Using FieldServers with

Using FieldServers with

Modbus/TCP
Modbus/TCP
Presented by:
Presented by:
Gordon MacLachlan (Mac)
Gordon MacLachlan (Mac)
Presentation Highlights
Presentation Highlights
Presentation Summary
The Modbus Standard
Function codes
Dual addressing system
Modbus Variations
Variations caused by transport medium
Variations caused by integer restriction
JBUS
Modbus TCP
Modbus TCP vs Modbus RTU
Considerations resulting from the introduction of Ethernet
Troubleshooting Ethernet protocols.
Configuration tips
Dealing with poll lengths
Dealing with Function codes
About the Could not create cache block error
Remote devices that use fixed node addressing.
Question and Answer Session
The Modbus Standard
The Modbus Standard
General Comments General Comments
Modbus is a truly open standard. The specification can be downlo Modbus is a truly open standard. The specification can be downloaded from aded from
the web and implemented by anybody. There is no charge for the the web and implemented by anybody. There is no charge for the
specification specification
Modbus is based on a Master/Slave poll and response topology. Modbus is based on a Master/Slave poll and response topology.
Modbus is an integer protocol, Modbus is an integer protocol, i.e i.e: floating point is not supported by the : floating point is not supported by the
protocol (variations of protocol (variations of modbus modbus exist that support floating point) exist that support floating point)
Modbus supports 4 basic data types: Analog Inputs, Analog Output Modbus supports 4 basic data types: Analog Inputs, Analog Outputs s
(Registers), Digital Inputs, Digital Outputs (Coils/Flags) (Registers), Digital Inputs, Digital Outputs (Coils/Flags)
Modbus supports 9999 addresses per data type (a variation, JBUS, Modbus supports 9999 addresses per data type (a variation, JBUS, supports supports
65535 per data type) 65535 per data type)
Modbus builds NO intelligence into what it is sending, Modbus builds NO intelligence into what it is sending, i.e i.e: it does not care : it does not care
what the data in the registers represent. what the data in the registers represent.
Modbus is used worldwide, and can probably boast that it is the Modbus is used worldwide, and can probably boast that it is the most most
supported protocol in the world. supported protocol in the world.
Modbus Memory Map
Modbus Memory Map
Address
Format 1
00001
10001
19999
30001
39999
40001
49999
09999
Flags (Read/Write)
Digital Inputs (Read Only)
Analog Inputs (Read Only)
Registers (Read/Write)
Read: Function Code 1, Offsets 0-9998
Write Single: Use Function Code 5
Write Multiple: Use function Code 15
Address
Format 2
Data Type
Read: Function Code 2, Offsets 0-9998
Write Single: N/A
Write Multiple: N/A
Read: Function Code 4, Offsets 0-9998
Write Single: N/A
Write Multiple: N/A
Read: Function Code 3, Offsets 0-9998
Write Single: Use Function Code 6
Write Multiple: Use function Code 16
Modbus Variations
Modbus Variations
Variations resulting from a difference in connection medium: Variations resulting from a difference in connection medium:
Modbus RTU: This is the most common Modbus variation. The medium Modbus RTU: This is the most common Modbus variation. The medium for for
communication is RS communication is RS- -232 or RS 232 or RS- -485. Data is transferred in hexadecimal 485. Data is transferred in hexadecimal
format. Only one master allowed. format. Only one master allowed.
Modbus ASCII: Also uses RS Modbus ASCII: Also uses RS- -232 or RS 232 or RS- -485. Data is transferred in ASCII 485. Data is transferred in ASCII
format. Only one master allowed. format. Only one master allowed.
Modbus TCP: Medium is Ethernet. Data is transferred in hexadecim Modbus TCP: Medium is Ethernet. Data is transferred in hexadecimal format al format
using the TCP/IP transport protocol. Allows multiple masters using the TCP/IP transport protocol. Allows multiple masters
Modbus Plus: Uses a proprietary medium. Special hardware needed. Modbus Plus: Uses a proprietary medium. Special hardware needed. Allows Allows
multiple masters. multiple masters.
All of the above protocols support Modbus in its true format. All of the above protocols support Modbus in its true format.
Modbus Variations
Modbus Variations
Variations resulting from protocol restrictions: Variations resulting from protocol restrictions:
The following FieldServer drivers are The following FieldServer drivers are modbus modbus variants: variants:
Modbus Modbus Tekair Tekair
Modbus Daniels Modbus Daniels
Modbus Modbus OmniFlow OmniFlow
