MODBUS examples

https//www.racom.eu/eng/support/prot/mod-ex-1009/index.html

Print version

Protocol MODBUS for MORSE

Examples for 10.0.9.0

version 10.0.9.0

8/7/2008

1. Introduction

Examples of MORSE protocol test configurations are given for a better understanding of the protocol’s modes and its parameters. The examples apply to MR400 and firmware version 10.0.9.0.

2. Transparent mode

Example of Radioslave – Radiomaster communication:

     Radioslave \|/  ....... \|/  Radiomaster
                 |            |
S02 - 691122FF -RFC          RFC- 69112205 - S03

      SPe2t                       SPe3t
      (m)s    (t)n                (m)m     (t)n
      (S)(f)5                     (M)(d)691122FF
         (u)1                        (0)5
      (T)(f)n                        (p)200*10
         (d)f                        (t)200*100
                                  (T)(f)n
                                     (d)n

Using function “in” insert data 0503 AAAA 0E37 into S02 in the Radioslave CU. The first byte of the packet contains the Slave address, the second the number of the Modbus function, then data AAAA and finally a checksum. Data complies with conditions for checking the format of the function and address. Then with a delay shorter than timeout “SPe3tMt” insert reply 0503 BBBB C26B to the Radiomaster using function “in”:

>>
Monitoring: source 691122FF|1.
12:31:03.816 rxsim   6 | S02
0503 AAAA 0E37                ...simulated packet in Modbus format
12:31:03.817|69112205 691122FF|69112205 691122FF|R01I    IN    6N89 3dat
0503 AAAA 0E37                ...it is transmitted without a change 
                                 to the network
Monitoring: source 69112205|0.
12:31:03.847|                 |00000005 000000FF|S03I    IN   6|*89 3user
0503 AAAA 0E37
12:31:03.847 tx      6 | S03
0503 AAAA 0E37                ...output to the PLC Slave

Monitoring: source 69112205|1.
12:31:05.967 rxsim   6 | S03
0503 BBBB C26B                ...simulated response from Slave
12:31:05.967|                 |000000FF 00000005|S03I   OUT   6||89 3user
0503 BBBB C26B

Monitoring: source 691122FF|2.
12:31:05.984|691122FF 69112205|691122FF 69112205|R01I   OUT    6n89 3dat
0503 BBBB C26B
12:31:05.984 tx      6 | S02
0503 BBBB C26B                ...output to PLC Master
>>

Data which complies with conditions for checking the function, address and CRC is transmitted via the Modbus protocol without change. Data AAAA and BBBB here represents the internal structure of the Modbus query and response. This simplification is allowed because the protocol in RM only checks the address, function number and CRC. These conditions are complied with here.

A similar example monitored in RM contains a query from RS in its real format (query to Slave 05 using function 03 to data from address 0000 numbering 2 address items). In its real format it is also a response (04 byte with content 1111 2222 and CRC comes from Slave 05 via function 03).

09:57:26.649|                 |69112205 691122FF|S03I   IN   8|*89 2usr 0
0503 0000 0002 C58F
09:57:26.649 tx      8 | S03
0503 0000 0002 C58F

>>
09:57:29.194 rxsim   9 | S03
0503 0411 1122 2272 73
09:57:29.194|                 |691122FF 69112205|S03I  OUT   9||89 2usr 0
0503 0411 1122 2272 73

Each frame is transmitted over the MORSE network in full. This is why Transparent mode is suitable for individual commands sent from the PLC Master to the PLC Slave. It is not suitable for data collection from a Slave which repeats over short intervals. A small network with a slow query cycle is an exception.

3. Cache mode

3.1. Transmitting a packet Slave -> Radiomaster -> Radioslave

    Radioslave  \|/....\|/  Radiomaster           Slave simulator
                 |      |
S02 - 691122FF -RFC    RFC- 69112205 - S03 ==== S01 - 00000001  

SPe2t                  SPe3t                       SPe1t
(m)s   (c)n            (m)m   (c)n                 (m)s     (p)n
(S)(f)5                (M)(d)691122FF              (S)(f)5
   (u)1                   (0)5                        (u)1
                          (p)200*10
                          (t)200*100
(C)(A)1                (C)(A)1                     (P)(a)5
   (t)40                  (t)30                       (N)0010
                                                      (H)0020
                       A  =Art table               
                       (N)1
                       (d)00000003 (w)00150010
                       (u)

The Slave simulator is in Packet mode and data from “its” is written to address (N)2H, here 0010. The Radiomaster reads data from addresses 0010 to 0015 (according to Art, w) even if there is a change and also sends it to the Radioslave with a period “SPe3tCt” (=30s).

