advanced Control Module (ACM) *
software, version 4.01 or higher. The QUADLOG version (P/N 15939-682V3.2x) is for use with either the *
Advanced Control Module Plus (ACM+) software or the Critical Control Module (CCM) software. Each *
must be version 3.20 or higher. *
The library software provides 4-mation with a set of function blocks for configuring a control module to
operate as a Modbus slave.
This document describes how to identify, register, backup, and install the Modbus Slave FB Library. It also
provides reference information for each function block. This information is intended to be used in
conjunction with Using the 4-mation Configuration Software, as well as the other documents listed in
section 1.3, Related Literature. After the Modbus Slave FB Library software has been installed, most of the
information presented in this document is also available through 4-mation’s on-line help system.
C Section 1, Introduction—Summarizes the information presented in this Guide, describes the software
package, provides the software registration procedure, and lists reference literature to consult for
additional information.
C Section 2, Software Installation—Describes the general disk handling and backup requirements and the
software installation procedure.
C Section 4, Function Blocks—Details the inputs, outputs, and softlist parameters of the MODBUS_S and
the SERIAL function blocks.
C Appendix C, Error Codes—Lists the error code messages that appear at the error code (E_CODE)
output of the MODBUS_S function block whenever an error condition is encountered.
C Appendix D, Specifications—Lists general specifications for the Modbus Slave Function Block (FB)
Library.
C Appendix E, Cable Connections—Shows the pin-out of control module serial ports and the minimum
cable requirements for connecting to the serial port of a foreign device.
C Appendix F, Entrelec RS-232 to RS-485 Converter Connections—Details the wiring and configuration
of the recommended RS-232 to RS-485 converter.
C Appendix G, Redundant System Wiring—Shows the general wiring configuration of a dual Modbus
network in a redundant system.
The Modbus Function Block (FB) Libraries permit the control module and the APACS/QUADLOG system
to exchange data with foreign devices that use the Modbus protocol. The Modbus RTU protocol is used by
AEG Schneider Automation (formerly Gould/Modicon) RTU programmable logic controllers (PLCs) and by
many types of specialty instruments and interfaces such as analyzers, chromatographs, weigh scales, human-
machine interfaces (HMIs), remote termination units (RTUs), and other distributed control systems (DCSs).
Modbus RTU is a master/slave protocol in which a single master can address multiple slaves. The slave
devices do not initiate any communication; they wait for a command from the master, which requests the
slave to read or write data values. The control module can be configured to be either the master or the slave,
but not both from the same port.
The Modbus Slave FB Library contains the Modbus Slave (MODBUS_S) function block, which allows the
control module to act as a Modbus slave. The Modbus Master FB Library contains the Modbus Master
(MODBUS_M) function block, which allows the control module to act as a Modbus master. To use a control
module as a Modbus Master, refer to the Modbus Master Function Block Library (document number
CG39FDI-2). Both libraries also contain a Serial (SERIAL) function block, which is used to initialize the
Modbus communications port.
The function blocks included in Modbus Slave FB Library are configured on a configuration sheet using the
4-mation™ configuration software. The configuration of the MODBUS_S function block establishes, inside
the control module, a data array to hold the foreign device data. The control module configuration, another
control module, or an operator interface can then access and use the foreign device data by referencing the
array element. Configuration of the SERIAL function block enables the control module’s serial port to
communicate with the Modbus network and its foreign devices.
The following subsections present guidelines for registering your software package and for contacting Moore
Products Co. for software product support.
Before reading further, complete and mail the brief Software Registration Form included in the package.
Registration will:
C Enter your software’s part number/version number and serial number in the master database of active
software packages
C Identify you as the person to whom information about future software enhancements and updates should
be sent
Without proper registration, it may be impossible to provide product support and to inform you of
enhancements and updates.
Each software update or enhancement will include a Software Registration Form so that your package’s
current part number/version number and serial number can be recorded in the database. Additional
registration forms are provided for subsequent users who become responsible for the software.
Product support can be obtained from the Moore Products Co. Technical Information Center (TIC). TIC is a
customer service center that provides direct telephone support on technical issues related to the functionality,
application, and integration of all products supplied by Moore Products Co.
To contact TIC for support, either call 215-646-7400, extension 4TIC (4842) or leave a message in the
bulletin board service (BBS) by calling 215-283-4968. The following information should be at hand when
contacting TIC for support:
(When someone calls for support for the first time, a personal caller number is assigned. This number is
mailed in the form of a caller card. Having the number available when calling for support will allow the
TIC representative taking the call to use the central customer database to quickly identify the caller’s
location and past support needs.)
C Product part number, software version, and serial number, all of which are identified on the software’s
disk label
C Computer brand name, model number, and hardware configuration (types of disk drives, memory size,
video adapter, etc.)
C Version number of operating system (e.g. MS-DOS 6.22, Windows 3.x, Windows 95, Windows NT)
For product support outside of North America, an alternative support system is available by contacting the
appropriate Moore Products Co. subsidiary:
* Australia Mexico
* Moore Products Co. (Australia) Pty.Ltd. Moore Products de Mexico S.A. de C.V.
* Tel: (61) (2) 9319 4877 Tel: 6-11-98-58; 6-15-19-48;
* 6-15-02-62; or 6-15-02-38
* Canada
* Moore Products Co. (Canada) Inc. The Netherlands
* Tel: (905) 457 9638 Moore Products Co. B.V.
* Tel: (00) (31) 180 461111
* France
* Factory Systemes, 22 Singapore
* Tel: (33 1) 64 61 68 68 Moore Products Co. (S) Pte.Ltd.
* Tel: (65) 299 6051
* India
* Moore Controls Pvt. Limited South Africa
* Tel: (91) (212) 770171 Moore Controls S.A. (Pty.)