These drivers exist due to the need for the vendor to compe These drivers exist due to the need for the vendor to compensate for Modbus nsate for Modbus
being a 16 bit integer protocol by providing a method for sendin being a 16 bit integer protocol by providing a method for sending 32 bit g 32 bit
values. Many other vendors do this too. values. Many other vendors do this too.
Additionally, FieldServer has a special move function that Additionally, FieldServer has a special move function that can assist in can assist in
decoding these 32 bit variants for use by other protocols. decoding these 32 bit variants for use by other protocols.
Modbus Variations
Modbus Variations
Supporting 32 bit values with Modbus Supporting 32 bit values with Modbus
FieldServer concept for manipulating FieldServer concept for manipulating modbus modbus floating point floating point (Concept is the same for 32 bit integers): (Concept is the same for 32 bit integers):
Modbus
Device
Two 16 bit
integers polled:
e.g: 40001,
length 2
Together, they
combine to
form a 32 bit
IEEE Floating
point number.
Source Data
Array
-------------------------
Offset 0: 40001
-------------------------
Offset 1: 40002
-------------------------
Float Data
Array
-------------------------
Offset 40: Float value
-------------------------
Modbus Poll
Special
Move
Moves
Sour ce_Dat a_Ar r ay , Sour ce_Of f set , Tar get _Dat a_Ar r ay , Tar get _Of f set , Lengt h , Funct i on
Sour ce_DA , 0 , Tar get _DA , 40 , 10 , 2. i 16- 1. f l oat - sw
Unreadable
content
Sensible data
Modbus Variations
Modbus Variations
Variations resulting from protocol restrictions (JBUS): Variations resulting from protocol restrictions (JBUS):
Background: Background:
Modbus stores the offset (address) as an integer in the poll mes Modbus stores the offset (address) as an integer in the poll message sage
However, the legal value for offset can only range from 0 However, the legal value for offset can only range from 0- -9998. 9998.
An unsigned integer can represent any integer from 0 An unsigned integer can represent any integer from 0- -65535. So why the 65535. So why the
limit? limit?
JBUS takes care of this and allows for the offset to range from JBUS takes care of this and allows for the offset to range from 0 0- -65535 65535
JBUS therefore supports 65536 addresses per data type. JBUS therefore supports 65536 addresses per data type.
Notes Notes
1. 1. You can poll a JBUS device with Modbus, but you will not have ac You can poll a JBUS device with Modbus, but you will not have access to cess to
offsets above 9998 offsets above 9998
2. 2. JBUS is sometimes called JBUS is sometimes called Extended Modbus Extended Modbus
Modbus TCP
Modbus TCP
Modbus RTU Modbus RTU vs vs Modbus TCP: Modbus TCP:
Modbus RTU: Modbus RTU:
Serial protocol using RS Serial protocol using RS- -232 or RS 232 or RS- -485 as a medium 485 as a medium
Devices are addressed by Station Address ( Devices are addressed by Station Address (Node_ID Node_ID) )
Modbus TCP: Modbus TCP:
Uses Ethernet. Uses Ethernet.
Modbus RTU + TCP/IP Layer = Modbus TCP Modbus RTU + TCP/IP Layer = Modbus TCP
Devices are addressed by IP address and Station address. Devices are addressed by IP address and Station address.
Modbus RTU string TCP/IP TCP/IP
Modbus TCP
Modbus TCP
Modbus TCP
Dealing with Ethernet and Modbus TCP: Dealing with Ethernet and Modbus TCP:
User needs to become familiar with User needs to become familiar with subnetting subnetting and the IP addressing and the IP addressing
system system
Using Modbus TCP across subnets requires the use of IP gateways, Using Modbus TCP across subnets requires the use of IP gateways, so the so the
Gateway address setting in IP configuration becomes important Gateway address setting in IP configuration becomes important
Modbus TCP uses port 502 to communicate. You Modbus TCP uses port 502 to communicate. You ll need to know this if ll need to know this if
you are to punch a hole in any firewall for communications. you are to punch a hole in any firewall for communications.
Modbus TCP makes use of TCP/IP connection management to allow Modbus TCP makes use of TCP/IP connection management to allow
multiple communications connections to occur. This makes multipl multiple communications connections to occur. This makes multiple e
masters on a Modbus TCP Network possible. masters on a Modbus TCP Network possible.
Modbus TCP
Modbus TCP
Troubleshooting on Ethernet: Troubleshooting on Ethernet:
Arm yourself with a good Ethernet capture tool. One such package Arm yourself with a good Ethernet capture tool. One such package, ,
Ethereal is available as freeware on the Web (go to Ethereal is available as freeware on the Web (go to www.ethereal.com www.ethereal.com) )
