Operating instruction manual

Controller

APM403
Communication in Modbus TCP

10/19/2018 33530066901_0_1
NDF_ 33530066901

CONTENTS

1 Introduction ................................................................................................................................................................................. 2
2 Communication in Modbus TCP ................................................................................................................................................. 2
2.1 Ethernet network ................................................................................................................................................................ 2
2.2 Computer equipped with an Ethernet port .......................................................................................................................... 2
2.3 Connection APM403 side - single electrical generating set ................................................................................................ 2
2.4 Connection APM403 side - power plant generating sets .................................................................................................... 3
2.5 Configuration of the Modbus TCP interfaces ...................................................................................................................... 3
2.6 Connection port .................................................................................................................................................................. 3
2.7 IP address and mask .......................................................................................................................................................... 3
2.7.1 Modbus client interface .................................................................................................................................................. 3
2.7.2 Modbus server interface ................................................................................................................................................ 4
2.7.3 Fixed IP addresses ........................................................................................................................................................ 4
3 Definitions ................................................................................................................................................................................... 4
3.1 Introduction......................................................................................................................................................................... 4
3.2 Physical link and protocol ................................................................................................................................................... 4
4 Modbus protocol ......................................................................................................................................................................... 5
4.1 General presentation .......................................................................................................................................................... 5
4.2 Modbus exchanges ............................................................................................................................................................ 5
4.3 Modbus frames and functions ............................................................................................................................................ 5
4.3.1 Description of a Modbus TCP frame .............................................................................................................................. 5
4.3.2 Modbus functions ........................................................................................................................................................... 6
4.3.2.1 Function 01 (0x01): Read Coils ................................................................................................................................. 6
4.3.2.2 Function 02 (0x02): read binary inputs (Read Discrete Inputs).................................................................................. 7
4.3.2.3 Function 03 (0x03): Read Holding Registers ............................................................................................................. 7
4.3.2.4 Function 04 (0x04): read multiple registers (Read Input Registers) ........................................................................... 7
4.3.2.5 Function 06 (0x06): Write Single Register ................................................................................................................. 8
4.3.2.6 Function 10 (0x016): Write Multiple Registers ........................................................................................................... 8
4.3.2.7 Length of frames ........................................................................................................................................................ 8
4.3.2.8 Error codes and exception codes .............................................................................................................................. 8
5 CM-Ethernet card - Installation, settings and use ....................................................................................................................... 9
5.1 Installation .......................................................................................................................................................................... 9
5.2 Settings .............................................................................................................................................................................. 9
5.2.1 Accessing settings ......................................................................................................................................................... 9
5.2.2 Parameters .................................................................................................................................................................. 10
5.3 Power-on and check ......................................................................................................................................................... 11
6 Information available ................................................................................................................................................................. 11
6.1 Dynamic assignment ........................................................................................................................................................ 11
6.2 Access to the Modbus table ............................................................................................................................................. 12
6.3 Examples ......................................................................................................................................................................... 13
7 Modifying the computer's IP address ........................................................................................................................................ 15

List of figures
figure 1 - star architecture .................................................................................................................................................................... 2
figure 2 - ring architecture .................................................................................................................................................................... 2
figure 3 - crossover Ethernet cable ...................................................................................................................................................... 2
figure 4 - straight Ethernet cable .......................................................................................................................................................... 2
figure 5 - Ethernet TCP/single electrical generating set ....................................................................................................................... 2
figure 6 - power plant electrical generating sets/star pattern................................................................................................................ 3
figure 7 - client/server link .................................................................................................................................................................... 5
figure 8 - Modbus TCP frame............................................................................................................................................................... 5
figure 9 - removing the rear cover ........................................................................................................................................................ 9
figure 10 - fastening pins...................................................................................................................................................................... 9
figure 11 - installed module .................................................................................................................................................................. 9
figure 12 - extract from the Modbus table - ".txt" file .......................................................................................................................... 12

NDF_1014_EN_19/10/2018 17:03 33530066901 1

1 Introduction
This manual describes the use of Modbus TCP communication with the APM403. It is broken down into six parts:
- Linking and communication in Modbus TCP,
- Definitions and use of specific words for data transmission,
- Modbus TCP protocol,
- Installing and configuring the Ethernet module,
- List of available information,
- Examples of using Modbus TCP communication.
Note: this document is applicable to firmware 1.0.0.35 (APM403S) and 1.1.0.9 (APM403P) versions.

