Вы находитесь на странице: 1из 76

GEI-100517A

GE Industrial Systems

Modbus
for HMI Applications

Document:
Issued:

GEI-100517A
2002-06-06

Modbus
for HMI Applications

These instructions do not purport to cover all details or variations in equipment, nor to
provide for every possible contingency to be met during installation, operation, and
maintenance. The information is supplied for informational purposes only, and GE makes
no warranty as to the accuracy of the information included herein. Changes,
modifications, and/or improvements to equipment and specifications are made
periodically and these changes may or may not be reflected herein. It is understood that
GE may make changes, modifications, or improvements to the equipment referenced
herein or to the document itself at any time. This document is intended for trained
personnel familiar with the GE products referenced herein.
GE may have patents or pending patent applications covering subject matter in this
document. The furnishing of this document does not provide any license whatsoever to
any of these patents. All license inquiries should be directed to the address below. If
further information is desired, or if particular problems arise that are not covered
sufficiently for the purchasers purpose, the matter should be referred to:
GE Industrial Systems
Post Sales Service
1501 Roanoke Blvd.
Salem, VA 24153-6492 USA
Phone:
+ 1 888 GE4 SERV (888 434 7378, United States)
+ 1 540 378 3280 (International)
Fax:
+ 1 540 387 8606 (All)
(+ indicates the international access code required when calling from outside the
USA)
This document contains proprietary information of General Electric Company, USA and
is furnished to its customer solely to assist that customer in the installation, testing,
operation, and/or maintenance of the equipment described. This document shall not be
reproduced in whole or in part nor shall its contents be disclosed to any third party
without the written approval of GE Industrial Systems.
GE PROVIDES THE FOLLOWING DOCUMENT AND THE INFORMATION
INCLUDED THEREIN AS IS AND WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY IMPLIED STATUTORY
WARRANTY OF MERCHANTABILITY OR FITNESS FOR PARTICULAR PURPOSE
ARCNET is a registered trademark of Datapoint Corporation.
Ethernet is a trademark of Xerox Corporation.
SPEEDTRONIC is a trademark of General Electric Company, USA.
Windows is a registered trademark of Microsoft Corporation.

Safety Symbol Legend

Indicates a procedure, condition, or statement that, if not


strictly observed, could result in personal injury or death.

Indicates a procedure, condition, or statement that, if not


strictly observed, could result in damage to or destruction of
equipment.

Indicates a procedure, condition, or statement that should be


strictly followed in order to optimize these applications.

Note Indicates an essential or important procedure, condition, or statement.

GEI-100517A Modbus for HMI Applications

Safety Symbol Legend i

This equipment contains a potential hazard of electric shock


or burn. Only personnel who are adequately trained and
thoroughly familiar with the equipment and the instructions
should install, operate, or maintain this equipment.
Isolation of test equipment from the equipment under test
presents potential electrical hazards. If the test equipment
cannot be grounded to the equipment under test, the test
equipments case must be shielded to prevent contact by
personnel.
To minimize hazard of electrical shock or burn, approved
grounding practices and procedures must be strictly followed.

To prevent personal injury or equipment damage caused by


equipment malfunction, only adequately trained personnel
should modify any programmable machine.

ii Safety Symbol Legend

GEI-100517A Modbus for HMI Applications

To:

GE Industrial Systems
Documentation Design, Rm. 291
1501 Roanoke Blvd.
Salem, VA 24153-6492 USA

Reader Comments

Fax: 1-540-387-8651
(GE Internal DC 8-278-8651)

General Electric Company

We welcome comments and suggestions to make this publication more useful.


Your Name

Todays Date

Your Companys Name and Address

Job Site
GE Requisition No.

If needed, how can we contact you?


Fax No.
Phone No.
E-mail

Your Job Function / How You Use This Publication

Publication No.

Address

Publication Issue/Revision Date

General Rating
Excellent
Contents
{
Organization
{
Technical Accuracy {
Clarity
{
Completeness
{
Drawings / Figures {
Tables
{
Referencing
{
Readability
{

Good
{
{
{
{
{
{
{
{
{

Fair
{
{
{
{
{
{
{
{
{

Poor
{
{
{
{
{
{
{
{
{

Additional Comments
____________________________________________________________
____________________________________________________________
____________________________________________________________
____________________________________________________________
____________________________________________________________
____________________________________________________________
____________________________________________________________
____________________________________________________________
____________________________________________________________

Specific Suggestions (Corrections, information that could be expanded on, and such.)
Page No.

Comments

_____

_________________________________________________________________________________

_____

_________________________________________________________________________________

_____

_________________________________________________________________________________

_____

_________________________________________________________________________________

_____

_________________________________________________________________________________

_____

_________________________________________________________________________________

Other Comments (What you like, what could be added, how to improve, and such.) ________________________________________________

__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
Overall grade (Compared to publications from other manufacturers of similar products, how do you rate this publication?)
{ Superior

{ Comparable

{ Inferior

Detach and fax or mail to the address noted above.

{ Do not know

Comment ____________________________________________

........................................................................ Fold here and close with staple or tape ..........................................................................................


Place
stamp
here.

____________________________
____________________________
____________________________

GE Industrial Systems
Documentation Design, Rm. 291
1501 Roanoke Blvd.
Salem, VA 24153-6492 USA

.......................................................................................... Fold here first ........................................................................................................

Contents
Chapter 1 Overview

1-1

Introduction.............................................................................................................................1-1
System Summary ....................................................................................................................1-1
Communication ........................................................................................................1-2
Features....................................................................................................................1-2
Modbus Slave Mode ...............................................................................................................1-3
Modbus Master Mode.............................................................................................................1-4
Alarm Handling ......................................................................................................................1-4

Chapter 2 Modbus Slave Mode

2-1

Introduction.............................................................................................................................2-1
Modbus Communication.........................................................................................................2-1
Specifications............................................................................................................2-1
System Operation .....................................................................................................2-2
RS-232C and Modbus...............................................................................................2-2
Physical Link Layer/Format, RS-232C Communications .......................................................2-3
Link Layer.................................................................................................................2-3
Physical Layer..........................................................................................................2-3
Physical Link Layer/Format, Ethernet Communications.........................................................2-6
TCI Modbus Configuration.....................................................................................................2-6
F:\IO_PORTS.DAT: Modbus Link Definition ..........................................................2-6
Modbus Slave Configuration: Holding Coils, Input Coils, Holding Registers, Input
Registers ...................................................................................................................2-8
Modbus Slave: @SPARE: Unused Coils and Registers ...........................................2-9
F:\UNITn\MODBUS.DAT: Mapping File Format ...................................................2-9
CimMod ..................................................................................................................2-13
MODBUS_L.EXE: MODBUS Listing Program .....................................................2-17
Modbus Data Format and Scaling.........................................................................................2-21
Modbus Data Conversions: Logics ........................................................................2-21
Modbus Data Conversions: Analogs......................................................................2-21
RS16 .......................................................................................................................2-22
RU16.......................................................................................................................2-22
UN12 ......................................................................................................................2-22
HW12......................................................................................................................2-23
Native .....................................................................................................................2-24
Modbus Command and Response Definition........................................................................2-25
RTU Transmission Mode ........................................................................................2-25
Statistics, Diagnostics, and Testing.......................................................................................2-27
Trace Global Sections ............................................................................................2-27
CIMMOD Diagnostics............................................................................................2-29
Modbus Master Simulation.....................................................................................2-29

