Industrial Networks & Databases - Device Bus - - Field Bus - - Data Bus -
Recall An Industrial Communication Network (control network) - any group of devices (computers, controllers, meters etc.) working in a peer-to-peer fashion to monitor sensors, control actuators, communicate reliably, manage network operation, and provide complete access to network data. Type of LAN (Local Area Network) with a greater demands on reliability, immunity to interference and determinism (knowledge of response time). A communications protocol is the set of standard rules for data representation, signaling, authentication and error detection required to send information over a communication channel. 2
Modbus Protocol MODBUS protocol is a messaging structure created by MODICON company in 1979 to connect PLC to programming tools. Today, this protocol is mainly used to set up master/client type communications with slaves/servers between intelligent devices. MODBUS is independent of the physical layer. It can be implemented on RS232, RS422, or RS485 links as well as on a wide variety of other media (e.g.: optical fibre, radio, etc.). 3
Modbus serial link and the OSI model MODBUS on a serial link is operating at 1200 to 56 Kbps with a master/slave access method. 7 APPLICATION Modbus 6 PRESENTATION EMPTY 5 SESSION EMPTY 4 TRANSPORT EMPTY 3 NETWORK EMPTY 2 LINK Master/Slave 1 PHYSICAL RS485 4
Modbus ASCII and RTU Two versions of MODBUS protocol : ASCII transmission mode Each eight-bit byte in a message is sent as 2 ASCII characters. RTU transmission mode Each eight-bit byte in a message is sent as two four-bit hexadecimal characters. The RTU mode achieves higher throughput. ASCII mode allows time intervals of up to 1 second to occur between characters without causing an error. 5
Modbus Frame Structure The Modbus frame structure is the same for requests (master to slave messages) and responses (slave to master messages). Modbus RTU silence Address Function Data Checksum silence Silence >= 3,5 characters Modbus ASCII : Address Function Data Checksum CR LF 3A Hex 0D Hex 0A Hex 6
Modbus Address Field Address Function Data Checksum Valid slave device addresses are in the range of 0... 247 decimal. The individual slave devices are assigned addresses in the range of 1... 247. Value 0 is reserved for broadcast messages (no response). Request: slave address Response: slave address 7
Modbus Function Field Address Function Data Checksum Valid codes are in the range of 1... 255 decimal. Request: kind of action. No error response: echo of the original function code Error resposne: original function code with its most significant bit set to a logic 1. 0000 0011 (Hexadecimal 03) 0000 0011 (Hexadecimal 03) 1000 0011 (Hexadecimal 83 8
Modbus Function Field Code Function 01 (0x01) Read n consecutive output bits 02 (0x02) Read n consecutive input bits 03 (0x03) Read n consecutive output words 04 (0x04) Read n consecutive input words 05 (0x05) Write 1 output bit 06 (0x06) Write 1 output word 07 (0x07) Read exception status 08 (0x08) Access diagnostic counters 15 (0x0F) Write n output bits 16 (0x10) Write n output words 23 (0x17) Read/Write n output words 43 (0x2B) Read identification The complete description of all Modbus request is freely available on the Modbus.org web site : http://www.modbus.org 9
Modbus Data Field Address Function Data Checksum Valid codes are in the range of 0... 255 decimal. Request: additional information for function code (register addresses, quantity of items to be handled) No error response: requested data Error response: an exception code 10
Modbus Data Field A possible exception codes: Code Name Meaning 01 ILLEGAL The function code received in the query is not an allowable action for the slave. If a Poll FUNCTION Program Complete command was issued, this code indicates that no program function preceded it. 02 ILLEGAL DATA ADDRESS 03 ILLEGAL DATA VALUE 04 SLAVE DEVICE FAILURE The data address received in the query is not an allowable address for the slave. A value contained in the query data field is not an allowable value for the slave An unrecoverable error occurred while the slave was attempting to perform the requested action. 05 ACKNOWLEDGE The slave has accepted the request and is processing it, but a long duration of time will be required to do so. This response is returned to prevent a timeout error from occurring in the master. The master can next issue a Poll Program Complete message to determine if processing is completed. 06 SLAVE DEVICE BUSY The slave is engaged in processing a long duration program command. The master should retransmit the message later when the slave is free. 07 NEGATIVE The slave cannot perform the program function received in the query. This code is ACKNOWLEDGE returned for an unsuccessful programming request using function code 13 or 14 decimal. The master should request diagnostic or error information from the slave. 08 MEMORY PARITY ERROR The slave attempted to read extended memory, but detected a parity error in the memory. The master can retry the request, but service may be required on the slave device. 11
