B0700BG B
B0700BG B
B0700BG B
REV B
Tables..................................................................................................................................... ix
Preface.................................................................................................................................... xi
Who This Document Is For ..................................................................................................... xi
What You Should Know .......................................................................................................... xi
Revision Information ............................................................................................................... xi
Reference Documents .............................................................................................................. xi
I/A Series Documents .......................................................................................................... xi
Modbus Protocol Documents ............................................................................................ xii
1. Introduction ...................................................................................................................... 1
What You Will Need ................................................................................................................ 2
Software ............................................................................................................................... 2
FDSI Configurator .......................................................................................................... 2
Hardware ............................................................................................................................. 2
Invensys Foxboro Hardware ............................................................................................ 2
Modbus Hardware ........................................................................................................... 2
Example Configurations ............................................................................................................ 3
Simplex (Non-Redundant) Configurations .......................................................................... 3
Redundant Configurations ................................................................................................... 4
2. Installation ........................................................................................................................ 5
Installing the Modbus Master Driver Files ................................................................................ 5
Installing the FDSI Configurator Software ................................................................................ 5
iii
B0700BG Rev B Contents
5. Error Handling................................................................................................................ 37
Modbus Write and Response Errors ........................................................................................ 37
Loss of Communications Monitoring ...................................................................................... 37
DCI Block Status in FoxView ................................................................................................. 38
Device Status in SMDH ......................................................................................................... 38
Failover ................................................................................................................................... 39
Capacity and Limitations ........................................................................................................ 39
6. Modbus Protocol............................................................................................................. 41
Modbus Protocol Options ....................................................................................................... 41
Modbus Function Codes Supported .............................................................................. 41
Modbus Protocol Operation ................................................................................................... 42
Modbus Exception Codes ....................................................................................................... 47
7. Troubleshooting.............................................................................................................. 49
Serial Communications (FBM230/231) .................................................................................. 49
iv
Contents B0700BG Rev B
v
B0700BG Rev B Contents
vi
Figures
1-1. Simplex Configuration Example, Serial (FBM230) ....................................................... 3
1-2. Simplex Configuration Example, Ethernet (FBM232) .................................................. 3
1-3. Redundant Configuration Example, Serial (FBM231) .................................................. 4
1-4. Redundant Configuration Example, Ethernet (FBM233) ............................................. 4
3-1. Typical Sequence for Installing and Configuring the I/A Series System with FDSI ....... 9
3-2. Serial Port Configuration Using FDSI Configurator ................................................... 12
3-3. Ethernet Port Configuration Using FDSI Configurator .............................................. 13
3-4. I/A Series Control Database Configuration for Use with the Modbus Master Driver
on an FBM232 and an FCP270 or ZCP270 ............................................................... 14
vii
B0700BG Rev B Figures
viii
Tables
1-1. Modbus Function Codes ............................................................................................... 1
3-1. Baud Rate/Response Timeout Values .......................................................................... 11
3-2. Parameter Definitions for ECB200 ............................................................................. 15
3-3. PORTEX Values ......................................................................................................... 15
3-4. Parameter Definitions for ECB202 ............................................................................. 16
3-5. Parameter Definitions for ECB201 ............................................................................. 17
4-1. Data Types and Memory Allocation for Modbus Devices ........................................... 25
4-2. DCI Blocks, Modbus Register Addresses, and Function Codes
with 5-Digit Addressing .............................................................................................. 26
4-3. DCI Blocks, Modbus Register Addresses, and Function Codes Z
with 6-Digit Addressing .............................................................................................. 26
4-4. Byte Swapping Options for Data Types U2, U4, S2, S4, and F4 ................................ 28
4-5. Bit Swapping Options for Coils Data Type ................................................................. 32
4-6. Data Types for DCI Input/Output Blocks .................................................................. 32
5-1. SMDH ECB201 Display on FBM230/232 (Non-Redundant) ................................... 37
5-2. SMDH ECB201 Display on FBM231/233 (Redundant) ............................................ 37
6-1. Supported Modbus Function Codes ........................................................................... 41
ix
B0700BG Rev B Tables
x
Preface
This document describes the I/A Series System Field Device System Integrator Modbus Master
driver utilizing FBMs 230, 231, 232, and 233.
Revision Information
This is the second release of this document.
Reference Documents
The following documents provide additional and related information:
xi
B0700BG Rev B Preface
xii
1. Introduction
This chapter provides an introduction to the Modbus Master driver for Foreign Device System
Integrators, and describes what you will need for configuration of an FBM230, 231, 232, or
233 to interface with Modbus devices.
The Modbus protocol, originally a proprietary messaging specification by Gould-Modicon, has
evolved into a globally accepted open standard for communication between field devices. The
Modbus protocol specifies the master-slave/query-response message structure that controllers can
recognize and use.
The Modbus Master driver is specifically designed to enable the integration of third-party devices
that support Modbus communication protocols into an I/A Series system. You can download the
Modbus Master driver into FDSI FBMs 230, 231, 232, and 233, thus enabling the I/A Series sys-
tem to translate and use vendor-defined functions of a broad range of Modbus compliant devices.
Devices that can successfully communicate with FDSI Modbus Master FBMs are those that sup-
port some subset of the Modbus Function codes listed in Table 1-1.
Modbus is a master/slave protocol. The Modbus master driver causes the Invensys Foxboro
system to act as the master, sending messages to a Modbus device acting as a slave. When the
FDSI receives responses from the messages it sends to the Modbus devices, it processes them and
updates the appropriate I/O points in the CP.
This document explains the procedure to install and configure the Modbus Master driver on a
FBM230/231/232/233. The driver communicates with Modbus controllers as follows:
Serially, via Modbus RTU and Modbus ASCII
Ethernet TCP/IP via Modbus TCP.
The Modbus Master driver is contained in the file Modbus.ziph, which runs on any of the appro-
priate FBMs (230-233). The FDSI driver is responsible for receiving the Modbus devices point
values as well as sending Foxboros point values.