2 Communication in Modbus TCP

This section explains how to connect a computer to an Ethernet network(), consisting of one or more APM403s, for
communication in Modbus TCP ().

() Ethernet is a local data transmission network protocol.

() Modbus and TCP (Transmission Control Protocol) are data transmission protocols.

Note: use a minimum category 5e Ethernet cable with a maximum length of 100 m, compatible with the IEC 8802-3, 100 BASE-TX
standard.

2.1 Ethernet network

There are two main Ethernet
architectures:
- the star (figure 1),
- the ring (figure 2).

In our application, we will only use the

star pattern.

figure 1 - star architecture figure 2 - ring architecture

2.2 Computer equipped with an Ethernet port

Point to point connection Network connection

For point to point connection (of one device to another device), For network connection, connect a straight Ethernet cable
connect a crossover type Ethernet cable (figure 3) to the RJ45 (figure 4) to the RJ45 port on the computer.
port on the computer.

figure 3 - crossover Ethernet cable figure 4 - straight Ethernet cable

2.3 Connection APM403 side - single electrical generating set

Connect the crossover cable from the
computer to the RJ45 port of the CM-
Ethernet module (figure 5).

figure 5 - Ethernet TCP/single electrical generating set

2 33530066901 NDF_1014_EN _19/10/2018 17:03

2.4 Connection APM403 side - power plant generating sets
Connect a straight Ethernet cable between
the computer and the input port on the
Ethernet switch (figure 6).

Connect a straight Ethernet cable from

each CM Ethernet module to one of the
RJ45 ports of the switch (figure 6).

Ethernet switch:
- make and model: Phoenix Contact,
2891001,
- 5 points for a maximum of four electrical
generating sets,
- 8 points for a maximum of seven
electrical generating sets.

figure 6 - power plant electrical generating sets/star pattern

2.5 Configuration of the Modbus TCP interfaces

The Modbus client interface is a computer or an industrial programmable logic controller.
The Modbus server interface is an APM403.
The client/server concept is described in paragraph 4.

2.6 Connection port

Depending on the protocol and the type of data to be transmitted, it is assigned a "software port" number. For the Modbus TCP, the
application must be connected to port 502.

2.7 IP address and mask

The IP (Internet Protocol) address is an identification number assigned permanently or temporarily to any system connected to an
Ethernet network. The IP address consists of 4 bytes (IP version 4):

byte 1 . byte 2 . byte 3 . byte 4

Each byte is a number between 0 and 255 (decimal notation). Given the large number of existing IP addresses throughout the
world, 4-byte coding has reached saturation. There is now a 6-byte code (IP version 6).

The IP address is associated with a subnetwork mask (also 4 bytes) which is used to more easily identify the IP address of a
system. Thus a series of APM403s (power plant of n electrical generating sets) will constitute a subnet, accessible from a larger
network. The value of the bytes making up the mask therefore defines the possible size of the subnet.

The table opposite shows whether two APM403s can communicate APM403 #1 APM403 #2 mask
on a network, according to the subnetwork mask. 192.168.1.1 192.168.1.2 255.255.255.0
192.168.10.1 192.168.1.3 255.255.0.0
192.56.72.90 192.63.75.17 255.0.0.0

In practice, the subnetwork mask will be: 255.255.255.0; which means that all the APM403s in a network will have three identical
bytes. Only the last byte distinguishes between the two APM403s.

2.7.1 Modbus client interface

In our case, we will use the following addresses on the computer or PLC side:

IP address 192.168.1.x x different to the x on all APM403s in the network ()

mask 255.255.255.0 therefore allows IP addresses to be assigned for the APM403s. Bytes no. 4 of each
address must be different ()

() see following paragraph for the addresses of the APM403s.

Example: the computer (client) may adopt the following IP address: 192.168.1.1

NDF_1014_EN _19/10/2018 17:03 33530066901 3

2.7.2 Modbus server interface

Opposite, the table of addresses used by the APM403 equipment IP address mask
(to be verified depending on the installation). GS #1 192.168.1.254 255.255.255.0
GS #2 192.168.1.253 255.255.255.0
The server (or APM403) number for the first electrical GS #3 192.168.1.252 255.255.255.0
generating set is 254 by default. GS #4 192.168.1.251 255.255.255.0
This value can be modified by accessing its GS #5 192.168.1.250 255.255.255.0
configuration mode (see paragraph 5.2.2). GS #6 192.168.1.249 255.255.255.0
GS #7 192.168.1.248 255.255.255.0
GS is the abbreviation for Generating Set.
GS #8 192.168.1.247 255.255.255.0
table 1 - IP addresses on APM403

2.7.3 Fixed IP addresses

The fixed IP address is used where the user wants to customize the installation, by using their own IP addresses.