Slave simulator 00000001:

Send packet: (N):1  (d):00000001h ...packet leaves the user output
(t)ype:0009h                         to Modbus
s(o)urce:691122FFh         ...this address is used by the simulator as dst
d(a)ta:..                  ...data 0xAAAA (or 0xBBBB), packet mode of the
                       simulator creates an entry at address 0x0010
                       in the format 0008 0903 691122FF AAAA

Radiomaster 69112205:

>>
07:25:29.725 tx      8 | S03
0503 0010 0005 8588           ...query for the content of cache, addresses
07:25:29.743 rx;i   15 | S03                                   0010 - 0014
0503 0A00 0809 0369 1122 FFAA AA8F 35 ..cache contains 0x0A byte with data
07:25:31.744 tx      8 | S03                     00 0809 0369 1122 FFAA AA
0503 0010 0005 8588            ...another query ascertains changed data
07:25:31.762 rx;i   15 | S03                                   (..BBBB)
0503 0A00 0809 0469 1122 FFBB BB35 A9

07:25:33.763|                 |691122FF 00000005|S03I  OUT  15||89 6usr 0
0503 0A00 0809 0469 1122 FFBB BB35 A9    ...new data is sent to RS

07:25:33.763 tx      8 | S03
0503 0010 0005 8588                      ...queries to the Slave continue
07:25:33.781 rx;i   15 | S03
0503 0A00 0809 0469 1122 FFBB BB35 A9
>>

The Radioslave receives data and stores it into its cache memory from where it sends responses to queries from the PLC Master. This function is not represented here.

A new entry “its” causes immediate data transmission. If no changes occur the status of cache is updated with a period of “SPe3tCt”.

Cache in RM must be filled with data. This means that the length of the query RM->Slave cannot be longer than the length of the data in the PLC Slave.

The length of the query is given in Art, gateway:

   0x0015 - 0x0010 = 0x5 word

The length of data in the slave simulator:

   0008 0903 691122FF BBBB

i.e. 4 words of the packet mode header + 1 word of data from “its”.

Example of communication during a change of the content of Art in RM to status :

   (d)00000003 (w)00150014
>>
08:26:43.667 tx      8 | S03
0503 0014 0001 C58A           ...query for 1 word from address 0x0014
08:26:43.681 rx;i    7 | S03
0503 02BB BB7B 07             ...the response only contains the fifth word
                               0xBBBB entry created in the slave simulator

08:26:45.682|                 |691122FF 00000005|S03I  OUT   7||89 3usr 0
0503 02BB BB7B 07
                              ...content of cache is sent from RM to RS
>>

3.2. Communication for more complicated cache memory configurations

Master      Radioslave  \|/....\|/  Radiomaster         Slave
                         |      |
PLC === S02 - 691122FF -RFC    RFC- 69112205 - S03 ==== PLC 05

              SPe2t                  SPe3t
              (m)s   (c)n            (m)m   (c)n
              (S)(f)5                (M)(d)691122FF
                 (u)1                   (0)5
                                        (p)200*10
                                        (t)200*100
              (C)(A)1                (C)(A)1
                 (t)40                  (t)30

Table Art the same in RS and in RM:

>>
ART No 1: 
items: 3
default gw: 00000000 (0.0.0.0   )
dest:    gw:
00010002 00040000 (0.1.0.2    0.4.0.0   )
00020003 00020000 (0.2.0.3    0.2.0.0   ) ...length 2 words
00030003 00130010 (0.3.0.3    0.19.0.16 ) ...length 3 words
>>

Content of Art:

dest 00010002  ...0001 - serial number for distinguishing dest items
               ...0002 - number of Modbus function, here Read Input Status
  gw 00040000  ...0004 - upper edge of memory block
               ...0000 - beginning of memory block

Modbus functions 02 and 03 use different parts of the memory which is why their addresses can overlap.