GEI-100517A Modbus for HMI Applications

Contents i

Chapter 3 Modbus Master Mode

3-1

Introduction.............................................................................................................................3-1
External Communication Links...............................................................................................3-1
Modbus Master Setup .............................................................................................................3-2
Modbus Master Configuration ................................................................................................3-2
Statistics..................................................................................................................................3-6
Modbus Master Diagnostics ...................................................................................................3-7

Chapter 4 Applications

4-1

Introduction.............................................................................................................................4-1
Mark V Systems......................................................................................................................4-1
Mark IV Systems ....................................................................................................................4-2
Mark VI Systems ....................................................................................................................4-3
Systems with GE Fanuc PLCs.................................................................................................4-4
Systems with non-GE PLCs ....................................................................................................4-5

Appendix A

5-1

Exception Code Responses .....................................................................................................5-1


Exception Code Response Format............................................................................5-1
Function Code Details.............................................................................................................5-2
Function Code 01: Read Holding Coils ...................................................................5-2
Function Code 02: Read Input Coils........................................................................5-3
Function Code 03: Read Holding Registers.............................................................5-4
Function Code 04: Read Input Registers .................................................................5-4
Function Code 05: Force Single Holding Coil ........................................................5-5
Function Code 06: Preset Single Holding Register .................................................5-6
Function Code 07: Read Exception Status...............................................................5-6
Function Code 16: Preset Multiple Holding Registers ............................................5-8
Serial Line Driver Settings......................................................................................................5-8
Fiber-Optic Line Driver Settings ..........................................................................................5-11

Glossary of Terms

ii Contents

5-1

GEI-100517A Modbus for HMI Applications

Chapter 1 Overview

Introduction
Modbus is an industry standard protocol for exchanging real time data and
commands between various control systems. This document describes the addition of
Modbus communication between the SPEEDTRONIC Turbine Control system and
the distributed control system to provide two-way transmission of control data and
operator commands. It covers the three Modbus modes of communication and the
interfaces to the various controller types.

System Summary
Modbus can be used in three different modes of communication, Slave mode, Master
mode, and CIMPLICITY Modbus Master mode. The most used is Modbus Slave
mode for communication with the distributed control system (DCS).

Mark VI

Ethernet
Ethernet
ARCNET

Mark V

HMI
Server
Serial

DCS

DCS

Mark V LM
CSF
Mark IV

or Serial

Figure 1-1. Physical Communication with DCS through the HMI

The Turbine Control Interface (TCI) software resides in the Human-Machine Interface
(HMI) Server. It provides a communication interface with the SPEEDTRONIC turbine
control, including data collection and an interface with the CIMPLICITY software.
TCI Modbus provides a communication link from the HMI Server to the DCS
controlling the plant. The DCS is usually located remotely from the turbine control
system; refer to the conceptual diagram in Figure 1-1.

GEI-100517A Modbus for HMI Applications

Chapter 1 Overview 1-1

The Modbus link allows the DCS to gather turbine performance data and display it for
the plant operator in the central control room, and allows the operator to control the
turbine startup, load, and shutdown. When the HMI is responding to DCS requests, the
mode of operation is known as Modbus Slave mode.
The HMI can also run in Modbus Master mode, where it sends requests to another
intelligent device. For example, the HMI can communicate over a serial link with a
Bently Nevada system, and issue requests for turbine vibration data. When the HMI
is running Modbus Master mode, however, Slave mode can run at the same time to
supply data to a DCS or Historian.
In Modbus master mode the TCI can gather data from attached Modbus slaves. The
data gathered is requested and stored in the TCI database based on points and update
rates specified in a Modbus data file.
Refer to the GFK-1181G
CIMPLICITY HMI Base
System-Device
Communication Manual.

CIMPLICITY Modbus Master is a third mode used to communicate with PLCs


controlling balance of plant (BOP) equipment, including GE Fanuc PLCs and other
manufacturers PLCs.

Communication
Modbus communication between the HMI and the DCS can be over Ethernet or over
an RS-232C serial link. If Ethernet is available, it is preferred because of the higher
speed.
As shown in Figure 1-1, the HMI can communicate with any of the Mark IV, V, and
VI SPEEDTRONIC controllers. Communication with Mark VI is over Ethernet,
while the Mark V uses ARCNET, and Mark IV uses CSF or a serial link. It is very
rare to have all these controller and communication types present in one system.
Note In this document the term controller refers to either the Mark IV, Mark V,
Mark V LM, or Mark VI SPEEDTRONIC turbine controller.
Modbus Slave is the most
used mode.

In Modbus Slave mode, the DCS can request information from each controller or
CIMPLICITY project by sending a Modbus data request message over the Modbus
link to a specific slave address. The DCS master can also issue Modbus command
messages to initiate operator commands to each controller or CIMPLICITY. These
command messages support both pushbutton commands (such as START, STOP)
and analog setpoint commands (such as a preselected load setpoint). A Modbus data
file specifies the correspondence between Modbus coil and register numbers and the
units (controllers) data.

Features
Important characteristics of the turbine control Modbus link are as follows:

1-2 Chapter 1 Overview

Modbus Master and Slave mode each support four data categories: Holding Coil,
Holding Register, Input Coil, and Input Register

Time tags are not available with the data

In general, alarms cannot be obtained (refer to Alarm Handling section below).

Alarm ACK ALL and Alarm Silence commands can be sent over Modbus to the
controller, where logic must be triggered to perform the function

The DCS may write to no more than 10 coils or registers per second

GEI-100517A Modbus for HMI Applications

Modbus function codes 15 and 16 should be avoided unless the user takes care
to not write more than 10 coils or registers per second

An extra Ethernet board is not required to implement Modbus over Ethernet

Two Masters can be connected to one HMI using two separate serial ports. The HMI
processes requests from each Master as they arrive, returning the reply to the Master
that made the request. Modbus communication over a multidrop (RS-485 or RS-422)
link is a non-standard configuration.

Modbus Slave Mode


Data can be supplied from Mark IV, Mark V, and Mark VI controllers to the DCS
when running Modbus Slave mode. Figure 1-2 shows the data flow paths through
CIMPLICITY to the TCI Modbus Slave to the DCS. Mark V data flows directly to
the TCI Modbus Slave, whereas Mark IV and VI data passes through CIMMOD first.
PLC data can also be supplied to the DCS or Historian through the TCI Modbus
Slave. While many different interfaces are used between the various PLCs and the
HMI, the TCI Modbus interface can be used with any of these devices. For more
information on transferring data from PLCs to the DCS or Historian, refer to Chapter
4 Applications.

HMI SERVER
Mark VI

Mark IV

TCI

CIMPLICITY

CIMMOD

TCI
Modbus
Slave

DCS

Mark V and
Mark V LM
Figure 1-2. Data Flow from controllers in Modbus Slave Mode

The rate at which the data can be collected from a serial Modbus slave is limited by
the transmission rate on the RS-232C link, and by the turn-around times of the
computers on each end of the link. The rate at which the data can be collected from
an Ethernet Modbus slave is limited by the Ethernet traffic and by the turn-around
times of the computers on each end of the connection. The DCS may issue no more
than ten operator commands per second.
A maximum of eight serial links may be configured for a single HMI. The number of
Ethernet connections an Ethernet Modbus slave will accept is configurable. Ethernet
and serial links may both be used at the same time. All data to and from a controller
is serialized and operated on one at a time.
For more information, refer
to Chapter 2 Modbus Slave
Mode.