Modbus Checksum Field Address Function Data Checksum Valid codes are in the range of 0... 255 decimal. Modbus RTU uses CRC : Modbus ASCII uses LRC : Cyclical Redundancy Check (2 byte) Longitudinal Redundancy Check (1 bytes) Request /Response: The checksum is calculated by the master (sender) and sends to the slave. The checksum is re-calculated by the slave (recipient) and compared to the value sent by the master. If a difference is detected, the slave will not construct a response to the master or received data are ignored. 12
Modbus Checksum Field A procedure for generating an LRC is: 1. Add all bytes in the message, excluding the starting colon and ending CRLF. Add them into an 8 bit field, so that carries will be discarded. 2. Subtract the final field value from FF hex (all 1 s), to produce the ones complement. 3. Add 1 to produce the twos complement. The function takes two arguments: unsigned char *auchmsg ; A pointer to the message buffer containing binary data to be used for generating the LRC unsigned short usdatalen ; The quantity of bytes in the message buffer. static unsigned char LRC(auchMsg, usdatalen) unsigned char *auchmsg ; /* message to calculate LRC upon */ unsigned short usdatalen ; /* quantity of bytes in message */ { unsigned char uchlrc = 0 ; /* LRC char initialized */ while (usdatalen ) /* pass through message buffer */ uchlrc += *auchmsg++ ; /* add buffer byte without carry */ return ((unsigned char)( ((char)uchlrc))) ; /* return twos complement */ } 13
Modbus Checksum Field A procedure for generating a CRC is: 1. Load a 16 bit register with FFFF hex (all 1 s). Call this the CRC register. 2. Exclusive OR the first 8 bit byte of the message with the low order byte of the 16 bit CRC register, putting the result in the CRC register. 3. Shift the CRC register one bit to the right (toward the LSB), zero filling the MSB. Extract and examine the LSB. 4. (If the LSB was 0): Repeat Step 3 (another shift). (If the LSB was 1): Exclusive OR the CRC register with the polynomial value A001 hex (1010 0000 0000 0001). 5. Repeat Steps 3 and 4 until 8 shifts have been performed. When this is done, a complete 8 bit byte will have been processed. The function takes two arguments: unsigned short CRC16(puchMsg, usdatalen) unsigned char *puchmsg ; /* message to calculate CRC upon */ unsigned short usdatalen ; /* quantity of bytes in message */ { unsigned char uchcrchi = 0xFF ; /* high byte of CRC initialized */ unsigned char uchcrclo = 0xFF ; /* low byte of CRC initialized */ unsigned uindex ; /* will index into CRC lookup table */ while (usdatalen ) /* pass through message buffer */ { uindex = uchcrchi ^ *puchmsgg++ ; /* calculate the CRC */ uchcrchi = uchcrclo ^ auchcrchi[uindex} ; uchcrclo = auchcrclo[uindex] ; } return (uchcrchi << 8 uchcrclo) ; } 14
Modbus Error Checking Methods Parity checking (even or odd) Frame checking (LRC or CRC) Continuous stream (more than 1.5 character times RTU mode or 1 second ASCII mode) The master is configured by the user to wait for a predetermined timeout interval before aborting the transaction. 15
Modbus Frame Exemple in RTU Mode Function code = 3: Read n words Request : 1 byte 1 byte 2 bytes 2 bytes 2 bytes Slave Function First word Number of Address code = 3 address words to read CRC16 Response : 1 byte 1 byte 1 byte 2 bytes 2 bytes 2 bytes Slave Function Number of Value of the Value of the CRC16 Address code = 3 bytes read first word last word 16
Modbus Frame Exemple in RTU Mode Function code = 6: Write one word Request : 1 byte 1 byte 2 bytes 2 bytes 2 bytes Slave Function Word Value of Address code = 6 address word CRC16 Response : 1 byte 1 byte 2 bytes 2 bytes 2 bytes Slave Function Word Value of CRC16 Address code = 6 address word 17
Modbus Frame Exemple in RTU Mode Function code = 16 (decimal): Write n words Request : 1 byte 1 byte 2 bytes 2 bytes 1 byte 2 bytes 2 bytes Slave Function First word Number of Number of Value of the CRC16 Address code = 16 address words to write bytes first word Response : 1 byte 1 byte 2 bytes 2 bytes 2 bytes Slave Function First word Number of CRC16 Address code = 16 address words to write 18