For testing, a copy of Modscan32 or similar is highly recommende For testing, a copy of Modscan32 or similar is highly recommended (go to d (go to
www.win www.win- -tech.com tech.com ). Use this to emulate a Client on the network and test ). Use this to emulate a Client on the network and test
communications. communications.
Be acutely aware of the network layout, including all subnets in Be acutely aware of the network layout, including all subnets involved, all volved, all
Modbus TCP devices on the network, all routers, and all firewall Modbus TCP devices on the network, all routers, and all firewalls. All of s. All of
these can influence communications. A detailed network layout di these can influence communications. A detailed network layout diagram is agram is
essential. essential.
Some devices support IP addressing in conjunction with variable Some devices support IP addressing in conjunction with variable Unit Unit
identifier ( identifier (Node_ID Node_ID). Others will fix the unit identifier and work with IP ). Others will fix the unit identifier and work with IP
addressing only. Know which variant you are dealing with, as the addressing only. Know which variant you are dealing with, as the
FieldServer will need to fix its FieldServer will need to fix its Node_ID Node_ID to the correct address if the latter to the correct address if the latter
is in use. is in use.
Configuration Tips
Configuration Tips
Dealing with Function Codes Dealing with Function Codes
Usually, devices support function codes 1,2,3,4,5,6,15 and 16. T Usually, devices support function codes 1,2,3,4,5,6,15 and 16. This allows for reads his allows for reads
and writes of all types. and writes of all types.
Some devices only support a subset of these function codes. This Some devices only support a subset of these function codes. This is legal, but it does is legal, but it does
mean that when communicating with these devices, the function co mean that when communicating with these devices, the function code being used de being used
needs to be selectable. needs to be selectable.
Managing Function Codes 1 Managing Function Codes 1- -4 is easily done by choice of address 4 is easily done by choice of address
It is often necessary, however, to suppress the use of Function It is often necessary, however, to suppress the use of Function codes 15 or 16 and codes 15 or 16 and
use 5 or 6 instead. To do this, FieldServer provides special map use 5 or 6 instead. To do this, FieldServer provides special map descriptor descriptor paramaters paramaters
that allow the read or write type to be stipulated. See Enote018 that allow the read or write type to be stipulated. See Enote018 for more details. for more details.
Example Example
FC 6 = Write Single Register FC 6 = Write Single Register
1. 1. Add a parameter to the Modbus client side map descriptor called Add a parameter to the Modbus client side map descriptor called data_type data_type. .
2. 2. If you specify the If you specify the data_type data_type as as Single_Register Single_Register and the Function as WRBC or WRBX, then a and the Function as WRBC or WRBX, then a modbus modbus poll poll
with FC 6 will be generated. with FC 6 will be generated.
3. 3. Of course Of course Single_Register Single_Register implies a length of one, and even if you try to set the length implies a length of one, and even if you try to set the length longer in the csv file, longer in the csv file,
the length is limited to 1 in the driver. the length is limited to 1 in the driver.
Configuration Tips
Configuration Tips
Modbus and Typecasting (FieldServer does this by default) Modbus and Typecasting (FieldServer does this by default)
Each protocol variable type is allocated a default Data type Each protocol variable type is allocated a default Data type
Moves between dissimilar data types result in type Moves between dissimilar data types result in type- -casting casting
To avoid type To avoid type- -casting, use matching data array types or special functions such casting, use matching data array types or special functions such as Floating point as Floating point
moves or Packed Bit Data Arrays moves or Packed Bit Data Arrays
Modbus 3xxxx
Default Type = Uint16
Float Data
Array
Poll
Modbus 1xxxx
Default Type = Bit
Uint16 Data
Array
Bit Data
Array
Change
value to a
floating
point
value
Change
value to a
unsigned
integer
value
Change
value to a
bit value
Example variable types
Configuration Tips
Configuration Tips
Bit Packing Bit Packing
Concept: Concept:
0 9 8 7 6 5 4 3 2 1 10 15 14 13 12 11
0
Bit
Array
16 Bit
Unsigned
Integer
C
o
m
m
u
n
i
c
a
t
i
o
n
s
H
a
r
d
w
a
r
e