The APM403 is not compatible with fixed IP addresses. Bytes 1, 2 and 3 cannot be modified for insertion in the existing network.

3 Definitions

3.1 Introduction
This paragraph recaps some concepts in information encoding.

Bit : the smallest elementary unit of information representation, the bit has a value of 0 or 1
byte : equals 8 bits
word : is equal to 2 bytes or 16 bits
long : is equal to 2 words or 4 bytes or 32 bits
baud : unit of measurement of data transmission speed, also expressed in bits/second ()
() In our case, speeds expressed in bauds or bits/s (bps) are equal because the signal is bivalent (2 values: 0 or 1).

A byte is a sequence of 8 bits, and is written as follows: 1001 0001 (where each bit has the value 0 or 1). For each byte, this gives
256 different combinations (in binary format: 1111 1111). A word is a series of 16 bits, i.e. 65536 possible values.
In this document, when values or addresses are expressed in hexadecimal, they are always preceded by the symbol "0x". Values
not preceded by any symbol are expressed in decimal.

3.2 Physical link and protocol

The method of communication available on the APM403 consists of two main components:

Data is exchanged in the form of 0s and 1s. The hardware component defines how a 0 and a 1 are represented.
Hardware
The Ethernet link is the medium.

The organization of the 0s and 1s received indicates what message one machine wants to send to another
Software
machine. This "organization" is known as a protocol. In our case, it is the Modbus TCP protocol.

4 33530066901 NDF_1014_EN _19/10/2018 17:03

4 Modbus protocol

4.1 General presentation

The protocol is the way of organizing the data that is exchanged on a physical medium (e.g. Ethernet).

Originally developed using serial transmission interfaces (RS232, RS485), Modbus has become "Modbus TCP" (or "encapsulated
Modbus") for TCP/IP media ()). It is now considered a standard, due to its ease of implementation.
() IP: Internet Protocol

The Modbus protocol is very widely used in the field of industrial communications, in particular in PLCs. The following are the
essential characteristics of the protocol:
- in a network, there are one or more clients (computer, PLC, etc.) and one or more servers (APM403),
- the client always initiates the communication,
- the reading and writing operations between devices are known as "functions".

We talk about "client/server" organization (Ethernet link) (figure 7).

figure 7 - client/server link

For the APM403, the limit is three clients.

4.2 Modbus exchanges

The exchanges are "half-duplex" (transmission followed by reception). No server in TCP mode can send a message without a prior
request from the client. Dialog between servers is not possible.

The dialog sequence is as follows:

1- A request is sent by the client to initiate a transaction,
2- An acknowledgment is sent by the server to confirm that a request has been received,
3- A response is sent by the server to comply with the client's request,
4- A confirmation is sent by the client to acknowledge the response.

The APM403 comprises a single server. It transmits data over the network only if requested by the client.

4.3 Modbus frames and functions

4.3.1 Description of a Modbus TCP frame

The Modbus protocol first defines a PDU (Protocol Data Unit) which consists of a function code and all the data to be exchanged.
To form a complete frame, the PDU is complemented by a prefix known as the MBAP header (ModBus Application Protocol
header) which contains the address to be queried and a check to verify correct data transmission (figure 8).

Modbus TCP ADU

MBAP header function code data

PDU

figure 8 - Modbus TCP frame

The MBAP header comprises 7 bytes, as follows:

name encoded as … description

transaction identifier 2 bytes transaction identifier echoed by the server
protocol identifier 2 bytes protocol identifier (Modbus = 0)
length 2 bytes number of bytes to follow
unit identifier 1 byte unit identifier or server address ()

() is the equivalent of the slave address in Modbus RTU

NDF_1014_EN _19/10/2018 17:03 33530066901 5

 The PDU comprises:
x bytes for the request frame ()
y bytes for the response frame ()
The number of x and y bytes varies depending on the function used (see paragraph 4.3.2 and onwards).

The length of a complete frame is therefore:

7 + x bytes for the request frame
7 + y bytes for the response frame

In the explanations provided in the following paragraphs, only the PDU bytes are described in detail.