* Tel: (27) 466 1673/9
* Italy
* Moore Products Co. (Italia) S.r.l. United Kingdom
* Tel: (39) (2) 2940 1094 Moore Products Co.(U.K.) Ltd.
* Tel: (44) (1935) 706262
* Japan
* Moore Products Co.(Japan) K.K.
* Tel: (81) (3) 5484 4390
C 4-mation, Installation and Operation (version 3.x binder number UM39-6, version 4.x binder number *
UM39-11) *
C Function Block Language (version 3.x binder number UM39-7, version 4.x binder number UM39-12) *
C APACS ACM Installation & Service Instruction (document number SD39ACM-2) *
C QUADLOG CCM Installation & Service Instruction (document number SDQLCCM-1) *
This section provides the procedures for making a backup copy of the Modbus Slave FB Library software,
installing the software, and performing initial software set-up. The software must be installed from floppy
disks to a permanent storage medium, such as the computer’s hard disk.
The Modbus Slave FB Library software is shipped on a high density (HD) 3½" floppy disk. The label on the
disk lists the product’s part number, release number, and date. It is recommended that you make backup
copies of the original disk. Make the copies using the disk copying procedure appropriate for your computer’s
operating system. Once copied, safeguard the original by storing it separately from the copies. Be sure to
correctly label and write-protect the copies.
The following procedures are used to install the Modbus Slave FB Library software from a floppy drive to a
permanent storage medium, such as a hard drive. The installation is performed from Windows Program
Manager or Explorer. This is accomplished with the installation program (SETUP.EXE) resident on the
library disk. Essentially, you are to load and run this program and respond to prompts. The prompts will be
in the form of pop-up dialog boxes which will query you to enter information regarding your computer
system. The method used to run the setup program varies depending on the specific version of Windows on
the host computer. Use the appropriate procedure as needed.
IMPORTANT
3. At the Run command line, enter drive:\SETUP.EXE to start and initialize the setup program.
4. When the setup program starts, you are presented with an installation screen. Pop-up dialog boxes
will prompt you to enter information about your computer. Respond as needed.
1. Click on the Start button, point to Settings, and then click Control Panel.
2. Double-click on the Add/Remove Programs icon. This opens the Add/Remove Program Properties
dialog box.
3. Click the Install button. This opens the Install Program From Floppy Disk or CD-ROM dialog box.
4. Insert the library disk into the floppy drive then click the Next button. This opens the Run
Installation Program dialog box.
5. Verify that the command line is displaying the path and name of the setup program, then click the
Finish button to commence installation.
6. When the setup program starts, you are presented with a series of dialog boxes that prompt you for
information about your computer. Respond as needed.
The procedure for installing this library under Windows NT (also called Windows NT Workstation) depends
on which version of this operating system you are using. For Windows NT up to and including version 3.5.1,
use the procedure for Windows 3.x above. For Windows NT version 4.0 and higher, use the procedure for
Windows 95 above.
#
3.0 CONFIGURATION
The Modbus Slave FB Library is used to configure a control module to act as a Modbus slave. In this role,
the control module provides APACS/QUADLOG data in response to requests from a Modbus master. Many
devices found in the control industry act as Modbus masters, such as human-machine interfaces (HMIs),
remote terminal units (RTUs), data acquisition systems, and distributed control systems. The slave control
module also responds to commands from the Modbus master to change (write) APACS/QUADLOG values
mapped as Modbus addresses.
3.1 PROCEDURE
The configuration procedure for the Modbus Slave FB Library entails the same skills and knowledge needed
for the configuration of other function blocks used by either APACS or QUADLOG. The configuration is
developed by use of the 4-mation configuration software. Instructions for proper installation and use of 4-
mation are given in the appropriate literature listed in section 1.3, Related Literature.
With the Modbus Slave FB Library properly installed (see section 2.0, Installation), 4-mation will
automatically include the Modbus Slave (MODBUS_S) and Serial (SERIAL) function blocks when it is
started. These function blocks can then be selected from 4-mation’s Standard function block list (they will
not appear on the icon bar).
Use the DERIVED key and then select the Standard radio button to display the list of function blocks
including the MODBUS_S and SERIAL blocks.
IMPORTANT
The MODBUS_S function block(s) can be configured to handle the majority of the Modbus communication
requirements. Additional control module configuration (ladder logic, function blocks, etc.) is also needed to
create and manipulate data arrays that provide data values to the MODBUS_S function blocks and, thus, the
Modbus master.
The basic MODBUS_S function block is shown in section 4.1. The Modbus slave node address is specified
as the ADDR input. A control module can only appear as a single slave node address. The Modbus reference
type (i.e. output coil, input coil, input register or holding register), length of the data array, and scaling values
are also entered as function block inputs. Scaling can be performed on analog values by using the ENG_LO
The purpose of the SERIAL function block is to setup one of the control module’s serial ports for serial
communication with a foreign device. This function block handles the baud rate, parity, stop bits, etc. along
with flow control, timeout, and buffer size parameters. The SERIAL block provides an ID output to be
referenced by other serial communication function blocks that use the control module serial port. Multiple
serial communication function blocks, such as the MODBUS_S, can make use of a single SERIAL block.
A common application for the MODBUS_S function block is to provide APACS/QUADLOG values to a
Modbus master using data references that are understood by the master (for example, coils and registers).
Typically, several MODBUS_S function blocks would be configured to retrieve APACS/QUADLOG values
in the control module, such as process variables, I/O points, and calculated variables, and to map these to the
Modbus coil and register addresses. The Modbus master would then be able to read and, as needed, write to
those coils and registers over the Modbus protocol link.