Modbus RS485 Physical Layer RS485 is the most common physical layer used on Modbus. The RS485 standard allows variants of different characteristics : Master 650 5 V 650 polarisation line terminator 120 1 nf D1 D0 Common 120 1 nf distribution of a reference potential number of slaves length of the bus Slave 1 Slave 2 Maximum length of bus Maximum number of stations (without repeater) Bus polarisation Line terminator Common polarity 1000 m at 19200 bps 32 (31 slaves) 650 at 5V and common for the master 120-0,25Wm in series with 1nF 10V Yes (Common) connected to the PG 19
Modbus RS485 Physical Layer Topology: Maximum distance: Data rate: Max. no. of devices: Bus with line terminations 1300 m without repeater 19200 bits/s maximum 32 master included Method of accessing the medium: Master - slave Transmission method: Max. useful data size: Transmission security: Messaging 120 words LRC or CRC Start and stop delimiters Parity bit Continuous stream 20
Modbus Application Example The XXMIT (Transmit) function block sends Modbus messages from a master PLC to a slave PLC or sends ASCII character strings from the PLC s Modbus serial port#1 (on Momentum PLCs port#2 is also supported) to ASCII printers and terminals. XXMIT sends these messages over telephone dialup modems, radio modems, or simply direct connections. This EFB can be found in the COMM library in the RTU subgroup. Remember, the Modbus protocol is a master/slave protocol. Modbus is designed to have only one master polling multiple slaves. Therefore, when using the XXMIT block in a network with multiple masters, contention resolution and collision avoidance is your responsibility and may easily be addressed through user logic programming. 21
Modbus Application Example The following Modbus Master operation is a read request to a slave device connected to port 1 of the master: read slave s 4:0001 to 4:00010 into local 4:00011 to 4:00020 The Slave must be set up with the following port parameters: 9600 baud 8 data bits 1 stop bit even parity (2) Variable Name StartModbusMstr ModbusMstrActive Data Type BOOL BOOL Initial Value ModbusMstrCommand WORD 16#0100 Bit 8 set ModbusMstrDone BOOL Comment ModbusMstrError BOOL The Master uses settings from the XXMIT function block ModbusMstrSettings ModbusMstrSettings[1] ModbusMstrSettings[2] ModbusMstrSettings[3] WordArr9 3 10 X Modbus Code: Read multiple registers Amount of Registers to read Slave Modbus address ModbusMstrSettings[4] ModbusMstrSettings[5] ModbusMstrSettings[6] 1 11 Source register Destination Register not used ModbusMstrStatus INT ModbusMstrNode WORD Enter Slave address ModbusMstrErrorCounter ModbusMstrDoneCounter INT INT 22
Strengths - Weaknesses Strengths Weaknesses Low implementation cost Number of devices connected in the world A program has to be written in order to access a variable Relatively slow Level of integration in PLC software No direct communication from slave to slave 23
Modbus Plus MODBUS PLUS is an industrial networking system that uses token-passing peer-to- peer communications at data transfer rates of one megabits per second; uses the MODBUS messaging structure. 7 APPLICATION Modbus 6 PRESENTATION EMPTY 5 SESSION EMPTY 4 TRANSPORT EMPTY 3 NETWORK EMPTY 2 LINK 802.4 Token passing 1 PHYSICAL RS485 24
Modbus Plus Specifications Deterministic token passing bus Based on the de facto industry standard Modbus protocol 1 Megabits/Second network speed CRC-16 error detection Number of nodes 32 without repeaters 64 with repeater(s) Choice of media inexpensive shielded twisted pair noise immune fiber optics 25
Modbus Plus Terminology Network: nodes accessed by the passing of a token. It consists of one or more cable sections Section: nodes joined only by cable segments. Sections are all part of one network, sharing the same token and address sequence. Each section can be up to 450 m long, and can contain up to 32 physical node connections. 26
Modbus Plus Terminology Cable Segment: A single length of trunk cable between two taps. The minimum cable length between any pair of nodes must be at least 3 m. The maximum cable length between two nodes is the same as the maximum section length of 450 m. Node: Any device that is physically connected to the Modbus Plus cable. The Bridge Plus - separately addressable node on each of its two networks. The Repeater is a node on each of two sections, but has no address. 27
Modbus Plus Terminology Token: A grouping of bits that is passed in sequence from one device to another on a single network. If two networks are joined by a Bridge Plus, each network has its own token. 28
Modbus Plus - Installation Nodes are connected to the cable by means of a tap device. The tap contains a resistive termination that is connected by two internal jumpers. The tap at each end of a cable section requires both of its jumpers to be connected to prevent signal reflections. MB+ TAP Modbus Plus Trunk Cable MB+ Drop Cable 29