4.3.2 Modbus functions

There are 21 Modbus functions. The following functions are implemented in the APM403:

No. description () applicable to … calculation

01 0x01
Read Coils Internal Bits Or Physical Coils Bit access
02 0x02
Read Discrete Inputs Physical Discrete Inputs Bit access
03 0x03
Read Holding Registers Physical Output Registers 16 Bits access
04 0x04
Read Input Registers Physical Input Registers 16 Bits access
06 0x06
Write Single Register Internal Registers or Physical Output Registers 16 Bits access
16 0x010
Write Multiple Registers Internal Registers or Physical Output Registers 16 Bits access

() These terms are used in the document "Modbus application protocol specification", version V1.1b3, available at
www.modbus.org/.

0x prefix used to write the Modbus function in hexadecimal.

4.3.2.1 Function 01 (0x01): Read Coils

 The frame sent by the client to request the value of one or more "coils" is as follows:
MBAP number of coils to
read request information function coil start address
header read [1]
frame
encoded as … 7 bytes 1 byte 2 bytes 2 bytes
[1] The maximum number of coils that can be read is 2000 (0x7D0).

 The response returned by the server is as follows:

MBAP number N of bytes values of the N
information function
response frame header sent bytes read
encoded as … 7 bytes 1 byte 1 byte N x 1 byte
The length of this frame depends on the number N of bytes read:
N = integer part of the quotient obtained by the division [number of inputs/8], if the remainder is zero
N = integer part of the quotient obtained by the division [number of inputs/8], if the remainder is not zero, N = N+1
The maximum number N will be: 2000/8=250

example: read the status of 10 coils, integer part of [10/8] = 1 and remainder not zero,  N = N+1 = 2 bytes
read the status of 32 coils, integer part of [32/8] = 4 and remainder not zero,  N = 4 bytes
read the status of 1 coil, integer part of [1/8] = 0 and remainder not zero,  N = N+1=1 byte

 In case of an error in the frame, see paragraph 4.3.2.8.

6 33530066901 NDF_1014_EN _19/10/2018 17:03

4.3.2.2 Function 02 (0x02): read binary inputs (Read Discrete Inputs)

 The frame sent by the client to request the value of one or more binary inputs is as follows:
MBAP number of inputs
read request information function input start address
header to read [1]
frame
encoded as … 7 bytes 1 byte 2 bytes 2 bytes
[1] The maximum number of inputs that can be read is 2000 (0x7D0).

 The response returned by the server is as follows:

MBAP number N of bytes values of the N
information function
response frame header sent bytes read
encoded as … 7 bytes 1 byte 1 byte N x 1 bytes
The length of this frame depends on the number N of bytes sent:
N = integer part of the quotient obtained by the division [number of inputs/8], if the remainder is zero
N = integer part of the quotient obtained by the division [number of inputs/8], if the remainder is not zero, N = N+1
The maximum number N will be: 2000/8=250

example: read the status of 10 inputs, integer part of [10/8] = 1 and remainder not zero,  N = N+1 = 2 bytes
read the status of 32 inputs, integer part of [32/8] = 5 and remainder not zero,  N = 4 bytes
read the status of 1 coil, integer part of [1/8] = 0 and remainder not zero,  N = N+1 = 1 byte

 In case of an error in the frame, see paragraph 4.3.2.8.

4.3.2.3 Function 03 (0x03): Read Holding Registers

 The frame sent by the client to request the value of one or more registers is as follows:
MBAP start address number N of
read request information function
header of the registers registers to read [1]
frame
encoded as … 7 bytes 1 byte 2 bytes 2 bytes
[1] The maximum number of registers that can be read is 125 (0x7D).
note: 1 register = 1 word = 2 bytes

 The response sent by the server is as follows:

MBAP number of bytes sent (2 value of the N
response information function
header x N) registers read
frame
encoded as … 7 bytes 1 byte 1 byte N x 2 bytes
The length of this frame depends on the number N of registers read.

 In case of an error in the frame, see paragraph 4.3.2.8.

4.3.2.4 Function 04 (0x04): read multiple registers (Read Input Registers)

 The frame sent by the client to request the value of one or more registers is as follows:
MBAP start address number N of
read request information function
header of the registers registers to read [1]
frame
encoded as … 1 byte 1 byte 2 bytes 2 bytes
[1] The maximum number of registers that can be read is 125 (0x7D).
note: 1 register = 1 word = 2 bytes

 The response sent by the server is as follows:

MBAP number of bytes value of the N
response information function
header sent (2 x N) registers read
frame
encoded as … 1 byte 1 byte 1 byte N x 2 bytes
The length of this frame depends on the number N of registers read.

