Vantage Modbus Guide

Vantage/Maestro/ProTech Control SystemModbus Interface Guide

About This Guide

This guide contains the basic information necessary to interface the Vantage, Maestro or ProTech control system with plant automation systems, Man-Machine-Interface (MMI) software, and other data logging systems using the Modbus communications interface. However, since installations may vary, these instructions may not cover all details or variations in the equipment supplied or every question that may arise during use.

More detailed information on the Modbus protocol is available in the Modicon Modbus Protocol Reference Guide, part number PI-MBUS-300 Rev. J.

If a question or situation develops which is not answered directly in this guide, contact an authorized service representative for more information, or contact the factory directly for specific answers and advice.

Guide Revision 1.7, January 25, 2008Copyright 2003- 2008 Bay Controls LLCProTech is a trademark of Bay Controls, LLC

Modbus Interface Guide

Installation

The communications interface is installed by connecting the Modbus Network Port, connector J9 on the Main Logic Module (MLM), to the plant, MMI, or other equipment. The controller operates as the slave device, the plant system or MMI operates as the Master device.

The physical link uses an RS-485 two-wire, half duplex, serial communications interface. The RS-485 standard defines the signal levels and other characteristics of the physical link. The equipment that is to be connected to the controller must implement this same RS-485 standard. Refer to the documentation of master device to be connected to confirm the standards used and how the connections are made.

The connection must be made using 22 Gauge, twisted 3-wire shielded cable, such as Belden # 3106A, or equivalent.

The positive terminal on the controller is connected to the positive terminal on the master device, and the negative terminal to the master negative terminal. The COM terminal on the controller is connected to the common terminal on the master device. The common connection is used to insure that both pieces of equipment have the same signal reference level.

Up to thirty one (31) controllers can be connected together with the master device. The controllers should be connected together in a daisy chain and then connected to the master device at one end.

The RS-485 standard specifies the maximum length of the physical connection at 5000 feet (1524 meters) between the farthest connections.

It is recommended that a RS-485 isolator be installed between the network of controllers and the Master device if the Master is located in a different building, if the Master may have a different ground reference, or if problems are experienced reliably communicating between the Master and controller(s).

There are a number of RS-485 isolators that will work well for this application. The Westermo RD-48 repeater has been tested and known to work well in this application. Refer to www.westermo.com, also available through Industrial Networking Solutions 800-889-1461, and Gross Automation 262-446-0000.

Configuration

The Modbus interface on the controller must be configured to match the speed and data format used by the master device. If multiple controllers are connected together, they must all be configured to use the same speed and data format.

The Desktop software is used to configure the controller. The Communications Tab on the desktop contains the Modbus settings. The communication speed is in bits per second, referred to as Baud rate. The data format is expressed as the number of data bits followed

1

http://www.westermo.com/


by the parity type, and then the number of stop bits. The parity can be Even, Odd, or None. Set the controller Modbus speed and data format to match that used by the master device. Refer to the online help in the Desktop for more information.

The Modbus access is selected based on what type of functionality you wish to implement from the master device. The default is Read-Only which prevents the master from changing any setting or executing any control function in the controller. Refer to the online help in the Desktop for more information.

Modbus Protocol

The Modbus protocol describes an industrial communications and distributed control system developed by Gould-Modicon to integrate PLCs, computers, terminals, and other monitoring, sensing, and control devices. Modbus is a Master/Slave communications protocol, whereby one device, (the Master), controls all serial activity by selectively polling one or more slave devices. The protocol provides for one master device and up to 247 slave devices on a common line. Each device is assigned an address to distinguish it from all other connected devices. The RS-485 physical link used by the controller limits the maximum number of slave devices to 31.

Only the master initiates a transaction. Transactions are either a query/response type, (only a single slave is address), or a broadcast/no response type, (all slaves are addressed). A transaction comprises a single query and single response frame or a single broadcast frame.

Certain characteristics of the Modbus protocol are fixed, such as the frame format, frame sequences, handling of communications errors and exception conditions, and the functions performed.

Other characteristics are user selectable. These include a choice of transmission media (physical link), baud rate, character parity, number of stop bits, and the transmission modes, (ASCII or RTU). The controller only supports the RTU transmission mode of the Modbus protocol.

