ProSoft Technology, Inc. RTU-5/03 Processor for Allen-Bradley SLC Modular Racks Inside this Manual

Transcription

1 Revision : 1.2 Updated : 6/30/04 ProSoft Technology, Inc. RTU-5/03 Processor for Allen-Bradley SLC Modular Racks Catalog Numbers : 3250-L532M RTU-5/03 Processor with 16 K RAM This manual is provided in to assist with the issues specific to the implementation of Modbus Slave communications with the RTU-5/03 processor. To obtain information relating to the physical installation of the processor or other information relating to the programming of processors in the Allen-Bradley SLC product family, please refer to the Allen-Bradley document shipped with this manual, Publication Inside this Manual 1 Product Overview Channel 0 Functionality General Specifications Modbus Slave Protocol Specifications Quick Start Guide Installation Procedure Testing the Modbus Slave Port Modbus Memory Map N100: Modbus Configuration and Diagnostic File Creating the N100 Modbus Configuration and Diagnostic File The Structure of the Modbus Configuration and Diagnostic File Communication Configuration Parameters Status and Diagnostic Data (Output values from Modbus Driver) Modbus Diagnostic File Error Code values Activating the Modbus Slave Driver Manual Modbus Driver Start and Stop AutoSwitch Mode Supported Modbus Function Codes Modbus Read Function Codes Modbus Write Commands Troubleshooting RTU-5/03 Modbus LED Indicator Processor Faults Troubleshooting Tips Modbus Diagnostic File Error Code values Cable Connection Channel Cable configuration for Modbus Communications Technical Support Modbus on Channel 0 Related Issues Non-Modbus Related Issues...26 Additional Information Modbus Protocol Specification ProSoft Technology has placed the Modbus Protocol specification on the web site at RTU-5/03 Application Notes ProSoft Technology has an example Application Note for the RTU-5/03 processor on the web site, or available by fax upon request.

2 Product Overview 1 Product Overview The ProSoft Technology, Inc. RTU-5/03 is a processor for the 1746 family of hardware that has been enabled with the Modbus protocol on Channel 0. The product family has been developed to address the needs of industries and applications that regularly apply the Modbus protocol. Two versions of the RTU-5/03 are available: 3250-L532M RTU-5/03 processor with 16K RAM These processors are fully functional SLC 5/03 processors, and as such implement the full suite of ladder logic commands normally supported by the SLC-5/03 processors. WARNING: Storage to the EEPROM is only supported through the DF1, Channel 0 port. Attempting to use the DH-485 port for burning an EEPROM will erase processor memory and fault the processor. The processor is Version OS302 and therefore does not support the M13 EPROM, nor the BTR/BTW instruction. 1.1 Channel 0 Functionality As in the SLC 5/03, Channel 0 is a 9-pin RS-232C port on the front of the processor. In addition to supporting the Slave and Master versions of the DF1 protocol (for programming purposes), the RTU-5/03 processor can communicate as a Modbus Slave on Channel 0. DF1 Functionality The DF1 protocol is supported on Channel 0 out of the box. The normal shipping communication defaults (19200 baud, CRC, DF1 Full Duplex, 8,N,1) will enable the connection of a programming package to Channel 0. Note that Channel 1 (DH-485 port) can also be used for programming purposes while the Modbus Driver is operational. Modbus Functionality Modbus Slave functionality is enabled by the User creating and configuring an Integer file at N100 in the RTU-5/03 processors data table. Once configured correctly, the RTU-5/03 can be setup to swap automatically (via the Autoswitch Mode) between the DF1 and the Modbus drivers. User Mode Functionality The Channel 0 User Mode is also available to the RTU-5/03. However, if this mode is configured, the Modbus Driver is disabled. 1.2 General Specifications The ProSoft Technology, Inc. RTU-5/03 processor product includes the following features: Channel 0 port capable of supporting Modbus Slave protocol Modbus Read and Write of binary, integer and floating point data types Modbus Master can read processor Status File (S2) RS-232C handshaking for SCADA radio/modem applications Satellite and Packet Radio support with a configurable Inter-Character Timeout Channel 0 Modbus Port configuration through entry of configuration values in Modbus Configuration and Diagnostic File (N100): Slave Addr : 1 to 127 (0 is broadcast) Parity : None, odd, or even, Stop Bit : 1 or 2 Baud Rate : 300 TO 19,200 RTS Send Delay: ms RTS Off Delay : ms Pre-Send Delay : ms Inter-character : ms 2

3 Product Overview 1.3 Modbus Slave Protocol Specifications The RTU-5/03 has the following Modbus Slave specifications: Protocol modes: RTU mode with CRC-16 error checking ASCII mode with LRC error checking (7 and 8 bit formats) Supported Modbus Function codes: 1 Read Output Status 2 Read Input Status 3 Read Multiple Data Registers 4 Read Input Registers 5 Force Single Coil (Latch/Unlatch) 6 Preset (Write) Single Data Register 8 Loopback Test (Test 0 only) 15 Multiple Coil Latch/Unlatch 16 Preset (Write) Multiple Data Register Supports broadcast commands from Modbus Master Error Status and Communication Statistics returned to the ladder processor through Modbus Configuration and Diagnostics File (N100) 3