The TCI Modbus slave, configured with the appropriate address, replies with the
requested data. A single HMI can respond to multiple slave addresses. Up to a
maximum of 16 slave addresses may be configured. Normally each separate slave
address would be assigned to gather data from a separate unit control.

GEI-100517A Modbus for HMI Applications

Chapter 1 Overview 1-3

Modbus Master Mode


In Modbus Master mode, the HMI gathers data from attached Modbus slaves and
stores it in the TCI database. The rate at which the data can be collected on an
RS232C link is limited by the following:

The transmission rate on the RS-232C link

The turn-around times of the computers on each end of the link

The periodic rate specified in the configuration data file

The rate at which the data can be collected from an Ethernet Modbus slave is limited
by the Ethernet traffic, by the turn-around times of the computers on each end of the
connection, and the periodic rate specified in the configuration data file.

For more information, refer


to Chapter 3 Modbus Master
Mode.

The TCI Modbus Master, configured with the appropriate address, requests data
from a third party device at a specified rate. A single HMI can communicate with
multiple slave addresses over various communication ports. Up to a maximum of
eight communication ports may be used to communicate with up to 48 separate slave
addresses. Nine function codes are supported; five for reading, and four function
codes for writing to coils and registers in the slave device.

Alarm Handling
GSM is recommended for
alarm transmission to the
DCS

Modbus cannot transmit alarms, but can transmit the source logic in the controller
that triggers the alarms. Many of these logics are not latched, so it is possible that a
Modbus link could miss some of the logic transitions. For this reason GE Industrial
Systems Standard Messages (GSM) is recommended for the transmission of alarms,
not a Modbus link. Refer to GEI 100516 GSM for SPEEDTRONIC Turbine Control
for details.
Alarm handling bits in the Mark V controller are as follows:

L86AACK_CPB Alarm ACK

L86ARST_CPB Alarm Reset

L86ASIL_CPB

Alarm Silence

Designations in the Mark IV are similar; check the alarm dialog in the toolbox for the
Mark VI names. Messages setting and resetting these bits can be used by the DCS to
ACK ALL or Silence the controller's alarms.

Alarm ACK and Alarm Silence


The DCS usually has its own
alarm in the central control
room, controlled from the
main console. This is separate
from any turbine control
alarms discussed above,
which may be located in the
turbine control area.

1-4 Chapter 1 Overview

The controller alarm is usually located in the turbine control area. The Mark V
controller has an internal alarm beeper and a contact closure for an external alarm.
The internal alarm is jumper-enabled. Alarm silence logic controlled by Modbus can
be configured in the controller to switch these off. Similarly the Mark VI controller
has a contact closure for an external alarm. This alarm can be switched off by alarm
silence logic in the controller that can be controlled by Modbus.
There is normally no need for the DCS to ACK and Silence the turbine alarm system.
Because the controller alarm system holds only the last 64 alarms, if there is no
native alarm management from the GE operator interface, DCS ACKs and Resets can
keep the controller alarm queue from filling.

GEI-100517A Modbus for HMI Applications

Notes

GEI-100517A Modbus for HMI Applications

Chapter 1 Overview 1-5

Chapter 2 Modbus Slave Mode

Introduction
This chapter describes how the HMI is set up to act as a slave to the DCS and pass on
data requests and operator commands to the controllers for execution. Modbus
communication, the physical link layer, I/O port definition, data mapping, and data
format are covered.

Modbus Communication
Modbus is an industry standard communication link used by the HMI to provide the
current value of plant variables to any system that requests it over the Modbus link.
The HMI acts as a Modbus slave, which means it waits for requests from another
computer (a Modbus master) and answers by returning the current value of the
variables requested.
Modbus is a popular
communication protocol for
control systems

The Modbus protocol is implemented as a set of registers and coils. The HMI
supports up to 10,000 registers and coils of each type from each turbine control.
These registers and coils are not mixed in any particular table. The mapping of the
Modbus register number to the turbine signal name is done using the MODBUS.DAT
or MODBUS_N.DAT file, or both, in the unit configuration directory. The TCI port
definition and configuration file, F:\IO_PORTS.DAT, assigns the available I/O ports.
Once the Modbus configuration has been done, the MODBUS_L program can be
used to generate a formatted list of the Modbus register numbers, turbine signal
names, and scaling information for each signal defined. This information is stored in
the MODBUS.LST file. The MODBUS.LST file can be used to configure the master
side of the Modbus link.

Specifications
The Modbus interface uses Gould Modicons Modbus Protocol (Gould Modicon is
now part of Schneider Automation). The following text provides application
information only. It does not specify the Modbus Protocol.
Detailed information on the Modbus protocol is available from Gould Inc.s
Reference Guide PI-MBUS-300 Rev B, January 1985. This is not the Modbus Plus
specification. It is recommended that both this document and the Gould reference
guide be used together.

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-1

The TCI system allows easy addition, deletion, or modification of the data lists by the
DCS vendor or customer after equipment installation. The data point capability of the
turbine control system generally far exceeds the actual needs of the DCS.
Ethernet communication does
not have the distance
restrictions of the serial link

An HMI server can be located locally, remotely, or anywhere within the distance
limitations of the Stage Link system (for details on the Stage Link, see GEH-6195B,
Chapter 9). The DCS or remote control system can be located anywhere within the
restrictions of the RS-232C serial communication link, or anywhere on the Ethernet
link.

System Operation
An external communication link allows an operator at a remote location to initiate
operator commands by sending a logical command or an analog setpoint to the HMI.
Logical commands are used to initiate automated sequences, which reside in the
controller. They are also used to change analog setpoints, such as the turbine load, to
a predefined level.
It is occasionally more efficient to set targets with an analog number, such as
megawatts, rather than manually entering raise/lower commands. The operator can
send a target setpoint that the controller enters into its database and ramps to the
target at a predetermined ramp rate.
Most of the operator commands that can be initiated from the HMI can be initiated
from the DCS through the communication link. A traditional hard-wired remote
control interface can be used, however, this can be I/O intensive and needs to be
evaluated on a case-by-case basis. Maintenance commands, for example editing
application software or changing tuning constants, are generally restricted to being
issued from an HMI.
All application data in the controller can be monitored by the DCS over the remote
serial communication link. The controller database contains several thousand points,
but usually less than 500 points are of interest to the DCS. These consist of logical
data for alarm and event messages and analog or numeric data for such variables as
speed, load, vibration, and temperature.
One HMI can interface with up to 16 controllers. Therefore the external
communication link to the remote control system has the capability to communicate
through the HMI to up to 16 controllers.

RS-232C and Modbus


GE Industrial Systems offers Modbus protocol with an RS-232C link as a level one
communication link because it is compatible with most control systems. The
limitations are a 19,200 bit/sec transmission rate and the lack of individual time tags
for alarms and events.
The communication link load is a function of the amount of data that the DCS is
requesting and how often it is to be transmitted. Data in the controller typically
requires one word per analog point and one word for each 16 logic points (such as
the state of alarms and events). An evaluation of the link load for a specific
application requires reviewing the amount and frequency of the data transmissions
and the specified baud rate, and verifying that all is within the desired sampling rate.

