TOP Server Understanding Modbus for Device Connectivity Presenter
TOP Server: Understanding Modbus for Device Connectivity Presenter: Kevin Rutherford
Modbus Protocol Training Agenda u u Overview Modbus Protocol Specifics u u u TOP Server Modbus Suite Flexibility u u u Modbus Types Modbus Terminology Modbus “Quirks” Example Modbus packets Supported Protocols Dealing with “Non-Standard” Modbus Devices Live Modbus Demo u u Configuration Troubleshooting u u u Using Quick Client Using Channel Diagnostics Questions?
What is a Protocol? u Protocols can happen at many levels and cover many things u u u u Cabling Electrical Packet structure Content of Packets Timing of Packets Rarely does ONE protocol cover all of these things Multiple protocols involved in making a full connection
What is a Protocol? Analogy – Train Tracks, Cars, & Cargo u u RS-232, 485, Ethernet define cabling and electrical protocols, i. e. the Train Tracks… In Ethernet connections, the transport defines the Train Cars (Packet structure) In Serial connections, the application protocol usually defines the Train Cars What’s in the Train Cars (packets) is the Cargo – the data – which is defined by the actual device/application protocol…. Application Protocols – Modbus TCP = Contents of the Train Cars Network Protocol Transport – TCP/IP Ethernet, FTP, HTTP = The train and cars Physical Transport Media- RS-232, RS-422, 10 -Base-T = The Train Tracks
Parts of a Typical Application Protocol u Many application protocols use some or all of these in their structures: u u u u Data section usually contains u u Header/start characters Target Device ID Function Code, Sub-Function Codes Data Length Data Checksum/error checking Termination character Read: Memory type, start location, length, or multiple locations in some protocols Write: Memory type & location to write, size to write, actual data to write Data contents is usually driven by what Function Code or Sub-Function Codes are used in the request Data is OFTEN communicated in Hex – Base 16!!!!
Modbus – Used Everywhere! u u u u u Schneider/Modicon/Telemecanique PLCs Nearly every other PLC brand offers built-in Modbus or a Modbus option module Electrical transmission & distribution control & monitoring equipment Water/wastewater control equipment Temperature controllers AC Variable Speed Drives Servo Drives Pick a device – it just might support Modbus When in doubt – find out – is Modbus a choice on the hardware?
Modbus Types u Serial – RS-232/422/485 electrical protocol u Two possible transmission modes: u u u Proprietary – Vendor specific electrical protocol u u Modbus Plus Ethernet – standard TCP/IP Ethernet electrical +transport u u u Modbus RTU Modbus ASCII Modbus TCP or Modbus Ethernet Encapsulated Modbus RTU or ASCII Gateway Devices u u u Ethernet or Modbus Plus Modbus RTU or ASCII serial on other side Multiple serial devices on downstream side
Modbus Terminology u Memory Types & Addressing u Input coils = Digital inputs u u Output Coils = Digital outputs u u 0 xxxxx address type 0/1 values Boolean data type Input Registers = Analog inputs u u 1 xxxxx address type 0/1 values Boolean data type 3 xxxxx address type 16 -bit registers 32 -bit data types use two consecutive registers Holding (Output) Registers = Analog outputs u u u 4 xxxxx address type 16 -bit registers 32 -bit data types use two consecutive registers
Modbus Terminology u Read/Write Access u u u Addressing – 5 or 6 digits u u u Read Only: Input registers & Input Coils Read/Write: Output Coils and Holding Registers Original Modbus was 5 digits – i. e. 40001 As PLC memories grew, went to 6, i. e. 400001 Offset u u u Modbus address offset is all digits after the first digit identify which memory type the address is Can be 0 or 1 based Pointer that specifies where into that memory type to go and start getting data or writing data
Modbus Terminology u Modbus Node Address u u u Used with serial devices Each device on serial connection has unique ID Slave ID values = 1 to 247 Master’s don’t have a Node address Modbus Function Codes u Used by Modbus Masters to tell a Modbus Slave what they want it to do u u u Read or Write? Memory Type? Single item or Multiple Items in a Transaction
Modbus Terminology u Common Modbus Function Codes u u u u 01 – Read Coils (output coils), 0 xxxxx memory 02 – Read Discrete Inputs (input coils), 1 xxxxx memory 03 – Read Holding Registers, 4 xxxxx memory 04 – Read Input Registers, 3 xxxxx memory 05 – Write Single coil (outputs), 0 xxxxx memory 06 – Write single Holding Register, 4 xxxxx memory 15 (0 x 0 F) – Write multiple coils (outputs) 16 (0 x 10) – Write multiple Holding Registers
Modbus Terminology u Modbus Exception Codes u u Used by slaves to tell Master what it did not like about a request Examples: u u u 02 - Bad memory address 01 - I don’t understand this function code 0 x 0 B - Slave didn’t respond – gateway devices
Common Modbus Quirks u Data Byte Ordering u u u u 32 bit data type word order 64 bit data type Dword order Byte order within words Addressing – 0 or 1 based Function Code support Use of user definable function codes Non-Modicon use of memory type + offset for addressing in documentation confusing
Modbus RTU Packet Framing u u PDU = protocol data unit Address field – 1 byte – node address of the slave CRC = error checking calculation, 2 bytes Function Code + Data depends on what you want to accomplish.
