Modbus Rtu TCP

Modbus for VLTFC-series6
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
Modbus RTU for FC 100
Agenda
Overview
Modbus ASCII/RTU
Frame Structure
Exception codes
Function codes
Coils
Holding registers
Drive parameters
RS-485
2009-June-22
Drives Division
Overview
MODBUS Protocol is a messaging structure created by MODICON
company to connect PLC to programming tools.
It is now widely used to establish master-slave communication between
intelligent devices.
MODBUS is independent of the physical layer.
It can be implemented using RS232, RS422, or RS485 or over a variety
of media (e.g. fibre, radio, cellular, etc...).
2009-June-22
Drives Division
MODBUS is independent of the physical layer:

Modbus Application Layer
Modbus on TCP
TCP
IP
Other
Modbus+/HDLC
Master/Slave
Ethernet II
802.3
Other
RS-485
RS-485/RS-232
Ethernet
physical layer
Modbus +
Modbus RTU
2009-June-22
Drives Division
Modbus ASCII and Modbus RTU

The MODBUS protocol comes in 2 versions :
ASCII transmission mode:
Each eight-bit byte in a message is sent as 2 ASCII characters.
RTU transmission mode
Each eight-bit byte in a message is sent as two four-bit hexadecimal characters.
The main advantage of the RTU mode is that it achieves higher throughput.
ASCII mode allows time intervals of up to 1 second to occur between characters without
causing an error (e.g. bar-code scanners).
2009-June-22
Drives Division
Modbus frame structure

The Modbus frame structure is the same for requests (master -> slave) and responses
(slave -> master):
Modbus RTU:
silence
Address
Function
Data
Checksum
silence
Silence >= 3.5 characters
Modbus ASCII:
Start
Address
Function
Data
3A hex
CR
0D hex
2009-June-22
Checksum
LF
0A hex
Drives Division
Address field
Address
Function
Data
Checksum
Valid slave device addresses are in the range of 0 ... 247 decimal.
The individual slave devices are assigned addresses in the range of 1 ... 247.
Value 0 is reserved for broadcast messages (no response).
Request:
A master addresses a slave by placing the slave address in the address field of
the message.
Response:
When the slave sends its response, it places its own address in this address field
of the response to let the master know which slave is responding.
2009-June-22
Drives Division
Function Field
Address
Function
Data
Checksum
Valid codes are in the range of 1 -> FF hex.

Request:
The function code field tells the slave what kind of action to perform.
Response:
For a normal response, the slave simply echoes the original function code.
For an exception response, the slave returns a code that is equivalent to the original
function code with its most significant bit set to a logic 1.
2009-June-22
Drives Division
Data Field
Address
Function
Data
Checksum
Request:
The data field contains additional information which the slave must use to take the action
defined by the function code. This can include items like register addresses, quantity of
items to be handled, etc...
Response:
If no error occurs, the data field contains the data requested.
If an error occurs, the field contains an exception code that the master application can use
to determine the next action to be taken.
2009-June-22
Drives Division
FC 100 Modbus Exception Codes

code in
data field
Exception code description
0x00
The parameter number does not exist
0x01
There is no write access to the parameter
0x02
The data value exceeds the parameter limits
0x03
The sub-index in use does not exist
0x04
The parameter is not of the array type
0x05
The data type does not match the parameter called
0x06
Only reset
0x07
Not changeable
0xB
No write access
0x11
Data change in the parameter called is not possible in the present mode
0x12
Other error
0x40
Invalid data address
0x41
Invalid message length
0x42
Invalid data length or value
0x43
Invalid function code
0x82
There is no bus access to the parameter called
0x83
Data change is not possible because factory set-up is selected
2009-June-22
Drives Division
10
Checksum Field
Address
Function
Data
Checksum
Modbus RTU uses CRC: Cyclical Redundancy Check (2 byte)

