MODBUS

Step-by-Step Definitions

RTU as PLC (Connected to Master Computer) Serial MODBUS

Site Configuration

1. Define one of the ports as RS232, Async, Third party protocols, (Connected to) Master
(or RS485, Async, Third party protocols, (Connected to) Master).

2. Define the Link Name: PLC 1, PLC 2, or PLC 3.

3. Select the appropriate Data Speed.

4. Click on the Advanced Configuration button, and select (if supported by the Master) the
DTR/CTS Support parameter to Yes.

5. In the Advanced Properties, set the Format parameter to the appropriate format. (The
default is 8 bit, no parity, 1 stop bit.)

6. Save the Advanced Configuration and the port configuration in the site.

Third Party Protocol Downloading

1. In the ACE3600 STS Downloader utility, make sure that the ACE3600 STS is connected
to the proper site ID/link ID.

2. Select the site configuration to be downloaded to the RTU.

3. Select the appropriate protocol file as described in Third Party Protocol Downloading
above.

4. Download the selected files to the RTU.

Application Programmer System Tables

1. In the Application Programmer Database tab, open the PLC Table under System Tables
and set the values as follows:

PLC address as required

Connected to RTU (Name) LOCAL
Via Port (Name) RTU AS PLC

2. Define the database tables and process.

Local RTU as PLC Master Serial MODBUS

Site Configuration

1. Define one of the ports as RS232, Async, Third party protocols, (Connected to) Slave
(or RS485, Async, Third party protocols, (Connected to) Master).

2. Define the Link Name: PLC 1, PLC 2, or PLC 3.

17
 MODBUS

3. Select the appropriate Data Speed.

4. Click on the Advanced Configuration button, and select (if supported by the Slave) the
DTR/CTS Support parameter to Yes.

5. In the Advanced Properties, set the Format parameter to the appropriate format. (The
default is 8 bit, no parity, 1 stop bit.)

Third Party Protocol Downloading

1. In the ACE3600 STS Downloader utility, make sure that the ACE3600 STS is connected
to the proper site ID/link ID.

2. Select the site configuration to be downloaded to the RTU.

3. Select the appropriate protocol file as described in Third Party Protocol Downloading
above.

4. Download the selected files to the RTU.

System Tables

1. In the Application Programmer Database tab, open the PLC Table under System Tables
and set the values as follows:

PLC address: 1
Connected to RTU (Name): LOCAL
via Port (Name): PLC1

RTU as PLC (Connected to Master Computer) MODBUS over TCP/IP

Site Configuration

1. Define one of the ports as one of the following:

Description Port Configuration Settings Additional Configuration

RS232 PPP port - connected
to a packet data (PPP)
modem via RS232.
Ethernet 10/100 Base-T port
configured for static LAN -
connected to LAN with a
static IP address.
Ethernet 10/100 Base-T port
configured for dynamic
LAN - connected to LAN
having a DHCP server
which allocates IP address.
RS232 -> Async -> PPP ->
[Null modem | Standard
modem | TETRA | iDEN]
10/100 BasetT -> Static LAN
-> Ethernet LAN
10 BasetT -> Static LAN ->
Ethernet LAN
10/100 BasetT -> DHCP
Client-> Ethernet ->LAN
10 BasetT -> DHCP Client->
Ethernet ->LAN
User must specify Link ID
and baud rate of modem.
User must specify Self IP
address, subnet mask, and
default router. User must
specify Link ID of port.
User must specify Link ID.
A host name of port is
optional but recommended.

18
 MODBUS

2. Click on the Protocols button and select the Modbus Slave Protocol.

3. Define the Port Name: PLC 1, PLC 2, or PLC 3.

4. Click on the Advanced Configuration button, and set the standard MODBUS advanced
parameters (described in Appendix A: Site Configuration Parameters in the ACE3600 STS
User Guide) and the special MODBUS TCP/IP parameters described in Port
Configuration for MODBUS over TCP/IP above, as necessary.
Note: In general, no changes to the default values of the advanced parameters are required.