Code Function
01 Read Coil Status
02 Read Input Status
03 Read Holding Registers
04 Read Input Registers
05 Force Single Coil
06 Preset Single Register
081 Loopback Diagnostic Test
15 Force Multiple Coils
16 Preset Multiple Registers
1. Supported for data diagnostic code only.
1
B0700BG Rev B 1. Introduction
FDSI Configurator
The FDSI Configurator is delivered on a single CD-ROM (separate from the driver CD-ROM)
and is installed on a PC running the Windows XP operating system. The FDSI Configurator is
responsible for creating the port configuration files that are used by the Modbus FBM download-
able driver.
Hardware
The delivered driver supports the following Invensys Foxboro and Modbus hardware. Refer to
Field Device System Integrators (FBM230/231/232/233) Users Guide (B0700AH) for detailed
installation instructions.
Modbus Hardware
Serial Hardware via Modbus RTU and Modbus ASCII
Ethernet Hardware via ModbusTCP.
2
1. Introduction B0700BG Rev B
Example Configurations
Simplex (Non-Redundant) Configurations
FBM230
Termination Assembly
RS-422
RS-485
2-Wire
RS-232
Device
Device 1
Device
Device 16
FBM232
Switch/Hub
Device 1 Device 64
3
B0700BG Rev B 1. Introduction
Redundant Configurations
FBM231 FBM231
(Main) (Backup)
RS-232 RS-232
Device
Device 1
RS-485 RS-485
Device 16
FBM233 FBM233
(Main) (Backup)
Switch/Hub Switch/Hub
Device 1
Device 64
4
2. Installation
This chapter describes the installation procedures for the Modbus Master driver. After these
installation procedures are complete, proceed to Chapter 3 Configuration and Download
Instructions.
5
B0700BG Rev B 2. Installation
6
3. Configuration and Download
Instructions
This chapter provides instructions to configure the Modbus Master driver and download it to
an FDSI FBM.
7
B0700BG Rev B 3. Configuration and Download Instructions
13. Using SMDH, verify that communication to the device is enabled. Refer to
Enable/Disable Communication to a Device in Field Device System Integrators
(FBM230/231/232/233) Users Guide (B0700AH).
14. Create and edit DCI blocks for all device I/O points to be processed. Refer to Con-
figuring DCI Blocks for Points on page 18.
15. Verify slave I/O data using the Block Detail displays. From the I/A Series FoxSelect
compound/block overview utility, access the Block Detail display for each DCI block
you created and confirm its data. Refer to Process Operations and Displays (B0700BN)
for instructions.
16. Checkpoint the database. For details, refer to System Management Displays (B0193JC),
I/A Series Configuration Component (IACC) Users Guide (B0400BP), or Integrated
Control Configurator (B0193AV).
Figure 3-1 shows the flow diagram indicating the sequence of operation:
8
3. Configuration and Download Instructions B0700BG Rev B
Start
2 8 Enable 13
Connect Field Place FBMs and
Communication with
Devices to TA/FBM(s) FCMs (if present)
Each Field Device
On-line
Create, if required, 5 16
Enable Port 11 Checkpoint the
an ECB210 for
on which the Device Database
FCM Hosting FBMs
is Connected
Figure 3-1. Typical Sequence for Installing and Configuring the I/A Series System with FDSI
9
B0700BG Rev B 3. Configuration and Download Instructions
Port Configuration
For FBMs connected to Modbus devices, you must use the FDSI Configurator to create or mod-
ify a port configuration file for the desired FDSI FBM(s). For general instructions on creating and
modifying a new or existing port configuration file using the FDSI Configurator, refer to the sec-
tion titled Port and Device Configuration Files in Field Device System Integrators
(FBM230/231/232/233) Users Guide (B0700AH).
The Modbus Master driver installation process installs four example XML port configuration
files. The files are described below:
EtherPort.xml Example of an FBM232 DHCP-enabled Ethernet configuration.
SerPort.xml Example of an FBM230, 4-port serial configuration. Each port is con-
figured at 9600 baud, no parity, and 1 stop bit.
RedEther.xml Example of an FBM233 DHCP-enabled redundant Ethernet
configuration.
RedSerial.xml Example of an FBM231 redundant 4 port serial configuration. Each
port is configured at 9600 baud, no parity, and 1 stop bit.
No_DHCP.xml Example of an FBM232 non-DHCP enabled Ethernet
configuration.
The following subsections provide configuration details specific to configuring and modifying a
Modbus Master driver port configuration file. The first subsection describes modifying a port
configuration file for a serial FBM (FBM230/231), and the second describes modifying a port
configuration file for an Ethernet FBM (FBM232/233).
10
3. Configuration and Download Instructions B0700BG Rev B
NOTE
In RS-485 configurations, these configuration settings apply to all devices con-
nected to the port.
11
B0700BG Rev B 3. Configuration and Download Instructions
12
3. Configuration and Download Instructions B0700BG Rev B
NOTE
After saving, you must manually copy the file to the usr\fox\sp\files\devices direc-
tory of the I/A Series host boot workstation.
13
B0700BG Rev B 3. Configuration and Download Instructions
Figure 3-4. I/A Series Control Database Configuration for Use with the Modbus Master Driver
on an FBM232 and an FCP270 or ZCP270
Configuring an ECB200/ECB202
For each FDSI FBM, you must configure an ECB200 or ECB202. For a non-redundant FDSI
FBM, you must configure one ECB200. For each redundant FDSI FBM in a redundant pair, you
must configure an ECB202.
Refer to the section titled Control Block Configuration Information in Field Device System Inte-
grators (FBM230/231/232/233) Users Guide (B0700AH) for basic instructions to configure an
ECB200.
Perform the following steps in the ECB200/202 to specifically configure Modbus installations:
Set the FILEID parameter to the name of the port configuration file
(<file name>.xml).
Set the SFILID to the driver filename (MODBUS.ZIPH).
Table 3-2 and Table 3-4 describe the required parameter settings for configuration of an ECB200
or ECB202 for use with an FDSI FBM running the Modbus Master driver:
14
3. Configuration and Download Instructions B0700BG Rev B
Parameter
Name Setting Description
NAME * Contains the name used by the CP to access this ECB.