Synchronization

Frame synchronization can be maintained in RTU transmission mode only by simulating a synchronous message. The receiving device monitors the elapsed time between receipt of characters. If three and one-half character times elapse without a new character or completion of the frame, then the device flushes the frame and assumes that the next byte received will be an address.

Message Format

A transaction consists of a single request from the master to a specific slave device, and a single response from that device back to the master. Both of these messages, request and response, are formatted as Modbus message frames. Each message frame consists of a series of bytes grouped into four fields as described below:

2


ADDRESS FUNCTION DATA ERROR CHECK1 byte 1 byte variable 2 bytes

Address Field

The address field immediately follows the beginning of frame and consists of one byte. This byte indicates the user assigned address of the slave device that is to receive the message sent by the master.

Each slave must be assigned a unique address and only the addressed slave will respond to a query that contains its address. When the slave sends a response, the slave address informs the master which slave is communicating. In a broadcast message, an address of 0 is used. All slaves interpret this as an instruction to read and take action on the message, but not to issue a response message.

The slave address is configured for the controller using the Desktop software, in the General Tab. The Unit Number specifies the Modbus slave address.

Function Field

The Function field tells the addressed slave controller what function to perform. Modbus function codes are specifically designed for interacting with a PLC on the Modbus industrial communications system. The high order bit in this field is set by the slave device to indicate an exception condition in the response message. If no exceptions exist, the high-order bit is maintained as zero in the response message.

The following functions are supported by the controller:

FUNCTION CODE MEANING ACTION03 READ HOLDING

REGISTERObtains current binary value in one or more holding registers.

04 READ INPUT REGISTER Obtains current binary value in one or more input registers.

06 PRESET SINGLE REGISTER

Place a specific binary value into a holding register.

08 LOOPBACK TEST Enables the master to test the communication system.

Data Field

The data field contains information needed by the slave controller to perform the specific function or it contains data collected by the slave in response to a query. This information may be values, address references, or limits. For example, the function code tells the slave to read a holding register, and the data field is needed to indicate which register to start at and how many to read.

3


Error Check Field

This field allows the master and slave devices to check a message for errors in transmission. Sometimes, because of electrical noise or other interference, a message may be changed slightly while its on its way from one device to another. The error checking assures hat the slave or master does not react to messages that have changed during transmission. This increases the safety and the efficiency of the Modbus system. The error check field uses a CRC-16 algorithm in the RTU mode.

Error Detection

There are two types of errors which may occur in a communications system: transmission errors and programming errors. The Modbus system has specific methods for dealing with either type of error.

Communications errors usually consist of a changed bit or bits within a message. The most frequent cause of communications errors is noise: unwanted electrical signals in a communications channel. These signals occur because of electrical interference from machinery, damage to the communications channel, impulse noise, (spikes), etc. Communications errors are detected by character framing, a parity check, and a redundancy check.

When the character framing, parity, or redundancy checks detect a communications error, processing of the message stops. A controller will not act on or respond to the message. (The same occurs if a non-existent slave address is used.)

When a communications error occurs, the message is unreliable. The controller cannot know for sure if this message was intended for it. So the controller might be answering a message which was not its message to begin with. It is essential to program the Modbus Master to assume a communications error has occurred if there is no response in a reasonable time. The length of this time depends upon the baud rate, type of message, and scan time of the controller. Once this time is determined, the master may be programmed to automatically retransmit the message.

The Modbus system provides several levels of error checking to assure the quality of the data transmission. To detect multibit errors where the parity has not changed, the system uses the Cyclical Redundancy Check (CRC).

4


Exception Responses

Programming or operation errors are those involving illegal data in a message, no response from the controller to the master, or difficulty in communicating with a controller. These errors result in an exception response from either the master or the controller, depending on the type of error.

The exception response codes are listed below. When a controller detects one of these errors, it sends a response message to the master consisting of the slave address, function code, error code, and error check fields. To indicate that the response is a notification of an error, the high-order bit of the function code is set to one.

CODE NAME MEANING01 ILLEGAL FUNCTION The message function received is not

an allowable action.02 ILLEGAL DATA ADDRESS The address referenced in the data field

is not an allowable address for the data.03 ILLEGAL DATA VALUE The value referenced in the data field is

not allowable in the addressed location.07 NAK-NEGATIVE

ACKNOWLEDGMENTThe function just requested could not be performed.

