MODBUS

The radioslave is connected via the SCC to the PLC Master and from the Master’s point of view represents all PLC Slaves in the network. The addresses of all PLC Slaves are defined for RS using parameters o(f)fset and n(u)mber. Based on the mode defined in menu SPe2t RS then communicates with RM modems which are located by individual PLC Slaves.

slave parameters:
address o(f)fset:1  n(u)mber:5  net addresses
address type (o)ut: MORSE
address type (i)n: MORSE
(r)epeat discard:5 (deprecated)
d(e)vice type:PLC
Sep (a)ddress:5
(q)uit
>>

Radiomaster appears in the MORSE network under an address, the last byte of which is the same as one of the Modbus slave addr:, e.g. 69112203. Messages for the next of them are received using the Multiaddressing function (in menu Ne). The address of the respective Radioslave is given in item (d)estination:.

Communication over the RS485 line (or RS232 for a single Slave) occurs with a (p)eriod: (here 200 ms), wait for a max. period of (t)imeout: for a response, (r)epeat: number of repeats after (t)imeout.

master parameters:
(d)estination:691122FFh  destination
d(e)vice type (deprecated):PLC
Modbus slave addr: (0):3 (1):4 (2):5 (3):0
Modbus slave addr: o(f)fset:1  n(u)mber:0
address type (o)ut: MORSE
address type (i)n: MORSE
(a)ddress mask:FFh (deprecated)
(p)eriod:20 period i(n) : *10ms
(t)imeout:10*100 ms
(r)epeat:2
DPM(B) bcast compat:OFF
(q)uit
>>

In transparent mode all data is transmitted from Master to Slave over the network. It is used for transmission of executive commands from the Master in Cache mode. For bidirectional transmission transparent mode is only suitable for very small networks with a slow “timeout” polling cycle. For restricting the transmission of spurious packets we use checks in  RM, as below.

After sending a packet to a Slave the Radiomaster expects, in a max. period of SPe2tMt (= timeout), a response from the Slave, which is then sent through the MORSE network to the Radioslave.

RM replies to the MORSE address of the source. This allows there to be more transparent RS in the network.

transparent parameters:
(A)rt table No:0
# ART dest:       gw:
#     mmnnffff    hhhhllll
#    mtf No Fce     high low addr (use help in default menu)
# BEWARE! IF YOU CHANGE CONTENT OF THE TABLE,
# YOU SHOULD RESTART (INIT) THIS PROTOCOL!
check (f)unction:ON
check a(d)dress:OFF
check (C)RC:OFF (deprecated)
check (n)et No:OFF
allow (r)ead req:OFF
(D)etect transp/cache<->packet by :CRC
Net(B)ase:0000  Net(M)ask:0000
(c)ommand cache:OFF  (t)im::0s
(q)uit
>>

CACHE mode is used for collection of data from a larger number of PLC Slaves. It is supplemented by Transparent mode for transmission of (less frequent) commands in the Master –> Slave direction.

In cache mode identical memory areas – cache – are created in the PLC and in modems. Transmission of data from Slave –> RM occurs on the link with short period SPe2tMp set in the range of 100 to 200ms. This maintains the current image of the status of connected Slaves in RM. If there are no changes in this image it is sent over the radio to RS in intervals SPe2tCt. If a change occurs in RM cache, a message for RS is sent immediately. Thus current images of the cache of all connected Slaves are maintained in RS cache with minimum loading of the radio network. PLC Master then reads this cache in RS in the same way as if it had read the status of all Slaves over the Modbus network.

On monitoring the status of cache memory the whole content of cache is transmitted over the link. Polling is controlled by the Radiomaster or the PLC Master. Information is only transmitted in the Slave –> Master direction.

    cache parameters:
(A)rt table No:1
# ART dest:       gw:
#     mmnnffff    hhhhllll
#    mtf No Fce     high low addr (use help in default menu)
# BEWARE! IF YOU CHANGE CONTENT OF THE TABLE,
# YOU SHOULD RESTART (INIT) THIS PROTOCOL!

(D)etect transp/cache packet by :CRC
Net(B)ase:0000  Net(M)ask:0000
net (t)imeout - mirror:30s
a(l)iasing:OFF
(g)lue to trans:off
(e)rr. report:SILENT  err. (a)dr:0h  err. (m)ask:0000h
(o)ld cache menu (since sw.630)
(q)uit
>>

err. (a)dr:0h  err. (m)ask:FFFFh

10:30:47.087 tx      8 | S03
0503 0010 0003 058A
10:30:47.148 rx;i   11 | S03
0503 06AA AABB BBCC CC12 33
10:30:49.149 tx      8 | S03      ...connection on RS485 broken
0503 0010 0003 058A
10:30:52.151|                 |691122FF 00000005|S03I  OUT  11||89 4usr 0
0503 06FF FFBB BBCC CC12 3A

Art and CACHE tables

Memory blocks for the cache function are defined in the same way in RS and RM using Table Art. For standard Modbus communication Art defines one cache memory in each of its rows. It contains a sequence number, Modbus function and the range of reserved memory. Example:

ART No 1: 
items: 3
default gw: 00000000 (0.0.0.0   )
dest:    gw:
00040002 00040000 (0.1.0.2    0.4.0.0   )
00050003 00020000 (0.2.0.3    0.2.0.0   ) ...length 2 word
00060003 00140010 (0.3.0.3    0.20.0.16 ) ...length 4 word
>>

Writing format for dest and gw:

| rez/8 | No/8 | rez/8 | fce mb/8 | high addr/16 | low addr/16 |

For example the third row defines the cache memory for function 03 – reading registers, which contains 4 words at addresses 0010, 0011, 0012, 0013.