If more areas of memory which are read by the same function appear it is necessary to distinguish between them. Here they are rows

   00020003 00020000    ...length 2 words (0002-0000=2)
   00030003 00130010    ...length 3 words (0013-0010=3)

with function 03. They are distinguished by the length of the transmitted data. Here they are 2 and 3 words. The shorter item must be located higher in the Art table, the longer item lower down.

Monitoring registers communication between the RM and Slave PLC. Here queries in Modbus format and responses are repeated. Each row in the Art table creates a single query. If there is a change to any element of data a summary report is sent to RS over the MORSE network. This message is made up of the responses to individual queries to SCC. If the data does not change this message is sent in regular intervals “SPe3tCt”.

>>
12:53:55.811 tx      8 | S03
0502 0000 0004 784D
12:53:55.875 rx;i    6 | S03
0502 0103 E0B9
12:53:57.876 tx      8 | S03
0503 0000 0002 C58F
12:53:57.941 rx;i    9 | S03
0503 0411 1122 2272 73
12:53:59.942 tx      8 | S03
0503 0010 0003 058A
12:54:00.008 rx;i   11 | S03
0503 06AA AABB BBCC CC12 33
12:54:02.009|                 |691122FF 00000005|S03I  OUT  26||89 2usr 0
0502 0103 E0B9 0503 0411 1122 2272 7305 0306 AAAA BBBB CCCC 1233
>>

The second part of monitoring records the receipt of a packet on the RS RF channel and its communication with the PLC Master on SCC2:

>>
12:56:06.032|691122FF 69112205|691122FF 69112205|R01I  OUT  26n89 6dat 0
0502 0103 E0B9 0503 0411 1122 2272 7305 0306 AAAA BBBB CCCC 1233
12:56:06.228 rx;i    8 | S02
0503 0010 0003 058A
12:56:06.229 tx     11 | S02
0503 06AA AABB BBCC CC12 33
12:56:06.494 rx;i    8 | S02
0502 0000 0004 784D
12:56:06.495 tx      6 | S02
0502 0103 E0B9
12:56:06.760 rx;i    8 | S02
0503 0000 0002 C58F
12:56:06.760 tx      9 | S02
0503 0411 1122 2272 73
>>

Communication intervals on SCC are set long for testing purposes. The normal period, for example, is 200 ms, according to parameter “SPe3tMp”.

3.3. Modbus and MTF

Communication with PLC Modbus and simultaneously with devices using MTF, in this case the ADIO module.

Master      Radioslave  \|/....\|/  Radiomaster         Slave
                         |      |
PLC === S02 - 690F00FF -RFC    RFC- 690F0065 - S03 ==== PLC 101

              SPe2t             .    SPe3t
              (m)s   (c)n       .    (m)m   (c)n
              (S)(f)101         .    (M)(d)690F00FF
                 (u)10          .       (0)101
                 (e)b ..PLC+MTD .       (p)200*10
                 (a)105         .       (t)200*100
              (C)(A)1           .    (C)(A)2
                 (t)40          .       (t)30
                                .
             ART No 1:          .     ART No 2:
             dest:    gw:       .     dest:    gw:
             02010003 00030000  .     00020003 00100003
             00020003 00100003  .
                                .
                               \|/  
                                |
                               RFC- 690F006C - G00  ...0x6C= 108
                                      GPe0pd
                                      (p)690F00FF
                                      (o)20
                                      (t)30
                                      (m)3
                                      (M)m        ...MTF format

Radioslave

for the configuration used it has this space set aside for cache memory :

Slave device 0000-0002  0003-0015
  101     MB         x       test
  102     MB         x       ....
  103     MB         x       ....
  104     MB         x       ....
  105    MTD      ....          x
  106    MTD      ....          x
  107    MTD      ....          x
  108    MTD      test          x
  109    MTD      ....          x
  110    MTD      ....          x

Parameters
   address o(f)fset:101 n(u)mber:10 net addresses
defines space for 10 Slaves with Modbus addresses 101 to 110.

Parameters
   d(e)vice type:PLC+MTD
   Sep (a)ddress:105

specifies that Slave devices can be used in both versions. They are PLC Modbus and Morse Technology Device using the MTF format. MTD devices are at addresses 105 to 110.