Why is Modbus Plus compatible with Modbus? Modbus, the de facto industry standard since 1979 Master/slave polling protocol 19.2 kbaud maximum speed Supports up to 247 devices on a single network Read/write, programming commands Modbus can run over virtually any media enabling a wide range of applications RS-232, RS-422, RS-485 Copper, infra-red, radio, telephone lines, microwave, spread spectrum... Any device with a serial port can implement Modbus Built into every Modicon controller Integrated into products from over 300 industrial suppliers 30
How is Modbus Plus compatible with Modbus? Modbus Plus supports full Modbus Protocol including read/write and programming Quantum, Compact, and 984 controllers have built-in Modbus to Modbus Plus Bridge BM 85 Bridge Mux Attach four individual Modbus master or slave devices, or entire Modbus networks Integrate existing Modicon 384s, 484s, 584s, 884s, 984s Magelis Modbus Modbus Plus BM 85 Modbus to Powermeter, Inductel, and Altivar 66 31
Modbus Plus Applications Three types of communication are available to the application program for exchanging messages between networked nodes: The MSTR function block can be used for transferring, reading and clearing statistics, and accessing the network s global database. The MSTR is a general function for transacting messages with any type of networked node. It is programmed into the user logic program of the controller. Peer Cop transfers can be used to move data both globally and with specific nodes. Such transfers are specified in the controller s Peer Cop table during its initial configuration. Distributed I/O transfers can be used to move data with DIO Drop Adapter nodes. Such transfers are specified in the controller s DIO Map table during its initial configuration. 32
Modbus Plus Applications Simple instructions for event driven communications MSTR function block (possible to select one of 12 available network communication operations) Read/write up to 100 registers Read/write the network global database Get/clear local/remote statistics Up to 4 MSTR blocks active on any scan, with automatic queuing for additional MSTRs Same MSTR block works on the native CPU or Quantum network option module ports Other function blocks: CREADREG: Continuous register reading CWRITREG: Continuous register writing READREG: Read register area once (rising edge of the REQ input) WRITEREG: Write register area once (rising edge of the REQ input) 33
Modbus Plus Routing Path Message Frame Routing Path Field START Routing Path Data END ROUTING ADDRESS 1 = 22 ROUTING ADDRESS 2 = 20 ROUTING ADDRESS 3 = 5 NODE 22 ROUTING ADDRESS 4 = 0 ROUTING ADDRESS 5 = 0 NODE 1 NODE 3 BRIDGE PLUS NODE 9 NETWORK A ZERO MEANS NO FURTHER ROUTING NODE 25 NETWORK B Each network has got its own token BRIDGE PLUS NODE 20 NODE 3 NODE 1 NODE 2 NODE 1 NODE 5 NETWORK C 34
Modbus Plus - Peer Cop Transactions Point to point data can be transacted while a node holds the token and during its token pass with Modbus Plus Peer Cop. Up to 500 words (16 bits each) can be directed to specific data references in node devices prior to release of the token, and up to 32 words can be globally broadcast to all nodes as part of the token frame. Nodes can be configured to send two kinds of Peer Cop data: Global Output Up to 32 words of data can be broadcast globally from each node to all nodes. Source data references are specified in the node configuration. Specific Output Up to 32 words of data can be transmitted to any specific node. Multiple node destinations can be specified, up to the maximum of 500 data words. Any nodes on the network can be specifically addressed as destinations. A unique block of references can be specified as the data source for each targeted node. 35
Modbus Plus - Peer Cop Transactions Nodes can be configured to receive two kinds of Peer Cop data: Global Input Up to 32 words of global data can be received by each node from each other node on the network. Destination references are specified in the receiving node s configuration. Up to eight blocks of references can be specified, giving up to eight separate destinations for the data received from each source node. The incoming data can be indexed to establish the starting point and length of each block of data to be extracted from the message and delivered to each destination. Specific Input Up to 32 words of data can be received from any specific node. Each node on the network can be specifically defined as a data source, up to the maximum of 500 data words. 36