5. Save the Advanced Configuration and the port configuration in the site.

Third Party Protocol Downloading

1. In the ACE3600 STS Downloader utility, make sure that the ACE3600 STS is connected
to the proper site ID/link ID.

2. Select the site configuration to be downloaded to the RTU.

3. Select the appropriate protocol file as described in Third Party Protocol Downloading
above.

4. Download the selected files to the RTU.

Application Programmer System Tables

1. In the Application Programmer Database tab, open the PLC Table under System Tables
and set the values as follows:

PLC address as required

Connected to RTU (Name) LOCAL
Via Port (Name) RTU AS PLC

2. In the Application Programmer Database tab, open the PLC IP Access Control Table and
create an entry for each authorized master and the corresponding PLC port on the slave to
which master will connect.

3. Define the database tables and process.

Local RTU as PLC Master - MODBUS over TCP/IP

Site Configuration

1. Define one of the ports as one of the following:

Description Port Configuration Settings Additional Configuration

RS232 PPP port - connected
to a packet data (PPP)
modem via RS232.
Ethernet 10/100 Base-T port
configured for static LAN -
connected to LAN with a
RS232 -> Async -> PPP ->
[Null modem | Standard
modem | TETRA | iDEN]
10/100 BasetT -> Static LAN
-> Ethernet LAN
User must specify Link ID
and baud rate of modem.
User must specify Self IP
address, subnet mask, and
default router. User must

19
 MODBUS

static IP address. 10 BasetT -> Static LAN -> specify Link ID of port.
Ethernet LAN
Ethernet 10/100 Base-T port 10/100 BasetT -> DHCP User must specify Link ID.
configured for dynamic Client-> Ethernet ->LAN A host name of port is
LAN - connected to LAN optional but recommended.
10 BasetT -> DHCP Client->
having a DHCP server
Ethernet ->LAN
which allocates IP address.
2. Click on the Protocols button and select the Modbus Master Protocol.

3. Define the Port Name: PLC 1, PLC 2, or PLC 3.

4. Click on the Advanced Configuration button, and select (if supported by the Slave) the
DTR/CTS Support parameter to Yes.

5. In the Advanced Properties, set the Format parameter to the appropriate format. (The
default is 8 bit, no parity, 1 stop bit.)

Third Party Protocol Downloading

1. In the ACE3600 STS Downloader utility, make sure that the ACE3600 STS is connected
to the proper site ID/link ID.

2. Select the site configuration to be downloaded to the RTU.

3. Select the appropriate protocol file as described in Third Party Protocol Downloading
above.

4. Download the selected files to the RTU.

System Tables

1. In the Application Programmer Database tab, open the PLC Table under System Tables
and set the values as follows:

PLC address: 1
Connected to RTU (Name): LOCAL
via Port (Name): PLC1

IP address: to IP address of slave

RTU as Master Ladder Diagram Consideration

The read/write of data from/to MODBUS PLC is done by SCAN operation in rungs. The
SCAN itself is performed on one of the new data type columns: PLC_VI, PLC_VO, PLC_DI,
or PLC_DO.

For each of the above columns, I/O Link should be performed.

When the SCAN operation is performed on one of the above columns, the system accesses the
destination MODBUS PLC by selecting one of the supported commands, according to the data
type of the column and the I/O link.
20
 MODBUS

Note that if the column is of input type, read operation is performed from the PLC, and if the
column is of output type, write operation is performed to the PLC.

I/O Link for PLC Data Type Columns

I/O Link for PLC Data Type Column is a procedure of describing the slave database that we
want to access.

There are two options for performing I/O Link for each PLC Data Type Column:

Static I/O Link each column is bound to the slave database with the formal I/O Link
(as for I/O)

Dynamic I/O Link each column is bound to the slave database by the ladder at
runtime, by programming the PLC Dynamic IOLINK system table before the SCAN
operation.

The ACE3600 RTU selects the method according the value of PlcElmNum in the PLC
Dynamic IOLINK system table. During the SCAN of the PLC column type, the ACE3600
RTU examines the value of PlcElmNum. If it is equal to 0, static I/O is selected. If it is not
equal to zero, the I/O Link parameters are expected to be programmed in the PLC Dynamic
IOLINK system table.

If PlcElmNum == 0, use Static I/O Link.

If PlcElmNum <> 0, use Dynamic I/O Link.

Static I/O Link for PLC Data Type Columns

Before performing the I/O Link, complete the definition of the PLC Table, otherwise you will
not be able to proceed to the I/O Link for PLC data type columns.

In I/O Link, for each PLC data type column you must define the following:

1) PLC Address the address of destination MODBUS PLC.