Table Art 1 with its row
   02010003 00030000
for function MTF type 02 converted to Modbus function Modbus 03 defines words numbers 0000 to 0002 for each Slave. This area is only used by PLC Slaves with addresses 105 to 110.
Next row
   00020003 00100003
for Modbus function 03 defines words numbers 0003 to 000F (i.e. 3 to 15 dec) for each Slave. This area is only used by PLC Slaves with addresses 101 to 104.

Radiomaster

has MORSE address 690F0065. The last byte of the address 0x65 = 101 dec is the address of the attached PLC Slave. Cache memory space is defined in table Art 2:
   00020003 00100003
i.e. for Modbus function 03 words with addresses 0003 to 000F (i.e. 3 to 15 dec) are reserved. Data from this space is then transmitted to cache memory in RS.

MTD

with MORSE address 690F006C, i.e. module ADIO, is set for work in MTF format. In this format it sends messages to CU 690F00FF, which contain 4 types of data (DI, DO, AI, AO). Out of these type 02 contains values on analog inputs. This type of data is processed in RS and values of analog inputs are recorded into cache in RS. PLC Master can then read them using Modbus function 03.

The conversion from MTF to Modbus function 03 in this example is a solution to the situation where the Master PLC is only able to communicate with function 03. The standard and recommended solution is conversion from MTF to the corresponding Modbus function, e.g. MTF 02 to Modbus 04, see Art example from the Modbus protocol description :

dest:    gw:                            ...CACHE, MB <-- SEP
06010001 00080000 (6.1.0.1   0.8.0.0  ) ...read Dout   8 bit
01020002 00100008 (1.2.0.2   0.16.0.8 ) ...read Din    8 bit
07030004 000C000A (7.3.0.4   0.12.0.10) ...read Aout   2 word
02040004 00090001 (2.4.0.4   0.9.0.1  ) ...read Ain    8 word
                                        ...RULY, MB --> SEP
07070006 01020100 (7.6.0.6   1.2.1.0  ) ...write Aout  2 word
06080005 00080000 (6.8.0.5   0.8.0.0  ) ...write Dout  8 bit
0609000F 00080000 (6.9.0.15  0.8.0.0  ) ...write Dout  8 bit

Monitoring communication

The Master PLC reads cache memory in RS using Modbus function 03. The status of the memory is changed with the arrival of a packet from the ADIO module with a new analog input value :

15:19:39.221 rx;i    8 | S02
6C03 0000 0002 CCB6         ...query to cache 0x6C=108, adr.0000
15:19:39.221 tx      9 | S02
6C03 0400 0200 03A7 34      ...response AI0=0002
                                        AI1=0003
15:19:39.488 rx;i    8 | S02
6503 0003 000D 7C2B         ...query to cache 0x65=101, adr.0003
15:19:39.489 tx     31 | S02
6503 1A00 0122 2200 0000 0000 0000 0000              ...response
0000 0000 0000 0000 0000 0000 00A4 15

15:19:40.127|                 |000000FF 0000006C|S02I   IN  42|*8A 7usr 0
0100 4728 01C3 1000 0003 0003 0002 06C3 1000 0003 0003 0003 
02C1 2000 09FD 0002         ...MTF frame, type 02, data AI0=09FD, AI1=0002
07C1 2000 09FF 0666 2A5B

15:19:40.266 rx;i    8 | S02
6C03 0000 0002 CCB6         ...query to cache 0x6C=108, adr.0000
15:19:40.267 tx      9 | S02
6C03 0409 FD00 0255 58      ...response AI0=09FD
                                        AI1=0002
15:19:40.533 rx;i    8 | S02
6503 0003 000D 7C2B         ...query to cache 0x65=101, adr.0003
15:19:40.533 tx     31 | S02
6503 1A00 0122 2200 0000 0000 0000 0000              ...response
0000 0000 0000 0000 0000 0000 00A4 15

4. Packet mode

4.1. Radiomaster -> Slave

Example of data transfer :

Radioslave  \|/....\|/  Radiomaster              Slave simulator
             |      |                            Modbus addr 05
  691122FF -RFC    RFC- 69112205 - SCC3 ==== SCC1 - 691122FF  

                       SIe3uAm                     FMeen
                       SIe3uB69112200              SIe1uAn

                       SPe3t                       SPe1t
                       (m)m    (p)n                (m)s     (p)n
                       (M)(d)691122FF              (S)(f)5
                          (0)5                        (u)1        
                          (p)200*10
                          (t)100*100
                          (r)1                     (P)(a)5 
                       (P)(N)2000                     (N)1000
                          (H)1000                     (H)2000
                                                      (s)n

With a period of “Spe3tMp” the Radiomaster asks the Slave for the content of its descriptor at address “SPe3tPH”, it is 1000.