Modbus ASCII uses LRC: Longitudinal Redundancy Check (1 bytes)
Request:
The checksum is calculated by the master and sends to the slave.
Response:
The checksum is re-calculated by the slave and compared to the value sent by the master.
If a difference is detected, the slave will not construct a response to the master.
2009-June-22
Drives Division
11
Modbus RTU Frame example:
Function code = 03hex : Read Holding Registers...
Request :
1 byte
1 byte
2 bytes
2 bytes
2 bytes
Slave
Address
Function
code=0x03
First word
address
Number of
words to read
CRC16
Response :
1 byte
1 byte
2 bytes
2 bytes
2 bytes
2 bytes
Slave
Address
Function
code=0x03
Number of
bytes read
Value of the
first word
Value of the
last word
CRC16
2009-June-22
Drives Division
12
Function code = 06hex : Write single Register
Request :
1 byte
1 byte
2 bytes
2 bytes
2 bytes
Slave
Address
Function
code=0x06
Word
address
Value of word
CRC16
Response :
1 byte
1 byte
2 bytes
2 bytes
2 bytes
Slave
Address
Function
code=0x06
Word address
Value of word
CRC16
2009-June-22
Drives Division
13
Function code = 10hex : Write Multiple Registers
Request :
1 byte
1 byte
2 bytes
2 bytes
Slave
Address
Function
code=0x10
First word
address
Number of
words to write
1 byte
Number of
bytes
2 bytes
Value of the
first word
2 bytes
CRC16
Response :
1 byte
1 byte
2 bytes
Slave
Address
Function
code=0x10
First word
address
2 bytes
Number of
words to write
2 bytes
CRC16
2009-June-22
Drives Division
14
Supported Modbus Function Codes in FC 100

The Function Code tells what type of Modbus telegram it is...
Function
Function
code
Read coils
1 hex
Read holding registers
3 hex
Write single coil
5 hex
Write single register
6 hex
Diagnostics*
8 hex
Write multiple coils
F hex
Write multiple registers
10 hex
Get comm. event counter
B hex
Report slave ID*
11 hex
Read Device Identification*
2B hex
*=
2009-June-22
Drives Division
15
Supported Modbus Function Codes

Function Code 8: Diagnostics
Function
Diagnostics
Function
code
Sub-function code
Sub-function
Restart communication
Return diagnostic register
10 (0xA)
Clear counters and diagnostic register
11 (0xB)
Return bus message count
12 (0xC)
Return bus communication error count
13 (0xD)
Return bus exception error count
14 (0xE)
Return slave message count
2009-June-22
Drives Division
16

Function Code 8: Diagnostics, sub-function 2 Return diagnostics register
Function
Function
code
Diagnostics
Sub-function code
Sub-function
Return diagnostic register
Response:
MSB
LSB
Description
Length
Data
Function code
1 byte
0x08
Sub-function code
2 bytes
0x0002
4 bytes
Alarm word
4 bytes
Warning word
2009-June-22
Drives Division
17

Function
Function
code
Diagnostics
Sub-function code
11
Sub-function
Return Bus Message Count
Response:
MSB
LSB
Description
Length
Data
Function code
1 byte
0x08
Sub-function code
2 bytes
0x000B
Data
2 bytes
Par. 8-80 Bus Message Count
2009-June-22
Drives Division
18

Function
Function
code
Diagnostics
Sub-function code
12
Sub-function
Return bus communication error count
Response:
MSB
LSB
Description
Length
Data
Function code
1 byte
0x08
Sub-function code
2 bytes
0x000C
Data
2 bytes
Par. 8-81 Bus Error Count
2009-June-22
Drives Division
19

Function
Function
code
Diagnostics
Sub-function code
13
Sub-function
Response:
MSB
LSB
Description
Length
Data
Function code
1 byte
0x08
Sub-function code
2 bytes
0x000D
Data
2 bytes
Par. 8-83 Slave Error Message Count
2009-June-22
Drives Division
20

Function
Function
code
Diagnostics
Sub-function code
14
Sub-function
Response:
MSB
LSB
Description
Length
Data
Function code
1 byte
0x08
Sub-function code
2 bytes
0x000E
Data
2 bytes
Par. 8-82 Slave Message Count
2009-June-22
Drives Division
21

Function Code 11hex: Report Slave ID
Response:
MSB
LSB
Function
Length
Data
Function code
1 byte
0x11
FC
Parameter
Name
Byte count
1 byte
1-251(N)
15-40
FC Type
Slave ID
0-250 bytes
Slave ID
15-41
Power section
Run status Indicators
1 bytes
0x00 or 0xFF
15-42
Voltage
15-43
SW version
0x00 if coil Stopped / Running is 0 (coil no. 44)

0xFF if coil Stopped / Running is 1 (coil no. 44)
2009-June-22
Drives Division
22