2) PLC Data Type the data type of destination PLC. For MODBUS PLC, only four data
types are relevant:

a) Logic Coils

b) Discrete Inputs

c) Holding Register

d) Input Registers

3) Coord1 the offset of the element corresponding to the first element of the column, from
the first element of the MODBUS PLC data type.

The elements at MODBUS PLC are referred (numbered) from zero;

(input 10001=zero=10001-10001,

21
 MODBUS

input 10002=one=10002-10001,

input 10003=two=10003-10001,

etc., for 584 PLC).

If the first element of the column corresponds to input 10003, the PLC Coord1 must be set
to 2.

4) Coord1 Len should be set to 2. The length of Coord1 is 2 bytes.

Note: Do not change the last three lines for coordinates. They are reserved for protocols with
more than one coordinate.

Dynamic I/O Link for PLC Data Type Columns

The ACE3600 RTU allows dynamic I/O Link per each PLC data type column.

The advantage of this method is that one can define multiple I/O Links at runtime for the same
PLC type column (not at the same time). Instead of defining the static I/O Link for a PLC
column, it is possible to program the PLC Dynamic IOLINK system table (#232).

The contents of the PLC Dynamic IOLINK table serves as an input for PLC column SCAN
operation and therefore programming this table should be done before the PLC column SCAN.
The programming of the PLC Dynamic IOLINK table is as follows:

PlcElmNum should be set to zero if Static I/O Link is used, otherwise it is generally set
to the number of elements (rows in column) in the corresponding PLC_DI, PLC_DO,
PLC_VI, PLC_VO, PLC_RI, PLC_RO data type column being accessed by the SCAN
operation. Note: PlcElmNum should be less than or equal to the number of elements
(rows in column) in the corresponding column accessed by SCAN.

PLcDstAddr Destination PLC address

PlcDataType 1 for PLC_RI ,PLC_RO (real floating point) column

2 for Logic Coils and Holding Registers

3 for Discrete Inputs and Input Registers

Special constants have been defined in the PLC Dynamic IOLINK Constants table for setting
the PlcDataType field: These include:

PLCBit
PLCVal
PLCRel
fc1_Read_Logic_Coil
fc2_Read_Discrete_Input
fc3_Read_Holding_Register
fc4_Read_Input_Register

22
 MODBUS

fc3_Read_PLCRel
fc5_fc15_Write_Logic_Coil
fc6_fc16_Write_Holding_Register
fc16_Write_PLCRel

PlcCoordNum Number of coordinates should be set to 1

PlcCoord1Len Should be set to 2. The length of Coord1 is 2 bytes

PlcCoord1 Should be set the same as described for "Coord1" in the Static I/O Link
section above.

Other fields of the PLC Dynamic IOLINK table are irrelevant for MODBUS protocol and
should be ignored.

23
 MODBUS

Scan from Rungs

Before performing a SCAN on a PLC column, check the PLCStt status for communication
busy.

PLCStt is an integer status system variable. The purpose of this variable is to give an
indication of the communication with PLCs. The values for this variable are defined in the
PLC Status Defines table (one of the Constants Tables).

Note that if PLCStt=PLCBsy, the new SCAN will not be performed.

If the communication is successfully terminated, the PLCStt variable changes to PLCRdy.

(Ready for a new SCAN after having successfully finished the previous SCAN).

24
 MODBUS

If the communication is not successfully terminated, the PLCStt variable is changed to one of
following values:

NO_Buf No buffers to perform the communication

PLCFal Failed to perform the communication
PLCIol I/O Link Error
PLCAdr The address does not appear in PLC Table
PLCTim No response from the PLC slave
PLCRpl Reply error from PLC slave

During the communication, the PLCStt variable is equal to PLCBsy.

RTU as PLC (Slave) Mapping of SCADA Element to

ACE3600 Database
The ACE3600 RTU defined as a MODBUS slave supports the following data types:

Logic Coils

Discrete Inputs

Holding Registers

Input Registers

Real (floating point) Registers

The ACE3600 versatile database enables mapping of various data types to any MODBUS
register/bit address (0-65355). However, some SCADA Centrals address the data types
according to a predefined register mapping scheme such as:

Logic coils (bit output) range: 000001-065535

Discrete Input status (bit input) range: 100001-165535

Input registers range: 300001-365535

Holding (output) registers range: 400001-465535

The ACE3600 user database is accessible (for MODBUS read/write operation) from the
SCADA using the MODBUS protocol.