2-2 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

To minimize the sampling rate for alarms, a contact output can be provided from the
controller to the plant alarm horn system that informs the DCS that a new alarm has
occurred. The DCS can then request a transmission of the alarm states data. This
eliminates the need to continuously sample the alarm signals at a fast rate. Some sites
provide a remote printer to get high-resolution local alarm (62 ms), event (62 ms),
and sequence of event logs in the control room without investing in more
sophisticated equipment.

Physical Link Layer/Format, RS-232C Communications


This section details the physical link layer/format of the Modbus serial link.

Link Layer
Each HMI can provide up to eight point-to-point Modbus RS-232C serial links and a
defined number of Ethernet connections to a customers DCS. The HMI, acting as a
Modbus slave, responds to requests from Modbus masters on any of the Modbus
links.

Physical Layer
The HMI processor is used as the communications port for Modbus, typically using
the HMI's COM2 serial communications port. If the COM1 or COM2 ports are not
available, a serial expander board is required to supply eight more serial ports. The
port used is configured with a DB-9P plug connector as Data Terminal Equipment
(DTE). Figures 2-1, 2-2, and 2-3 show this connection.

Refer to the TCI Modbus


Configuration section in this
Chapter for timeout
configuration.

The system is asynchronous RS-232C compatible, 300 to 19200 baud, with


programmable parity. It is compatible with full duplex data sets (modems). Modemgenerated signals such as CTS (Clear to Send), CD (Carrier Detect), and RI (Ring
Indicator) are not required to enable the transmitter. The RTS (Ready to Send) and
the DTR (Data Terminal Ready) are always equal to 1 when the HMI is powered up.
This prohibits any multi-drop DCS configurations, since these signals cannot enable
or disable communications. Hardware handshaking (flow control using RTS/CTS
signals) is not supported. It is up to the master to only request data that it can
reasonably expect to handle in a single burst.
GE Industrial Systems does not recommend remote control of turbine products over a
telephone modem because of the inherent unreliability in this type of communication.
If it is necessary to collect data or operate over telephone modems, in most cases the
maximum number of bits that can be communicated is ten. Therefore the standard
eight bits of Modbus data and the two bits for start/stop is all that can be
accommodated. This means that parity is not supported over telephone modems.

RS-232C communications are


limited to 50 feet without the
use of modems

RS-232C systems require two metallic shielded twisted-pair wires to connect the
short-haul modems. RS-232C transmission distances are defined in Table 2-1.

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-3

Table 2-1. RS-232C Transmission Distances with Modems


Baud
Rate

26 Gauge
Miles
km

24 Gauge
Miles
km

22 Gauge
Miles
km

19 Gauge
Miles
km

300

10.0

16.1

12.0

19.3

15.0

24.1

25.0

40.2

1200

6.0

9.7

7.5

12.1

9.0

14.5

15.0

24.1

2400

4.5

7.2

5.5

8.9

7.5

12.1

11.0

17.7

4800

3.5

5.6

4.5

7.2

5.5

8.9

7.0

11.3

9600

2.2

3.5

3.2

5.1

4.0

6.4

5.0

8.0

19200

1.0

1.6

1.2

1.9

1.5

2.4

2.0

3.2

While modems are supplied by GE Industrial Systems, the customer must supply the
cabling and terminations. The standard modems supplied by GE Industrial Systems
require power on pin four. The modem connected to the HMI obtains its power from
the HMI serial port. The other modem must receive power on pin four from the DCS.
If the DCS cannot supply power, the optional modem set is required and must be
specified when ordering from GE Industrial Systems. This set is powered by an
external source. For line driver information, refer to Appendix A.
The DCS and the cabling are supplied by the customer. In figures 2-1, 2-2, and 2-3,
the following apply:

NC means No Connection.

LDDS means Limited Distance Data Set (short haul modem).

DCS

Typical HMI
DB9P (DTE)
RXD
TXD
RTS
CTS
SCOM
CD
DTR
DSR
RI

(2)
(3)
(7)
(8)
(5)
(1)
(4)
(6)
(9)

DB25P (DTE)
Cable
NC
NC
Common (not shielded)
NC
NC
NC
NC

TXD
RXD
RTS
CTS
SCOM

(2)
(3)
(4)
(5)
(7)

Figure 2-1. RS-232C Connection to DB9 Serial Ports with No Modems

2-4 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

HMI

Data Set

Data Set

DB9P (DTE)

(Modem)

(Modem)

RXD
TXD
DTR
SCOM

(2)
(3)
(4)
(5)

R1-4
R2-3
S1-2
S2-1

(2)
(3)
(4)
(5)

S1-2
S2-1
S1-4
R2-3

DCS

(2)
(3)
(4)
(5)

Shielded
Twisted-Pair
wire

RXD
TXD
V+
SCOM
Cable

Figure 2-2. RS-232C Connection to DB9 Serial Port with Modems

The DCS power, V+, is 3-5 mA at 10 V dc. The nominal voltage is 12 V dc, with a
minimum of 6 V dc, and maximum of 25 V dc.

Typical HMI

Data Set

DB9P (DTE)

LDDS

RXD
(2)
TXD
(3)
RTS
(7)
CTS
(8)
SCOM (5)
CD
(1)
DTR
(4)
DSR
(6)
RI
(9)

(3)
(2)
NC
NC

Data Set

DCS
DB25P (DTE)

LDDS
S1
S2
R1
R2

R1
R2
S1
S2

(7)
NC
NC
NC
NC

Power 120 V ac

(3)
(2)
(4)
(5)
(7)
(8)

RXD
TXD
RTS
CTS
SCOM
CD

(3)
(2)
(4)
(5)
(7)
(8)

Power 120 V ac

Figure 2-3. Optional RS-232C Connection with LDDS

If a DB9 pin connector is used instead of a DB25 pin connector, change:

pin 3 to pin 2 for RXD

pin 2 to pin 3 for TXD

pin 4 to pin 7 for RTS

pin 5 to pin 8 for CTS

pin 7 to pin 5 for SCOM

pin 8 to pin 1 for CD

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-5

Physical Link Layer/Format, Ethernet Communications


The Mark VI system uses
Ethernet data highways.

The Mark VI system can use Ethernet communication with the DCS over the Plant
Data Highway (PDH). This is a 10Base-T, 10 Mbps (100 Mbps optional) Ethernet
data highway with optional 100Base-FX fiber-optic cables for longer distances. For
the link from the PDH to the DCS in the central control room, a fiber-optic cable
would normally be used. If required, Serial Modbus can be used with the Mark VI.
The PDH uses Fast Ethernet Switches. Some versions have both electrical ports for
RJ-45 connectors, and fiber-optic ports for 100 Base-FX connectors. Check the
Ethernet Switch description for the type of fiber-optic connector required.
The electrical cable is unshielded twisted-pair (UTP) cable, Category 5 EIA/TIA 568
A/B, or better. The fiber-optic cable is 62.5/125 micron, dual-window, graded index
profile, multimode glass-on-glass construction. Thermoplastic cable jackets for
indoor and outdoor use are available.

TCI Modbus Configuration


This section defines the required additions or modifications to configuration files on
an HMI to accomplish the following:

Enable and configure the TCI Modbus task

Enable and configure a serial port for Modbus communication

Set up the Modbus mapping tables

Generate the related document for the DCS vendor

F:\IO_PORTS.DAT: Modbus Link Definition


The Modbus Master program (MModbus.exe) and the Modbus Slave program
(Modbus.exe) share a common configuration file entitled F:\IO_PORTS.DAT to
specify important site variable data such as the port, baud rate, and Modbus slave id.
The configuration file is an ASCII-based text file that may be modified with any
standard text editor. Lines are not case sensitive. The configuration file is divided
into sections and each section begins with a title enclosed in brackets [ ].
The Modbus Slave program uses three sections as follows:

The [MODBUS_SLAVE_PORT] sections are repeated once for each I/O port to
be used as a Modbus slave link. Both serial and Ethernet ports are defined here.
Serial links can use the COM1 or COM2 port, or a port from a serial expansion
board. The Ethernet link, if used, can also be specified here, but is only needed
once (not once per Modbus master using this link).