Function Code 2Bhex: Device Identification
Response:
MSB
Description
Length
Data
Function code
1 byte
0x2B
MEI type
1 byte
0x0E
Read device ID code
1 byte
1 or 2 or 3 or 4
Conformity level
1 byte
1 or 2 or 3 or 81 or 82
More Follows
1 byte
0x00 or 0xFF
Next Object ID
1 byte
Object ID number
Number of objects
1 byte
0x00 0x0F
1st object ID
1 byte
1st object length
1 byte
1st object Value
1st obj. length
Device Ident.
...
LSB
...
2009-June-22
Drives Division
23
Device Identification
FC Parameter
Name
Modbus Obj. ID
15-51
FC Serial
0x80
Private object
15-60 [0]
Option: Slot A
0x81
Private object
15-61 [0]
Option SW: Slot A
0x82
Private object
15-62 [0]
Opt. ord. no.: Slot A
0x83
Private object
15-60 [1]
Option: Slot B
0x84
Private object
15-61 [1]
Option SW: Slot B
0x85
Private object
15-62 [1]
Opt. ord. no.: Slot B
0x86
Private object
15-60 [2]
Option: Slot C0
0x87
Private object
15-61 [2]
Option SW: Slot C0
0x88
Private object
15-62 [2]
Opt. ord. no.: Slot C0
0x89
Private object
15-60 [3]
Option: Slot C1
0x8A
Private object
15-61 [3]
Option SW: Slot C1
0x8B
Private object
15-62 [3]
Opt. ord. no.: Slot C1
0x8C
Private object
15-45
Option: Slot D
0x8D
Private object
2009-June-22
Modbus description
Drives Division
24
Coils (single bit)

Coil number
Description
Signal direction
1 16
Frequency converter control word
Master -> slave
17 32
Frequency converter speed or setpoint reference

Range 0x0 0xFFFF (-200% ...
~200%)
Master -> slave
33 48
Frequency converter status word
Slave -> master
49 64
Open loop mode: Frequency converter

output frequency
Closed loop mode: Frequency
converter feedback signal
Slave -> master
65
Parameter write control
Master -> slave
66 - 65536
0=
Parameter changes are

written to the RAM of
the frequency converter
1=
Parameter changes are

written to the RAM and
EEPROM of the
frequency converter.
Reserved
2009-June-22
Drives Division
25
Holding registers (words)

Register number
Description
00001 00006
Reserved
00007
Last error code from an FC data object interface
00008
Reserved
00009
Parameter index*
00010 00999
000 parameter group (parameters 001 through 099)
01000 01999
02000 02999
03000 03999
04000 04999
49000 49999
50000
Input data: Frequency converter control word register (CTW).
50010
Input data: Bus reference register (REF).
50200
Output data: Frequency converter status word register (STW).
50210
Output data: Frequency converter main actual value register

(MAV).
2009-June-22
Drives Division
26
Holding registers (words), addressing

Holding register 00001 is addressed as register 40001 in the data address
field of the message.
The function code field already specifies a holding register operation.
Therefore, the 4XXXX reference is implicit.
Example: Par 0-01 Language:
Holding reg. 00010, addressed as: 40010
Example: Par 20-21 Feedback: (NB: 32 bit)

Holding reg. 020210, addressed as: 420210 (high
word)
Holding reg. 020211, addressed as: 420211 (low
word)
2009-June-22
Drives Division
27
FC 100 Frequency Converter Set-up

To enable Modbus RTU on the FC 100, set the following parameters:
Parameter no.
Parameter name
Setting
8-30
Protocol
Modbus RTU
8-31
Address
1 247
8-32
Baud rate
2400 - 115200
8-33
Parity / Stop bits
Even parity, 1 stop bit (default)
2009-June-22
Drives Division
28
RS-485 physics
5V
Master
650
650
D1
120
1 nF
120
1 nF
D0
Common
Slave 2
Slave 1
Maximum length of bus
1000 m at 19200 bps
Maximum number of stations (without repeater)
32 (31 slaves)
Maximum length of tap links
20 m for one tap link

40 m divided by the number of tap links
Bus polarisation
650 at 5V and common for the master
Line terminator
120 - 0,25Wm in series with 1nF 10V
Common polarity
Yes (Common) connected to the PG
2009-June-22
Drives Division
29
Modbus TCP
MCA 122
Modbus TCP is the oldest Industrial Ethernet
Protocol
Was introduced by Modicon back in 1999.
The Protocol is widely used inside:
Water/Wastewater and inside companies
standardizing their PLC system on
Modicon/Group Schneider PLCs
2009-June-22
Drives Division
30
Modbus TCP
MCA 122
Modbus RTU to Modbus TCP
Easy connection to Group Schneider PLCs and leading
SCADA systems
High performance option, capable of execute
commands in 5mSec rate
Two Ethernet ports with build in switch, enabling line
structure.
No need for expensive switches, due to the build in
switch,
Build in web server, for easy status from remote PC
E-mail notify, that can send E-mail if Warning/alarm
occurs
Register mapping equal to Modbus RTU, which allows a
easy upgrade from
High speed access from MCT-10 Setup Software via
Ethernet
2009-June-22
Drives Division
31
Modbus RTU/TCP
Read/write block of data (Process data)