ACE3600 data is mapped into the MODBUS database by using the following default formula,
where Z (=0-31) is the table number, X (=0-7) is the column number, and Y (=0-249) is the
row number:

MODBUS register/bit address = offset + Z*2048 +X*256+Y.

25
 MODBUS

The offset may vary according for different SCADA software. See Offset Note below.

By default, the table number (Z) may vary from 0 to 31. If a higher numbered user table must
be accessed, then do the following:

1) In the ACE3600 STS site configuration, modify the Advanced Physical Register map
parameter for the PLC port configuration to the table=64 column=8 row=128 value.

2) Use the following formula where the user table number (Z) may vary from 0-63,
X (=0-7) is the column number, and Y (=0-127) is the row number.

MODBUS register /bit address = offset + Z*1024 +X*128+Y.

Again, the offset may vary for different SCADA software. See Offset Note below.

Offset Note: There are some SCADA systems for which addressing does not depend on the
data type; there is no specific absolute range reference per data type. For such a SCADA, the
offset in the equation should be set to 0. For other SCADA software, the offset = 000001,
100001, 300001, and 400001 for logic coil, input status, input register, and holding register
data type respectively.

In addition, a PLC Translation file add-on to the STS enables access to all data available in
ACE3600 database user tables. For information on preparing such a file, see PLC Translation
File below.

PLC Translation File

The register mapping scheme described above is limiting and does not enable access to all data
in the RTU database user tables. An additional mapping on top of the basic register mapping
scheme can be defined, based on PLC addresses, or MODBUS function codes, or both.

The PLC Translation file is a text file, created by the user, which defines the additional
mapping. When the file is configured and downloaded to the ACE3600 RTU, the additional
mapping becomes active.

The following example describes a system for which the PLC Translation File add-on is
applicable.

Four totally identical RTUs are accessed by an ACE36000 concentrator. The

database for the first RTU is mirrored (reflected) in the ACE3600 by tables
(0-31), the second RTU by tables (32-63), the third RTU by tables (64-95) and
the fourth RTU by tables (96-127). The four groups of tables are totally identical
and reflect the database of the corresponding RTU.

The MODBUS SCADA accesses the RTU by accessing the corresponding table
and element in the ACE3600 table.

In addition, on the SCADA, the application engineer would like to define four
copies of each element (tag) (per RTU) having the same MODBUS register/bit
number. Each tag will appear four times (having the same register/bit number),
but with four different MODBUS PLC addresses (1, 2, 3, 4).

26
 MODBUS

A number of problems arise in building such a system:

1. The MODBUS to ACE3600 database mapping is limited by the range of tables that can be
accessed, because only the first 32 (0<=Z<=31) or 64 (0<=Z<=63) tables can be mapped.
See RTU as PLC (Slave) Mapping of SCADA Element to ACE3600 Database above.

2. The MODBUS register/bit number has a unique mapping to the ACE3600 (z, x, y) element
and therefore it cannot be mapped to four different elements on the ACE3600
(representing different RTUs in different tables) with the same register/bit number on the
SCADA, as described above. If four elements on the SCADA are defined with the same
register/bit number, they will all be mapped to the same (z, x, y) element on the ACE3600.

The solution is to introduce an additional mapping on the top of the register mapping scheme
described above using a PLC Translation File.

The PLC Translation File uses the .ini format and includes three sections (one per PLC port)
and instructions. It is a text file and can be edited by any text file editor. The file can be built
from the example template, Modbus_Example.plc, which is located in the "config" directory
under the STS installation path (e.g. C:\STS1150\Config.) Once the file is configured and
downloaded to the ACE36000, the additional mapping will become active.

The example PLC Translation File looks as follows, and defines a mapping for the port
defined as PLC2:

The section
represents instructions which are relevant for access via PLC port PLC1. In this example, no
instructions are defined in this section.

The section
represents instructions which are relevant for access via PLC port PLC2. Four offsets are
defined based on the PLC address, and eight offsets are defined based on MODBUS function
codes.

27
 MODBUS

The four keywords above define additional offsets, each of which depends on the PLC
address. The offsets 0, 32, 64, 96 correspond to PLC addresses 1, 2, 3, 4.