Memory Notation

Data points in the controller are referenced in the same manner as points in a Modicon PLC. This notation allows for four different types of data: coils, discrete inputs, input registers, and holding registers. Register variables consist of two bytes, while coils and discrete inputs are single bits. The coil and discrete input data types are not used as they have no application in the controller.

Each function references only one type of data and uses a relative address in the message frame with a zero offset. For example, holding register 40001 relative address is 0000, input register 30003 relative address is 0002, and so on.

Data Type Absolute Address Relative Address FunctionInput Registers 30001-39999 0-9998 4Holding Registers 40001-49999 0-9998 3,6

5


Function 3 Read Holding Registers

The read holding registers function is used to obtain the values of set points, and status information from a controller. The format of the request frame is as follows:

REQUEST FRAMEADDRESS FUNCTION

CODESTARTING REGISTER

REGISTER COUNT

ERROR CHECK

1 BYTE 1 BYTE 2 BYTES 2 BYTES 2 BYTESUNIT

NUMBER03 SEE HOLDING

REGISTER MAP

NUMBER OF REGISTERS

CRC-16

The starting register number is shown in the following table. The register count specifies how many consecutive register values will be returned in the response message. An exception message will be returned when specifying a register number that is not defined. Note that the message frame uses relative addressing; see Memory Notation above for more information.

HOLDING REGISTER MAPREGISTER DESCRIPTION NOTE

0 System Pressure Set Point 11 System Pressure Offset Set Point 12 Max Discharge Pressure Set Point 13 Standby Pressure Offset Set Point 14 Check Valve Offset Set Point 1

100 Motor Status 2101 Motor Load (%) 3102 Protection Status 4103 Last Alarm Monitoring Point 5104 Last Trip Monitoring Point 5105 Inlet Control Mode 6106 Blow Off Control Mode 7107 Network Control Mode 8108 Network Pressure Set Point 1109 Network Priority Number 9110 Network Time Constant 10111 Network Dead band 1112 Network Cascade Set Point Adjustment 1113 Network Start Pressure Offset 1114 Network Start Time Delay 10115 Network Availability 9116 Automatic Start/Stop Mode 11117 Automatic Start/Stop Lockout 12118 Automatic Start Pressure Offset 1

6


HOLDING REGISTER MAP119 Automatic Stop Delay Time 10120 Capacity Control Mode 14121 Maximum Motor Load (% of FLA) 15

1099 + N Monitoring Point (N) Alarm High Set Point 11199 + N Monitoring Point (N) Alarm Low Set Point 11299 + N Monitoring Point (N) Trip High Set Point 11399 + N Monitoring Point (N) Trip Low Set Point 11499 + N Monitoring Point (N) Start High Set Point 11599 + N Monitoring Point (N) Start Low Set Point 11699 + N Monitoring Point (N) Data (N=1-63) 11799 + N Monitoring Point (N) Status (N=1-63) 151899 + N Control Point (N) Data (N=1-31) 11999 + N Register (N) Data (N=0-31) 1

Notes:1. Data is formatted as a signed integer in the range of -32767 to 32767. There is an

implied decimal point based upon the configuration of the corresponding monitoring point. The set point is expressed in engineering units configured for the associated monitoring point. Refer to the controller configuration. For example, if the controller is configured for the System Pressure monitoring point with a precision of 1 and units of PSI, then a register value of 1123 indicates 112.3 PSI.

2. Motor Status is enumerated as follows:0 Stopped1 Stopping2 Starting3 Running

3. An unsigned integer in the range of 0 to 65535 with an implied decimal place of 1. For example a register value of 1001 indicates a data value of 100.1.

4. An unsigned integer in the range of 0 to 63 indicating the current number of monitoring points with an alarm status.

5. An unsigned integer in the range of 0 to 63 referencing a monitoring point number. A value of 0 indicates that no point is referenced. Refer to the controller configuration for the numbering of monitoring points.