The control module is configured to represent a single Modbus slave node address by entering a value in the
ADDR input of each MODBUS_S function block. The type of Modbus reference (coil, register, etc.) is
determined by the START input.
In the Modbus system, coils are addresses from 00001 to 09999 (1 to 9999), input coils are 10001 to 19999,
input registers are 30001 to 39999, and holding registers are 40001 to 49999. The NUM input then
defines how many sequential references will be provided by this MODBUS_S function block, beginning at
the START address.
The actual data values are placed in the configured DATA array, where each element generally corresponds to
a Modbus coil or register. For some values, like REALs and DINTs, two registers may be used to represent a
single value, depending on the function block configuration.
Analog values in the APACS/QUADLOG system, such as REALs, DINTs, and UINTs should be mapped to
input registers (3xxxx) or holding registers (4xxxx). Discrete values, like BOOLs, should be mapped to coils
(0xxxx) or input coils (1xxxx). Using a simple assignment method on a control module configuration sheet,
each APACS/QUADLOG value can be transferred to a corresponding DATA array element and provided to
the Modbus master when requested. New data values, sent by the Modbus master to change Modbus values
via the MODBUS_S function block, also appear in the DATA array.
IMPORTANT
Section 4.0, Function Blocks, defines the inputs, outputs, and soft list parameters of the MODBUS_S and
SERIAL function blocks used in configuring the Modbus slave. Detailed descriptions of two applications are
provided in the appendices of this Guide. Appendix A contains Application Example 1, which describes a
control module configured as a Modbus slave that provides sixty floating point (REAL) values to a Modbus
master. Appendix B contains Application Example 2, which describes a control module configured as a
Modbus slave that provides 500 BOOL values to a Modbus master. Both examples also include information
for handling Modbus master write operations. Additional supplemental information is provided in
appendices C through H as described in section 1.0, Introduction.
The Modbus Slave Function Block Library provides the 4-mation configuration software with a set of
function blocks for configuring a control module (ACM/CCM) to operate as a Modbus slave. This permits an
APACS or QUADLOG system to exchange data with foreign devices that use the Modbus protocol. Modbus
is a master/slave protocol in which a single master can address multiple slaves. A listing of the library blocks
is presented here. Reference information pertaining to individual blocks is detailed in the sections to follow.
The symbol for the Modbus Slave (MODBUS_S) function block is shown above. This block allows the
control module to act as a Modbus slave. This section defines the inputs, outputs, and soft list parameters of
the block.
4.1.1 Inputs
When this ENable input is TRUE, the block is setup for continuous response to read requests or
commands from the master that are configured properly for this block. If EN is FALSE, the master
does not get a response for a command destined for this block.
A valid ID input must be configured for each MODBUS_S function block to execute. The ID
originates from a SERIAL connect block, which can be used for multiple MODBUS_S blocks in a
control module.
This is the Address input. Enter the Modbus slave address that is assigned to the Modbus slave
emulation running in this control module. Commands from a Modbus master must use this slave
address for proper communication with the control module. The control module does not respond to
commands that are not destined for the configured slave address.
IMPORTANT
A control module can only appear as a single Modbus slave address. Multiple
MODBUS_S blocks can be configured in one control module, but they must have
the same ADDR input value.
This input defines the starting address for the configured command. It requires a double integer
(DINT) data type since valid entries are 1 (for coil 00001) to 49999 (holding register 49999) and
allows for future reference types to be added.
This input defines the quantity of coils or registers to be read or written by the configured command.
When reading floating point or double integer values from the slave device, give careful notice to this
entry and the NumBytesPerReg Softlist entry. If the FP or DINT value is composed of two register
addresses (NumBytesPerReg=2), the NUMber of registers configured should be twice the number of
values desired (see Application Example 1 in Appendix A).
DATA Data Type: Single dimension array of REAL, UDINT, DINT, STRING, UINT, WORD, or
BOOL depending upon the Modbus Command number (see the Command
descriptions above)
When receiving a command that reads data from the slave device, this array contains the actual data
values returned in the response from the slave. When the command performs a write to change a
value in the slave, the new values are written to this array.
When declaring and handling this array, it is important to be aware of the following important rules:
C Do not use the Modbus reference type (0,1,3,4) as part of the DATA array size declaration. For
example, if the MODBUS_S block is sourcing 50 unsigned integer registers to your master
(START=40301, NUM=50), the DATA array could be declared as SLVDATA[301..400]; that
is, the 4 is omitted from the array size.
C Values communicated via Modbus are placed or extracted from the DATA array according to
how the array is declared, the value of the START input and/or the ArrayOffset soft list
parameter.
If the ArrayOffset parameter is FALSE, the first Modbus value corresponds to the first DATA
array element number. In the example above, the ArrayOffset should be set FALSE so that the
value for register 40301 is placed in the first DATA array element, in this case SLVDATA[301].
Since the SLVDATA array was declared with a range 301..400, element [301] is still the first
element even though its value is not 1.
Declaring the DATA array with element numbers that correspond to the Modbus reference may
provide a convenient way to identify an array element number with the Modbus reference,
depending upon the data type.
If the ArrayOffset parameter is TRUE, the value of the START input determines the
corresponding DATA array element number. Continuing with the example given above, if a
second MODBUS_S block was configured to soure registers 351 to 400 (START=40351,
NUM=50), the same SLVDATA array could be used. However, ArrayOffset should be set
TRUE so that register 40351 is placed in SLVDATA[351]. The value of the START input,
ignoring the Modbus reference type, is used to determine the offset.
C When 32-bit values are handled and the slave uses two registers for one value, the number of
Modbus registers required is twice the number of actual 32-bit values. Therefore, a one-to-one
correspondence between register number and DATA array element number will not exist.