Using function “its” send data AAAA from the Radiomaster to its own address (i.e. to SCC3). Data is stored in buffer N2H and is then transferred to the buffer in the Slave simulator by the process given below.

The PLC Slave is replaced here by a standard CU (MR400) in the Slave simulator function with this configuration:

  • MORSE address of simulator is used for creating the destination address, which is why it is the same as the Radioslave address.

  • Simulator is forbidden from transmitting to RFC.

  • Modbus address of simulator is defined by parameter SPe1tPa5.

  • The pair of address (N)2H and (H)2N is set as standard to be the same in RM and Slave. For the needs of the simulator addresses are switched here. Parameter “SPe1tP” (s)imulator is on.

Monitored in  CU Radiomaster:

10:20:46.649 tx      8 | S03
0503 1000 0001 814E            = Slave 5, do you have data for me ?
10:20:46.663 rx;i    7 | S03
0503 0200 0049 84              = no

Send packet: (N):1   (d):69112205h
(t)ype:0009h
s(o)urce:691122FFh             = simulation of Radioslave address
d(a)ta:..                      = data AAAA in hexadecimal
random data (l)ength:0byte
(r)epeat period:0ms + (j)itter:0ms
IP (P)ing
(s)tart r(e)port sto(p)
(q)uit
>>s

10:20:48.664 tx      8 | S03
0503 1000 0001 814E
10:20:48.678 rx;i    7 | S03
0503 0200 0049 84
10:20:50.456|                 |69112205 691122FF|S03I   IN   2|*09 1usr  0
AAAA                           = prot. RadMaster received data for Slave 5
10:20:50.679 tx      8 | S03
0503 2000 0001 8E4E            = Slave 5, is buffer N2H empty ?
10:20:50.693 rx;i    7 | S03
0503 0200 0049 84              = yes
10:20:52.694 tx     19 | S03
0510 2000 0005 0A00 0809 0169 1122 FFAA AAE5 E6   = record message
10:20:52.714 rx;i    8 | S03
0510 2000 0005 0A4E            = recorded
10:20:54.715 tx      8 | S03
0503 1000 0001 814E            = Slave 5, do you have data for me ?
10:20:54.729 rx;i    7 | S03
0503 0200 0049 84              = no ... queries continue

4.2. Radioslave <- Radiomaster <- Slave

Sending a packet from Slave by Modbus to Radiomaster and on to RF channel.

The protocol in function RS records data arriving from the network (i.e. from the node from  test “its”) to buffer N2H. We can set this parameter to a value of 1000. Parameter “SPe1tPsn” (simulator:ON) switches on bit DTE.

Data BBBB is sent using command “its” in the Slave simulator. This is written to address N2H=1000 in the Slave simulator.

Radiomaster periodically enquires about the status of address H2N=1000. It receives data BBBB from the Slave from this address including destination address 691122FF. It then sends data in a MORSE packet to this address. The address can be directed to the Radioslave (and on to the Modbus Master) or to another Radiomaster.

Send packet: (N):1  (d):691122FFh   = packet leaves the user output
(t)ype:0009h                                              to Modbus
s(o)urce:691122FFh
d(a)ta:»»                           = data BBBB hex
random data (l)ength:0byte
(r)epeat period:0ms + (j)itter:0ms
IP (P)ing
(s)tart r(e)port sto(p)
(q)uit
>>s
Monitored in CU Radiomaster:
10:23:56.059 tx      8 | S03
0503 1000 0001 814E            = Slave 5, do you have data for me ?
10:23:56.073 rx;i    7 | S03
0503 0200 0049 84              = no
                        ... prot. Slave simulator received data for Master
10:23:58.074 tx      8 | S03
0503 1000 0001 814E            = Slave 5, do you have data for me ?
10:23:58.088 rx;i    7 | S03
0503 0200 0848 42              = I have 08 byte
10:24:00.089 tx      8 | S03
0503 1001 0004 108D            = send 4 words from address 1001
10:24:00.106 rx;i   13 | S03
0503 0809 8369 1122 FFBB BB0F B4     = Im sending 8 byte
10:24:00.106|                 |691122FF 00000005|S03I  OUT   2||09 3usr  0
BBBB                           = data BBBB sent to node
10:24:00.112|691122FF 69112205|691122FF 69112205|01C  RFTX     2 09 3dat 0
BBBB                           = data BBB sent to RF channel
10:24:02.107 tx     11 | S03
0510 1000 0001 0200 0085 51    = delete descriptor
10:24:02.123 rx;i    8 | S03
0510 1000 0001 048D            = I deleted descriptor
10:24:04.124 tx      8 | S03
0503 1000 0001 814E            = queries to Slave continue ...
10:24:04.138 rx;i    7 | S03
0503 0200 0049 84