4 Quick Start Guide 2 Quick Start Guide The following step-by-step guide has been designed to help get you operational as quickly as possible. Please follow the instructions carefully. At the end of the procedure, if the RTU-5/03 is not working properly, read the troubleshooting section of this manual or call ProSoft Technology s Technical Support phone. 2.1 Installation Procedure Step Name Instructions 1 Connect Battery Connect the battery cable as shown in the following diagram. 2 Install the processor Making sure power is off, insert the processor into slot 0 of the 1746 chassis. The processor must be inserted into the left slot (slot 0), as shown below, while care is taken to remove the plastic wrap from the power supply after installing the RTU-5/03. 3 Apply Power to the Rack Energize the chassis power supply. Verify that the chassis power supply and processor LEDs are in their correct states: Installation Procedure (Cont d) 4

5 Quick Start Guide 4 Copy sample files to disk 5 Configure sample program file 6 Establish communications to the processor and download program to RTU-5/03 Copy the ladder logic files from the sample diskette to the appropriate subdirectory on the programming station. The following files should be copied using Windows Explorer or the DOS COPY command: Software Source Path Dest Path (Default) APS a:\aps\rtu_smpl.* c:\ipds\arch\slc500 RSLogix 500 a:\rsi\rtu_smpl.* c:\rsi\logix500\project The sample program has the following defaults which may be configured by the user prior to downloading to the processor: Parameter Default I/O Rack Size 4 slot Additional I/O None N100 File Autoswitch On Run on Fail Continue comm. Coil Base File 10 (B10/0 to B10/4096) Inputs Base File 12 (B12/0 to B12/4096) Input Reg Base File 14 (N14:0 to N14:255) Holding Reg Base File 16 (N16:0 to N16:255) Float Hold Reg Base File 18 (F18:0 to F18:99) Slave Address 1 Modbus Mode RTU Baud Rate 9600 Stop Bits 1 Parity None Pre-Send Delay 0 RTS Send Delay 0 RTS Off Delay 0 Intercharacter Timeout 0 Connect the programming station to the RTU-5/03 processor via one of the standard methods: Channel 0: DF1 Full Duplex CRC Error Checking Duplicate detect on No parity Channel 1: DH Node Address = 1 Once communicating with the processor, download the program to the RTU-5/03. 7 Place processor in RUN or REM RUN mode Using the key switch or the programming station, place the processor into the RUN or REM RUN mode. Once in one of these modes, the Modbus driver will be available to operate on Channel 0. 8 Verify LED Status If the RUN LED is in the ON state, the Installation Procedure has been successful. If the FLT LED is ON, the Processor Configuration values (Rack size and I/O modules) must be verified. If any other state, verify that the key switch is not in the PROG position. 2.2 Testing the Modbus Slave Port The simplest test tool we have found for testing a Modbus Slave device such as the RTU-5/03 processor is a Windows based application available off the Internet. 5

6 Quick Start Guide We have provided the shareware version of the program on the sample logic diskette under the modscan subdirectory. Simply copy this file to your hard drive and Run the program from Windows. Operating instructions are available through the Help File along with purchasing instructions. The following cable diagram will show how to connect the RTU-5/03 processor to a PC port to test with the Modscan software. RTU-5/03 DB-9 Pin Male PC Port DB-9 Pin Male TxD 3 3 TxD RxD 2 2 RxD RTS 7 7 RTS CTS 8 8 CTS GND 5 5 GND DTR 4 RTS-CTS jumper must be installed on RTU-5/03 to communicate 4 DTR 6

7 Modbus Memory Map 3 Modbus Memory Map Although discussed in more detail within other sections of this manual, the following discussion gives an overview of the Modbus memory map in the RTU-5/03. To control the relationship between Modbus Addressing and data table addressing in the RTU-5/03 processor, five (5) configuration values have been provided. These values, called Base File Addresses, act as Modbus Function Code pointers into the data table file structure. Specifically, the Base File Address value is used to establish the relationship between the Function Code (Modbus Command) and the data table in the processor with which to read or write data Output Coil Map: 0xxxx Data Space Output Coils (0xxxx) Base File : [N100:2] (Example: N100:2 = 10) SLC File Address [N100:2] (Example: B10) Binary Data File Modbus Addressing 0001 up to 4096 [N100:2] + 1 (Example: B11) Binary Data File 4097 up to Sequential files can be addressed on multiples of 4096 (+1) boundaries 2. Unused files can be skipped over, but they still consume 4096 bits in the Modbus address range 3. Files sizes can range from 1 bit to 4096 bits, but any sequential files are still addressed on the multiple of 4096 (+1) boundary 4. The File Type can be binary(b type) or integer (N type) Command From Host Base File Address Modbus Address in Command From Host Data File Accessed by Command FC 1 FC 5 FC 15 N100:2 (Ex: = 10) Discrete Input Map: 1xxxx Data Space Discrete Inputs (1xxxx) Base File : [N100:3] (Example: N100:3 = 12) B10/0 to B10/4095 B11/0 to B11/4095 SLC File Address [N100:3] (Example: B12) Binary Data File Modbus Addressing up to [N100:3] + 1 (Example: B13) Binary Data File up to Sequential files can be addressed on multiples of 4096 (+1) boundaries 2. Unused files can be skipped over, but they still consume 4096 bits in the Modbus address range 3. Files sizes can range from 1 bit to 4096 bits, but any sequential files are still addressed on the multiple of 4096 (+1) boundary 4. The File Type can be binary(b type) or integer (N type) 7