TYPE ECB200 Type of the block
DEV_ID FCM10X The DEV_ID parameter is a 6-character identifier of the
FBM, with the last two characters representing the base-
plate positions 00 to 08.
When the FBM is controlled by a ZCP270, the first four
characters of DEV_ID should be the same as the first
four characters of the associated FCM100Ets DEV_ID.
When the FBM is controlled by an FCP270, the first
four characters can be any characters.
HWTYPE 230/232 FBM230: 230 (non-redundant serial)
FBM232: 232 (non-redundant Ethernet)
SWTYPE 230/232 Same as HWTYPE
PORTEX * FBM230: The valid range is 1 through 15, represent-
ing the bit mask of the ports present. Refer
to Table 3-3.
FBM232: 1
FILEID * Set FILEID to the filename of the port configuration
XML file.
SFILID MODBUS.ZIPH Set the SFILID to the name of the downloadable driver
for Modbus, MODBUS.ZIPH.
The following table provides useful PORTEX parameter values that can be configured for the
FBM230 and FBM231 (serial FBMs) and their meanings. The PORTEX parameter defaults to 0,
but the valid range is 1 to 15. Make sure you set the PORTEX parameter to a value between 1 and
15.
15
B0700BG Rev B 3. Configuration and Download Instructions
Parameter
Name Setting Description
NAME * Contains the name used by the CP to access this ECB.
TYPE ECB202 Type of the block
DEV_ID FCM10X The DEV_ID parameter is a 6-character identifier of the
FBM, with the last two characters representing the base-
plate positions 0A to 0D.
When the FBM is controlled by a ZCP270, the first four
characters of DEV_ID should be the same as the first
four characters of the associated FCM100Ets DEV_ID.
When the FBM is controlled by an FCP270, the first
four characters can be any characters.
HWTYPE 231/233 FBM231: 231 (redundant serial)
FBM233: 233 (redundant Ethernet)
SWTYPE 231/233 Same as HWTYPE
PORTEX * FBM231: The valid range is 1 through 15, represent-
ing the bit mask of the ports present. Refer
to Table 3-3 above.
FBM233: 1
FILEID * Set FILEID to the filename of the port configuration
XML file.
SFILID MODBUS.ZIPH Set the SFILID to the name of the downloadable driver
for Modbus, MODBUS.ZIPH.
Device Configuration
Device configuration for the Modbus Master driver is performed entirely in DCI blocks. There
are no device configuration files required or used by the driver. Once you have configured DCI
blocks, the driver builds the required Modbus scan transactions to transfer data.
You can use the IOM_ID parameter to associate a DCI block with a specific device. The DCI
block must have the Compound:block name of the device ECB (ECB201).
Configuring an ECB201
Configure an ECB201 for each Modbus device that needs to be connected. Refer to the section
titled Control Block Configuration Information in Field Device System Integrators
(FBM230/231/232/233) Users Guide (B0700AH) for detailed instructions to configure an
ECB201. Table 3-5 describes the required parameter settings for configuration of an ECB201:
16
3. Configuration and Download Instructions B0700BG Rev B
Parameter
Name Setting Description
NAME * The name of the block.
TYPE ECB201 Type of the block.
DEV_ID PLCName The device ID.
HWTYPE 230/231/232/233 Same as parents HWTYPE.
SWTYPE 230/231/232/233 Same as parents SWTYPE.
PARENT * The name of this devices parent ECB200 or ECB202, in
<compound_name>:<block_name> format.
DVNAME * FBM230: Modbus Device Address1
FBM231: Modbus Device Address1
FBM232: Modbus IPAddress
The Modbus devices address2 can be speci-
fied in the DVOPTS field.
FBM233: Modbus MainIP;TrackerIP
Example: 152.155.190.34;152.155.190.35
The Modbus devices address can be specified
in the DVOPTS field.
DVOPTS MODBUS The name of the protocol plus any required options. This
parameter is only applicable for FBM232/233. The
FBM230/231 protocols and options are defined in the
port configuration XML file. Refer to Configuring the
DVOPTS Parameter below.
PORTNO * FBM230/231: 1 to 4
FBM232/233: 1
1.
The valid range for a Modbus device address in the DVNAME parameter is 1 to 254.
2. Device address in this document is the same as Unit Identifier in the Open Modbus/TCP Speci-
fication (see page xii). The default device address is 255. Some devices ignore the device address.
17
B0700BG Rev B 3. Configuration and Download Instructions
NOTE
In the example above, the DVOPTS protocol and options require 29 characters in
the DVOPTS field. Only 31 characters are available. If a string of required options
is configured that uses more than 31 characters, the standard Modbus Ethernet
driver cannot support this. A custom Modbus Ethernet driver will be required.
18
3. Configuration and Download Instructions B0700BG Rev B
information about specifying the data types, swapping, and mirroring options is described in
Memory Allocation and Data Types on page 25.
The block types that the FBM supports are discussed in the following subsections, as well as their
parameter configurations.
19
B0700BG Rev B 3. Configuration and Download Instructions
20
3. Configuration and Download Instructions B0700BG Rev B
Parameter
Name Setting Description
NAME pointName The name of the point.
TYPE PLSOUT Defines the block as a pulse output block
IOM_ID * The name of the associated ECB201.
CO1_PT, * Address of the pulse input or output.
CO2_PT Example of 5-digit address: 00001.
Example of 6-digit address: 000001.
21
B0700BG Rev B 3. Configuration and Download Instructions
22
4. Principles of Operation
This chapter provides an overview of the operation of the Modbus Master driver interfacing an
I/A Series system to Modbus devices.
After you configure the appropriate DCI blocks and ECBs using a control configurator such as
ICC, make sure that all ECBs are ONLINE and NOT FAILED (white) in SMDH, and enable
device communication from SMDH, the FDSI starts sending scan messages to the Modbus
device. The FDSI waits for responses from the device, processes the responses, and updates I/O
points in the control processor (CP). In the case of the FBM232/233 using TCP/IP communica-
tion, the FBM runs as a TCP client and establishes a connection with the server in the device
before sending request messages.
Please refer to Chapter 6 Modbus Protocol for descriptions of the message format for all mes-
sages between the Modbus device and the FDSI.