As an example using 32-bit values where NumBytesPerReg=2, if the START value is 48001
and the NUM input is 100, the DATA array could be created as DATAONE[8001..8050]
REALs. That is, it takes 100 registers to produce 50 floating point (REAL) values when
NumBytesPerReg=2. The composite value from registers 48001 and 48002 would be placed in
DATAONE[8001], the value from registers 48003 and 48004 would be placed in
DATAONE[8002], etc. The composite value for the last two registers, 48099 and 48100, would
be found in DATAONE[8050].
As an alternative, the register number association to the DATA array element number can be
eliminated by declaring your DATA array to be [1..50] in the example above. In this manner, the
10th floating point value read would be placed in DATAONE[10].
C The DATA array dimensions must encompass the range of addresses configured by the START
and NUM inputs. For example, if the START input is 16000 (Input Coil 6000) and the NUM is
200, the DATA array could be declared as INPUTS[6000..6199]. Again, note that the reference
type designator (0,1,3 or 4) is not declared as part of the array element number.
C When reading and writing Text Strings, refer to the Special Application section under ENG_LO
for details on proper DATA Array declaration.
The MODBUS_S function block assumes a raw data range of 0 (0%) to 65535 (100%) for a 16-bit *
unsigned integer value. Based upon the configured ENG_LO and ENG_HI array element values, each *
DATA array element is scaled by the linear equation y = mx + b, where y is the scaled REAL value and x *
is the raw register value. *
*
For example, if ENG_LO=0.00 and ENG_HI=100.00, a REAL value of 50.00 is scaled to produce a *
register value of 32768. The associated Modbus master must then use its own scaling mechanism to *
produce an engineering range value, in this case, converting it back to 50.00. This can be accomplished *
as follows: *
*
DATA[a] = [(ENG_HI[a] - LO[a] ) / (65535)] (register value) + ENG_LO[a] *
*
Where: [a] is the array element number. *
*
*
IMPORTANT *
*
ENG LO and ENG_ HI array inputs should not be configured when 32-bit values *
can be handled by the Modbus master. These scaling factors are primarily intended *
for use when converting an APACS/QUADLOG REAL to a 16-bit value (unsigned *
integer) because the Modbus master does not support this data type. *
*
When a Modbus master reads a text string from a Modbus slave, the DATA array must be declared
with a STRING data type and ENG_LO with an INT data type. Each text string in the (ACM/CCM)
Modbus slave has a certain character length that you define. Typically, each Modbus register holds
two characters.
Each text string corresponds to a STRING array element in your MODBUS_S DATA array. The
number of characters for each text string and, therefore, each STRING array element is specified by
the corresponding array element in the ENG_LO array. The ENG_LO array should be declared as
data type INT with the same number of elements as the DATA array. The value in the ENG_LO
array element specifies the number of characters for the corresponding STRING. For example,
assume your Modbus slave device has three text strings, as shown below, to be read into the control
module. The START input still specifies the starting Modbus register, in this case, 40325. The
DATA array is declared as SLV1TXT1[1..3], STRING data type. The ENG_LO array is declared as
LENGTH1[1..3], INT data type.
When the Modbus master sends a Modbus command to the slave (usually Function Code 03) to read
14 registers starting at 40325, the NUM input does not need to be configured because the
MODBUS_S block calculates the correct number of registers for you (based on two characters per
register, the ENG_LO array values, and DATA array length).
This is the Engineering Range High input. It is used in conjunction with the ENG_LO
input. Refer to the description of the ENG_LO input for usage information.
* The MODBUS_S function block does not have a CMD (command) input because, as a slave, it does not
* execute any commands; it only responds to commands issued from the Modbus master. The Modbus
* function code commands supported by the MODBUS_S function block are described in this section. Consult
* the master device’s Modbus implementation regarding implemented function codes, valid reference types and
* ranges, maximum number of values read in a single command, etc. to ensure compatibility.
Reads Modbus reference type Output Coil (addresses 00001 to 09999 decimal). Note that the
STARTing address for MODBUS_S function block does not have the leading zeroes (e.g. Coil
00001 would be entered as 1). Maximum coils read by a function block using Command 01 is 2000.
Reads Modbus reference type Input Coil (addresses 10001 to 19999 decimal). The maximum coils
read by a function block using Command 02 is 2000.
DATA Array: WORD, INT, UINT, REAL, DINT, UDINT, STRING, or BOOL (lowest number coil is
first BOOL element in array)
Reads Modbus reference type Holding Register (addresses 40001 to 49999 decimal). Maximum
registers read by a function block using Command 03 are:
126 DATA Array: WORD, INT, UINT, BOOL, REAL, DINT, or UDINT
(NumBytesPerReg=2)
DATA Array: WORD, INT, UINT, REAL, DINT, UDINT, STRING, or BOOL (lowest number coil is
first BOOL element in array)
Reads Modbus reference type Input Register (addresses 30001 to 39999 decimal). Maximum
registers read by a function block using Command 04 are:
126 DATA Array: WORD, INT, UINT, BOOL, REAL, DINT, or UDINT
(NumBytesPerReg=2)
Processes a command from a Modbus master to change the state of a single 0xxxx coil.
DATA Array: WORD, INT, UINT, REAL, DINT, UDINT, STRING, or BOOL (lowest number coil is
first BOOL element in array)
08 - Loopback Test
One of the properly configured MODBUS_S blocks automatically handles this command by re-
transmitting the received data from the Modbus master.
NOTE
The MODBUS_S implementation of the Loopback Test requires that the first word of
data, after the diagnostic code portion, indicate the number of words (registers) being
transmitted. For example, when the master sends a Loopback Test command with Diag.
Code = 00 00, followed by 6 registers of data, the value in the first data register should
be 00 06.