8 Modbus Memory Map Command From Host Base File Address FC 2 N100:3 (Ex: = 12) Modbus Address in Command From Host Data File Accessed by Command B12/0 to B12/4095 B13/0 to B13/4095 Input Registers: 3xxxx Data Space Input Registers (3xxxx) Base File : [N100:4] (Example: N100:4 = 14) SLC File Address [N100:4] (Example: N14) Integer Data (Read Only) Modbus Addressing 30001up to N100:0 to N100:49 [N100:4] +1 (Example: N15) N100 Config File (Read Only) Integer Data (Read Only) 30501up to up to S2:0 to S2:x S2 Status File 31501up to 315xx (Read Only) [N100:4] +2 (Example: N16) Integer Data (Read Only) 32001up to Sequential files can be addressed on multiples of 1000 (+1) boundaries 2. Unused files can be skipped over, but they still consume 1000 words in the Modbus address range 3. Files sizes can range from 1 to 256 words, but any sequential files are still addressed on the multiple of 1000 (+1) boundary (ie., 3rd file (Base File +2) always begins at The File Type can be binary (B type), integer (N type), or Float (F type) 5. Floating Point data files must be read with a count of 2 words per float value when the Modbus Address is under (if >= then see description for Floating Point Holding Registers (47xxx) ) Command From Host Base File Address FC 4 N100:4 (Ex: = 14) Modbus Address in Command From Host xx Data File Accessed by Command N14:0 to N14:255 N100:0 to N100:49 N15:0 to N15:255 S2:0 to S2:X 8

9 Modbus Memory Map Holding Registers: 4xxxx Data Space Holding Registers (4xxxx) Base File : [N100:5] (Example: N100:4 = 16) SLC File Address [N100:5] (Example: N16) Integer Data (Read/Write) Modbus Addressing 40001up to N100:0 to N100:49 [N100:5] +1 (Example: N17) N100 Config File (Read/Write) Integer Data (Read/Write) 40501up to up to S2:0 to S2:x S2 Status File 41501up to 415xx (Read/Write) [N100:5] +2 (Example: F18) Floating Point Data (Read/Write) 42001up to Sequential files can be addressed on multiples of 1000 (+1) boundaries 2. Unused files can be skipped over, but they still consume 1000 words in the Modbus address range 3. Files sizes can range from 1 to 256 words, but any sequential files are still addressed on the multiple of 1000 (+1) boundary (ie., 3rd file (Base File +2) always begins at The File Type can be binary (B type), integer (N type), or Float (F type) 5. Floating Point data files must be read/written with a count of 2 words per float value when the Modbus Address is under (if >= then see description for Floating Point Holding Registers (47xxx) ) Command From Host FC 3 FC 6 FC 16 Base File Address N100:5 (Ex: = 16) Modbus Address in Command From Host xx Data File Accessed by Command N16:0 to N16:255 N100:0 to N100:49 N17:0 to N17:255 S2:0 to S2:X 9

10 Modbus Memory Map Floating Point Holding Registers: 47xxx Data Space Floating Point Holding Registers (47xxx) Base File : [N100:6] (Example: N100:6 = 18) SLC File Address [N100:6] (Example: F18) Floating Point Data (Read/Write) Modbus Addressing 47001up to [N100:6] +1 (Example: F19) Integer Data (Read/Write) 48001up to [N100:6] +2 (Example: N20) Integer Data (Read/Write) 49001up to Sequential files can be addressed on multiples of 1000 (+1) boundaries 2. Unused files can be skipped over, but they still consume 1000 words in the Modbus address range 3. Files sizes can range from 1 to 256 values, but any sequential files are still addressed on the multiple of 1000 (+1) boundary (ie., 3rd file (Base File +2) always begins at 49001) 4. The File Type can be Integer (N type), or Float (F type) 5. If the Modbus Address is >= and maps to an N file, then treat as a 16 bit value from a count perspective 6. If the Modbus Address is >= and maps to a F file, then treat as a 32 bit value from a count perspective Command From Host FC 3 FC 6 FC 16 Base File Address N100:6 (Ex: = 18) Modbus Address Data File in Command Accessed From Host by Command F18:0 to F18:99 10

11 N100: Modbus Configuration and Diagnostic File 4 N100: Modbus Configuration and Diagnostic File The RTU-5/03 Channel 0 Modbus Slave driver is configured by values entered into a special N100 integer file. This file, called the Modbus Configuration and Diagnostic File, has a predefined structure that allows the programmer to configure the Modbus communication parameters. In addition the file provides the programmer with Channel 0 Modbus diagnostic status data. The following discussion details the structure of the N100 file and how to create/modify the file. Use of the N100 file for any other purposes than Modbus Configuration and Diagnostics may result in the unpredictable operation of the ladder logic program. The Modbus Slave driver modifies the values in N100 during its operation. If the ladder logic program uses N100 for control purposes, the changing values in N100 may cause unexpected and dangerous operation of equipment. 4.1 Creating the N100 Modbus Configuration and Diagnostic File The N100 Modbus Configuration and Diagnostic File must be created by the RTU-5/03 programmer (See A- B programming documentation if assistance is needed). The following specifications must be followed when creating the file: File File File File Function Type Number Length Modbus Config & Diag File N Important If the N100 file is not created with a length greater than or equal to 50 words, and the Modbus signature is present in N100:16 to N100:18, the processor will Major Fault and return a Fault Code of 0xA The Structure of the Modbus Configuration and Diagnostic File The following table details the structure of the Modbus Configuration and Diagnostic File. This structure is pre-defined and must be adhered to in order for Modbus communications to function properly Communication Configuration Parameters Anytime driver configuration values in the N100 file (words 10 to 19) are changed, the Modbus Driver must either be stopped and restarted or must be commanded to reconfigure (N100:0 = 4). These steps are not necessary to accept changes in N100 words 0 to 9 as these values are dynamically referenced by the Modbus Driver. 11