S
h
u
t
d
o
w
n
I
n
p
u
t

F
a
i
l
u
r
e
O
u
t
p
u
t

C
B

O
p
e
n
I
n
p
u
t

C
B

O
p
e
n
D
C

G
r
o
u
n
d

F
a
u
l
t
B
a
t
t
e
r
y

D
i
s
c
h
a
r
g
e
D
C

C
a
p

F
u
s
e

B
l
o
w
n
L
o
w

B
a
t
t
e
r
y

R
e
s
e
r
v
e
O
u
t
p
u
t

O
v
e
r
l
o
a
d
R
e
c
t
i
f
i
e
r

F
u
s
e

B
l
o
w
n
N
o
t

U
s
e
d
1034
B
a
t
t
e
r
y

D
i
s
c
h
a
r
g
e
H
a
r
d
w
a
r
e

S
h
u
t
d
o
w
n
R
e
c
t
i
f
i
e
r

F
u
s
e

B
l
o
w
n
Ser ver
Si de
Cl i ent
Si de
Configuration Tips
Configuration Tips
Bit Packing Bit Packing
Mechanics: Mechanics:
Modbus 3xxxx
Default Type = Uint16
Offset 0
30001
----------------
Offset 1
30002
Offset 0
DI 1
.
DI16
--------------
Offset 16
DI17