DATA Array: WORD, INT, UINT, REAL, DINT, UDINT, STRING, or BOOL (lowest number coil is
first BOOL element in array)
Processes a command to change the value of multiple 4xxxx holding registers. When changing the
value of a floating point or double integer address that uses two consecutive registers, this command
must be used (Function Code 06 does not work).
One of the configured MODBUS_S function blocks will automatically handle this command by
responding with nine bytes of data, similar to a Modicon 984 PLC.
BYTE CONTENTS
1 09 Slave ID
2 FF Run Indicator
3 00 not used, refer to PI-MBUS-300
4 00 not used, refer to PI-MBUS-300
5 00 not used, refer to PI-MBUS-300
6 00 not used, refer to PI-MBUS-300
7 A0 pwr on, run, mem protect off, battery OK
(may not reflect actual ACM conditions)
8 00 not used, refer to PI-MBUS-300
9 00 not used, refer to PI-MBUS-300
4.1.3 Outputs
When a command is received through the serial port for the configured function block, the boolean
output will toggle from FALSE to TRUE and then back to FALSE the next scan. This can be used
to inform other logic that new data has been received or a command has completed.
An error condition received by this block causes the output to go TRUE for one control module scan.
If desired, this output can be used to indicate to outside logic that an error has occurred and to assist
in troubleshooting communication problems.
This output provides a string description of an error condition. A value of 0 at the output indicates
no errors. Other error values are described in Appendix C.
This output provides an integer that represents the current communication status of the function
block as follows:
1 = Idle
2 = Building a command
3 = Sending a command
4 = Waiting for a response
This subsection provides specifications and important supplementary information for the MODBUS_S
function block soft list parameters.
This parameter configures the function block to handle each register as either a 2-byte entity or a 4-
byte entity (a byte is 8 bits). When the MODBUS_S block is providing a 32-bit value to the master,
the DATA array should be configured as REAL, DINT, or UDINT as appropriate. Some slaves, like
Modicon PLCs, use two consecutive registers to represent a single 32-bit value, while others use one
register. For proper reading (and writing) of data values, this parameter must be set correctly. In
addition, the byte ordering is very important in determining a 32-bit value. This characteristic is
handled by the ModiconByteOrder parameter discussed below.
NOTE
When this parameter is TRUE, the MODBUS_S function block assumes that the byte ordering for
32-bit floating point values is similar to Modicon PLCs. That is, a Modicon 32-bit value is sent as
two registers (NumBytesPerReg=2) and the transmitted byte order is:
For example, a floating point value in a Modicon PLC-compatible slave device is stored in Registers
40001 and 40002. The current value is 100.00. This value would be transmitted via Modbus
protocol as:
40001 40002
00 00 42 C8
Using the standard IEEE single-precision floating point format, this would be interpreted as the value
100.00 REAL in the APACS or QUADLOG system.
When this parameter is FALSE, the MODBUS_S function block expects the byte order to be “word-
swapped” from the Modicon byte order. That is, the value above would be transmitted as:
40001 40002
42 C8 00 00
NOTE
When this parameter is FALSE, the data values correspond to the first element location of the
declared DATA array, regardless of the START input value. When ArrayOffset is set to TRUE, an
offset is used when placing values in the DATA array. This offset process actually causes values to
be placed in the array according to the configured START input value. For example, if the START
value is 41626, ArrayOffset=TRUE, and the DATA array is declared as UINT data type
(DATA_ONE[501..750]), the values from a register read command are placed in the DATA_ONE
array, starting at element [626] not the first element [501].
This feature is often useful in applications where several full-capacity MODBUS_S blocks are going
to bring data into the control module and build a single DATA array. For example, MODBUS_S_1
reads registers 41501 to 625 and places data in DATA_ONE[501] to [625]. MODBUS_S_2 reads
registers 41626 to 750 and places data in DATA_ONE [626] to [750]. The complete range of
values can then be accessed by an APACS or QUADLOG client by reading array DATA_ONE. The
ArrayOffset=TRUE must be set for MODBUS_S_2).
Default: FALSE
When this parameter is TRUE and the security is enabled to prevent data writes, Register and Coil
writes are rejected.
Default: TRUE
When this parameter is FALSE, the valid address ranges are defined as follows:
When this parameter is TRUE, the valid address ranges for extended addressing are defined as
follows:
Default: FALSE
This parameter is intended to specify the minimum APACS or QUADLOG version compatibility
level for using this function block. Its use is flexible. For example, you can use it to enter the control
module firmware revision number, 4-mation’s software version number, or both. Once entered, you
can determine compatibility by checking a software number against the number(s) in this parameter.
SERIAL
BOOL EN NDR BOOL
ERROR BOOL
E_CODE INT
ID INT
The symbol for the Serial (SERIAL) function block is shown above. This block is used to initialize the
Modbus communications port. Specifically, it enables the control module’s serial port to communicate with
the Modbus network and its foreign devices. This section defines the input/output nubs and the soft list
parameters of the SERIAL function block.
The following subsections provides specifications and important supplementary information for all the
SERIAL function block input/output nubs.
4.2.1 Input
When this input is set to FALSE, the SERIAL block is not active. When TRUE, the function block
will generate an ID output, which is to be used by the other serial communication function blocks.
When active, the function block handles requests from the communication function blocks and
external devices connected to the serial port.
4.2.2 Outputs
This output is TRUE when the last transmitted or received message contained an error. More
information about the error is provided by the E_CODE output.
A zero output indicates that no general serial port errors exist. Error conditions particular to a serial
port command will be passed to the appropriate communication function block (e.g. MODBUS_S),
which has its own E_CODE output.