In the redundancy case, the FBM231 or 233 each communicate independently with the Modbus
device via their respective communication connection (serial or Ethernet). When the FBM run-
ning as master fails because it loses communication with at least one Modbus device, it checks the
status of the tracker FBM. If the tracker FBMs status is good, the master FBM requests a role
switch, causing the tracker to become the new master, and the master to become the new tracker.
Refer to Failover on page 39 for additional information on role switching in redundant
configurations.
23
B0700BG Rev B 4. Principles of Operation
3. Once the Soft Download is complete (the FBM is ONLINE - NOT FAILED), per-
form a DB Download to install the port configuration XML file.
During this operation, the FBM equipment information page should indicate DCI
NOT READY. When the download completes, the equipment information page indi-
cates DCI READY, and the FBM changes color on the display. In most instances, the
FBM is yellow because the ECB201s are not active yet.
For more details on SMDH equipment change actions, and equipment information pages, refer
to the Maintenance chapter in Field Device System Integrators (FBM230/231/232/233) Users
Guide (B0700AH).
Modbus Driver
Modbus Master driver operations include the creation of scan query request messages based on
contiguous DCI input block PNT_NO addresses. Up to 124 registers (16-bit) can be read in one
Modbus message transaction. Output query messages are constructed on a change-driven basis.
The driver selects between Modbus functions 5 and 15 and between 6 and 16 based on whether it
has multiple values to write or only one value to write.
24
4. Principles of Operation B0700BG Rev B
ECB201 Operation
The device ECBs must be ENABLED to communicate. By default they are disabled when first
created. Use the SMDH Equipment Change display and select the ENABLE COMMUNICATIONS pick.
Once the Enable Communications action takes place, the Equipment Information display for
the ECB201 indicates DCI READY and if heartbeats have been configured, those messages transmit
once or twice. Assuming that good replies to the heartbeat messages are received from the Mod-
bus device, the Modbus query messages start and the heartbeats stop. The presence of the query
messages indicates that some DCI input blocks have been configured in the host CP for this
device. If heartbeats have not been configured a query message is transmitted instead.
These message transactions are transparent to the user. When the interface is working correctly,
the ECBs are ONLINE - NOT FAILED (white in SMDH). The associated DCI input blocks go out
of the OOS (cyan) state.
Table 4-1. Data Types and Memory Allocation for Modbus Devices
If you attempt to configure blocks with addresses outside the valid ranges shown in Table 4-1, the
driver reports the error invalid connection in the point depicted in the FoxView default dis-
play.
Table 4-2 and Table 4-3 shows the DCI blocks supported, the 5-digit (Table 4-2) and 6-digit
(Table 4-3) Modbus register addresses that could be used for each block type, and the correspond-
ing function codes used in the protocol. To configure the address, set the PNT_NO parameter of
the DCI block equal to the address in the Modbus device printed range.
25
B0700BG Rev B 4. Principles of Operation
Table 4-2. DCI Blocks, Modbus Register Addresses, and Function Codes
with 5-Digit Addressing
Modbus Device
Printed Address Modbus Protocol
DCI Block Range Address Range Modbus Function Code
BIN/PAKIN 00001-09999 0-9998 1
BIN/PAKIN 10001-19999 0-9998 2
BINR 00001-09999 0-9998 1
BINR 10001-19999 0-9998 2
BOUT/ 00001-09999 0-9998 5 or 15 for write;
PAKOUT/ 1 for read
PLSOUT
IIN 30001-39999 0-9998 4
RIN 30001-39999 0-9998 4
RINR 30001-39999 0-9998 4
PAKIN 30001-39999 0-9998 4
IIN 40001-49999 0-9998 3
IOUT 40001-49999 0-9998 6 or 16 for write;
3 for read
RIN 40001-49999 0-9998 3
RINR 40001-49999 0-9998 3
ROUT 40001-49999 0-9998 16 for write;
3 for read
PAKIN 40001-49999 0-9998 3
PAKOUT 40001-49999 0-9998 6 or 16 for write;
3 for read
Table 4-3. DCI Blocks, Modbus Register Addresses, and Function Codes Z
with 6-Digit Addressing
Modbus Device
Printed Address Modbus Protocol
DCI Block Range Address Range Modbus Function Code
BIN/PAKIN 000001-065536 0-65535 1
BIN/PAKIN 100001-165536 0-65535 2
BINR 000001-065536 0-65535 1
BINR 100001-165536 0-65535 2
BOUT/ 000001-065536 0-65535 5 or 15 for write;
PAKOUT/ 1 for read
PLSOUT
IIN 300001-365536 0-65535 4
26
4. Principles of Operation B0700BG Rev B
Table 4-3. DCI Blocks, Modbus Register Addresses, and Function Codes Z
with 6-Digit Addressing (Continued)
Modbus Device
Printed Address Modbus Protocol
DCI Block Range Address Range Modbus Function Code
RIN 300001-365536 0-65535 4
RINR 300001-365536 0-65535 4
PAKIN 300001-365536 0-65535 4
IIN 400001-465536 0-65535 3
IOUT 400001-465536 0-65535 6 or 16 for write;
3 for read
RIN 400001-465536 0-65535 3
RINR 400001-465536 0-65535 3
ROUT 400001-465536 0-65535 16 for write;
3 for read
PAKIN 400001-465536 0-65535 3
PAKOUT 400001-465536 0-65535 6 or 16 for write;
3 for read
Data Conversions Between the Device and the I/A Series System
For devices that have data type formats that are different from the I/A Series system, the driver
provides several features that can be configured to facilitate conversion of the device data type to
I/A Series and vice versa.
You need to be aware of data representation in the device, the byte order used in the Modbus pro-
tocol, and the byte order used in the I/A Series system. If the default settings do not provide data
in I/A Series (as seen in default displays) in the same format as the device, you must configure the
appropriate byte swapping and/or bit mirroring, or bit swapping.
The sections below describe the byte swapping (W1, W2, and W3) and bit swapping options for
the following data types:
U2: unsigned 16-bit integer
U4: unsigned 32-bit integer
S2: signed 16-bit integer
S4: signed 32-bit integer
F4: 32-bit floating point value (IEEE single precision float).