 In case of an error in the frame, see paragraph 4.3.2.8.

NDF_1014_EN _19/10/2018 17:03 33530066901 7

4.3.2.5 Function 06 (0x06): Write Single Register

 The frame sent by the client to be written in a register is as follows:

MBAP value to write
write request information function register address
header in the register
frame
encoded as … 7 bytes 1 byte 2 bytes 2 bytes

 The response returned by the server is as follows:

MBAP
response information function register address register value
header
frame
encoded as … 7 bytes 1 byte 2 bytes 2 bytes
The two values are identical, the response is an "echo" of the write request.

 In case of an error in the frame, see paragraph 4.3.2.8.

4.3.2.6 Function 10 (0x016): Write Multiple Registers

 The frame sent by the client to write in a finite number of registers is as follows:
write MBAP register start number N of registers value to write in the
information function
request header address to write to [1] N registers
frame encoded as … 7 bytes 1 byte 2 bytes 2 bytes N x 2 bytes
[1] The maximum number of registers that can be read is 123 (0x7B).
The length of this frame depends on the number N of registers to be written to.

 The response returned by the server is as follows:

MBAP register start number N of
response information function
header address registers to write to
frame
encoded as … 7 bytes 1 byte 2 bytes 2 bytes

 In case of an error in the frame, see paragraph 4.3.2.8.

4.3.2.7 Length of frames

For all Modbus functions implemented in the APM403, the frame lengths are as follows:

frame type function frame length in bytes (not including the header)
01 5
02 5
read request
03 5
04 5
06 5
write request
16 variable (depends on number N)
01 variable (depends on number of bytes sent)
02 variable (depends on number of bytes sent)
03 variable (depends on number of bytes sent)
response
04 variable (depends on number of bytes sent)
06 5
16 5

4.3.2.8 Error codes and exception codes

In case of an error in the frame, the server issues an error code and an exception code.
server error exception
error information
address code code
frame
encoded as … 1 byte 1 byte 1 byte

The error codes are calculated as follows: function error code

0x01 (01) 81
error code = function code + 0x80 0x02 (02) 82
0x03 (03) 83
0x06 (06) 86
0x10 (16) 90

The table opposite describes the meaning of the exception exception code meaning
codes: 01 Incorrect function code
02 incorrect address
04 processing error

8 33530066901 NDF_1014_EN _19/10/2018 17:03

5 CM-Ethernet card - Installation, settings and use
Implementation comprises three phases:
- Plug-in for the CM-Ethernet module in the APM403,
- Configuration of the CM-Ethernet module,
- Power-on and check.

The CM-Ethernet module (reference 31613811902) is supplied non-assembled in a plastic bag, to reduce the effects of electrostatic
discharges.
Please observe the general advice on handling electronic cards (see appendix to APM403 user manual).

5.1 Installation
The CM-Ethernet module will be installed in APM403 slot B.

1. Remove the rear cover by pressing on the four clips as per the sketch opposite (figure 9).
2. Slide the Ethernet module under the pins  (figure 10).
3. Press gently on the Ethernet module, at the black connector, until it locks onto the pins  with an audible "click" (figure 11).

figure 9 - removing the rear cover figure 10 - fastening pins figure 11 - installed module

4. Refit the rear cover and remove the small plate marked  (slot B side) (figure 9).

5. Connect the Ethernet cable to the RJ45 connector (see paragraphs 2.3 and 2.4).

5.2 Settings

5.2.1 Accessing settings

To modify one of the parameters of the CM-Ethernet module, the APM403 must be in "Advanced" mode.

1. Press and simultaneously from any display screen.

2. Press four times.

3. Select "Advanced" mode with .

4. Press and wait 8 seconds. The main screen is displayed automatically.

NDF_1014_EN _19/10/2018 17:03 33530066901 9

5.2.2 Parameters

1. From the main screen, press ; the "main menu" screen will appear and "Password" is selected.
2. Press as many times as required until "CM-Ethernet" appears.
3. Press to access the menu content.

If it is necessary to enter a password, or to access and modify one or more parameters, refer to paragraph 11 of the APM403
user manual.