12 N100: Modbus Configuration and Diagnostic File N100 Word Modbus Addr Name Default Value Valid Range Description Modbus Command 0 0,1,2,4,8 Value Description 0 Do Nothing 1 Start Modbus 2 Stop Modbus 4 ReRead Configuration 8 Clear Counters AutoSwitch and RunMode Config 0 (Don t AutoSwitch and Continue Comm. when not in run) 0-3 Bit 0 enables the AutoSwitch feature of the Driver.: Bit 0 Description 0 AutoSwitch Off 1 AutoSwitch On When set to 1, if no DH messages are received on Channel 0 in 20 seconds, the Modbus Driver is turned on. If the Modbus driver experiences 5 seconds of communication errors, the Modbus driver is turned off and the DH driver is turned on Modbus Data Table Coil Base File Number Modbus Data Table Contact Base File Number Modbus Data Table Input RegisterBase File Number Bit 1 determines the failure mode of the Modbus port when the RTU-5/03 is in the PGM/FAULT state : Bit 1 Description 0 Continue communicating 1 Fail the Modbus port When set to 1, Modbus Exception 4 is returned to the Master when the SLC is not in RUN mode. 0 0 to 255 Selects the first file in the RTU-5/03 that serves as the beginning of the Modbus Coil Area. Modbus address maps to element 0 bit 0 of this data table. Modbus Functions 1,5,15 use this base file number. An invalid file selection (<0 or >255) will cause a configuration error when the driver is started. If the file does not exist, an error will be generated when a message is received which attempts to reference the nonexistent file. 0 0 to 255 Selects the first file in the RTU-5/03 that serves as the beginning of the Modbus Contact Area. Modbus address maps to element 0 bit 0 of this data table. Modbus Function 2 uses this base file number. An invalid file selection (<0 or >256) will cause a configuration error when the driver is started. If the file does not exist, an error will be generated when a message is received which attempts to reference the nonexistent file. 0 0 to 255 Selects the first file in the RTU-5/03 that serves as the beginning of the Modbus Input Register Area. Modbus address maps to element 0 of this data table. Modbus Function 4 uses this base file number. An invalid file selection (<0 or >256) will cause a configuration error when the driver is started. If the file does not exist, an error will be generated when a message is received which attempts to reference the nonexistent file. 12

13 N100: Modbus Configuration and Diagnostic File N100 Word Modbus Addr Name Modbus Data Table Holding Register Base File Number Modbus Data Table Holding Register Floating Point Base File Number Default Value Valid Range Description 0 0 to 255 Selects the first file in the RTU-5/03 that serves as the beginning of the Modbus Holding Register Area. Modbus address maps to element 0 of this data table. Modbus Functions 3,6,16 use this base file number. Addresses larger than do not use this Base File Number. See word N100:6 Regardless of the File Type, the Number Of Points field is interpreted to mean the number of 2 byte objects. An invalid file selection (<0 or >256) will cause a configuration error when the driver is started. If the file does not exist, an error will be generated when a message is received which attempts to reference the nonexistent file. 0 0 to 255 Selects the first file in the RTU-5/03 that serves as the beginning of the Modbus Floating Point Holding Register Area. Modbus address maps to element of this data table. Modbus Functions 3,6,16 use this base file number if the Address field in the packet is >= If the file is a Floating Point File, then the Number Of Points field in the packet is interpreted to mean the number of 4 byte Floating Point objects Signature1 Mo or Signature2 db or Signature3 us or An invalid file selection (<0 or >256) will cause a configuration error when the driver is started. If the file does not exist, an error will be generated when a message is received which attempts to reference the nonexistent file. Modbus Signature. If the word Modbus does not appear in N100:16 through N100:18, the Modbus features of the processor are disabled. No errors are reported in this case. The purpose of this signature is to reduce the chance of unexpected behavior if the processor is accidentally installed in place of a standard SLC 5/03. The signature must be exactly Modbus, including uppercase M and lowercase odbus Modbus Slave Address 0 (Generates Configuration Error) ATTENTION: this safety mechanism is not foolproof The Modbus Slave Address that the RTU-5/03 will use to determine which commands to respond to. There should not be more than one slave on a network with the same address Modbus Mode 0 (RTU Mode) 0 to 2 Selects the Modbus Mode which the port will use to decode commands from a host. The following modes are available: Value Description 0 Modbus RTU (Binary) 1 Modbus ASCII - 7 bit 2 Modbus ASCII - 8 bit 13

14 N100: Modbus Configuration and Diagnostic File N100 Word Modbus Addr Name Default Value Baud Rate 0 (9600 baud) Stop Bits 0 (1 Stop Bit) Parity 0 (No Parity) Pre-Send Delay 0 (No Delay) RTS Send Delay 0 (No Delay) RTS Off Delay 0 (No Delay after last character) Valid Range Description 0 to 6 Selects the baud rate that the port will use to communicate with the host. Value Description Note that this value may be different than the value configured for the programming port 0 to 1 Selects the number of stop bits which the port will use when communicating: Value Description 0 or 1 1 Stop Bit 2 2 Stop Bits 0 to 2 Selects the parity configuration which the port will use when communicating: Value Description 0 None 1 Odd 2 Even 0 to 2500 Pre-Send Delay is the amount of time that the processor adds in front of asserting RTS of a response (ie., the delay before responding). This time begins when the Command Request is received (LF in ASCII or Timeout in RTU). RTS is asserted at the end of this time period. 0 to 2500 RTS Send Delay is the time after asserting RTS prior to transmitting the first character. If CTS is on at the end of RTS Send Delay, the first character is transmitted. If CTS is not on, the slave waits up to 1 second for it. If it is not on within 1 second, the packet transmission is aborted. This delay is sometimes used to provide key-up time for radio modems. 0 to 2500 RTS Off Delay is used to increase the time after the last transmitted character before RTS is dropped. This feature is sometimes useful in noisy radio and modem systems when trailing noise will bother the receiving master. The value configured in this parameter should never exceed the Master s message handling turnaound time (i.e., a slave s RTS should not be asserted while the Master is transmitting). 14