These data types are described further in Data Types for DCI Input/Output Blocks on page 32.
27
B0700BG Rev B 4. Principles of Operation
Byte Swapping Options for Data Types U2, U4, S2, S4, and F4
The supported byte swapping specifications, W1, W2, and W3, are described below:
Table 4-4. Byte Swapping Options for Data Types U2, U4, S2, S4, and F4
Specifying W2 or W3 with a 2-byte data type should result in an undefined block with an invalid
data connection error.
Bit Mirroring Option for Data Types U2, U4, S2, S4, and F4
There is a bit mirroring specifier: M1. M1 specifies that bit mirroring will be performed for each
byte individually, for example, [bit 7 | ... | bit 0] is mirrored to [bit 0 | ... | bit 7].
28
4. Principles of Operation B0700BG Rev B
Register Order\
Endianness Upper Register First Lower Register First
Little Endian W1 W2
Big Endian W3 Default
Also, as in the case of reading a single register, if bytes are transmitted LSB (least significant bit)
first, use the M1 option in PNT_NO. The default case expects the byte to be transmitted by
the device MSB first.
Example 1: Single-register access with data in Modbus message in big endian format
IIN with PNT_NO 30001:U2
Data in device: 13000 (32C8 hex)
Data in Modbus message in big endian format:
Data Hi 32
Data Lo C8
Default 2-byte format
Data after default processing in FDSI: 32C8
Data in CP: 13000 (32C8 hex)
Example 2: Single-register access with data in Modbus message in little endian format
IIN with PNT_NO 30001:U2
Data in device: 13000 (32C8 hex)
Data in Modbus message in little endian format:
Data Hi C8
Data Lo 32
Data after default processing in FDSI: C832
Data in CP: 51250 (C832 hex)
To fix this, use PNT_NO 30001:U2:W1
Data in FDSI after W1 application: 32C8
Data in CP: 13000 (32C8 hex)
Example 3: Single-register access with data in Modbus message in little endian format, and the
LSB (least significant bit) of a byte is sent out first
IIN with PNT_NO 30001:U2
Data in device: 13000 (32C8 hex)
Data in Modbus message:
Data Hi 13
Data Lo 4C
Note that 13 (00010011) is the mirror image of C8 (11001000) and 4C (01001100)
is the mirror image of 32 (00110010).
Data after default processing in FDSI: 134C
29
B0700BG Rev B 4. Principles of Operation
Example 4: Two-register access with lower register followed by upper register, and register
data sent out in big endian format
IIN with PNT_NO 30001:S4
Data in device: 4-byte value 1538732744 (5BB732C8 hex)
Register 30001: 13000 (32C8 hex)
Register 30002: 23479 (5BB7 hex)
Data in Modbus message: Lower register followed by upper register, and register data
sent out in big endian format:
Data Hi (Register 30001) 32
Data Lo (Register 30001) C8
Data Hi (Register 30002) 5B
Data Lo (Register 30002) B7
Data after default processing in FDSI: 5BB732C8
Data in CP: 1538732744 (5BB732C8 hex)
Example 5: Two-register access with upper register followed by lower register, and register
data sent out in little endian format
IIN with PNT_NO 30001:S4
Data in device: 4-byte value 1538732744 (5BB732C8 hex)
Register 30001: 13000 (32C8 hex)
Register 30002: 23479 (5BB7 hex)
Data in Modbus message: upper register followed by lower register, and register data
sent out in little endian format.
Data Hi (Register 30002) B7
Data Lo (Register 30002) 5B
Data Hi (Register 30001) C8
Data Lo (Register 30001) 32
Data after default processing in FDSI: C832B75B
Data in CP: -936200357 (C832B75B hex)
To fix this, use IIN with PNT_NO 30001:S4:W1
Data in FDSI after W1: 5BB732C8
Data in CP: 1538732744 (5BB732C8 hex)
30
4. Principles of Operation B0700BG Rev B
Example 6: Two-register access with upper register followed by lower register, and register
data sent out in big endian format
IIN with PNT_NO 30001:S4
Data in device: 4-byte value 1538732744 (5BB732C8 hex)
Register 30001: 13000 (32C8 hex)
Register 30002: 23479 (5BB7 hex)
Data in Modbus message: upper register followed by lower register, and register data
sent out in big endian format.
Data Hi (Register 30002) 5B
Data Lo (Register 30002) B7
Data Hi (Register 30001) 32
Data Lo (Register 30001) C8
Data after default processing in FDSI: 32C85BB7
Data in CP: 851991479 (32C85BB7 hex)
To fix this, use IIN with PNT_NO 30001:S4:W3
Data in FDSI after W3: 5BB732C8
Data in CP: 1538732744 (5BB732C8 hex)
Example 7: Two-register access with lower register followed by upper register. Register data
sent out in little endian format, with LSB of a byte sent out first
IIN with PNT_NO 30001:S4
Data in device: 4-byte value 1538732744 (5BB732C8 hex)
Register 30001: 13000 (32C8 hex)
Register 30002: 23479 (5BB7 hex)
Data in Modbus message: lower register followed by upper register. Register data is
sent out in little endian format. Also, LSB of a byte is sent out first.
Data Hi (Register 30001) 13
Data Lo (Register 30001) 4C
Data Hi (Register 30002) ED
Data Lo (Register 30002) DA
Note that 13 is the mirror image of C8, 4C is the mirror image of 32, ED is the mir-
ror image of B7, and DA is the mirror image of 5B.
Data after default processing in FDSI: EDDA134C
Data in CP: -304475316 (EDDA134C hex)
To fix this, use IIN with PNT_NO 30001:S4:W2:M1
Data in FDSI,
after W2: DAED4C13
after M1 (mirroring at the byte level): 5BB732C8
Data in CP: 1538732744 (5BB732C8 hex).
31
B0700BG Rev B 4. Principles of Operation
Example 1: If you specified C13 with R, the first 13 bits of the Modbus 16-bit transfer are
swapped [bit 13 ... bit 1] and put into the first 13 bits of the I/A Series word. All other bits of the
word are zero.
