Using Modbus Devices

Guide to Using the EPICS Modbus Driver

Rev. 3 24JUN99

P. Sichta (PPPL)

Introduction

This document provides insight about using the EPICS Modbus (not ModbusPlus) driver, in RTU mode. The driver works for Modicon PLCs and GE Series 6 PLCs in the RTU mode.

References

Gould Modbus Manual PI-MBUS-300 (Rev E?)

EPICS Collaboration Meeting Presentation, May 1998

GE-Fanuc Series 6 Data Communications(cat. GEK-25364B)

Record Definition for a Gould PLC

The Modbus driver supports ai,ao,bi,bo,mbbi, mbbo, mbbiDirect,mbboDirect record types. For each of these record types the DTYP field must be set to Modbus. When Modbus is selected, the INP field shows "L0 A0 C0 S0 @". Use the following guidelines, all values are entered in decimal :

L This is the RS-232 link number. Valid entries are 0 – 19. If the vme335 4-port card at vmeBase address 0x3600 is used, serial ports 1 – 4 correspond to L values of 0 – 3.

A This is the value of the PLC’s RTU-Slave address. The driver supports values between 1 and 10. The protocol supports values between 0 and 254.

C This indicates the PLC 'i/o address range' of Modbus transfer.

0 This will read or write single(bi/bo) or multiple (mbbi/mbbo) output bits (coil). The coil's address is specified in the "S" field. Output bits start at PLC address 00001.
1 This will read a PLC binary input bit(bi) or bits (mbbi). Input bits start at PLC I/O address 10001. The input's address is specified in the "S" field.
3 This will read a 16-bit input register. Input registers start at PLC address 30001. The register's address is specified in the "S" field.
4 This will read(mbbi) or write(mbbo) a 16-bit holding/output register. Holding/output registers start at PLC address 40001. The register's address is specified in the "S" field.
33 This is for psuedo i/o, used for integrating the device driver (control & status) with records/database operations. Details are described in the driver source code.

S The "S" field is used to specify the address for the coil/input/register.

Bi/bo The "S" parameter is used to specify the address of the input coil. For a Modicon PLC it is used as an offset from the base address of the coils. The minimum value is 1. For example, to read input 10032, C=1, S=32. To read the status of coil 20, C=0, S=20. For a GE Series 6 PLC, it simply specifies the input or coil address.
Mbbi/mbbo The "S" parameter is used to specify the address the register to extract the mbbi data from. The NOBT field in the record definition will provide the number of useful bits in the multi-bit device. The record’s SHFT field should be left "zero". The hardware mask's (@) value is used to specify the index into the register of the LSB of the mbbi data (min value = 0). For a Modicon PLC it provides an offset from the base address of the registers. For example, to read register 40008, C=4 and S=8. For the GE Series 6 PLC, it is simply the address of the register.
Ai The "S" parameter is used to specify the address of the PLC register to read. For a Modicon PLC it provides an offset from the base address of the registers. For example, to read register 40008, C=4 and S=8. For the GE Series 6 PLC, it is simply the address of the register.
Ao Have not tried this, but probably similar to the Ai record's usage.

@ The "@" symbol is the hardware-word mask parameter. Its use is normal, as described in the record reference manual for each record type.

Record/Modbus/C-value cross-reference

The following table describes the valid application of the "C" parameter for different record types :

Record Type Permissible "C" value

Bi 0,1,33

Bo 0,33

Mbbi,mbbiDirect 0,1,33

Mbbo,mbboDirect 0,33

Ai 3,4,33

Ao 4,33

Gould Modbus Codes

The following Modbus protocol function codes are supported : 1,2,3,4,5,6,8,15,16,128.

Modbus Code	Invoked by Record's "C" value
1 - read coil status	0, bi
2 - read input status	1, bi, mbbi, mbbiDirect
3 - read holding register	4, ai
4 - read input register	3, ai
5 - force coil	0, bo
6 - load register	4, ao
8 - loop back diagnostic	33, all records
15 - force multiple coils	0, mbbo, mbboDirect
16 - load multiple registers	?
128 - reserved for exception responses	?