15 N100: Modbus Configuration and Diagnostic File N100 Word Modbus Addr Name Inter-character Timeout Reserved Default Value 0 (RTU 3.5 characters ASCII 1 sec) Valid Range Description 0 to 2500 In satellite systems, or really in any packet radio type of system that is used today, a data packet can get broken down into several separate packets when being sent. As a result a time delay of up to 200 ms sometimes can exist between packets on the receiving end when these packets are coming in. The Modbus RTU mode uses a 3.5 character width quiet time to define the end of a message. As an example, at 9600 baud this works out to about 3.5 ms. Without Inter-Character Delay, the slave would timeout in the middle of a message and then error and not respond. With a configurable inter-character timeout, the user can override the 3.5 character delay and enter a new value. Note that often the ASCII mode is also used to overcome this problem since the character timeout in this mode is normally set to 1000 ms Status and Diagnostic Data (Output values from Modbus Driver) N100 Word Modbus Addr Name Range Description Status Bits 1,2 Reports the current state of the Modbus Driver: Value Description 1 Modbus Active 2 Modbus Off If N100 is not the right size or the signature is not correct, this field will not be updated, so will not correctly indicate the Modbus Status. To verify that the value is valid, overwrite it manually and see that the Modbus System puts it back to a 1 or 2. Only bits 0 and 1 are affected. Other bits are meaningless and should be set to Error Code for Configuration and Value Description Application Layer Errors 0 All Ok 1 Both On and Off Cmd set 2 Bad Baud 3 Bad RTS Send Delay 4 Bad RTS Off Delay 5 Bad Pre Send Delay 6 Bad InterChar Timeout 7 Bad Parity config 8 Bad Stop Bit config 9 Bad Modbus Mode 10 Bad Node Address 11 Channel in User Mode 12 Bad Base File Number 101 Msg too short 102 FNC cant Broadcast 103 FNC not supported 104 Bad length (exceeds data table end) 105 Bad Data Address 106 No such Data Table 107 Bad Data values 108 Bad Count value 109 Bad Msg Length 110 Not in Run Mode 111 Channel Write Protected 112 Table Write Protected 15

16 N100: Modbus Configuration and Diagnostic File N100 Word Modbus Addr Name Range Description Application Layer Error Count 0 to Rollover counter of the number of messages which generated an application layer error Error FNC code 0 to 255 Value of FNC field of last message that caused an application layer error. This value is updated every time an error code is returned to the host Last Transmitted Exception Code 1 to 8 Value of Exception code in last Exception Response transmitted to Master. Value Description 1 Illegal Function 2 Illegal Data Address. Perhaps data table does not exist. 3 Illegal Data Value. Count field exceeds data table size or Coil Write data not correct. 4 Slave Device Failure. Not in RUN mode or Table/Channel Write protected. 5 Acknowledge. Unused. 6 Slave Device Busy. Unused. 7 Negative Acknowledge. Unused. 8 Memory Parity Error. Unused. Look in N100:20 for more details regarding the error which caused an Exception Response. This value is updated every time an error code is returned to the host Data Table number of Error Request 0 to 255 SLC data table number (file number) which was the attempted target of the last message which caused an application error. Use this field to diagnose Exception 2 and 3 replies, which indicate that the address did not map to a valid location This value is updated every time an error code is returned to the host Element Number of Error Request 0 to 255 SLC element number (word number) which was the attempted target of the last message that caused an application error. Use this field to diagnose Exception 2 and 3 replies, which indicate that the address did not map to a valid location. Check that the target data table has at least this number of elements. This value is updated every time an error code is returned to the host Active Function Code Bits 0 to 8 A bit packed word indicating the type of command that was successfully processed by the port for this slave Bit Function

17 N100: Modbus Configuration and Diagnostic File N100 Word Modbus Addr Name Range Description These bits may optionally be cleared in ladder logic or via communication channel write. The bits are updated at the end of ladder scan or during SVC instruction Reserved Reserved FC 1 Message Counter 0 to Rollover counter that increments every time a Function Code 1 is seen addressed to this slave FC 2 Message Counter 0 to Rollover counter that increments every time a Function Code 2 is seen addressed to this slave FC 3 Message Counter 0 to Rollover counter that increments every time a Function Code 3 is seen addressed to this slave FC 4 Message Counter 0 to Rollover counter that increments every time a Function Code 4 is seen addressed to this slave FC 5 Message Counter 0 to Rollover counter that increments every time a Function Code 5 is seen addressed to this slave FC 6 Message Counter 0 to Rollover counter that increments every time a Function Code 6 is seen addressed to this slave FC 8 Message Counter 0 to Rollover counter that increments every time a Function Code 8 is seen addressed to this slave FC 15 Message Counter 0 to Rollover counter that increments every time a Function Code 15 is seen addressed to this slave FC 16 Message Counter 0 to Rollover counter that increments every time a Function Code 16 is seen addressed to this slave Reserved Modem Status Bit map of Modem Control Line status Link Layer Error 0 to 200 Last error encountered by Link Layer Value Description 0 No receive buffers available 1 Unexpected : 2 Unexpected char (usually a nonhex digit in ASCII mode). 3 Msg too long 4 UART Error. Framing,Parity, Break. Check bit, baud, parity settings. 5 Bad LRC or CRC 6 Msg too short 7 Invalid Receive State 8 Interchar timeout 100 CTS timeout 101 CTS drop mid packet 102 Driver shutdown mid-packet Link Layer Error Count 0 to Count of Link Layer Errors Messages to this slave 0 to This rollover counter increments every time a command is received which has a slave address which matches the configured Modbus slave address Total messages seen 0 to This rollover counter increments every time a command is seen on the Modbus port, no matter who the command is for. This counter may be used as a network activity counter. 17