List of parameters accessible from the "CM-Ethernet" menu

parameter description default value

E-mail address to which you wish to send the information, to be entered in full
E-mail Address 1 -
(e.g.: jules.dupont@sdmo.com)
E-mail Address 2 E-mail address to which you wish to send the information, to be entered in full. -
E-mail Address 3 E-mail address to which you wish to send the information, to be entered in full. -
E-mail Address 4 E-mail address to which you wish to send the information, to be entered in full. -
Language used for sending SMS and e-mails: depending on the number of
E-Mail/SMS Language English
languages implemented in APM403.
Choice of time difference from Greenwich Mean Time (GMT) :
Time Zone GMT+1:00
GMT+0:00, GMT+1:00, etc …
Event Message Sending "event" messages: Enabled, Disabled Enabled
Wrn Message Sending "alarm" messages: Enabled, Disabled Enabled
BOC Message Sending "emergency stop" messages: Enabled, Disabled Enabled
Sd Message Sending "fault" messages: Enabled, Disabled Enabled

SMTP User Name User name in SMTP mode, to be entered in full () -
SMTP User Password Password in SMTP mode, to be entered in full () -
SMTP Server Address Server address in SMTP mode: airgate.comap.cz:9925 -
SMTP Sender Address Address to be entered in full: donotreply@sdmo.com -
IP Address Mode IP address operation mode: Fixed, Automatic Fixed
IP Address Module IP address 192.168.1.20
Subnetwork mask Subnetwork mask 255.255.255.0
Gateway IP Gateway IP address 192.168.1.1
DNS IP Address 1 ? 8.8.8.8
DNS IP Address 2 ? 4.4.4.4
Modbus Server Activating Modbus server (APM403); Enabled, Disabled Disabled
SNMP Agent Activation ?…. ; Enabled, Disabled Disabled
SNMP RD Community public
-
String
SNMP WR Community private
-
String
SNMP Traps IP ?
Address 1
SNMP Traps IP ?
Address 2
AirGate Connection AirGate connection activation: Enabled, Disabled Enabled
Address of server providing access to Airgate, to be entered in full:
AirGate Address -
airgate.comap.cz
ComAp TCP Port TCP communication port number 23

Please correctly enter the parameters from the table above, except for the three parameters shaded gray, which must not be
modified. Parameters marked with the () symbol should not be entered.

The essential parameters are:

IP Address Mode IP address operation mode: Fixed, Automatic Fixed

IP Address Module IP address 192.168.1.x ()
Modbus Server Activating Modbus server (APM403); Enabled, Disabled Disabled

() x between 247 and 254

4. After correctly entering the parameters, press to go back to the main menu.
5. Press twice to go back to the main screen.

The CM-Ethernet module is configured.

10 33530066901 NDF_1014_EN _19/10/2018 17:03

5.3 Power-on and check
1. Power on the APM403.
When initialization is finished, the APM403 switches automatically to the main screen (figure
opposite).
If the symbol is displayed on the screen, it means that there are one or more anomalies
present. To delete the anomaly/anomalies, refer to paragraph 14.3 of the user manual.

2. Check that slot B has been declared "occupied". From the main screen, press twice to
bring up the "Plug-in Modules" screen. The display must agree with the figure opposite (for
slot B).

Otherwise, slot B must be declared in the "Plug-In Modules" menu (see user manual in
paragraph 11).

Statuses of the Ethernet module LED

green: all OK
red: one or more faults
flashing every
in operation - Ethernet cable not connected
1 second
- the module cannot connect to Airgate
- the module cannot obtain an IP address from DHCP
flashing every green: programming is in progress
programming
0.1 second red: program absent in the Ethernet module

6 Information available
This paragraph contains information available over the Ethernet link. The data is classified by category:

Modbus address description access Modicon type Modbus function

0000 ….. 0999 binary objects read only Discrete Inputs 01, 02
1000 ….. 2999 analog values read only Input Registers 03, 04
read; 03, 04
3000 ….. 3999 settings read/write Holding Registers
write; 06, 16

Examples:
Address 0006 = logic input for the oil pressure sensor, terminal 7 of the APM403 (read)
Address 1054 = analog value for the battery voltage (read)
Address 3008 = nominal power of the GS in kW (read and write)

The above Modbus addresses are expressed in decimal value.

6.1 Dynamic assignment

The Modbus table of the APM403 is not fixed, but assigned dynamically. The content of the Modbus table varies depending on the
type of APM403 (S or P), the module configuration, the number of inputs/outputs used, whether or not the auxiliary I/O modules
(IO8 or EM-BIO8) are used and whether or not an ECU (Engine Control Unit) is connected.
In other terms, an input x at the address a may, depending on the configuration, appear at an address b.