The [MODBUS_ASSIGNMENT] section is used to bind Modbus slave


addresses to internal unit numbers, and indicates what Modbus addresses the
TCI Modbus slave should answer as. It also controls the data format (mode) used
over the Modbus link.

The [MODBUS_SLAVE_TIMEOUT] section controls the message level


timeouts, and the NAKs that are returned when a timeout occurs.

2-6 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

To customize F:\IO_PORTS.DAT, use any standard text file editor.


F:\IO_PORTS.DAT contains textual information to help define a MODBUS link. The
following sections are in the file:
The three sections are defined in more detail in the template file in
G:\DATA\IO_PORTS.DAT. The following sample IO_PORTS.DAT file illustrates how

slave Serial and Ethernet ports are set up.


;------------------------------------------------------------------------;------------------------------------------------------------------------;
;
<HMI> PORT DEFINITION FILE - F:\IO_PORTS.DAT
;
;
; This file defines the serial ports that exist on this PC
; and that are to be controlled by TCI services.
;
;------------------------------------------------------------------------;------------------------------------------------------------------------;
; This section defines MODBUS SLAVE port and hardware characteristics.
; This section can be duplicated up to 8 times (Ethernet plus serial ports).
;
[MODBUS_SLAVE_PORT]
;port com2
port none
baud
9600
parity
0
;0-4 (none,odd,even,mark,space)
databits 8
;5-8
stopbits 0
;0-2 (1, 1.5, 2 stop bits) (1.5 stop bits currently
unsupported)
xonxoff
0
;0-1
port_it 40
;Timeout interval between characters, msec. Default=40
port_tt 200
;Timeout for total message, msec. Default=200
;------------------------------------------------------------------------;
; This section defines that the MODBUS can receive requests over the
; ethernet. There can only be one of these sections.
;
[MODBUS_SLAVE_PORT]
;port ethernet
port none
timeout
60
; no activity disconnect time in minutes (0 = disable)
Max_Connections 10
; Maximum number of socket connections allowed
;------------------------------------------------------------------------;
; This section defines MODBUS slave address and software characteristics
;
[MODBUS_ASSIGNMENT]
;
;format1:
SLAVE nnn
UNIT uu
MODE keyword
;format2:
SLAVE nnn
CIMPLICITY project MODE keyword
; where:
nnn is the SLAVE address (in decimal) to recognize when sent
;
a message from a modbus master.
;
uu is the two character unit name (defined in F:\CONFIG.DAT)
;
project is the name of a CIMPLICITY project on this computer.
;
keyword is either RS16, RU16, UN12, HW12, or NATIVE for Signed 16,
;
Unsigned 16, Unsigned 12, Honeywell 12, and Native data
;
respectively.
;
;
SLAVE and MODE are required entries. UNIT or CIMPLICITY must also be
;
on a valid line.
;
A new line should appear for each definition. Normally this is one
;
or two lines for typical data patterns. A maximum of 16
;
definition lines may appear.

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-7

;
;SLAVE 1 UNIT <unit_name> MODE RS16
;SLAVE 2 CIMPLICITY <project_name> MODE RU16
;------------------------------------------------------------------------;
; This section defines MODBUS slave timeout and Nak characteristics
;
[MODBUS_SLAVE_TIMEOUT]
modbus_timeout
4000
;Time (milliseconds) before we give up and send nak
modbus_timeout_nak 6
;Nak code used if unit timeout occurs.
;To use timeout, specify 4 or 6 only.
;To disable timeout, specify 0.
;-------------------------------------------------------------------------

Modbus Slave Configuration: Holding Coils, Input


Coils, Holding Registers, Input Registers
For the Mark V and Mark V LM controllers, a Modbus Mapping file (Modbus.dat) is
created for each controller. This file contains mapping tables to associate the
registers and coils with controller signal database (CSDB) points.
Usually with the Mark IV and Mark VI controllers, a Modbus Mapping file
(CimMod.dat) is created for each CIMPLICITY project. This file contains mapping
tables to associate the registers and coils with the CIMPLICITY points.
There are two categories of point mapping tables: holding and input. The Modbus
protocol supports reading and writing of holding table points, and reading but not
writing of input table points.
There are no restrictions on what controller CSDB points can be in the input and
holding tables. The TCI knows on a point-by-point basis which points are controller
commands and which points are not. A controller command is one of the following:

The DCS may not write to


input coils or input registers

LOGICS:

pushbuttons

ANALOGS:

analog setpoints

logic state variables


enumerated state variables

The holding tables may be used exclusively, and the input tables may be omitted
completely. Sending a Modbus write command to a point on a holding table that is
not mapped to a controller command has no effect and is ignored. A NAK is
returned.
There are two classes of signals found on the two tables: coils and registers. A coil is
one bit and maps to a logic point, with a value of zero or one. A register is 16 bits,
and maps to an analog point, or to a set of (up to) 16 packed logicals.
Multiple holding coils or registers may be mapped to the same point. If the
pointname is a controller command, a write command to any of the mapped holding
coils or registers causes the command to be executed.
HC holding coils are one-bit logic signals that are both readable and writable.
Logic commands must be in this table to issue the command to the controller;
however, not all points in this table must be logic controller commands. Logic
commands are not writable from the holding register table.
IC input coils are one-bit logic signals that are readable but not writable. Any
controller logic signal can be in this table, but logic controller commands are not
writable from this table.

2-8 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

HR holding registers are 16-bit analog signals that are both readable and writable.
Analog controller commands must be in this table to send the command to the
controller, but not all points in this table must be analog commands. They can be any
analog signal, or a set of (up to) 16 bit-packed logic signals. Logic commands can be
packed into a holding register, but they are not writable in that format. For the TCI to
issue a logic controller command, it must be in the holding coil table.
IR input registers are 16-bit analog values that are readable but not writable. Any
analog control database signal, or a set of up to 16 bit-packed logic control database
signals may be in this table. Analog or logic controller commands are not writable
from this table.

Modbus Slave: @SPARE: Unused Coils and


Registers
If a request is made using a coil or register not mapped to a controller point, a NAK
code of 02 is returned, which is listed as INVALID ADDRESS (see the section on
Message Errors later in this chapter). This prevents the DCS from interpreting the
reply as data from the controller.
To define coils or registers without mapping them to controller CSDB points, map
them to @SPARE in the mapping table. This indicates that the coil or register is not
used, but is legally defined. A data value of zero is returned for all coils and registers
defined as @SPARE. It is not necessary to map all the points in the mapping table.
The @SPARE is used only to fill in the gaps or to format the table as required by the
DCS.
Bit packed registers (logic control database signals packed into a 16-bit register)
should not have unused bits defined as @SPARE. When any one bit of a register is
defined as a packed bit, the entire register is defined as a packed register. Therefore,
omit defining the unused bits. Bits in a packed register not mapped to a logic
controller CSDB pointnames always send a value of zero to the DCS. @SPARE can
only be used on an unpacked register when the entire register is unused.