Responses to Modbus queries are stored in individual cache memories based on the number of the Modbus function. If there are more records with the same function number they are distinguished by their length. Memory for functions with the same number must be defined such that they can be differentiated by their length and must be listed in Art from the shortest at the top to the longest at the bottom. A PLC Slave must provide data for all cache defined in this way. If data is shorter then communication doesn’t take place.

It is possible to define a max. of 8 cache memories in Art. The maximum volume of all defined cache is 1400 byte in the case of the Radiomaster. This means that upon refreshing cache in the Radiomaster -> Radioslave direction a MORSE packet of maximum size 1400 bytes of user data can pass through the network.

For the Radioslave (in the centre) the memory in the modem is a limiting factor.
Allocated memory in the centre = (NumberPLC+NumberSEP+NumberADIO) × SizeCache

ADIO, SEP and MTF in the Modbus

The Master PLC can communicate with Slaves ADIO or SEP, which work with the MTF format.

These devices are defined in RS in the (S)lave menu using parameters SPe2tSe, SPe2tSa. Table Art then performs a transfer between functions MTF and Modbus. Besides CACHE memory blocks for reading from modules ADIO and SEP a RULY blocks are defined for writing. Here is the recommended configuration of Art with comments:

dest:    gw:                            ...CACHE, MB <-- SEP
06010001 00080000 (6.1.0.1   0.8.0.0  ) ...read Dout   8 bit
01020002 00100008 (1.2.0.2   0.16.0.8 ) ...read Din    8 bit
07030004 000C000A (7.3.0.4   0.12.0.10) ...read Aout   2 word
02040004 00090001 (2.4.0.4   0.9.0.1  ) ...read Ain    8 word
                                        ...RULY, MB --> SEP
07070006 01020100 (7.6.0.6   1.2.1.0  ) ...write Aout  2 word
06080005 00080000 (6.8.0.5   0.8.0.0  ) ...write Dout  8 bit
0609000F 00080000 (6.9.0.15  0.8.0.0  ) ...write Dout  8 bit

Contain of dest and gw items:

| mtf/8 | No/8 | rez/8 | fce mb/8 | high addr/16 | low addr/16 |

A maximum of 8 CACHE can be defined.

Memory with the same Modbus function number (here rows No 3 and 4) are again distinguished by length and listed from shortest to longest.

The table in question is suitable for communication with module ADIO and SEP. The Master PLC must send queries corresponding to the length of the connected device, e.g. for Din ADIO a query of 2 bits.

Radiomaster sends a regular message for RS in the interval Net timeout SPe2tCt. In addition to this it sends current reports about changes. Radioslave monitors whether each RM reponds at least once in time SPe2tCt.
If not it behaves according to the error report setting.

Cache in RS is organised according to Modbus addresses or according to MORSE addresses. If addresses do not begin with one the unused part of memory for the Slave (0 to N-1) can be left out by using offset addresses, parameter SPe2tSf. The number of blocks of cache can then be adapted to the total number of Slaves in the network using parameter SPe2tSu.

RS recognises individual Slave PLCs for their insertion into cache according to MORSE addresses from which a message was received. If it is necessary to distinguish PLCs according to Modbus addresses it is possible to set up with the type of address in parameter SPe2tSo, SPe2tSi.

In packet mode two memory buffers are created in each PLC and in modems for transmission of data from Slave –> Radiomaster (host to net, H2N) and back (net to host, N2H). The length of the buffers is min. 250 bytes (max. length of Modbus frame), max. 1600 byte (max. length of MORSE packet).

Data transfer in packet mode can take place in any direction, i.e. Master<->RS, RM<->Slave, Slave<->Slave.

Radiomaster periodically queries each Slave for the content of the first word of the buffer H2N called the descriptor. If it is non-zero the length of the pseudoframe prepared in H2N is found out and this is transmitted in the next communication to the Radiomaster. Then the descriptor is deleted which indicates to the Slave the possibility of transmission of the next frame. Communication from PLC Master – RS, which is controlled by the Master, takes place in a similar manner.

Transmission from the Radiomaster (RM) to the Slave takes place in such a way that RM reads the descriptor N2Hdesc in PLC Slave and if it is zero it writes its pseudoframe to N2H. After processing this the Slave writes a zero word to N2Hdesc on the signal that buffer N2H is again available.

packet parameters:
Modbus (a)ddress:5
(A)RT table No.:0 (deprecated)
(N)2H buffer:2000  (H)2N buffer:1000
Warning: Both addresses should be nonzero.
(s)imulator:OFF
(D)etect transp/cache<->packet by :CRC
Net(B)ase:0000  Net(M)ask:0000
(q)uit
>>

Pseudoframes H2Nfr and N2Hfr have headers of length 6 bytes and data. The header contains the necessary information for creating a MORSE packet and sending it to the Radioslave or another Radiomaster.