18 N100: Modbus Configuration and Diagnostic File N100 Word Modbus Addr Name Range Description Messages responded by this slave 0 to This rollover counter increments every time a response is issued by the RTU-5/03. Note that this counter increments whether the response is a data response or an error code response Reserved Reserved Reserved Reserved Note that all counters are rollover counters and are reset when the Modbus Driver is started (on AutoSwitch following RTU-5/03 power up or download), when N100:0/0 Start bit or N100:0/4 Clear Counters Bit is set 4.3 Modbus Diagnostic File Error Code values The Modbus Slave driver returns error codes to the Diagnostic file. This data will be useful for diagnosing the status of the Modbus Slave port communications. Note that in all cases, if a zero is returned, there was not an error. Valid Error Status Codes are as follows: Code Name Description 0 All OK The port is operating as desired 1 Illegal Function An illegal function code request is being attempted 2 Bad Data Address The address, or the range of addresses, covered by a request from the host is not within allowed limits 3 Bad Data Value The value in the data field of the command from the host is not allowed. 4 Incomplete Response Detected This error indicates that an incomplete query was received from a host query. This indicates that the slave port is timing out too quickly (i.e., application may require some Inter-character Timeout Delay) or that the host query is getting abbreviated, possibly by the transmitting modem (last character getting dropped). 6 Module Busy The module busy status code is returned when a write command from the master cannot be completed. 8 Timeout Error Communications with the addressed slave have been unsuccessful due to a lack of response from the slave. The Master port will attempt a command three times before moving onto the next command. 10 Buffer Overflow The receive buffer has overflowed and reset the character count to 0. If this condition occurs try reading fewer parameters at one time 16 Port Configuration Error One or more of the serial port configuration values has been mis-configured. To determine the exact source of the problem, verify the following: - Slave Address - Parity Configuration - Stop Bit Configuration - Baud Rate Configuration - Modbus Data Table First File 254 Checksum Error The slave determined that the message checksum was in error, and therefore discarded the message 255 TX Hardware Timeout A transmit timeout condition has occurred indicating that the port was not able to begin transmiit prior to the RTS Send Delay timing out. Verify that the RTS- CTS jumper on the port is still connected 18

19 4.3 Activating the Modbus Slave Driver Two mechanisms are available for turning on and off the Modbus Slave Driver. - Manual Start/Stop - AutoSwitch Manual Modbus Driver Start and Stop N100: Modbus Configuration and Diagnostic File To configure the driver for Manual Start Stop, clear bit N100:1/0 (Disable AutoSwitch) to 0. When you want to use Modbus protocol, instead of the configured DataHighway protocol on channel 0, set bit N100:0/0 to 1. If the configuration file is valid, N100:0/0 will be reset to 0 and N100:20/0 will be set. This indicates that the Modbus driver is active. When you want to cease Modbus communication and resume Data Highway (for example for updating or monitoring the ladder program), Set bit N100:0/1 to 1 (i.e. write the N100:0 word to 2). N100:0/1 and N100:20/0 will be reset and N100:20/1 will be set. This indicates the Modbus driver is no longer active. If the driver does not start when commanded, look for configuration errors reported in N100:21. If the N100:0/0 bit does not get set back to zero, make sure the N100 file is at least 50 words long and has the word Modbus at word N100:7 through 9. See also Troubleshooting section. To get the Modbus driver to automatically start when the Ladder Program starts, use the First Pass Bit (S:1/15) to latch N100:0/0. The Start/Stop bits may be manipulated using ladder logic, data table monitoring software or physical inputs from an input card AutoSwitch Mode AutoSwitch attempts to automatically install the correct driver based on Channel 0 activity. To configure the driver for AutoSwitch, set bit N100:1/0 (Enable AutoSwitch) to 1. When the SLC starts (following powerup or download, or driver configuration), the selected Channel 0 System Mode driver is active. If no Data Highway messages are received on Channel 0 for 20 seconds, the Modbus driver is automatically installed. Bit N100:20/0 is ON when the Modbus driver is installed. If there is either no activity, or valid Modbus messages, the Modbus driver remains installed. If the Modbus driver detects non-modbus activity for 5 seconds, with no intervening valid Modbus activity, the Modbus driver is turned off and the Data Highway driver is automatically reinstalled. The cycle repeats as needed. The Modbus and Data Highway drivers need not use the same protocol settings (baud, bits, parity). When configured for AutoSwitch, Note that bits N100:0/0 and /1 can still be used, but the driver will switch back after a brief time if the AutoSwitch criteria are met. Note that the driver will not AutoSwitch (or manual switch) from the User Mode Channel 0 Driver. Channel 0 must be configured for System Mode. If using programming software such as RSLogix, several On-line requests may be necessary to get Modbus to switch off and Data Highway to switch on. This is because 5 seconds of non-modbus activity are required, and the DF1 driver will only retry a message 2 or 3 times before giving up. If you ask to go On-line again, it will try 2 or 3 times again. Usually within 3 On-line requests the Modbus Driver will AutoSwitch to Data Highway. 19