Each time a MODBUS packet is received via the port named PLC2, the MODBUS driver first
calculates the (z, x, y) coordinates of the element being accessed (using the register mapping
scheme for the MODBUS register /bit address formula above.) Based on the destination PLC
address (1, 2, 3, 4), the coordinates of the element are then changed to (z+offset,x,y). The
table number is shifted forward by the offset (namely 0 when accessing PLC address 1, 32
when accessing PLC address 2, 64 when accessing PLC address 3, and 96 when accessing
PLC address 4). In other words, the tables for PLC address 1 start from Z=0, the tables for
PLC address 2 start from Z=32, the tables for PLC address 3 start from Z=64, and the tables
for PLC address 4 start from Z=96.

This increases the range of tables that can be accessed.

Notes: 1. PLC addresses 1, 2, 3, 4 should all be configured in PLC Table as legal PLC
addresses, otherwise the ACE3600 will not respond to accesses to PLC addresses 1, 2, 3, 4.
See the PLC Table description.

2: Any of the optional STATION_TABLE (Z)_OFST_BY_ADDR_* keywords is

legal (0 < * < 255 and represents a legal MODBUS PLC address.)

Z=31
PLC
PLC Table
Table
addr
Addr Offset Z=1
Offset
Z=0
10 1 0 0 Z=63
Z=33
Z=32
20 2 3232
Z=95
Z=65
30 3 6464
Z=64

40 4 9696 Z=127
Z=97
Z=96

28
 MODBUS

The above keywords define an additional offset based on the MODBUS function code on the
PLC2 port. In the example file, all offsets are zero, so the final table number (Z) is not
impacted by the keywords. If, however, the
keyword was set to 5, any access done with MODBUS function code 1 via port PLC2 would
increase the table number (Z) or shift Z forward by five tables.

Notes: 1. Any of the optional keywords is

legal (*= one of MODBUS function codes 1, 2, 3, 4, 5, 6, 15, 16.)

2: If both types of keywords and

are defined the table number is advanced
(shifted) forward by the sum of the two offsets.

The section
represents instructions which are relevant for an access done via PLC port PLC3. In this
example, no instructions are defined in this section.

PLC Diagnostics
The PLC Translation File which is downloaded to the ACE3600 can be viewed using the STS
SW Diagnostics utility (DEVICE= PLC1L for port name PLC1, PLC2L for port name PLC2,
PLC3L for port name PLC3, LEVEL=0.) See the example below. For more on the SW
Diagnostics utility, see the ACE3600 STS User Guide. For a description of the diagnostics,
see the TOSCADA (PLC1L, PLC2L, PLC3L) section of the ACE3600 Software Diagnostic
Output and Error Messages Manual.

29
 MODBUS

30
 MODBUS

RTU Supported MODBUS Protocol Exceptions (Negative

Acknowledges)
In case of a failure, the RTU supported MODBUS protocol sends to the master the following
exceptions (negative acknowledges):

Exception Number Sent when

4 (Device FAIL) An internal buffer overflow occurs in RTU.

The database doesnt exist.
An internal buffer communication error occurs in RTU.
The number of elements is zero.
The master tries to access an integer data-type by
interrogating a bit data-type or vice versa.
An internal failure occurs in RTU.
1 (Illegal function) The function code is not supported.
6 (BUSY) The access to the RTU database is temporarily shut off
by the system. Try polling again
2 (Illegal Address) The master tries to access an element which is not
defined in the RTU database, or is out of range. This
error usually occurs when the accessed column is not
defined in the RTU database, or the column is defined,
but the first or the last accessed element is out of range.
(First or last Y of the accessed element is greater than
the number of rows.)

31
MODBUS over RS485 Troubleshooting
If MODBUS communication is not working and the MODBUS RS485 port Tx LED is
constantly OFF, the ACE3600 may not be transmitting over RS485 multidrop. This is due to
bad idle conditions on the line caused by the peer RTU or device.

To solve the problem, do the following:

1. In the Site Configuration, select the RS485 port.

2. Click on the Advanced Configuration button.

3. In the PLC MASTER or PLC SLAVE tab, set Driver specific parameters #4 to 1 (this sets
the mask to 0x0001 - one bit on and the others off.)

4. Click OK to close the Advanced Configuration.

5. Save the changes to the port configuration in the site.

By setting the Driver specific parameters #4 bit mask to 1 (0x0001), the MODBUS driver will
force transmission regardless of the line idle conditions.

32