6. Inlet control mode is enumerated as follows:0 Manual1 Unloaded2 System Pressure3 Minimum Flow4 Maximum Load

7. Blow-Off control mode is enumerated as follows:0 Manual

7


1 Unloaded2 System Pressure3 Discharge Pressure

8. Network mode is enumerated as follows:0 Local Control1 Networked Leader2 Networked Follower

9. An unsigned integer in the range of 1 to 32.10. An unsigned integer greater than or equal to 1 that expresses a time value in

seconds.11. Automatic Start / Stop mode is enumerated as follows:

0 No automatic functions configured1 Local auto start enabled2 Network auto start enabled3 Local auto start and network auto start enabled4 C-Link/Modbus start and stop enabled5 Local and C-Link/Modbus start and stop enabled6 Network auto start and C-Link/Modbus start and stop enabled7 Local auto start, network start auto start, and C-Link/Modbus start and stop

enabled8 Local auto stop enabled9 Local auto start and stop enabled10 Network auto start and local auto stop enabled11 Local auto start, network auto start, local auto stop enabled12 C-Link start and stop, and local auto stop enabled13 Local auto start, C-Link start and stop, and local auto stop enabled14 Network auto start, C-Link start and stop, local auto stop enabled15 Local auto start and stop, network auto start, and C-Link start and stop

enabled12. Automatic Stop Lockout is enumerated as follows:

0 Lockout not enabled1 Bypass; auto start disabled until local start successful, then auto start enabled2 Locked out; auto start disabled, local start allowed

13. The network availability is enumerated as follows: 0 Stopped, not ready to start (permissive not ready)1 Stopped, ready for local start2 Stopped, ready for local auto start3 Stopped, ready for network auto start4 Stopped, ready for local auto or network auto start5 Stopped, ready for C-Link/Modbus start6 Stopped, ready for C-Link/Modbus start and local auto start7 Stopped, ready for C-Link/Modbus and network auto start8 Stopped, ready for C-Link/Modbus, local auto start, and network auto start

8


16 Stopping, not ready to restart (stop sequence lockout timer or permissive not ready)

17 Stopping, ready for local start18 Stopping, ready for local auto start19 Stopping, ready for network auto start20 Stopping, ready for local auto or network auto start21 Stopping, ready for C-Link/Modbus start22 Stopping, ready for C-Link/Modbus start and local auto start23 Stopping, ready for C-Link/Modbus and network auto start24 Stopping, ready for C-Link/Modbus, local auto start, and network auto

start32 Starting, normal33 Starting, failed start sequence48 Running on automatic, unloaded49 Running on automatic, loading50 Running on automatic, blowing off51 Running on automatic, minimum flow (no blow off)52 Running on automatic, modulating53 Running on automatic, maximum load65 Running on manual, full manual control66 Running on manual, unloaded67 Running on manual, base loaded68 Running on manual, tuning discharge pressure loop69 Running on manual, tuning maximum load loop70 Running on manual, tuning surge control loop71 Running on manual, surge test in process72 Running on manual, tuning blow off system pressure loop

14. The capacity control mode is enumerated as follows (READ): 0 Automatic1 Full manual (engineering mode)2 Unload3 Base Load4 Tune discharge pressure5 Tune maximum current6 Tune surge control7 Surge test8 Natural surge test

The capacity control mode is enumerated as follows (WRITE): 0 Automatic1 Manual2 Unload

15. An unsigned integer in the range of 0 to 65535 with an implied decimal place of For example a register value of 1021 indicates a data value of 102.1.

9


.

RESPONSE FRAMEADDRESS FUNCTION

CODEBYTE COUNT DATA ERROR

CHECK1 BYTE 1 BYTE 1 BYTES VARIABLE 2 BYTESUNIT

NUMBER03 NUMBER OF

REQUESTED REGISTERS

X 2

SEE HOLDING REGISTER

TABLE

CRC-16

The response message contains a variable length data field that is equal to the number of registers requested multiplied by 2. The registers are ordered consecutively in the data field as 2 byte values; high byte followed by low byte.

Exceptions

Exception code 02 is returned if the registers requested are not defined. Note that the protection set point registers are defined based upon the configuration in the controller.