PLC Scanning & Record Scanning

The driver will continuously communicate the PLC, updating a (memory) table with the latest values. When a record is scanned, it will look into the table for its value. So, the driver/PLC communication rate is independent of the record's scan rate.

Typing dumpMod L,A or printmodstats L,A at the VxWorks prompt will list the data values in the scan table as well as some statistics. Use The "L" and "A" values from a record's INP field.

RS-232 Connections

For the first 2 of 4 ports on the MVME-335 serial card, the configuration is :

9600 baud, 1 stop, even parity, 8 bits

This setup is used for the Gould Water Systems PLC.

For the last 2 of 4 ports on the MVME-335 serial card, the configuration is :

19200 baud, 1 stop, odd parity, 8 bits

This setup is used for the GE Series 6 HHFW PLC.

335 VME Board Settings

VME short I/O base address 0x3600,

Interrupt IRQ1,

Interrupt Vector = 0xA0

Specifics for HHFW

19200 baud, 1 stop, odd parity, 8 bits

Line = 2 (3^rd of 4 ports on 1^st 335 module)

Modbus Slave address = 9

When writing to the PLC, the value should remain stable for at least one PLC scan (< 100 ms).

Specifics for Water Systems

9600 baud, 1 stop, even parity, 8 bits

Line = 0 (1^st of 4 ports on 1^st 335 module)

Modbus Slave address = 1

PPPL Code Changes

drvModicon.c

26APR99 P. Sichta

Added a delay of 0.5 seconds to the monitoring portions of the scan_plc function. This will permit some "dead time" for the PLC communications interface. Not an essential change.

04JUN99 P. Sichta

Added a couple of 'switches' such that if the line is 0 or 1, the as-delivered 9600/even/1_stop/8_bits RS-232 parameters will be used. If the line value is 2 or 3, then 19200/odd/1_stop/8_bits parameters will be used for the 335 ports.

drvSer335.h 23APR99 P. Sichta

1) Changed the filler[20] to filler[0x20]. This is for the data structure for the 335 vme registers for serial ports 3 and 4.

2) Changed the minimum coil address to be 100 (decimal). This is meant to prevent the possibility of "physical" coils (or real relay outputs) be energized from EPICS. For the water system PLC, coils above 100 are "soft" coils.

drvModicon.h 04JUN99 P. Sichta

changed NUMMOPLCS from 2 to 10. The HHFW GE Series 6 PLC Addr was 9.
changed NUMMODREGS from 64 to 2000. This permits a register address of up to 8000. The HHFW PLC registers were up in the 6000 range.
Changed the TXTIMEOUT and RXTIMEOUT from 6 to 60 (16 ms) ticks. The HHFW PLC was getting timeouts on the responses at 6 ticks.

devBioModicon 06MAY99 P. Sichta

Modified the shift parameter in mbbi records. May also need to be done for other mbbx records.
Added mask argument to init_mbbi call to ModBiDriver.
Changed init_bi_record and init_mbbi_record and init_mbbiDirect_record to return(0) following call to ModBiDriver.

devAoModicon 22JUN99 P. Sichta

In write_proc function, changed argument in call to ModAoDriver to use 'value' not '&value'.

Building the Driver

In addition to compiling the software into vxworks binaries, you will need to make changes to the .dbd file.

Add this to the .dbd file:

driver(drvModicon)( makes dbior know about modbus)

device(ai,AB_IO,devAiModicon,"Modbus")

device(ao,AB_IO,devAoModicon,"Modbus")

device(bi,AB_IO,devBiModicon,"Modbus")

device(mbbi,AB_IO,devMbbiModicon,"Modbus")

device(mbbiDirect,AB_IO,devMbbiDirectModicon,"Modbus")

device(bo,AB_IO,devBoModicon,"Modbus")

device(mbbo,AB_IO,devMbboModicon,"Modbus")

device(mbboDirect,AB_IO,devMbboDirectModicon,"Modbus")