DI32
Poll
Metasys DI
Default Type = Bit
No typecasting
occurs. Data
Array is treated as
type Uint16 to
Match variable
type
Packed Bit Data Array
Poll
No typecasting
occurs. Data
Array is treated as
type Bit to match
variable type
/ / ================================================================================
/ /
/ / Dat a Ar r ays
/ / Packed_Bi t i s enabl ed mer el y by decl ar i ng t he dat a ar r ay t o be
/ / of t ype: Packed_Bi t
Dat a_Ar r ays
Dat a_Ar r ay_Name , Dat a_For mat , Dat a_Ar r ay_Lengt h
Packer , Packed_Bi t , 200
Configuration Tips
Configuration Tips
Modbus as a slave Modbus as a slave Keep data map Keep data map large large contiguous contiguous
Why? Because you don Why? Because you don t know how a client will structure its poll, and if it polls for t know how a client will structure its poll, and if it polls for undefined undefined
points, the poll will fail. points, the poll will fail.
Client side Data
Array 1
Client side Data
Array 4
Client side Data
Array 2
Client side Data
Array 3
Server Side
Data Array
Moves
Remote
Client can
now poll the
FieldServer
using large
poll lengths
without fear
of hitting
undefined
registers.
1 Server
Data Array
means 1
Server map
descriptor is
possible
Configuration Tips
Configuration Tips
Configuring Data Moves
Configuring Data Moves
/ / ================================================================================
/ /
/ / Dat a Ar r ays
/ /
/ / Decl ar e Dat a Ar r ays f or t he dat a t o be moved. I n t he r eal wor l d exampl e,
/ / t he Dat a Ar r ays may al r eady be decl ar ed.
/ /
Dat a_Ar r ays
Dat a_Ar r ay_Name , Dat a_For mat , Dat a_Ar r ay_Lengt h
Sour ce_DA , Fl oat , 200
Tar get _DA , Fl oat , 200
/ / ================================================================================
/ /
/ / Set up t he moves t o move t he dat a.
/ /
Moves
Sour ce_Dat a_Ar r ay , Sour ce_Of f set , Tar get _Dat a_Ar r ay , Tar get _Of f set , Lengt h , Funct i on
Sour ce_DA , 0 , Tar get _DA , 40 , 20 , Move_Onl y
Configuration Tips
Configuration Tips
Help! I Help! I m getting m getting could not create cache block could not create cache block
This error occurs frequently when the FieldServer is configured This error occurs frequently when the FieldServer is configured as a as a modbus modbus
slave slave
It means that the FieldServer has received a poll for addresses It means that the FieldServer has received a poll for addresses that do not that do not
exist in the FieldServer under any one Server map descriptor. exist in the FieldServer under any one Server map descriptor.
The content of the error message will tell what poll was receive The content of the error message will tell what poll was received. The d. The
message can be message can be intepreted intepreted as follows: as follows:
T02> MODBUS_TCP : Could not create cache block T02> MODBUS_TCP : Could not create cache block
T02> Node:1 Addr:40001 Len:100 T02> Node:1 Addr:40001 Len:100
Server Node
being polled
Modbus
Address being
polled
Length of poll
Configuration Tips
Configuration Tips
Managing Floating point values with Integers Managing Floating point values with Integers - - Scaling Scaling
Map_Descr i pt or s
Node_Name , Addr ess , Lengt h , Dat a_Ar r ay_Low_Scal e , Dat a_Ar r ay _Hi gh_Scal e , Node_Low_Scal e , Node_Hi gh_Scal e
MBP_Sr v_1 , 30001 , 200 , 0 , 10 , 0 , 100
Data Array
-------------------------
Offset 0: 26.4
-------------------------
Offset 1: 32.5
-------------------------
X10
Remote Device
-------------------------
Offset 0: 264
-------------------------
Offset 1: 325
-------------------------
Configuration Tips
Configuration Tips
Making two Making two modbus modbus Slaves talk to each other using the FieldServer Slaves talk to each other using the FieldServer
Slaves are passive, so they cannot Slaves are passive, so they cannot independantly independantly request data from each other. request data from each other.
Insert the FieldServer as a Master, read the data from one slave Insert the FieldServer as a Master, read the data from one slave, and then write it to the other , and then write it to the other