If the SERIAL block is functioning, it provides an ID output which must be used by other serial
communication function blocks as their ID input. An output of 0 indicates the SERIAL block is not
functioning.
This subsection provides specifications and important supplementary information for the SERIAL function
block’s soft list parameters.
This parameter sets the communication baud rate between the control module and the foreign serial
device. The baud rates must be the same for all the serial communication devices.
Valid Entries: 110, 300, 600, 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200,
125000, 143000, 170000, 200000, 250000
Default: 9600
The number of data bits used to represent a character must be specified. For Modbus, the data bits
should be set to 8.
Valid Entries: 7, 8
Default: 8
The parity mode must be the same for all serial communication devices. Traditional Modbus devices
use even parity but be sure to check the foreign device’s documentation.
Default: 0 = None
The number of stop bits used for a serial transmission must be specified.
Valid Entries: 1, 2
Default: 1
Flow control specifies what type of hardware handshaking will be used between the serial
communication devices. If the options below do not satisfy your application, you may have to
hardwire the necessary handshaking lines. Refer to Appendix E for typical cable pin-outs.
Default: 0
IMPORTANT
When using a FlowControl setting other than 0, the control module serial port Data
Carrier Detect (DCD) input, pin 4, must be connected to a logic TRUE pin from the
Modbus device serial port, such as a DCD output or a Data Terminal Ready (DTR)
signal. If the Modbus device does not have this signal, pin 4 of the control module
serial port can be tied back to pin 8, the Request to Send (RTS) output.
When a control module initiates a serial transmission, it waits for the specified period of time for a
response from the foreign device before indicating a timeout.
This parameter should be set to the control module serial port number connected to the Modbus
master device.
Valid Entries: 1 to 8
Default: 2
This parameter is intended to specify the minimum APACS or QUADLOG version compatibility
level for using this function block. Its use is flexible. For example, you can use it to enter the control
module firmware revision number, 4-mation’s software version number, or both. Once entered, you
can determine compatibility by checking a software number against the number(s) in this parameter.
In this example, the control module operating as Modbus slave device address 10, provides 60 REAL values
to a Modbus master. The Modbus master handles a single floating point value (REAL) as two Modbus
registers, with a byte order similar to a Modicon PLC. Therefore, the MODBUS_S block is configured with
a NUMber of registers that is twice the number of DATA array elements (120 registers for 60 floating point
values).
Because the block is using 4xxxx type registers, the master must use Modbus function code 03 to read
registers and Code 16 to write registers (and write two registers for one FP value). Figures A-1, A-2, and
A-3 show the various configuration parameters associated with this example.
The ENable input is set TRUE by the SLV_EX1_EN input to the MODBUS_S function block, which allows
the block to respond to properly configured commands from the Modbus master. The ID1 input value comes
from the SERIAL block that handles communication on the control modules’s serial port 2. The control
module is configured to appear as slave address 10, and the starting register address for this block is 45001
as set by the R45001 variable. This block will respond to read (or write) commands for Modbus registers in
the range from 45001 to 45120, as determined by the START and NUM inputs.
SLV_EX1
MODBUS_S
TRUE
SLV_EX1_EN - EN NDR -
2
ID1 - ID ERROR -
10
SLV_ADDR10 - ADDR E_CODE -
45001
R45001 - START
120
NUM_120 - NUM
SLVDATA1 - DATA
- ENG_LO
- ENG_HI
The data values that are provided to the Modbus master correspond to actual variables in the control module
or elsewhere in the APACS/QUADLOG system. The values might originate from I/O modules or other
variables on an ACM/CCM configuration sheet. These values can be provided to the Modbus master as
“registers” by assigning them to elements in the SLVDATA1 array. An example of this assignment is shown
in Figure A-2.
The value for APACS /QUADLOG variable PV1 will be assigned to the variable in the cell to the right, in
this case, the variable SLVDATA1[5001]. This element of the SLVDATA1 array corresponds to Modbus
registers 45001 and 45002. As a result, when the Modbus master asks for two registers starting at 45001, it
will receive the PV1 value in floating point format. Similar assignments are made for the other array
elements.
65.9 65.9
PV1 SLVDATA1[5001]
100.0 100.0
PV2 SLVDATA1[5002]
200.0 200.0
PV3 SLVDATA1[5003]
250.0 250.0
PV4 SLVDATA1[5004]
275.0 275.0
PV5 SLVDATA1[5005]
350.0 350.0
PV6 SLVDATA1[5006]
777.56 777.56
PV7 SLVDATA1[5007]
If it is desired to have the Modbus master change an ACM/CCM value, two options are available. A portion
of the SLVDATA1 array can be used for write-only registers that will contain the new value sent by the
Modbus master. For example, Registers 45101 to 45120 (which correspond to SLVDATA1[5051] to
[5060]) could be set aside as write-only elements; that is, no assignment is made from APACS/QUADLOG
variables to these elements. In fact, the opposite would normally occur, the array element containing the new
value would be assigned to an APACS/QUADLOG variable in the cell to the right (see Figure A-3.) Another
option would be to configure another MODBUS_S function block and another DATA array for handling
writes from the master.
65.9 65.9
SLVDATA1[5051] SETPOINT_A
100.0 100.0
SLVDATA1[5052] SETPOINT_B
200.0 200.0
SLVDATA1[5053] SETPOINT_C
250.0 250.0
SLVDATA1[5054] SETPOINT_D
275.0 275.0
SLVDATA1[5055] SETPOINT_E
350.0 350.0
SLVDATA1[5056] SETPOINT_F
777.56 777.56
SLVDATA1[5057] SETPOINT_G
In this example, the same control module appearing as Modbus slave 10 will be configured to provide 500
BOOL values to the Modbus master. BOOL variables in the APACS or QUADLOG system would typically
be handled as Modbus “coils,” that is, references of the 0xxxx type. The “coils” may actually be the
Standard Discrete Module Plus (SDM+) or Critical Discrete Module (CDM) discrete inputs/outputs or
BOOL elements in a ladder logic diagram.