Function 4 Read Input Registers The read input registers function is used to obtain the values of monitoring and control point data from a controller. The format of the request frame is as follows:


CODESTARTING REGISTER

REGISTER COUNT

ERROR CHECK


NUMBER4 SEE INPUT

REGISTER MAP

NUMBER OF REGISERS

CRC-16

INPUT REGISTER MAPREGISTER DESCRIPTION NOTE

N - 1 Monitoring Point (N) Data 199 + N Control Point (N) Data 21099 Global Monitoring Status 3

1099 + N Monitoring Point (N) Status 41199 Controller Software Version 5

Notes:

10


1. Monitoring point data is formatted as a signed integer in the range of -32767 to 32767 with an implied decimal point determined by the controller configuration. The value is expressed in the engineering units configured for the respective point. Refer to the monitoring point configuration listing. Digital points are expressed as 0 for the OFF or inactive state, and 1 for the ON or active state.

2. Control point data is formatted as an unsigned integer in the range of 0 to 65535. Refer to the control point configuration listing. Digital points are expressed as 0 for the OFF or inactive state, and 1 for the ON or active state.

3. An unsigned integer indicating the number of monitoring points that are in the faulted state.

4. Monitoring point status is an unsigned integer enumerated as follows:0 Normal1 Alarm2 Open3 Short4 Fault5 Fail

5. The controller software version is expressed as two unsigned integer bytes. The high byte contains the major version number; the low byte contains the minor version number.


CODEBYTE COUNT DATA ERROR

CHECK1 BYTE 1 BYTE 1 BYTE VARIABLE 2 BYTESUNIT

NUMBER4 SEE MAP

TABLESEE MAP TABLE

CRC-16

The response message contains a variable length data field that is equal to the number of registers requested multiplied by 2. The registers are ordered consecutively in the data field as 2 byte values; high byte followed by low byte.

Exceptions

Exception code 02 is returned if the registers requested are not defined. Note that the monitoring and control point registers are defined based upon the configuration in the controller.

11


Function 6 Preset Single Register

The preset single register function is used to change one of the set points in a controller, or initiate a control action. Note that access to set points and control actions are configurable and may not be permitted. Refer to the controller configuration to determine what access is allowed. The format of the request frame is as follows:


CODEREGISTERNUMBER

REGISTER DATA

ERROR CHECK


NUMBER06 SEE PRESET

REGISTER MAP

SEE REGISTER

MAP NOTES

CRC-16

PRESET REGISTER MAPREGISTER DESCRIPTION NOTE

0 System Pressure Set Point 11 System Pressure Offset Set Point 1

100 Motor Start 2102 Alarm Acknowledge 3109 Network Priority Number 4110 Network Time Constant 5111 Network Dead band 1112 Network Cascade Set Point Adjustment 1113 Network Start Pressure Offset 1114 Network Start Time Delay (Sec) 5117 Auto Start/Stop Lockout 6118 Automatic Start Pressure Offset 1119 Auto Stop Time Delay (Min) 7120 Capacity Control Mode 8121 Maximum Motor Load (% of FLA) 9

1099 + N Monitor Point (N) Alarm High Set Point 11199 + N Monitor Point (N) Alarm Low Set Point 11299 + N Monitor Point (N) Trip High Set Point 11399 + N Monitor Point (N) Trip Low Set Point 11499 + N Monitor Point (N) Start High Set Point 11599 + N Monitor Point (N) Start Low Set Point 1

Notes:1. Data is formatted as a signed integer in the range of -32767 to 32767. There is an

implied decimal point based upon the configuration of the corresponding monitoring point. The set point is expressed in engineering units configured for the associated monitoring point. Refer to the controller configuration. For example, if the controller is configured for the System Pressure monitoring point

12


with a precision of 1 and units of PSI, then a register value of 1123 indicates 112.3 PSI.

2. Set the motor start register to 1 to start the compressor, 0 to stop the compressor.3. Set the alarm acknowledge register to 1 to acknowledge and silence the alarm.4. An unsigned integer in the range of 1 to 32.5. An unsigned integer greater than or equal to 1 that expresses a time value in

seconds.6. The auto start lockout is enumerated as follows:

0 Normal Automatic start and stop are enabled.1 Bypass Disabled but will be re-enabled on successful start.2 Locked Automatic start and stopped are disabled.