Structure of buffers:

Description of items:

H2Ndesc:   |ret/1|rep/1|No/2|res/1|rxsize/11|
N2Hdesc:   |ret/1|rep/1|No/2|res/1|txsize/11|

Addresses of individual blocks of memory (H2N, N2H) are freely configured in the modem according to the requirements of the connected device. A pseudoframe contains the actual packet determined for transfer to/from the network. A header containing network information is contained inside the pseudoframe. The header is located in the buffer in the next position after the descriptor. Structure of header and data:

User pseudoframe:

      | T/8 | D/1 | R/4 | N/3 | A/32 | data |

Example:

The Packet mode frame transfering the data from RM to Slave:

                                     AA AA      ...data
                      09 0169 1122 FFAA AA      ...user pseudframe N2Hfr
                 00 0809 0169 1122 FFAA AA      ...N2H descriptor + N2Hfr
0510 2000 0005 0A00 0809 0169 1122 FFAA AAE5 E6 ...Modbus frame, record
                                                   with function 0x10

The frame transering data from Slave to RM:

                      BB BB       ...data
       09 8369 1122 FFBB BB       ...user pseudframe H2Nfr
0503 0809 8369 1122 FFBB BB0F B4  ...Modbus frame, reading
                                     with function 0x03

When reading data from the Slave to RM the descriptor is not read again because this is transferred in the previous step of the dialog. More detailed examples are given in a separate article.

Multiaddressing

Radiomaster, which serves several Slaves, uses Multiaddressing. When switching on the Multiaddressing function in the Nodes menu packets which were directed via routing to the node’s link output are sent to the user output. This therefore determines that packets from the MORSE network, determined for any of its Slaves, are accepted by the Radiomaster and that they leave its user port to SCC with Modbus.

Modbus automaster:
t(i)meout:0s
master mode after switching:
(c)ache:OFF  (p)acket:OFF  (t)rans:OFF
(q)uit
>>

Time synchronisation in Modbus and watchdog for PLC Slave.

Modbus services:
(t)ime sync:OFF  (m)ode:RECEIVER  (p)eriod:0s
time (a)ddr:0000h  time sync (b)it:0000h
(d)ebug addr:00000000h (deprecated)
radiomaster only:
(w)dog bit:0000h  wd(o)g addr:0000h  wdog p(e)riod:0s  (F)unc16:OFF
(q)uit
>>

Parameters for time transfer:

Parameters for watchdog are only entered in Radiomaster; they provide the PLC Slave with the option of checking whether a connection with Radiomaster lasts.

Time Synchronisation

The Modbus protocol allows time to be transmitted between a MORSE CU and a connected Modbus device. In this way it is possible to link to time synchronisation in the MORSE network; see the example in the separate article. In all CUs it is necessary to switch on synchronisation SPe2tst and set up the address for recording time SPe2tsa the same way. There are four configuration options:

Parameter “period 0” means that Modbus communication is controlled by the other participant. Parameter “period” is set as required, e.g. 3600sec. If more PLC Slaves are connected to RM synchronisation only takes place with the first of them.

Example – RS in function SENDER accepts a time query from the Master PLC and responds:

12:01:47.831 rxsim   8 | S02
0503 3000 0006 CB4C
12:01:47.832 tx     17 | S02
0503 0C47 3984 1B03 402F 010C 0D0A 6BA4 84

Format of Time Data

|gmtsec/32|R/1|ts/1|R/4|msec/10|sec/8|min/8|hour/8|day/8|month/8|year/8|

Others are generated from the above mentioned items containing local time including a correction of the time zone. In the command for writing time to the CU the following items can be arbitrary, e.g. zero:

Structure of used example:

0503 0C   - Modbus address 05, function 03, 12 byte
4739 841B - Unix time, seconds from 1.1.1970
0340      - 0000bit winter time, 0x340 = 832ms
2F        - 47 sec
01        - 01 min
0C        - 12 hod
0D        - 13 den
0A        - 10+1     = 11 month
6B        - 107+1900 = 2007 year
A4 84     - crc

12:01:47.832 – monitoring time corresponds with the content of the frame

Watchdog Functions

PLC Slave does not have the possibility of finding out whether communication with the Radiomaster has been interrupted or not. For that reason it is possible here to set up the Watchdog function in Radiomaster, which writes a particular word to a selected address in the PLC Slave at regular intervals. Everything is set up in menu SPe2ts. The PLC can then regularly read and delete this entry thus maintaining information about the existence of the connection.

Short description of types of packets on the user interface.

|U/1|B/1|H/1|subt/5|

Examples for transparent, packet and cache mode are given in a separate article MODBUS examples. Examples of packet mode are also contained in the older description MODBUS 574.