Modbus Plus - Peer Cop Transactions Secure, configurable communications Data protection feature provides secure read only integrity Configure time critical communications with Peer Cop Read/write Global Database Broadcast up to 32 words out to all network nodes Pick from up to 2016 words in from other nodes Map inputs to whatever data type you like Map specific inputs and outputs between nodes Up to 32 words in and out per node Up to 500 words in and 500 words out per port Data length of outputs and node address of source controller must match with config table entries on the destination controller before data is moved to inputs Map inputs to whatever data type you like 37
Modbus Plus - Peer Copping Example Node # 1 Node # 2 Node #3 Specific Outputs 400001-400004 Specific Inputs 100001-100512 Global Data Out 401000-401020 Node #2 Specific Outputs 000001-000064 Specific Inputs 300001-300020 Global Data Out 401000-401020 Node # 3 Node #1 Specific Outputs 400101-400120 Specific Inputs 100001-100064 Global Data Out 400500-400510 Node #1 Specific Outputs 400001-400032 Node #2 Specific Outputs 000001-000064 Specific Inputs Specific Inputs 100001-100064 300001-300020 Global Data Out Global Data Out 400200-400231 400200-400231 Node #3 Specific Outputs 400001-400020 Specific Inputs 100001-100064 Global Data Out 400500-400510 38
Modbus Plus - Peer Cop Transactions Because Peer Cop data is transacted as part of the token pass, it applies to each network independently of any other networks that are part of the Modbus Plus system. Tokens are not exchanged between networks, because they are not passed through Bridge Plus devices. Each network maintains its own Peer Cop database, with its own system of global broadcasting and specific node addressing. 39
Modbus Plus Performance Predictable performance token rotation time and response time As fast as hardwired I/O Typical token rotation time of 2 milliseconds per node Transfer of 100 registers per activation MSTR instruction Maximum network throughput of 10,000 registers/sec Up to 4 MSTR blocks active on any scan Network Throughput Reg/Sec per Node 10000 8000 6000 4000 2000 4 MSTR's Always On 0 2 4 10 20 30 Nodes 40
Modbus Plus - Predicting Token Rotation Time 41
Modbus Plus - Predicting Token Rotation Time The formula for calculating the average token rotation time is: where: TR = (2.08 + 0.016 * DMW) * DMP + (0.19 + 0.016 * GDW) * GDN + 0.53 * N TR is the average token rotation time in ms DMW is the average number of words per Data Master path used in the network (maximum 100 for controllers) DMP is the number of Data Master paths used continuously in the network GDW is the average number of global data words per message used in the network (maximum 32) GDN is the number of nodes with global data transmitted in the network N is the number of nodes on the network 42
Modbus Plus Predicting MSTR Response Time The average response time is the sum of the following times: 1 token rotation time 1 scan time of the requesting unit 1/2 scan time of the responding unit The worst case response time would be: 2 token rotation times 2 scan times of the requesting unit 1 scan time of the responding unit 43
Modbus Plus Predicting MSTR Response Time (example) Node 1 Node 2 Node 2 Node 3 Node 5 Node 6 Modbus Plus Network Node Type of Communication Receiving Node MSTR always ON 50 registers 2 1 MSTR ON for 500 ms 100 registers 3 MSTR always ON 75 registers 4 2 MSTR always ON 100 registers 1 MSTR always ON 75 registers 4 3 Global Data ON 16 registers ALL MSTR always ON 75 registers 4 4 Global Data ON 32 registers ALL 44
Modbus Plus Predicting MSTR Response Time (example) Node 1 Node 2 Node 2 Node 3 Node 5 Node 6 Modbus Plus Network 1. Finding the average token rotation time TR = (2.08 + 0.016 * DMW) * DMP + (0.19 + 0.016 * GDW) * GDN + 0.53 * N DMW = (50 + 100 + 75 + 100 + 75 + 75) / 6 = 79 words DMP = (1 + 20/500 + 1 + 1 + 1 + 1) = 5.04 paths GDW = (16 + 32) / 2 = 24 words GDN = (1 + 1) = 2 nodes N = 6 nodes TR = (2.08 + 0.016*79) * 5.04 + (0.19 + 0.016 * 24) * 2 + 0.53 * 6 = 21.18 ms 2. Calculating the MSTR response time Average response time = 1 token rotation time (21.18 ms) + 1 scan time of the requesting unit (20 ms) + 1/2 scan time of the responding unit (10 ms) = 51.18 ms Worst case response time = 2 token rotation times (42.36 ms) + 2 scan time of the requesting unit (40 ms) + 1 scan time of the responding unit (20 ms) = 102.36 ms 45
Modbus Plus Concept Example 46
Modbus Plus - Example of Architecture 47
Modbus Plus - Example of Architecture XBT-P021010 Modbus/RS232 TAP1 MB+1 BUDYNEK WIELOFUNKCYJNY Interbus -S 171CCC76010 172PNN21022 170ADO35000 170INT11000 170ADI35000 170INT11000 170AAI14000 170INT11000 170AAI14000 170INT11000 170ADM35010 DYSPOZYTORNIA ifix2.6 TAP2 Modbus Plus MB+2 Interbus -S MB+3 TAP3 171CCC76010 172PNN21022 170AAI14000 170INT11000 170ADI35000 170INT11000 170ADO35000 POMPOWNIA WODY SUROWEJ TAP4 MB+4 TSX3721 TSXMBP100 TSXMBPCE030 48