F:\UNITn\MODBUS.DAT: Mapping File Format


If the Modbus Slave mode is Native, F:\UNITn\MODBUS_N.DAT is used for the point
configuration. If the Modbus Slave is in any mode except Native,
F:\UNITn\MODBUS.DAT is used for the point configuration. The following section
contains a simple template as an example for filling out the Modbus mapping file.
More details are in the sample file in g:\data\modbus.dat and g:\data\modbus_n.dat.
If the Slave is defined to be a CIMPLICITY project, the configuration file is
CIMMOD.DAT or CIMMOD_N.DAT. This is located in the data directory of the
CIMPLICITY project. For the CIMPLICITY data to work, the TCI Modbus option
must be installed in the CIMPLICITY project options. When this option is installed,
templates of these files are installed. There is information in the header of these files
on how to fill them out. They are almost the same as the unit configuration files. The
Mark VI uses CIMMOD.DAT

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-9

Adding or Modifying Entries in the MODBUS.DAT File


Rules and guidelines for adding or modifying entries in this file are as follows.
Rules:

Never define a bit of a packed holding register (such as HR0001.1) as @SPARE.


Defining just one of the bits as packed defines the entire register as a packed
register. A 0 is returned for bits not mapped

When a semi-colon is found in a line, the rest of the line is considered a


comment

Do not map any one register to both packed controller CSDB logic pointnames
and to an analog controller CSDB pointname

Do not have any one coil or register mapped more that once

Never add page breaks (form feeds) in this file

Guidelines:

The table entries may be in any order

It is not necessary to define all the table points in this file, only the ones desired

Group similar controller CSDB points together, such as temperatures, speed


signals, or controller command feedback signals

Table_Type, Table_Point, and CSDB_Pointname


The Table_Type is one of four kinds: HC, IC, HR, or IR.
The Table_Point ranges from 1 through 10000 points, and the CSDB_Pointname is a
valid control signal database pointname.
Following the CSDB_Pointname are optional fields to specify the minimum and
maximum values. These fields should always be specified except in the case of logic
points.

2-10 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

The following is a sample Modbus.Dat file:


;
;
MODBUS.DAT
;
; This file should be put in the unit directory to configure the MODBUS Slave.
;
; Each line should begin with:
; HCxxxx - Holding Coil, xxxx = coil number, this should be followed by a
;
pointname.
; ICxxxx - Input Coil, xxxx = coil number, this should be followed by a
;
pointname.
; HRxxxx - Holding register, xxxx = register number, this should be followed
;
by pointname, Minimum value, and Maximum value.
; IRxxxx - Input register, xxxx = register number, this should be followed by
;
pointname, Minimum value, and Maximum value.
;
; The Minimum and Maximum values a not required by any point that will fit in
; 16 bits directly. They can be used if wanted to rescale the point. The
; minimum value is the point value that will correspond to the minimum value
; for the mode. For signed 16 this is -32768, for unsigned 16 this is 0. The
; maximum value is the point value that will correspond to the maximum value
; for the mode. For signed 16 this is 32767, for unsigned 16 this is 65535.
;
; Holding registers and Input registers can also be set so that a boolean fills
; in each bit of the register.
; HRxxxx.b and IRxxxx.b where b is the bit number from 0 to 15.
;
HC0001
L4
HC0002
L52GX
;C0001
;C0002
;
;REGISTER
;NUMBER
;
IR0001
IR0002

L52GX
L4
SIGNAL
NAME
T54_1
T54_2

HR0001
T54_1
HR0002
T54_2
;
;PACKED REGISTERS
;
HR0200.0
L4
HR0200.15 L52GX
;

GEI-100517A Modbus for HMI Applications

MINIMUM
VALUE

MAXIMUM
VALUE

-200
-200

2000
2000

;TC
;TC

-200
-200

2000
2000

;TC
;TC

Chapter 2 Modbus Slave Mode 2-11

An example of a Modbus_N.Dat file, used for Native type data where no gain or
offset is used, is as follows:
;
; MODBUS_N.DAT - This file defines the points to be loaded by the HMI
;
for retrieval via a RS232 link using MODBUS protocol.
;
;----------------------------------------------------------------------;
; The HMI acts as a slave to a MODBUS master, typically a customer
; supplied Distributed Control System (DCS).
;
; The HR (Holding Register) and HC (Holding Coil) tables support 10000
; points each. This list does not show all available spare points,
; but they may be added at any time. The HR and HC tables are defined
; by MODBUS as READ/WRITE points.
;
; Two Other tables, IR (Input Registers) and IC (Input Coils), are
; also available, but HR and HC tables have been selected as a GEDS
; standard. The IR and IC tables are defined by MODBUS as READ only.
;
; Points may be defined as spare by the @SPARE symbol in the controller
; Signal Name field.
;
; The points in the tables need not be in numerical order. Likewise,
; @SPARE points may exist anywhere in the table without affecting any
; of the other points (except packed registers, discussed later).
;
; Points in the HC table are 1 byte (8 bits) in length and typically
; used for READ/WRITE logics, i.e. push-buttons and logic states. If
; the MODBUS master requests a change of state in a HC point, the HMI
; will attempt to WRITE to that signal in the controller Control Signal
; Database.
;
; Points in the HR table are 2 bytes (16 bits) in length and are used
; for READ/WRITE analogs and READ only logics, such as alarms, etc.
; HR points may be defined as 16 individual logics, holding registers
; such as these are referred to as packed registers. Individual bits
; (HR0xxx.0,..,HR0xxx.15) in a packed HR can be assigned Control logic
; points. However, if any bit in a packed HR is defined as an @SPARE
; then the entire HR defaults to spare. Therefore, any packed register
; which is not entirely filled should omit definitions for the unused bits.
;
;MODBUS
Mark V
;Table Point
Signal Name
;----------------------------------------------------------------------HR0001
BB_MAX
HR0002
CPD
HR0003
@SPARE
HR0004
@SPARE
HR0005
CTD
HR0006
CTDA3
HR0007
CTDA2
HR0008
CTIF1
HR0009
GENHUM
HR0010
CTIM
HR0011
DF
HR0012
DPF
HR0013
DRPF_CMD
HR0014
DRVAR
HR0015
DRVAR_CMD
HR0016
DV
HR0017
DVAR
HR0018
DVX
HR0019
DWATT
HR0020
FLAME

2-12 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

HR0021
HR0022
HR0023
HR0024
HR0025
HR0112
HR0113
HR0114
HR0115
HR0116
HR0117
HR0118
HR0119
HR0120

FSR
FSR1
FSRACC
FSRMAN
FSRMAX
QTLO1
QTLO2
@SPARE
DFL
CAP
DVOLT
DAMP
DVF
DAF

In this example, it can be seen that not all table points are defined or in order,
comments are added using a semi-colon ( ; ), and there are no duplicate table point
definitions.