The Modbus master will use function code 01 to read the coils and Codes 5 or 15 to write coils. Figures B-1,
B-2, and B-3 show the various configuration parameters associated with this example.
The ENable input is set TRUE by the SLV_EX2_EN input to the MODBUS_S block, which allows the block
to respond to properly configured commands from the Modbus master. The ID1 input value comes from the
SERIAL block that handles communication on the ACM/CCM’s serial port 2. The ACM/CCM is configured
to appear as slave address10 and the starting coil address for this block is 1 as set by the O00001 variable.
This block will respond to read (or write) commands for Modbus coils in the range from 00001 to 00500, as
determined by the START and NUM inputs.
SLV_EX2
MODBUS_S
TRUE
SLV_EX2_EN - EN NDR -
2
ID1 - ID ERROR -
10
SLV_ADDR10 - ADDR E_CODE -
1
O00001 - START
500
NUM_500 - NUM
COIL_RW1 - DATA
- ENG_LO
- ENG_HI
The 500 BOOL values (coils 1 to 500) are placed in the DATA array COIL_RW1. This array must be
defined as a one-dimensional BOOL array from 1 to at least 500. The MODBUS_S function block uses the
array element number as a reference for handling each data value. In this case, there will be a one-to-one
correspondence between the Modbus coil number and the COIL_RW1 array element. For example, the value
for coil 465 will be found in COIL_RW1[465].
The data values that are provided to the Modbus master correspond to actual variables in the ACM/CCM or
elsewhere in the APACS/QUADLOG system. The values might originate from I/O modules or other
variables on a configuration sheet. These values can be provided to the Modbus master as “coils” by
assigning them to elements in the COIL_RW1 array. An example of this assignment is shown in Figure B-2.
The value for APACS/QUADLOG variable MTR1_RUN will be assigned to the variable in the cell to the
right, in this case, the variable COIL_RW1[1]. This element of the COIL_RW1 array corresponds to
Modbus coil 00001. As a result , when the Modbus master asks for coil 00001, it will receive the run status
for MOTOR1. Similar assignments are made for the other array elements.
TRUE TRUE
MTR1_RUN COIL_RW1[1]
TRUE TRUE
MTR2_RUN COIL_RW1[2]
FALSE FALSE
MTR3_RUN COIL_RW1[3]
FALSE FALSE
TANK1_HI COIL_RW1[4]
FALSE FALSE
TANK1_HIHI COIL_RW1[5]
TRUE TRUE
TANK1_FEED COIL_RW1[6]
In this example, coils 401 to 500 have been pre-determined to handle write commands from the Modbus
master. Therefore, when the master wants to change the state of a BOOLean value in the ACM/CCM, such
as an SDM+/CDM output, it would write to the coil that corresponds to that DATA array element.
In Figure B-3, an assignment is made between COIL_RW1[401] and the channel 5 output of the
SDM+/CDM in Rack 2, Slot 6. When the Modbus master writes to coil 00401, the ACM/CCM
configuration will transfer this value to the SDM+/CDM output. A similar assignment is made for other coils
to which the Modbus master will write.
In typical applications, the Modbus master only writes at the request of an operator or as the result of an
automatic trigger (alarm, limitswitch, etc). In other words, writes from the master to the slave (control
module) usually occur much less frequently than read operations.
TRUE TRUE
COIL_RW1[401] SDMR2S6C5
TRUE TRUE
COIL_RW1[402] SDMR2S6C6
FALSE FALSE
COIL_RW1[403] SDMR2S6C7
FALSE FALSE
COIL_RW1[404] SDMR2S6C8
FALSE FALSE
COIL_RW1[405] SDMR2S6C9
The error code (E_CODE) output from the Modbus Slave (MODBUS_S) function block provides a string
that lists one or more of the following error code messages listed in Table C-1.
The E_CODE output clears with each execution of the block. To view the string in 4-mation’s on-line mode,
use its Variable Control function to set the block’s Request (REQ) and Continuous (CONT) inputs to
FALSE. Then, toggle the REQ input TRUE (do not pulse the input). The block executes once and the error
string can be read until the REQ input is changed.
15 Array_DataType_Problem The DATA input array variable Verify the MODBUS block’s
type is invalid. DATA input with respect to
its CMD, START, and NUM
inputs. See section 4.1.1,
Inputs.
25 Invalid_Address The MODBUS block’s START Verify the START, NUM and
input address may be invalid. DATA inputs for valid
The START and NUM input address ranges. See section
values may not match the 4.1.1, Inputs.
DATA, ENG_LO or ENG_HI
array sizes.
28 CTS_Lost_During_Transmission When using FlowControl Monitor serial
options 2 or 3, the CTS line communications parameters
went low before transmission and check modem if problem
was completed. persists.
31 Illegal_Function_Exception The Modbus slave device does Verify that the function code
not understand the function used is supported by the
code. Modbus slave device.
32 Illegal_Data_address_Exception The starting or ending Modbus Verify that the value used is
address, data register, or coils is within the defined range.
out of range.
General specifications for the Modbus_S Function Block Library are listed in Table D-1. Where applicable,
default values are shown in bold type.
ITEM SPECIFICATION
Note that the Vx.xx suffix refers to the software version number. It
will differ for later versions.
Electrical I/O Port RS232 (Other physical layers can be accommodated with external
converters, such as RS422 for multi-drop applications). For
RS422/RS485, use 4-wire only.