20 Supported Modbus Function Codes 5 Supported Modbus Function Codes The Modbus Function Codes that are supported by the RTU-5/03 can be broken down into read and write commands. The Function Code issued by the host to determine the range of addresses that are either read or written to. This section details the RTU-5/03 data table addresses that are accessed by each Function Code. 5.1 Modbus Read Function Codes The following table details the Modbus Read commands that are supported by the RTU-5/03: Function Command Code Name 1 Read Coil Image 2 Read Input Image Modbus Addressing 0001 to 4096-File to 8192-File 2 etc to File to File 2 etc. Description This command returns bit level data in response to queries for coil data. Key points about this command includes: 1) The host can address multiple files on a 4097 bit address boundary 2) The host can issue read commands which cross file boudaries 3) Binary and Integer files can be addressed This command returns bit level data in response to queries for Discrete Input data. Key points about this command includes: 1) The host can address multiple files on a 4097 bit address boundary 2) The host can issue read commands which cross file boudaries 3) Binary and Integer files can be addressed 3 Read Holding Registers - Integers (Under 47001) to File to N to File to 415xx-S to File 3 etc. This command gives read access to integer values in the data table. Valid file types include N, B, F (if the count value is two words per float). Note that the driver gives read and write access to two special locations in the data table memory: 1) The N100 file is addressable starting at ) The S2 file is addressable starting at Read Holding Registers - Floating Point (GEQ 47001) 4 Read Input Registers to File to File 2 etc to File to N to File to 315xx-S to File 3 etc. When a FC 3 command is addressed at or above, the Modbus driver will return the following: 1) If the file is a floating point type, the driver will return two words per count requested 2) If the file is an integer type, the driver will return one word per count requested This command gives read access to integer values in the data table. Valid file types inclide N, B and F (if the count value is two words per float). 5.2 Modbus Write Commands The following details the Modbus Write commands that are supported by the RTU-5/03: Function Command Code Name 5 Set/Reset Coils Modbus Addressing 0001 to 4096-File to 8192-File 2 etc. Description This command will set/reset a single bit in a B or N file. 20

21 Supported Modbus Function Codes 6 Single Regs 16 Multiple Regs Write Single Register- Integers (Under 47001) to File to N to File to 415xx-S to File 3 etc. This command gives read access to integer values in the data table. Valid file types include N, B, F (if the count value is two words per float). Note that the driver gives read and write access to two special locations in the data table memory: 1) The N100 file is addressable starting at ) The S2 file is addressable starting at Write Holding Registers - Floating Point (GEQ 47001) 15 Write Multiple Coils to File to File 2 etc to 4096-File to 8192-File 2 etc. When one of these commands is addressed at or above, the Modbus driver will allow the following: 1) If the file is a floating point type, the driver will expect two words per count requested 2) If the file is an integer type, the driver will expect one word per count requested This command will set/reset multiple bits in a B or N file. 21

22 Troubleshooting 6 Troubleshooting The following sections provide the information necessary for a programmer to troubleshoot the Modbus port on the RTU-5/ RTU-5/03 Modbus LED Indicator When the RTU-5/03 Modbus port is active, the Modbus LED Indicator on the front of the processor can provide some visual indication of the Modbus port status. Note The behavior of the Modbus LED only applies when the Modbus Driver is active, otherwise refer to SLC documentation for LED operation LED Action Off Toggling Description The Modbus is not receiving a command with a Modbus Slave address matching the value configured in the N100 file The LED will toggle under two conditions: 1. When a command is received which matches the RTU- 5/03 s Modbus Slave address, the LED will toggle, whether the command is legal or not. 2. When the RTU-5/03 generates a response, the LED will stay for the duration of the response (i.e., until the transmit buffer is emptied) 6.2 Processor Faults In addition to the Major Fault code documented in the SLC Fault Codes (See SLC documentation), the RTU- 5/03 will generate several unique fault codes under certain conditions. The new fault codes that have been added are: Fault Code 0xA0 0XA1 Description Indicates that an internal firmware error has occurred within the Modbus driver code. If this fault code occurs, the contents of the N100 file ( words 0 to 49) should be documented and reported to ProSoft (See Section 7 or contact information) This fault code will be generated under the following condition: If the Modbus signature is found in words 7 to 9 in the N100 file, but the length of the file is not greater than or equal to 50 words 6.3 Troubleshooting Tips The following table details some of the conditions that can cause problems in the operation of the Modbus Slave port. Suggested solutions are also provided. If the suggested solution does not clear the problem, please contact ProSoft directly for assistance. Error Condition Description Items to Check Processor Major Fault Code 0xA1 The RTU-5/03 will return a Major Fault (Non-recoverable) code of 0xA1 if the processor is placed in RUN with the Modbus signature in N100:16 to N100:18 with an 1. Verify that the file N100 has a length of at least 50 words. 22