4.3. Radiomaster + more Slave

CU Radiomaster can communicate via RS485 link with more PLC Slaves.

Radioslave  \|/....\|/  Radiomaster              Slave simulator
             |      |                  RS485                Modbus
  691122FF -RFC    RFC- 69112205 - SCC3 ==== SCC1 - 691122FF  05
                                          == SCC1 - 691122FF  06

                       SIe3uAm                     FMeen
                       SIe3uB69112200              SIe1uAn

                       SPe3t                       SPe1t
                       (m)m    (p)n                (m)s     (p)n
                       (M)(d)691122FF              (S)(f)5
                          (0)5                        (u)2        
                          (1)6 
                          (p)200*10
                          (t)100*100
                          (r)1                     (P)(a)6 
                       (P)(N)2000                     (N)1000
                          (H)1000                     (H)2000
                                                      (s)n

RM can have several PLC Slaves defined, with which it communicates in any of the following manners:

  • parameters SPe3tM (0)5, next (1)6 and others

  • or parameters SPe3tM o(f)fset:5, n(u)mber:2 and more

A group of Slaves connected via RS485 is replaced here with a single Slave simulator connected via RS232. Using parameters “SPe1tSf5” and “SPe1tSu2” Modbus addresses 05 and 06 which the simulator substitutes are defined. Parameter “SPe1tPa6” defines Modbus address 06, from where it is possible to send a packet to RM.

07:45:44.498 tx      8 | S03
0503 1000 0001 814E             = query to Slave 5
07:45:44.512 rx;i    7 | S03
0503 0200 0049 84               = response from Slave 5
07:45:46.513 tx      8 | S03
0603 1000 0001 817D             = query to Slave 6
07:45:46.527 rx;i    7 | S03
0603 0200 080C 42               = dialog with Slave 6 ...
07:45:48.528 tx      8 | S03
0603 1001 0004 10BE
07:45:48.545 rx;i   13 | S03
0603 0809 8069 1122 FFCC CC54 26
07:45:48.545|                 |691122FF 00000006|S03I  OUT   2||09 0usr  0
CCCC
07:45:48.545|691122FF 69112205|691122FF 69112206|R01I    IN    2N09 0dat 0
CCCC
07:45:50.546 tx     11 | S03
0610 1000 0001 0200 0091 A1
07:45:50.562 rx;i    8 | S03
0610 1000 0001 04BE
07:45:52.563 tx      8 | S03
0503 1000 0001 814E             = query to Slave 5
07:45:52.577 rx;i    7 | S03
0503 0200 0049 84
07:45:54.578 tx      8 | S03
0603 1000 0001 817D             = query to Slave 6, communication continues
07:45:54.592 rx;i    7 | S03                  
0603 0200 000D 84

5. Time synchronisation

Transmitting time

Transferring time from PLC Master via RS and RM to PLC Slave

   Radioslave  \|/....\|/  Radiomaster              Slave simulator
                |      |                            Modbus addr 05
SCC2- 691122FF -RFC    RFC- 69112205 - SCC3 ==== SCC1 - 69112205 

                       SIe3uAm                     FMeen
                       SIe3uB69112200              SIe1uAn

 SPe2t                 SPe3t                       SPe1t
 (m)s    (t)n          (m)m    (p)t                (m)s     (t)n
 (S)(f)5               (M)(d)691122FF              (S)(f)5
    (u)1                  (0)5                        (u)1        
                          (p)200*10
                          (t)100*100
                          (r)1                     
 (T)(f)n               (T)(f)n                     (T)(f)n