Baud Rate 110, 300, 600, 1200, 2400, 4800, 9600, 19200, 38400, 57600,
115200, 125000, 143000, 170000, 200000, 250000
Start Bits 1
Data Bits 7 or 8
Stop Bits 1 or 2
* MODBUS_M only
ITEM SPECIFICATION
Extended Addressing:
000001-065535 Read/Write Coils
100001-165535 Read Input Status
300001-365535 Read Input Registers
400001-465535 Read/Write Holding Registers
The pin-out for a control module serial port (DB9 female) is shown in Table E-1. As a minimum, the cable
between the control module serial port and the foreign device will require TD, RD, and SG as shown in
Figure E-1. The foreign device may require additional handshaking signals for proper operation (consult the
foreign device documentation.) The FlowControl soft list parameter of the SERIAL block may also be useful
in selecting the proper handshaking mode, or these signals may have to be tied back to the foreign device
(RTS to CTS, and DTR to DSR and DCD) as shown in Figure E-1.
NOTE
The control module’s serial port pin-out is not the same as that typically found on a
personal computer. The control module’s serial port is a DB9 female connection,
using different pins than a PC for transmitting (TD) and receiving (RD) data.
When using a FlowControl setting other than 0, the control module’s serial port
Data Carrier Detect (DCD) input, pin 4, must be connected to a logic TRUE pin
from the Modbus device serial port, such as a Data Carrier Detect (DCD) output or
a Data Terminal Ready (DTR) signal. If the Modbus device does not have this
signal, pin 4 of the control module can be tied back to pin 8, the Request to Send
(RTS) output.
Cable connections needed to interface an RS-485 foreign device to the ACM/CCM RS-232 serial port by
means of the Entrelec RS232/485 Converter are shown in Figure F-1. This converter is recommended by and
available from Moore Products Co.
Signal
Common
5 G 0V Rx- E Tx-
Signal Signal
J Common C Common
Note: 7 (0V)
Note: 8 Note: 4
F
Entrelec
P/N 84233-11 NOTES:
Moore Products Co. 1. Internal Jumper Rt set to 220 Ohms
2. Internal Jumper R set to ON
P/N 16055-395 3. Internal Jumper E set to ON/OFF
4. All RS-485 Slave devices must be
P+ wired in parallel.
5. Arrows on lines denote signal
P- direction.
6. When RTS is not available,
0V (i.e. Foreign Device side)
Jumper M to L on converter.
5V 7. Shield must be connected to
the metal connector shell.
COM V- 8. J to F connection has been provided
+24VDC V+ Notes: 1, 2, 3, 4, 5, 6 inside the Entrelec converter.
< 100ma
Figure G-1 shows the general wiring needed for a dual Modbus network in a redundant system. For typical
RS-232 and RS-485 cable connections, refer to Appendix F.
The following describes how to configure a Modbus Slave (MODBUS_S) block to be used as a serial
protocol analyzer. Using the block in this way permits you to view messages coming into the control module
(i.e. ACM/CCM) in both Modbus master and slave applications. Refer to Figure H-1 as an example of
setting up a serial analyzer. Position the Serial Analyzer block on the configuration sheet so that it is the first
Modbus function block to execute. The incoming Modbus messages are placed into a string array one byte at
a time in hex ASCII format.
SERIAL_ANALYZER
MODBUS_S
TRUE
EN_SERIAL_ANAL - EN NDR - FALSE
2
ID1 - ID ERROR - FALSE
- START
6 - NUM
Example viewing the array:
RCVD_MESSAGES - DATA
'01 03 00 03 00 01 AC 45'
- ENG_LO RCVD_MESSAGES[1]
'01 01 00 10 00 01 34 65'
- ENG_HI
RCVD_MESSAGES[2]
'02 01 00 20 00 01 EF 28'
RCVD_MESSAGES[3]
When the ENable input is TRUE, the function block looks for incoming messages. If a message is
found and the MODBUS ADDR matches, the data is converted to hex ASCII format. As much of the
message as possible is placed into one DATA array element. When EN is FALSE, the array is not
overwritten. When the EN input transitions from FALSE to TRUE, the array connected to DATA
input is cleared.
A valid ID input must be configured for each MODBUS_S function block to execute. The ID
originates from a SERIAL connect block, which can be used for multiple MODBUS_S blocks in a
control module (ACM/CCM).
If not configured, all messages are received and placed into the DATA array. If a specific Modbus
slave address is configured, only messages to that slave address are placed into the DATA array.
START Leaving this input unconfigured selects the Serial Analyzer Mode.
This input defines the number of array elements to use for placing received messages.
DATA Data Type: Single dimension STRING array is used for Serial Analyzer Mode
Received messages that match the slave address definition are placed into the DATA array. Each new
message is placed as the next element of the array and the following array element is emptied (set to ‘
’). When the end of the array is reached, new messages overwrite old ones starting at the first array
element. Each byte in a Modbus message takes 3 characters in the string array element. This means
the largest message would be 84 bytes captured without a Max_Size_Exceeded error, assuming a
254 byte string size for the array. If the message cannot fit into the array element, as many bytes as
possible are placed into the array element and the following array element will have the error string
‘Max_Size_Exceeded’ placed into it.
When a message is received through the serial port for the configured function block, the BOOL
output toggles from FALSE to TRUE and then back to FALSE the next scan. This input stays
TRUE if messages are being received every scan.
An error condition received by this block will cause the output to go TRUE for one control module
scan.
This output provides a STRING description of an error condition. A value of 0 at the output
indicates no errors. A Max_Size_Exceeded error will be displayed if the received message cannot fit
into the array element. Other error strings are described in Appendix C.
Soft list parameters are ignored when in the Serial Analyzer mode.