For a specific case, the user must log in with the "Configurator" software (see next paragraph).

NDF_1014_EN _19/10/2018 17:03 33530066901 11

6.2 Access to the Modbus table
Download the Modbus table from the "Configurator" software. "Configurator" is available from the GAIA platform:
- Customers who have received training can access GAIA using a login and password,
- Customers who have not received training should contact Kohler/SDMO.

The APM403 software versions are as follows:

- 1.0.0.35 for APM403S,
- 1.1.0.9 for APM403P.

1 - Connect the APM403 to a computer using an A/B type USB cable.

2 - Power on the APM403.

3 - Open "Configurator" and click on "Connect to controller". 4 - Select the APM403 connected to the PC and click
on "Open".

5 - In the top bar, select "Tools" and click on "Generate Configuration Image".
The "Save As" window opens.

6 - Select the download location (on the computer) for the Modbus table and click on "Save".
The file format is: "cfgmodbus.txt". Once created, the text file (Modbus table) opens automatically (figure 12).

figure 12 - extract from the Modbus table - ".txt" file

The Modbus table is created in the language selected in the "Controller" tab. If necessary, change the language in the "Language"
tab in the top bar.

Organizing the file

File header  general information

"Binaries" table (functions 1 and 2)  logic inputs and outputs

 addresses from 0000 to 0999
"Values" table (functions 3 and 4)  analog measurements
 addresses from 1000 to 2999
"Setpoints" table (functions 3, 4, 6 and 16)  parameters
 addresses from 3000 to 3999

12 33530066901 NDF_1014_EN _19/10/2018 17:03

6.3 Examples
 "Oil Pressure" binary input
The information concerning the "Oil Pressure" binary input is as follows:
- Modbus function: 0x02 (Read Discrete Input),
- address to be queried: 0x0006 (0006 in decimal),
- length of data to be queried: 16 bits or 2 bytes,

The following data items allow the request frame to be created:

start address to number of inputs
information MBAP header function
read from to read
read request
encoded as … 7 bytes 1 byte 2 bytes 2 bytes
frame
00 06 00 01 ()
content 00 00 00 00 00 06 01 () 02
(MSB LSB) (PF pf) ()
() In the example, there is only one input to read.

() Detail of the MBAP header in the request frame:

information transaction identifier protocol identifier length of data bytes following APM403 address
encoded as … 2 bytes 2 bytes 2 bytes 1 byte
value 00 00 00 00 00 06 01

. 1 byte for "controller address" number of bytes to follow = 06

. 1 byte for "function",
. 2 bytes for "start address to read from",
. 2 bytes for "number of inputs to read".

The APM403 returns the following response frame (as an example):

number N of bytes values of N inputs
information MBAP header function
response frame sent read
encoded as … 7 bytes 1 byte 1 byte N x 1 bytes
value 00 00 00 00 00 05 01 () 02 01 () 01 ()
() N = 1 input/8=0 + remainder different to 0  N =0+1=1 byte sent.
() In the example, there is only one input; the binary result of 01 (hexadecimal value) is: 0000 0001.

This result shows that the input queried is at status 1 ("Oil Pressure" is active). The other bits of the byte containing the input status
are at 0.

MSB = Most Significant Byte

LSB = Least Significant Byte

() Detail of the MBAP header in the response frame:

information transaction identifier protocol identifier length of data bytes following APM403 address
encoded as … 2 bytes 2 bytes 2 bytes 1 byte
value 00 00 00 00 00 04 01

. 1 byte for "controller address" number of bytes to follow = 04

. 1 byte for "function"
. 1 byte for "number N of bytes sent"
. 1 byte for "values of N inputs read"

NDF_1014_EN _19/10/2018 17:03 33530066901 13

 Battery voltage
The information concerning the battery voltage is as follows:
- Modbus function: 0x03 (Read Input Registers),
- address of the register to be queried: 0x041D (1053 in decimal),
- length of data to be queried: 16 bits or 2 bytes,
- the measurement unit is a tenth of a Volt.

The following data items allow the request frame to be created:

address of the number of
information MBAP header function
read register to be read registers to read
request encoded as … 7 bytes 1 byte 2 bytes 2 bytes
frame 04 1D 00 01 ()
content 00 00 00 00 00 06 01 () 03
(MSB LSB) (PF pf) ()
() In the example, there is only one register to read, therefore 01 in hexadecimal.