CimMod
CimMod is a program used with the Mark IV and Mark VI systems. CimMod cooperates with the TCI Modbus Slave program to allow read and write access to data
in CIMPLICITY projects using normal Modbus messaging, and extends the data
capability of the TCI Modbus Slave program

The CimMod program gets data from the CIMPLICITY Point Manager (read) and
sets values in the CIMPLICITY Point Manager (write) based on messages to and
from the TCI Modbus slave program. CimMod is capable of scaling Modbus data for
presentation to the TCI Modbus slave program. Five Modbus modes are supported as
follows:
(move fwd)

RS16 - Signed 16

RU16 - Unsigned 16

UN12 - Unsigned 12

HW12 - Honeywell 12

NATIVE - Native

CimMod keeps its configuration files and log files in the following directories:

%site_root%data

%site_root%log

where %site_root% stands for an environment variable defined by the CIMPLICITY


project. For any given CIMPLICITY project, open the project workbench to
determine the variable of %site_root%

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-13

To Determine the Value of %site_root%


1. From the Desk Top, click on Start, Programs, CIMPLICITY, HMI, then
Workbench
2.

From the menu, select Tools, then Command Prompt. The resulting
Command Prompt window has the variable site_root defined for the selected
project. The percent signs surrounding site_root mean evaluate.

3.

To display site_root, enter


set site_root

For example, if the set site_root command results in the display:


site_root=c:\site\cimproj\

then the directory %site_root%data is c:\site\cimproj\data.


CimMod is configured by two files. Both files reside in the directory
%site_root%data. One file is called Cimmod_n.DAT and the other file is
Cimmod.DAT. See the example files Cimmod_N.DAT and Cimmod.DAT for
formatting information.
The Cimmod_n.DAT file handles the assignment of Modbus coils and registers to
CIMPLICITY data points when scaling is Native, that is no gain or offset is used.
When CIMPLICITY data exists in a format that will not fit within a single Modbus
register (16-bits), the Cimmod_n.DAT file can map up to four registers (8-bytes) to a
single CIMPLICITY data point.
The Cimmod.DAT file handles the assignment of Modbus coils and registers to
CIMPLICITY data points when scaling is not Native. A gain and offset is used to
scale the data into a register. The user specifies the calculated gain and offset by
specifying in the Cimmod.DAT file the maximum and minimum value for each point
assigned to a Modbus register.

2-14 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

CimMod Example
A sample CimMod.DAT file follows:
;
;
CimMod.DAT
;
; This file should be put in the CIMPLICITY projects data directory to ;
;configure the TCI-MODBUS Slave. This file is used for any slave mode other
;
than NATIVE.
; CimMod_N.dat is used for NATIVE mode.
;
; Each line should begin with:
; HCxxxx - Holding Coil, xxxx = coil number, this should be followed by a
;
pointname.
; ICxxxx - Input Coil, xxxx = coil number, this should be followed by a
;
pointname.
; HRxxxx - Holding register, xxxx = register number, this should be followed ;
by
;
pointname, Minimum value, and Maximum value.
; IRxxxx - Input register, xxxx = register number, this should be followed by
;
pointname, Minimum value, and Maximum value.
;
; The minimum value is the point value that will correspond to the
value for the mode. For signed 16 this is -32768, for unsigned 16
; The maximum value is the point value that will correspond to the
value
; for the mode. For signed 16 this is 32767, for unsigned 16 this
;
; Holding registers and Inputs registers can also be set so that a
fills in each bit of the register.
; HRxxxx.b and IRxxxx.b where b is the bit number from 0 to 15.
;
HC0001
BIT1
HC0002
BIT2
IC0001
IC0002
;
;REGISTER
;NUMBER
;
IR0001
IR0002

minimum
this is 0.
maximum

;
;

is 65535.
boolean

BIT1
BIT2
SIGNAL
NAME

MINIMUM
VALUE

MAXIMUM
VALUE

ANALOG_16
ANALOG_32

-1000
0

1000
2000

HR0001
ANALOG_16
HR0002
ANALOG_32
;
;PACKED REGISTERS
;
HR0200.0
BIT1
HR0200.15 BIT2
;

-1000
0

1000
2000

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-15

A sample CimMod_N.Dat file, used for Native type data where no gain or offset is
used, is as follows:
;
;
CimMod_N.DAT
;
; This file should be put in the CIMPLICITY projects data directory to
configure
; the TCI-MODBUS Slave. This file is used when the slave mode is NATIVE.
;
; Each line should begin with:
; HCxxxx - Holding Coil, xxxx = coil number, this should be followed by a
;
pointname.
; ICxxxx - Input Coil, xxxx = coil number, this should be followed by a
;
pointname.
; HRxxxx - Holding register, xxxx = register number, this should be followed
by
;
a pointname.
; IRxxxx - Input register, xxxx = register number, this should be followed by
;
a pointname.
;
; Multiple Holding registers and Input registers can be filled in by one
; point when data is requested in NATIVE mode. In NATIVE mode, a 32 bit value
; will take two registers and a 64-bit value will take four registers to
return.
; All the registers must be requested in the same message to get the correct
; value. Also all the registers must be sent in the same message to be set
; correctly.
; HRxxxx-yyyy and IRxxxx-yyyy where xxxx is the first register and yyyy is
; the last register.
;
; Holding registers and Inputs registers can also be set so that a boolean
fills
; in each bit of the register.
; HRxxxx.b and IRxxxx.b where b is the bit number from 0 to 15.
;
HC0001
BIT1
HC0002
BIT2
IC0001
IC0002
;
;REGISTER
;NUMBER
;
IR0001
IR0002

BIT1
BIT2
SIGNAL
NAME
ANALOG_16
ANALOG_32

HR0001
ANALOG_16
HR0002
ANALOG_32
;
;PACKED REGISTERS
;
HR0200.0
BIT1
HR0200.15 BIT2
;32 bit value
;
HR0010-0011 ANALOG_32
;
;64 bit value
;
HR0012-0015 REAL_64
;

2-16 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

The CIMPLICITY project and TCI must be restarted for changes to take effect. After
the TCI has restarted, inspect the file G:\LOG\MODBUS.LOG and %siteroot%log\CIMMOD.LOG for any errors or warnings.
Beware when configuring data from multiple devices. If one
device is down, Modbus requests will fail (exception code 4) if
they contain registers configured for points from the device
that is down.
It is best to group registers by device to help avoid a Modbus failure. For example, if
configuring data for two Mark VI controllers avoid interspersing data as follows:
HR0001
HR0002
HR0003
HR0004

G1\DWATT
G2\DWATT
G1\DVAR
G2\DVAR

It is preferable to group them so that each controller's points are in a contiguous


range of addresses as follows:
HR0001
HR0002
HR0003
HR0004

G1\DWATT
G1\DVAR
G2\DWATT
G2\DVAR

MODBUS_L.EXE: MODBUS Listing Program


After F:\UNITn\MODBUS.DAT is completed, the file F:\UNITn\MODBUS.LST can be
created as a convenience for use by the DCS vendor for setting up the DCS. This file
documents the Modbus tables.
MODBUS_L is a command line utility program run from the unit configuration
directory. It does not require any command line parameters, but a few are available to
change the default format or scale codes generated. If run with the /? parameter, it
produces a help screen, as shown in the example below:

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-17

F:\UNIT1>MODBUS_L /?
MODBUS_L: MODBUS LISTING PROGRAM
Command format: MODBUS_L [options]
options:
ENGLISH, METRIC, CUSTOM, HARDWARE
These options control the scale code set used to supply the gain,
offset, and engineering units for each point.
RS16, RU16, UN12, HW12, NATIVE
These options control the formatting of the raw data, with the
appropriate changes to the gain and offset for each point.
QUIET
This option disables the printout to the terminal of messages
indicating that a point name was not found in the dictionary.
The messages, however, will be indicated in the MODBUS.LST file.
NOLONG
This option produces a MODBUS.LST file without longnames.
LONG
This option makes a MODBUS.LST with a nonlogic longname field of
66 characters. The nonlogic longname field default is 40 char.
/LOG
Redirect output sent to the screen into MODBUS_L.LOG.
F:\UNIT1>

The Modbus listing file


defines the format and scaling
of each mapped coil and
register. Included in this list
is an indication of which
signals are controller
commands

The Modbus Listing Program, G:\EXEC\MODBUS_L.EXE, reads the necessary


configuration files in the TCI and creates F:\UNITn\MODBUS.LST. This file contains
a list of the coil and register maps, complete with scaling information. It is
recommended that a new listing file be created each time F:\UNITn\MODBUS.DAT is
changed, or when the mode defined for the Modbus link is changed in
F:\IO_PORTS.DAT. This Modbus listing file is the key to programming the DCS end
of the Modbus link.
To create a new listing file F:\UNITn\MODBUS.LST

From the Command Prompt in F: , enter:


\UNITn
MODBUS_L

The new listing is created.