 (s)(t)n               (s)(t)n    ...synchronisation  (s)(t)n
    (m)r ...receiver      (m)s    ...sender           (m)r  ...receiver
    (p)0                  (p)20   ...period           (p)0
    (a)3000               (a)3000 ...address          (a)3000

                       Ue(i)1     ...synchronisation in the MORSE network
                         (c)691122FF
                         (p)20

Monitored in CU Radioslave:
10:22:59.645 rxsim  21 | S02       ...synchronisation frame inserted using
0510 3000 0006 0C47 3971 B102 5E00 0000 0000 009F 25   function "in" to RS
10:43:13.598 tx      9 | S02       ...RS is synchronised (monitoring time)
0510 3000 0006 0C0F 31             ...response from RS to PLC Master

Monitored in CU Radiomaster:
10:23:02.166 tx     21 | S03       ...RM writes old time to PLC Slave
0510 3000 0006 0C47 396C F600 A602 170A 0D0A 6B40 1A
10:23:02.188 rx;i    9 | S03
0510 3000 0006 0C0F 31

10:23:06.994|69112205 691122FF|69112205 691122FF|R01I   OUT    6n97 0dat 0
4739 71B8 03B2                ...synchronisation packet through RF channel
                                                             from RS to RM
10:43:36.149 tx     21 | S03       ...RM is synchronised (monitoring time)
0510 3000 0006 0C47 3971 C800 9524 2B0A 0D0A 6B9C 14    ...synchronisation
10:43:36.171 rx;i    9 | S03             frame is sent via Modbus to Slave
0510 3000 0006 0C0F 31

10:43:40.868|69112205 691122FF|69112205 691122FF|R01I   OUT    6n97 0dat 0
4739 71CC 0364                     ...synchronisation cycle repeats

10:43:56.181 tx     21 | S03
0510 3000 0006 0C47 3971 DC00 B538 2B0A 0D0A 6B40 8A
10:43:56.203 rx;i    9 | S03
0510 3000 0006 0C0F 31

Radioslave in “receiver” mode receives information about time from PLC Master. Here the packet is generated using function “channel send”. Composition of frame:

0510             modbus address 05, function 0x10 entry
3000 0006 0C     from address 0x3000 write 0x0006 words, i.e. 0x0C byte
4739 71B1        Unix time, sec od 1.1.1970
02 5E            0x0 summer time, 0x25E = 606 msec
00 0000 0000 00  arbitrary value, 6 byte
9F 25            crc

Frame is written to address 3000 and according to this address the local time of the modem is set. Time appears in the monitoring header in the next row:

10:43:13.598 tx      9 | S02

According to the settings in menu “Ue” synchronisation takes place in the MORSE network. Time is transferred to CU RM by the nearest synchronisation message. Only Unix time and msec are transferred : 4739 71B8 03B2

A received packet is written in RM to address 3000 and local time of RM is synchronised according to this. The remaining part of the time frame is calculated in RM. CU Radiomaster is in “sender” mode and sends synchronisation frames to Slave with a period of “SPe3tsp” = 20s. The frame has a similar format to the frame simulated for RS using function “in”, however its contents correspond to the current time:

0510          modbus address 05, function 0x10 entry
3000 0006 0C  from address 0x3000 write 0x0006 words, i.e. 0x0C byte
4739 71DC     Unix time, sec od 1.1.1970
00 B5         0x0 summer time, 0x0B5 = 181 msec
38            56 sec
2B            43 min
0A            10 hod
0D            13 den
0A            10+1     = 11th month  
6B            107+1900 = 2007 year
40 8A         crc

The time in the monitoring header matches these values:

10:43:56.181 tx     21 | S03

Periods for synchronisation “SPe3tsp” and “Uep” are set short here. Under normal operating conditions an interval of several hours is used.

Ascertaining the time

In CU Radioslave from the previous example we can change parameter “SPe2tsm” to “sender”. Then we receive a response containing the current time to a simulated query from  PLC Master:

12:01:47.831 rxsim   8 | S02
0503 3000 0006 CB4C
12:01:47.832 tx     17 | S02
0503 0C47 3984 1B03 402F 010C 0D0A 6BA4 84

6. History

Applies to sw version 10.0.9.0 from 9.10.2007.

©  2024 RACOM s.r.o. All Rights Reserved.