Modbus Packet Format Modbus RTU u u u A MODBUS message is placed by Modbus Master into a serial frame that has a known beginning and ending point. This is an amount of time indicating to devices that receive a new frame to begin at the start of the message, and to know when the message is completed. In RTU mode, message frames are separated by a silent interval of at least 3. 5 character times. Character time= time to send one byte @ chosen baud rate
Modbus RTU Example Read Holding Registers 108 -110 from Slave Node 01 u u Transmit: TX: 01 03 00 6 B 00 03 xx xx Receive: RX: 01 03 06 02 2 B 00 00 00 64 xx xx = 2 byte checksum IMPORTANT Notice: 1. Request is in # of registers 2. Response is in # of bytes 3. 1 Register = 2 bytes
Modbus RTU Example Write Single Holding Register 2 with value of 3 on Slave Node 1 u u Transmit: TX: 01 06 00 01 00 03 xx xx Receive: RX: 01 06 00 01 00 03 xx xx = 2 byte checksum
Modbus RTU Example Exception Response u Master asks for memory address that doesn’t exist in the slave
Modbus Packet Format Modbus TCP u u A Modbus TCP Packet is put into a TCP/IP wrapper Notice similarity to Modbus RTU with function code + data MBAP Header=Modbus Application Protocol Header – similar to the address field in the serial framing MBAP = 7 extra bytes on beginning of transmission
Modbus TCP MBAP Header Contents u Unit identifier used when using bridging to downstream serial devices. 0 = no bridging being used
Modbus TCP - Example u u Reading Input Register 30070, Reading through a gateway to slave device ID 1 on serial connection Request: u TX: 08 3 B 00 00 00 06 01 04 00 46 00 01 u u u 08 3 B 00 00 00 06 01 = MBAP u 08 3 B = Transaction ID u 00 00 = Protocol ID u 00 06 = 6 bytes follow from here u 01 = Node ID 1 04 00 46 00 01 = regular Modbus Read input Registers command u 04 = Function Code u 00 46 = Starting address in hex 0 x 46 = 70 decimal = offset into input registers u 00 01 = Quantity of input registers to read Response u RX: 08 3 B 00 00 00 05 01 04 02 01 23 u u 08 3 B 00 00 00 05 01 = MBAP u 08 3 B = Transaction ID – notice this matches the request u 00 00 = Protocol ID u 00 05 = 5 bytes follow from here u 01 = slave ID 1 04 02 01 23 = regular response to Modbus Read Input Registers u 04 = Function Code u 02 = byte count u 01 23 = Value in hex = 291 Decimal
TOP Server Modbus Suite Flexibility u Protocols Supported u u u Modbus RTU Serial Master and Slave Modbus ASCII Master Modbus Plus Modbus TCP Ethernet Master and Slave Flexible Settings for Non-Standard Modbus u u Zero or One-Based Addressing Holding Register Bit Mask Writes Specifying Function Code for Writes Data order manipulation
Live Demo u u Overview Modbus Protocol Specifics u u u TOP Server Modbus Suite Flexibility u u u Modbus Types Modbus Terminology Modbus “Quirks” Example Modbus packets Supported Protocols Dealing with “Non-Standard” Modbus Devices Live Modbus Demo u u Configuration Troubleshooting u u u Using Quick Client Using Channel Diagnostics Questions?
Questions? u Questions later? u Kevin Rutherford u krutherford@softwaretoolbox. com u 704 -849 -2773 x 1326 support@softwaretoolbox. com u u TOP Server Modbus Suite (Info / Free Demo) u u http: //www. toolboxopc. com/html/modbussuite. html Other learning opportunities u Visit www. softwaretoolbox. com/webinars
- Slides: 24