Function code = 03hex : Read Holding Registers...
Request :
1 byte
1 byte
2 bytes
2 bytes
2 bytes
Slave
Address
Function
code=0x03
First word
address
Number of
words to read
CRC16
Function code = 10hex : Write Multiple Registers
Request :
1 byte
1 byte
2 bytes
2 bytes
Slave
Address
Function
code=0x10
First word
address
Number of
words to write
1 byte
Number of
bytes
2 bytes
2 bytes
Value of the
first word
CRC16
This is only possible with consecutive registers (no holes in the range)
2009-June-22
Drives Division
32
Modbus RTU/TCP

Since parameters are organized in registers
with jumps of 10, it is not possible to make
block-read/write.
Register #
10
11
12
13
14
15
16
17
18
19
20
21
2009-June-22
Data
Par. 0-01
Par. 0-02
Drives Division
33
Modbus RTU/TCP

To enable block-read/write, a block of
process-data has been defined.
Par. 281 and 291 is not used.
Can also be used for down-mapping of

parameters
WRITE
Block is below reg. #10,000 which is

accessible for all PLCs
Available on Modbus TCP

Will also be available on Modbus RTU
READ
Data
2810
CTW
12-21[0]
8-43[0]
2811
REF
12-21[1]
8-43[1]
2812
PCD 3
12-21[2]
8-43[2]
2813
PCD 4
12-21[3]
8-43[3]
2814
PCD 5
12-21[4]
8-43[4]
2815
PCD 6
12-21[5]
8-43[5]
2816
PCD 7
12-21[6]
8-43[6]
2817
PCD 8
12-21[7]
8-43[7]
2818
PCD 9
12-21[8]
8-43[8]
2719
PCD 10
12-21[9]
8-43[9]
2910
STW
21-22[0]
8-44[0]
2911
MAV
21-22[1]
8-44[1]
2912
PCD 3
21-22[2]
8-44[2]
2913
PCD 4
21-22[3]
8-44[3]
2914
PCD 5
21-22[4]
8-44[4]
2915
PCD 6
21-22[5]
8-44[5]
2916
PCD 7
21-22[6]
8-44[6]
2917
PCD 8
21-22[7]
8-44[7]
2918
PCD 9
21-22[8]
8-44[8]
2919
PCD 10
21-22[9]
8-44[9]
2009-June-22
Modbus TCP
Modbus RTU
Mapping parameter
Register #
Drives Division
34
Modbus RTU/TCP

...
2009-June-22
Drives Division
35
Modbus
Want to know more?
VLT FC 100 LonWorks:

MG.11.E1.02
www.modbus.org
2009-June-22
Drives Division
36

Modbus Rtu TCP

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Modbus Rtu TCP

Caricato da

Copyright:

Formati disponibili

Modbus for VLTFC-series6

Modbus RTU for FC 100

Modbus RTU for FC 100

Modbus RTU for FC 100

MODBUS is independent of the physical layer:

Modbus RTU for FC 100

Modbus ASCII and Modbus RTU

Modbus RTU for FC 100

Modbus frame structure

Silence >= 3.5 characters

Modbus RTU for FC 100

Modbus RTU for FC 100

Valid codes are in the range of 1 -> FF hex.

Modbus RTU for FC 100

Modbus RTU for FC 100

FC 100 Modbus Exception Codes

Exception code description

The parameter number does not exist

There is no write access to the parameter

The data value exceeds the parameter limits

The sub-index in use does not exist

The parameter is not of the array type

The data type does not match the parameter called

Invalid data address

Invalid message length

Invalid data length or value

Invalid function code

There is no bus access to the parameter called

Data change is not possible because factory set-up is selected

Modbus RTU for FC 100

Modbus RTU uses CRC: Cyclical Redundancy Check (2 byte)

Modbus RTU for FC 100

Modbus RTU Frame example:

Function code = 03hex : Read Holding Registers...

Modbus RTU for FC 100

Modbus RTU Frame example:

Function code = 06hex : Write single Register

Modbus RTU for FC 100

Modbus RTU Frame example:

Function code = 10hex : Write Multiple Registers

Modbus RTU for FC 100

Supported Modbus Function Codes in FC 100

Read holding registers

Write single coil

Write single register

Write multiple coils

Write multiple registers

Get comm. event counter

Report slave ID*

Read Device Identification*

Modbus RTU for FC 100

Supported Modbus Function Codes

Return diagnostic register

Clear counters and diagnostic register

Return bus message count

Return bus communication error count

Return bus exception error count

Return slave message count

Modbus RTU for FC 100

Supported Modbus Function Codes

Modbus RTU for FC 100

Supported Modbus Function Codes

Par. 8-80 Bus Message Count