Example 2: If you specified C23 with R, the 16 bits of the first Modbus 16-bit transfer and the
first seven bits of the next Modbus 8-bit transfer are swapped to [bit 23 ... bit 1] and put into the
first 23 bits of the I/A Series word. All other bits of the word are zero.
Default Data
DCI Block Device Data Type Swapping Options Type
IIN, IOUT S2 or U2 W1 S2
S4 W1, W2, or W3 S2
RIN, RINR, ROUT F4, S2, S4, or U2 W1, W2, or W3 F4
BIN, BINR, BOUT N/A N/A Binary Value
PAKIN Cx R C32
in Coils (0x) and Input (C1 to C32 allowed)
Status (1x)
PAKIN S2 or U2 W1 U4
in Holding (4x) and S4 or U4 W1, W2, or W3 U4
Input (3x) Registers
PAKOUT Cx R C32
in Coils (0x) (C1 to C32 allowed)
PAKOUT S2 or U2 W1 U4
in Holding Registers S4 or U4 W1, W2, or W3 U4
(4x)
32
4. Principles of Operation B0700BG Rev B
The Modbus driver supports three types of swap options. Swap here refers to a change in the
byte order in the DCI blocks compared to the byte order in the Modbus device.
The input DCI block default condition (no swapping specified) presents the data in the block as
it normally appears in the Modbus device. The output DCI block default condition (no swapping
specified) presents the data to the Modbus device in the byte arrangement that the device expects.
For PAKIN/PAKOUT blocks in Coils or Input Status, the driver supports bit mirroring (swap-
ping of all bits so that the least significant bits become the most significant bits).
If the data type is two bytes (16 bits) with U2 or S2, option W1 in Table 4-4 is supported. If the
data type is 4 bytes (32 bits) with U4, S4, or F4, then swap options W1, W2, and W3 are
supported.
Refer to the following sections for additional details on byte swapping, mirroring, and bit swap-
ping options:
Byte Swapping Options for Data Types U2, U4, S2, S4, and F4 on page 28
Bit Mirroring Option for Data Types U2, U4, S2, S4, and F4 on page 28
Bit Swapping Options for Coils or Input Status Data Type on page 32
Data Types and ranges for the DCI block data types are:
U2: 2-byte unsigned integer (register). Range is 0 to 65535.
U4: 4-byte unsigned integer (two consecutive registers). Range is 0 to 4294967295
S2: 2-byte signed integer (register). Range is -32768 to +32767
S4: 4-byte signed integer (two consecutive registers). Range is -2147483647 to
+2147483646.
F4: 4-byte floating point value (two consecutive registers). IEEE single precision float.
PAKIN/PAKOUT Blocks
Usage in Coils and Input Status
When Modbus Register addresses are in the 0x (Coils) section and the 1x (Input Status) section,
use the Cx option when defining the register address.
Examples:
33
B0700BG Rev B 4. Principles of Operation
34
4. Principles of Operation B0700BG Rev B
Heartbeat
The heartbeat message is used to detect a loss of communication with the Modbus device. The
driver allows the FBM to send a query with Function Code 8 to the device if no I/O points that
need to be scanned are entered from the CP.
NOTE
Function Code 8 is supported for data diagnostic code only.
To configure the heartbeat in an FBM232 or FBM233 (single or redundant Ethernet), specify the
option in the DVOPTS parameter. See Configuring the DVOPTS Parameter on page 17 for
procedures.
To configure the heartbeat in an FBM230 or FBM231 (single or redundant serial), configure the
driver name parameter in the port configuration file with the option. See Creating/Modifying a
Port Configuration File for FBM230/231 on page 10 for procedures.
35
B0700BG Rev B 4. Principles of Operation
36
5. Error Handling
This chapter describes error handling for the Modbus Master FDSI Driver.
37
B0700BG Rev B 5. Error Handling
38
5. Error Handling B0700BG Rev B
Failover
The FBM231/233s each communicate independently with the Modbus device via their respective
connections. When the FBM running as Master fails to communicate with a device, it checks the
status of the Tracker module. If the Tracker is communicating with all devices, the Modbus driver
initiates a role switch, where the Master becomes the Tracker and the Tracker becomes the new
Master. If the present Trackers device communication error condition clears up, and the new
Master encounters a failure on one of its devices, the Modbus driver initiates a role switch.
A user can force a role switch via the SMDH equipment change action, even if the Tracker has a
failed device. If a role switch is forced by SMDH and the Tracker has one failed device but the
Master has none, the role switch does occur; however, the Modbus Master driver internally senses
that the new Tracker has no failed devices and initiates a second role switch, so that the FBM with
no failed devices becomes the Master again.
When a role switch occurs due to a failed device on one FBM, and the condition subsequently
clears up so that the device is communicating properly again, an automatic role switch does not
occur. If you want the current Tracker module to become the Master, you must force a role
switch via SMDH or perform an SMDH RESET change action on the current Master module.
During normal operations and assuming the Main (left) FBM is the Master, page 3 of the
ECB201s Equipment Information display indicates Main Port Active, Dual Ported. When a
device fails on the Master FBM, SMDH changes the ECB colors from White to Yellow. Page 2 of
the Equip Info displays System Error and page 3 indicates:
Main Port Failed
Bkup Port Active (indicates that the backup FBM is Master)
Dual Ported.
The System Alarm log will indicate Role Switch due to Driver Request.
If both FBMs experience a failure that would cause an ECB201 to fail simultaneously, page 3 of
the ECB201 Equipment Information display shows:
Main Port Failed
Bkup Port Failed
Bkup Port Active (indicates that the backup FBM is Master)
Dual Ported.
39
B0700BG Rev B 5. Error Handling
Efficiency of the database (scattered registers require more Modbus transactions to ser-
vice them all). This should be a primary consideration with baud rates below 38.4k.
Update speed: Scan rate has a minimum value of 100 ms and no maximum value.
The default scan rate is 500 ms. A general idea of the update rate can be calculated by
determining the sum of the following times:
Determine the number of messages and the length (in bytes) of how many mes-
sages are required. Both pieces of information can be determined from the details
of the database (which registers are used) and the published Modbus specification.