23 Troubleshooting N100 length of less than 50 words. Error Condition Description Items to Check Fault, BATT and Modbus LEDs blink at once Modbus Error Code 1 returned to Host If these three LEDs blink it means that the RTU-5/03 hardware is not compatible with the OS which has been loaded in the 5/03 flash. The RTU-5/03 will not run with standard SLC 5/03 OS firmware. This value is returned whenever a Function Code is received from a host which is not supported by the RTU-5/03 1. Contact ProSoft Technology technical support 1. Verify that the Host is sending a Function Code which is supported by the RTU/5-03 Modbus Error Code 2 returned to Host Modbus Error Code 3 returned to Host Modbus Error Code 4 returned to Host This value is returned when the Start Address in the request from the Host exceeds the length of the data file in the RTU-5/03 This value is returned when the Count field in a request causes the file boundary in the RTU-5/03 to be exceeded, or when the request exceeds the length supported by the protocol This value is returned when the host has attempted to write to a data table in the RTU-5/03 that is Protected (either Static or constant) 1. Verify that the RTU-5/03 data file addressed by the command exists and with sufficient length to meet the needs of the requests from the host. 1. Verify that the length of the read or write request from the host does not cause a file boundary to be crossed. The RTU-5/03 will not cross file boundaries to satisfy data requests 2. Verify that the lenght of the request does not exceed that allowed by the Modbus protocol or the driver implementation: Coils 2000 Registers Verify that the data location being addressed by the host is correct 2. If the data memory is to have write access, then verify the Protection state. 6.3 Modbus Diagnostic File Error Code values The Modbus Slave driver returns error codes to the Diagnostic file. This data will be useful for diagnosing the status of the Modbus Slave port communications. Note that in all cases, if a zero is returned, there was not an error. Valid Error Status Codes are as follows: Code Name Description 0 All OK The port is operating as desired 1 Illegal Function An illegal function code request is being attempted 2 Bad Data Address The address, or the range of addresses, covered by a request from the host is not within allowed limits 3 Bad Data Value The value in the data field of the command from the host is not allowed. 4 Incomplete Response Detected This error indicates that an incomplete query was received from a host query. This indicates that the slave port is timing out too quickly (i.e., application may require some Inter-character Timeout Delay) or that the host query is getting abbreviated, possibly by the transmitting modem (last character getting dropped). 6 Module Busy The module busy status code is returned when a write command from the master cannot be completed. 8 Timeout Error Communications with the addressed slave have been unsuccessful due to a lack of response from the slave. The Master port will attempt a command three times before moving onto the next command. 23

24 Troubleshooting Code Name Description 10 Buffer Overflow The receive buffer has overflowed and reset the character count to 0. If this condition occurs try reading fewer parameters at one time 16 Port Configuration Error One or more of the serial port configuration values has been mis-configured. To determine the exact source of the problem, verify the following: - Slave Address - Parity Configuration - Stop Bit Configuration - Baud Rate Configuration - Modbus Data Table First File 254 Checksum Error The slave determined that the message checksum was in error, and therefore discarded the message 255 TX Hardware Timeout A transmit timeout condition has occurred indicating that the port was not able to begin transmit prior to the RTS Send Delay timing out. Verify that the RTS-CTS jumper on the port is still connected 24

25 Cable Connections 7 Cable Connection Channel 0 The following diagrams details the physical connection to the Channel 0 port when the port is active as a Modbus Slave and when the port is being used as a programming port. 7.1 Cable configuration for Modbus Communications The following cable diagrams identify the pin out on the RTU-5/03 RS-232 port and the cable configuration using the most common connections. Important Note The RTU-5/03 absolutely requires that CTS be activated in order to transmit. This requirement is independent of whether connected to a modem network or point-point with a PC. If in doubt, jumper RTS to CTS (Pin 7 to 8) The direct connection diagram should be used when connecting the port directly to another DTE device (i.e., another computer or similar device). The direct connection diagram can also be used under some circumstances with soft-keyed radios and/or modems. Direct Connection Need to verify this port connection diagram on pins 2 & 3. Diagram RTU-5/03 DB-9 Pin Male TxD RxD RTS CTS GND DTR RTS-CTS jumper must be installed on RTU-5/03 to communicate PC Port DB-9 Pin Male TxD RxD RTS CTS GND DTR The modem connection should be used when interfacing the RTU-5/03 port to a modem and/or radio modem which requires hardware handshaking signals. Under most circumstances, the important signals to connect will be the RTS/CTS signals, which will control the transmit state of the modem. 25

26 Troubleshooting 8 Technical Support Technical support for the ProSoft Technology RTU-5/03 processor can be broken down into two categories to help clarify who to call for support: 1. Modbus on Channel 0 related issues 2. All other issues 8.1 Modbus on Channel 0 Related Issues If any technical support issues relating to the application of the Channel 0 Modbus port arise, these should be directed to ProSoft Technology, Inc. Examples of issues that should be directed to ProSoft include: 1. RTU-5/03 Hardware warranty issues 2. Modbus Configuration and Diagnostic File questions 3. Modbus port not functioning 4. Modbus Error Codes being returned 5. Processor returning Major Fault Code XX (See Troubleshooting section) 6. Modbus addressing questions Contact information for ProSoft Technology, Inc. is as follows: ProSoft Technology, Inc Chester Avenue, 4 th Floor Bakersfield, CA (661) Phone (661) Fax prosoft@prosoft-technology.com Non-Modbus Related Issues All non-modbus related technical support issues should be directed to the local A-B Technical Support office. Examples of the type of questions and issues which should be directed to the A-B Technical Support resource include: 1. Ladder logic programming questions 2. Rack and hardware configuration questions 26