7. An unsigned integer greater than or equal to 1 that expresses a time value in minutes.

8. The capacity control mode is enumerated as follows: 0 Automatic1 Unload2 Base Load

9. An unsigned integer in the range of 10 to 2000 (1.0% to 200.0%) with an implied decimal place of 1. For example a register value of 1021 indicates a data value of 102.1%. Data outside of the valid range will be ignored.


CODEREGISTERNUMBER

REGISTERDATA

ERROR CHECK


NUMBER06 SAME AS

REQUEST FRAME

SAME AS REQUEST

FRAME

CRC-16

The response frame is the same as the request message; returned to indicate that the specified holding register was set to the data value in the request message.

Exceptions

Exception code 02 is returned if the registers requested are not defined. Note that the protection set point registers are defined based upon the configuration in the controller.

Exception code 03 is returned if the register data is out of range or invalid for the specified holding register.

13


Function 8 Loop Back Test

This function enables the master to test the communication system with the controller Modbus interface. The diagnostic code of the request frame must be set to 0000; the Modbus RETURN QUERY DATA code. The data value is a binary value from 0 to 65535.


CODEDIAGNOSTIC

CODEDATA VALUE

ERROR CHECK


NUMBER08 0000 TEST DATA CRC-16


CODEDIAGNOSTIC

CODEDATA VALUE

ERROR CHECK


NUMBER08 0000 TEST DATA CRC-16

The response frame is identical to the request frame if the test is successful. Typically the data value is checked in the response to confirm the same as the value sent. Successful completion of this test confirms that the physical and protocol layers of the communication system are functioning properly.

Exceptions

Exception code 01 is returned if a diagnostic code other than 0000 is specified in the request frame.

14


Upgrading to Vantage/Maestro/ProTech from the Quad 2000

Plant automation systems and/or other master devices that were configured to interface with a Quad 2000 controller will need to be modified for interfacing with the new control system. The following configuration changes need to be made in the master device:

1. The address of the data points need to be configured in the master to point to the locations in the new controller. Refer to the Modbus Memory Map. Also there is additional information available in the new control system; you may want to add data values into the master system.

2. All of the data in the controller is expressed in engineering units. The data in the Quad 2000 had to be scaled by the master into the appropriate units to have meaning. The temperature RTD inputs in the Quad 2000 required a look up table to translate the data value into engineering units. The data scaling functions should be turned off in the master as they are not needed.

15


Modicon PLC Memory Map

The following table shows the Vantage/Maestro/ProTech data and control functions addressed as data points in a Modicon PLC.

MODBUS MEMORY MAPABSOLUTE ADDRESS

DESCRIPTION MODBUSFUNCTION

30000 + N Monitoring Point (N) Data 430100 + N Control Point (N) Data 431100 Global Monitoring Status 431100 + N Monitoring Point (N) Status 431200 Controller Software Version 440001 System Pressure Set Point 3, 640002 System Pressure Offset Set Point 3, 640003 Max Discharge Pressure Set Point 340004 Standby Pressure Offset Set Point 340005 Check Valve Pressure Offset Set Point 340101 Motor Status 3, 640102 Motor Load (%) 340103 Protection Status / Alarm Acknowledge 3, 640104 Last Alarm Monitoring Point 340105 Last Trip Monitoring Point 340106 Inlet Control Mode 340107 Blow Off Control Mode 340108 Network Control Mode 340109 Network Pressure Set Point 340110 Network Priority Number 3, 640111 Network Time Constant 3, 640112 Network Dead band 3, 640113 Network Cascade Set Point Adjustment 3, 640114 Network Start Pressure Offset 3, 640115 Network Start Time Delay 3, 640116 Network Availability 340117 Automatic Start/Stop Mode 340118 Automatic Start/Stop Lockout 340119 Automatic Start Pressure Offset 340120 Automatic Stop Delay Time 3, 640121 Capacity Control Mode 3, 640122 Maximum Motor Load (% of FLA) 3, 641100 + N Monitoring Point (N) Alarm High Set Point 3, 641200 + N Monitoring Point (N) Alarm Low Set Point 3, 641300 + N Monitoring Point (N) Trip High Set Point 3, 641400 + N Monitoring Point (N) Trip Low Set Point 3, 641500 + N Monitoring Point (N) Start High Set Point 3, 6

16


41600 + N Monitoring Point (N) Start Low Set Point 3, 6

17

Documents

Vantage Modbus Guide