Calculate the time for each message at the baud rate selected. For example, at
9600 baud, 1 byte requires about 1 ms. According to the calculation, a 20 byte
message requires about 20 ms. Add the times of all of the Modbus messages to get
the amount of time required to pass all of the Modbus messages to a device.
The turn-around-time of a PLC is between 10 and 20 ms. Modern PLC devices
may have a faster turn-around-time. However, this may vary in actual use depend-
ing on how busy the device is. Add this time to each message.
The turn-around time of the driver is processor dependent, but is generally about
5 ms for the FDSI. Add 5 ms to each message.
Refer to Field Control Processor 270 (FCP270) Sizing Guidelines and Excel Workbook (B0700AV)
and Z-Module Control Processor 270 (ZCP270) Sizing Guidelines and Excel Workbook (B0700AW)
for details on performance loading.
40
6. Modbus Protocol
This chapter discusses the Modbus communication protocol including its options, supported
function codes, memory allocation and data types, operation, and exception codes that you may
encounter.
Function
Code Function Name Description
1 Read Coil Status Reads the ON/OFF status of discrete
outputs (0x references, coils)
2 Read Input Status Reads the ON/OFF status of discrete
inputs (1x references)
3 Read Holding Regis- Reads the binary contents of holding
ters registers (4x references).
4 Read Input Registers Reads the binary contents of input reg-
isters (3x references)
5 Force Single Coil Forces a single coil (0x reference) to
either ON or OFF
6 Preset Single Register Presets a value into a single holding
register (4x reference).
8 Diagnostic Sub Function 00 only
15 Force Multiple Coils Forces each coil (0x reference) in a
sequence of coils to either ON or OFF.
16 Preset Multiple Regs Presets values into a sequence of hold-
ing registers (4x references).
41
B0700BG Rev B 6. Modbus Protocol
NOTE
Device address may also be referred to as station address for serial protocols.
For Example:
Read 1 coil at reference 0 (00001 in Modicon 984 unit 5)
RTU format:
05 01 00 00 00 01 XX
where:
XX represents CRC byte 1 and CRC byte 2.
A Modbus ASCII message format is similar to RTU format, except that the values are hex-ascii
and Start of Message (:)/LRC, End of message (CR LF) characters are used to wrap the protocol.
Using the example above:
Read 1 coil at reference 0 (00001 in Modicon 984 unit 5)
ASCII format:
: 0 5 0 1 0 0 0 0 0 0 0 1 X X CR LF
where:
X X represents LRC byte 1 and LRC byte 2.
In RTU format, the example requires just 7 bytes. In ASCII it requires 17 bytes.
The following function code examples do not include the device address or the CRC bytes.
42
6. Modbus Protocol B0700BG Rev B
Request
Byte 0: FC = 01
Byte 1-2: Reference number
Byte 3-4: Bit count (1-2000)
Response
Byte 0: FC = 01
Byte 1: Byte count of response (B=(bit count+7)/8)
Byte 2-(B+1): Bit values (least significant bit corresponds to the first coil requested)
Exceptions
Byte 0: FC = 81 (hex)
Byte 1: exception code = 01 or 02
Example
Read 1 coil at reference 0 (00001 in Modicon 984) resulting in value 1:
01 00 00 00 01 => 01 01 01
Note that the format of the return data is not consistent with a big-endian architecture. Note also
that this request can be very computation-intensive on the slave if the request calls for multiple
words and they are not aligned on 16-bit boundaries.
Request
Byte 0: FC = 02
Byte 1-2: Reference number
Byte 3-4: Bit count (1-2000)
Response
Byte 0: FC = 02
Byte 1: Byte count of response (B=(bit count+7)/8)
Byte 2-(B+1): Bit values (least significant bit corresponds to the first coil requested)
Exceptions
Byte 0: FC = 82 (hex)
Byte 1: exception code = 01 or 02
Example
Read 1 discrete input at reference 0 (10001 in Modicon 984) resulting in value 1:
02 00 00 00 01 => 02 01 01
43
B0700BG Rev B 6. Modbus Protocol
Note that the format of the return data is not consistent with a big-endian architecture. Note also
that this request can be very computation-intensive on the slave if the request calls for multiple
words and they are not aligned on 16-bit boundaries.
Request
Byte 0: FC = 03
Byte 1-2: Reference number
Byte 3-4: Word count (1-125)
Response
Byte 0: FC = 03
Byte 1: Byte count of response (B=2 x word count)
Byte 2-(B+1): Register values
Exceptions
Byte 0: FC = 83 (hex)
Byte 1: exception code = 01 or 02
Example
Read 1 register at reference 0 (40001 in Modicon 984) resulting in value 1234 hex:
03 00 00 00 01 => 03 02 12 34
Request
Byte 0: FC = 04
Byte 1-2: Reference number
Byte 3-4: Word count (1-125)
Response
Byte 0: FC = 04
Byte 1: Byte count of response (B=2 x word count)
Byte 2-(B+1): Register values
Exceptions
Byte 0: FC = 84 (hex)
Byte 1: exception code = 01 or 02
Example
Read 1 input register at reference 0 (30001 in Modicon 984) resulting in value 1234 hex:
04 00 00 00 01 => 04 02 12 34
44
6. Modbus Protocol B0700BG Rev B
Request
Byte 0: FC = 05
Byte 1-2: Reference number
Byte 3: = FF to turn coil ON, =00 to turn coil OFF
Byte 4: = 00
Response
Byte 0: FC = 05
Byte 1-2: Reference number
Byte 3: = FF to turn coil ON, =00 to turn coil OFF (echoed)
Byte 4: = 00
Exceptions
Byte 0: FC = 85 (hex)
Byte 1: exception code = 01 or 02
Example
Write 1 coil at reference 0 (00001 in Modicon 984) to the value 1:
05 00 00 FF 00 => 05 00 00 FF 00
Request
Byte 0: FC = 06
Byte 1-2: Reference number
Byte 3-4: Register value
Response
Byte 0: FC = 06
Byte 1-2: Reference number
Byte 3-4: Register value
Exceptions
Byte 0: FC = 86 (hex)
Byte 1: exception code = 01 or 02
Example
Write 1 register at reference 0 (40001 in Modicon 984) of value 1234 hex:
06 00 00 12 34 => 06 00 00 12 34
45
B0700BG Rev B 6. Modbus Protocol
Request
Byte 0: FC = 08
Byte 1-2: Subfunction (00)
Byte 3-4: value
Response
Byte 0: FC = 08
Byte 1-2: Subfunction (00)
Byte 3-4: value
The response to Function Code 8 (as used by the FDSI Modbus driver for heartbeat messages) is
a loop-back of the query request.