() Detail of the MBAP header in the request frame:

information transaction identifier protocol identifier length of data bytes following APM403 address
encoded as … 2 bytes 2 bytes 2 bytes 1 byte
Content 00 00 00 00 00 06 01

. 1 byte for "APM403 address" number of bytes to follow = 06

. 1 byte for "function",
. 2 bytes for "address of the register to read"
. 2 bytes for "number of registers to read".

The APM403 returns the following response frame (as an example):

number N x 2 of values of the N
information MBAP header function
bytes sent registers read
response
encoded as … 7 bytes 1 byte 1 byte N x 2 bytes
frame
00 F0
value 00 00 00 00 00 05 01 03 02 ()
(MSB LSB)
() N = 1 register to read x 2 = 2, i.e. the value 02 in hexadecimal.
The input registers are sent over 2 bytes, since the size of the registers is at least 1 word (2 words for the correct amount of analog
data) (see example in the "cfgmodbus.txt" file).
example: at the address 0x1040: Generator Voltage L1-L2 (voltage between phases 1 and 2) is encoded as 1 word or 2 bytes,
since with 1 byte it is not possible to count over 255 (FF). With 2 bytes, it is possible to count from 0 to 65535 (FF) (example: 410
Volts between phase 1 and phase 2 is indicated as 01 9A).

MSB = Most Significant Byte

LSB = Least Significant Byte

() Detail of the MBAP header in the response frame:

information transaction identifier protocol identifier length of data bytes following APM403 address
encoded as … 2 bytes 2 bytes 2 bytes 1 byte
value 00 00 00 00 00 05 01

. 1 byte for "APM403 address" number of bytes to follow = 05

. 1 byte for "function"
. 1 byte for "number N of bytes sent"
. 2 bytes for "values of the N registers read"

How do we use the register value?

The number of decimal digits after the decimal point is indicated in the Modbus table (extract below).

The battery voltage is read by converting the hexadecimal coefficient bar

decimal value
hexadecimal value to a decimal value. value (see note) Battery
00 F0 240 1/10 24.0 Volts

All registers 1000 to 2999 must be read in the same way.

14 33530066901 NDF_1014_EN _19/10/2018 17:03

 "Nominal Power" setpoint (in the "Basic Settings" menu)
The information concerning the "nominal power" parameter is as follows:
- Modbus function: 0x06 (Write Single Register),
- address to be queried: 0x0BC0 (3008 in decimal),
- length of data to be queried: 16 bits or 2 bytes,
- the measurement unit for the active power is the Watt.

The following data items allow the request frame to be created:

value to write in
information MBAP header function register address
read the register
request encoded as … 7 bytes 1 byte 2 bytes 2 bytes
frame 0B C0 00 64
content 00 00 00 00 00 06 01 06
(MSB LSB) (MSB LSB)

() Detail of the MBAP header in the response frame:

information transaction identifier protocol identifier length of data bytes following APM403 address
encoded as … 2 bytes 2 bytes 2 bytes 1 byte
value 00 00 00 00 00 06 01

. 1 byte for "APM403 address" number of bytes to follow = 06

. 1 byte for "function"
. 2 bytes for "register address"
. 2 bytes for "value to write in the register"

The APM403 returns the following response frame (as an example):

information MBAP header function register address register value
response
encoded as … 7 bytes 1 byte 2 bytes 2 bytes
frame
0B C0 00 64
value 00 00 00 00 00 06 01 06
(MSB LSB) (MSB LSB)
The two values are identical, the response is an "echo" of the write request.

The power value written in the register is 200 kW.

MSB = Most Significant Byte

LSB = Least Significant Byte

() Detail of the MBAP header in the response frame:

information transaction identifier protocol identifier length of data bytes following APM403 address
encoded as … 2 bytes 2 bytes 2 bytes 1 byte
value 00 00 00 00 00 06 01

. 1 byte for "APM403 address" number of bytes to follow = 06

. 1 byte for "function"
. 2 bytes for "register address"
. 2 bytes for "register value"

7 Modifying the computer's IP address

To communicate with the server (the APM403) and in addition to paragraph 2.7.1, the IP address of the client (computer) must be
modified.

Refer to the operating description reference 33530066601.pdf.

NDF_1014_EN _19/10/2018 17:03 33530066901 15