Wrbc Wrbc is normally the best function for writing status data is normally the best function for writing status data
Moves may be necessary to separate responsible map descriptors Moves may be necessary to separate responsible map descriptors
Data Array 1 Data Array 2
Rdbc Wrbc
Move
Server 1
Passive client
Configuration Tips
Configuration Tips
Helping Clients share data Helping Clients share data
Passive Server map descriptors can reference the same data array Passive Server map descriptors can reference the same data array. This means the Data Array . This means the Data Array
can be used as a shared repository for multiple active clients. can be used as a shared repository for multiple active clients.
Network
Protocol A
FieldServer
Client 1 Client 2
Network
Protocol B
This Data Sharing configuration
is useful in applications where
clients on different networks need
to share stored data
The same setup can provide a
passive server/passive client
functionality too
Map descriptor function used for
both protocols A and B is passive
Fieldserver is non-intrusive into
both networks, and responds to
queries and commands only.
Configuration Tips
Configuration Tips
Using the FieldServer to bring Modbus RTU into a Modbus TCP netw Using the FieldServer to bring Modbus RTU into a Modbus TCP network ork
Since the protocol is the same, port expansion can be used. This Since the protocol is the same, port expansion can be used. This requires minimal requires minimal
configuration. configuration.
Full Port expansion configuration example: Full Port expansion configuration example:
Connect i ons
Por t , Baud, Par i t y, Dat a_Bi t s, St op_Bi t s, Pr ot ocol , Handshaki ng, Pol l _Del ay,
R1 , 9600, None , 8 , 1 , Modbus_RTU, None , 0. 100s ,
R2 , 9600, None , 8 , 1 , Modbus_RTU, None , 0. 100s ,
P7 , 9600, None , 8 , 1 , Modbus_RTU, None , 0. 100s ,
P8 , 9600, None , 8 , 1 , Modbus_RTU, None , 0. 100s ,
Connect i ons
Adapt er , Pr ot ocol
N1 , Modbus/ TCP
Nodes
Node_Name, Node_I D, Pr ot ocol , Por t ,
PLC_07 , 7 , Modbus_RTU, P7 ,
PLC_08 , 8 , Modbus_RTU, P8 ,
PLC_11 , 11 , Modbus_RTU, R1 ,
PLC_12 , 12 , Modbus_RTU, R1 ,
PLC_21 , 21 , Modbus_RTU, R2 ,
PLC_22 , 22 , Modbus_RTU, R2 ,
Configuration Tips
Configuration Tips
Monitoring the status of Client side nodes (Servers) Monitoring the status of Client side nodes (Servers) Node Status Node Status
/ / ======================================================================================
/ /
/ / Not es : Al l t hat i s needed t o enabl e node st at us i s t he node st at us dat a ar r ay
/ / decl ar at i on. Not e, t hough, t hat Node I D' s i n t he conf i g need t o be
/ / uni que, ot her wi se t he Fi el dSer ver wi l l i ncor r ect l y r epor t t he st at us of
/ / dupl i cat e Node I D' s
/ /
/ / ======================================================================================
/ / ================================================================================,
/ /
/ / Dat a Ar r ays
/ /
Dat a_Ar r ays
Dat a_Ar r ay_Name , Dat a_For mat , Dat a_Ar r ay_Lengt h , Dat a_Ar r ay_Funct i on
DA_Comm_St at us , Bi t , 256 , Node_St at us
/ / ================================================================================,
/ /
/ / Modbus TCP Ser ver Map Descr i pt or Tur ns 10001 i nt o Nde 1 St at us, 10002=Node 2, et c.
/ /
Map_Descr i pt or s
Map_Descr i pt or _Name, Dat a_Ar r ay_Name, Dat a_Ar r ay_Of f set , Funct i on, Node_Name , Addr ess, Lengt h,
Node_St at us_Map , DA_Comm_St at us , 1 , Ser ver , MBP_Sr v_11, 10001 , 200 ,
Resources
Resources
1) www.fieldserver.com
FieldServer Configuration manual
FieldServer Troubleshooting manual
Modbus TCP Manual
2) www.modbus.org
List of modbus certified vendors
Modbus TCP specification
Application guidelines
3) Vendor sites
Mapping for modbus devices
4) www.ethereal.com
Ethernet packet capture utility
5) www.win-tech.com
Modscan32
Questions?
Questions?
Email Mac at:
Email Mac at:
[email protected]
[email protected]
PH: 408-262-2299, 888-509-1970
Email: [email protected]
www.fieldserver.com
THANK YOU!
THANK YOU!

..for taking the time to attend this

..for taking the time to attend this
presentation.
presentation.