Request
Byte 0: FC = 0F (hex)
Byte 1-2: Reference number
Byte 3-4: Bit count (1-800)
Byte 5: Byte count (B = (bit count + 7)/8)
Byte 6-(B+5): Data to be written (least significant bit corresponds to the first
coil requested)
Response
Byte 0: FC = 0F (hex)
Byte 1-2: Reference number
Byte 3-4: Bit count
Exceptions
Byte 0: FC = 8F (hex)
Byte 1: exception code = 01 or 02
Example
Write 3 coils at reference 0 (00001 in Modicon 984) to values 0,0,1:
0F 00 00 00 03 01 04 => 0F 00 00 00 03
Note that the format of the input data is not consistent with a big-endian architecture. Note also
that this request can be very computation-intensive on the slave if the request calls for multiple
words and they are not aligned on 16-bit boundaries.
46
6. Modbus Protocol B0700BG Rev B
Request
Byte 0: FC = 10 (hex)
Byte 1-2: Reference number
Byte 3-4: Word count (1-100)
Byte 5: Byte count (B=2 x word count)
Byte 6-(B+5): Register values
Response
Byte 0: FC = 10 (hex)
Byte 1-2: Reference number
Byte 3-4: Word count
Exceptions
Byte 0: FC = 90 (hex)
Byte 1: exception code = 01 or 02
Example
Write 1 register at reference 0 (40001 in Modicon 984) of value 1234 hex:
10 00 00 00 01 02 12 34 => 10 00 00 00 01
01 ILLEGAL FUNCTlON
The function code received in the query is not an allowable action for the
slave. This may be because the function code is only applicable to newer
controllers, and was not implemented in the unit selected. It could also
indicate that the slave is in the wrong state to process a request of this
type, for example because it is unconfigured and is being asked to return
register values.
47
B0700BG Rev B 6. Modbus Protocol
48
7. Troubleshooting
This chapter describes troubleshooting problems with the FDSI driver for Modbus devices.
The document Field Device System Integrators (FBM230/231/232/233) Users Guide (B0700AH)
includes a table (Table 8-3) that details the corrective actions you can take in response to status
messages that appear in the equipment information pages of the FBMs. In addition, you should
refer to the device documentation provided by the manufacturer to troubleshoot the devices.
If you see constant or intermittent device failure or slowdown, and the device configuration is cor-
rect, you may want to use a serial data analyzer for FBMs 230 and 231 or an Ethernet snooper for
FBMs 232 and 233 to fully analyze any communication problems. Using the data analyzer or
snooper, look at the messages between the device and the FBM and find out if there are any data
communication issues such as parity errors.
Generally speaking, at startup, it is helpful to troubleshoot only one message at a time on a com-
munication link. Often users configure everything and turn everything on at once. When trouble
starts, there is some difficulty in tracking the problem(s) down. One suggestion is to start with a
small database that includes one device and one point. Observe the returned value or troubleshoot
and correct the link. Check each device on the link with one or two points and verify that com-
munication is OK. The heartbeat message is useful to verify the physical layer of the communica-
tion. If the ECB201s are good (white) in SMDH with the heartbeat operational, then the physical
link should be OK. Afterwards, a better test will be with a scan query that asks for 120 values.
Not all Modbus PLC devices respond within the same time limit. A particularly busy PLC may
be slower to respond to queries than a less busy one. This can cause occasional response time-
outs and may fail an ECB201. Be aware of this and tune the response timeout values
accordingly.
You can also check the configuration of the ZIPH and XML filenames in the ECBs. It is easy to
misspell a file name, but difficult to troubleshoot the problems it may cause. This is particularly
the case when an existing driver or XML file is present in the FBM. Also make sure the files exist
in the d:\usr\fox\sp\files\devices directory on the host AW.
Remember: Anytime an SMDH Soft Download action is performed to reload the Modbus driver,
the action causes the FBM to reboot. Soft Download also wipes out any configuration XML files.
So a DB Download action to the FBM must always follow a Soft Download to reload the port
configuration XML file.
49
B0700BG Rev B 7. Troubleshooting
incorrectly, modems can inhibit handshake signals or cut short the transmission of a message
before the end is reached.
A default slave address of 255 (device address) is applied by the FDSI Modbus Master driver when
the DVNAME parameter in particular ECB201 is left blank. This is a broadcast address, which
means that all connected slave devices will respond to the query sent by the master. Be sure to
configure the proper Modbus device slave addresses in the DVNAME parameters. For multidrop
connections (RS-422/RS-485 and so forth), make sure that each ECB201 representing a device in
the drop has the same port number in the PORTNO field of the ECB201.
Performance problems are sometimes caused when a slow slave device does not respond within
the default response time. (The default value of the response timeout varies with the baud rate
configured. See Table 3-1.) You may have to tune the response time in the port configuration
XML file by increasing the response timeout value in the Driver column of the FDSI Port Con-
figurator (see Creating/Modifying a Port Configuration File for FBM230/231 on page 10).
However it is good to minimize message traffic as much as possible between individual devices
and the FBM by trying to make sure that as many values as possible are located in contiguous reg-
ister addresses.
50
7. Troubleshooting B0700BG Rev B
51
B0700BG Rev B 7. Troubleshooting
33 Commercial Street
Foxboro, Massachusetts 02035-2099
United States of America
www.foxboro.com
Inside U.S.: 1-866-746-6477
Outside U.S.: 1-508-549-2424 or contact your local Foxboro representative.
Facsimile: 1-508-549-4999
Printed in U.S.A. 1204