There is a corresponding Modbus listing program for CIMPLICITY. It is
CimMod_L.exe.
To run CimMod_L.exe

1.

From the Command Prompt for the CIMPLICITY Workbench, change


directory to the data directory. Enter:

2.

Enter:

cd data
CimMod_L

The message Modbus list processing complete displays.

2-18 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

MODBUS_L Command Format


The options described below are used to modify the format of
F:\UNITn\MODBUS.LST.

scaling (ENGLISH, METRIC, CUSTOM, HARDWARE) determines which


F:\UNITn\*.SCA file is used (ENGLISH.SCA is the default file).
mode (RS16, RU16, UN12, HW12, NATIVE) used must match the mode defined in
F:\IO_PORTS.DAT. Since different Modbus links can be running in different modes
at the same time, the desired mode should be specified.
quiet if used, F:\UNITn\MODBUS.LST should be checked for error messages, as the
errors will not be displayed on the screen.
nolong omits longnames (controller control signal database pointname definitions)
defined in the file F:\UNITn\LONGNAME.DAT.
long is used to widen F:\UNITn\MODBUS.LST to avoid trimming longnames of
nonlogic (analog) signals.
MODBUS_L flags errors such as duplicate coil or register assignments, undefined
controller CSDB pointnames, invalid formats, invalid coil or register numbers, and
conversion errors. Resolve all errors before communicating with the DCS.

F:\UNITn\MODBUS.LST: MODBUS Listing File


The following is a sample F:\UNITn\MODBUS.LST file:
+HR0001
|
+HR0002
|
+HR0003
|
HR0004
|
HR0005
|
+HR0006
|
+HR0009
|
HR00010 |
HR0200.00|
HR0200.01|
HR0200.02|
HR0200.03|
+HC0001
|
+HC0002
|
+HC0003
|
+HC0004
|

SWREF_CMD
DRVAR_CMD
SC43LOAD
@SPARE
@SPARE
L90PSEL_CMD
SC43
SS43
L52GX
L94X
L30D_SD
L30D_SU
L1FAST_CPB
L1START_CPB
L70R4R_CPB
L70R4L_CPB

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

SIGN16
SIGN16
UNS16
spare
spare
SIGN16
UNS16
UNS16
PACKED
PACKED
PACKED
PACKED
LOGIC
LOGIC
LOGIC
LOGIC

GEI-100517A Modbus for HMI Applications

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

512 | 0 | MW
|
512 | 0 | MVAR |
65536 | 0 | STATE |
512 | 0 | MW
| PRESELECTED LOAD ANALOG SETPOINT
65536 | 0 | STATE | TURBINE CONTROL SELECTION
65536 | 0 | STATE | TURBINE COMMAND STATE SELECTION
GENERATOR BREAKER CLOSURE
NORMAL SHUTDOWN
NORMAL DISPLAY MESSAGE SHUTDOWN STATUS
NORMAL DISPLAY MESSAGE STARTUP STATUS
FAST LOAD START SIGNAL
START SIGNAL
SPEED SETPOINT RAISE COMMAND PUSHBUTTON
SPEED SETPOINT LOWER COMMAND PUSHBUTTON

Chapter 2 Modbus Slave Mode 2-19

Each line in F:\UNITn\MODBUS.LST contains the information below in the following


order:

(Write Status + means writable)

Table Point

CSDB Pointname

Data Format

Gain

Offset

Units

Longname

(Write Status) A preceding plus sign (+) indicates that this is mapped to a
controller command. In this case it is legal for the DCS to request a write to the point,
and thus issue the command to the controller. The sample listing shows holding
register 1 as an analog command, holding coil 1 as a logic command, and holding
register 9 as an enumerated state variable that can be written to the controller. Logic
controller commands cannot be written if packed into holding registers (see above
section Modbus Slave Configuration: Holding Coils, Input Coils, Holding Registers,
Input Registers). In this sample, a 0 may select OFF, 1 may select CRANK, and 2
may select AUTO.
Table Point indicates which one of the four Mapping Types and what point on the
table is used for this point.
CSDB Pointname controller control signal database pointname that the coil or
register maps.
Data Format transmission mode used to send the data over the Modbus link.
Packed 16 bit register containing packed logics
Sign16 signed 16 bit signal
Uns16

unsigned 16 bit signal

Logic

true/false

Spare

spare

Uns12

unsigned 12 bit signal

Hw12

Hardware 12 bit signal

Uns8

unsigned 8 bit signal

Real32 32 bit real signal


?

error conditions will contain the character ?

Gain required to convert the Modbus value of registers to engineering units.


Offset required to convert the Modbus value of registers to engineering units.

2-20 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

Engineering Units displayed units associated with the above Modbus Gain and
Offset for registers. An entry of HEX indicates that this point is not normally
converted into engineering units, but displayed in hexadecimal. Special points, such
as bit masks, are defined this way.
Longname description of the signal found in F:\UNITn\LONGNAME.DAT.
When F:\UNITn\MODBUS.LST is generated, do not edit it since running MODBUS_L
overwrites any changes.

Modbus Data Format and Scaling


The data formats used for logic and analog signals are described below.

Modbus Data Conversions: Logics


Logic control database signal values can be transmitted to the DCS using either coils
or registers. Coil data conversion corresponds to a single logic control database
signal with the least significant bit (LSB) indicating its state.
When registers are used to transmit logic control database signal values, each bit
corresponds to the state of a logic signal. A register having 16 bits corresponds to a
group of (up to) 16 logicals with the LSB being the first logic signal in the group,
and the most significant bit (MSB) as the last logic signal in the group. The two bytes
are packed into the Modbus message using the normal rules for MSB and LSB order.
The values of undefined bits in a packed register are transmitted as 0. Read carefully
for details on the modes used in transmission of data, because some modes may not
be suitable for bit packed registers.

Modbus Data Conversions: Analogs


Analog signal values can be transmitted using registers only. Since DCS vendors
handle analog signals in different ways, for example 12-bit positive numbers, analog
data may be transmitted in one of several modes. The following modes are currently
supported to meet customer needs. This section defines how to convert each data type
to engineering units. The Modbus listing file (see above) defines the data type for
each signal.
The conversion algorithms presented here define the conversion process at the most
understandable level. The implementation of these algorithms does not always follow
these algorithms directly as there are many different schemes used to prevent
mathematical overflows in the computations. The choice of the final implementation
is left to the DCS vendor.

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-21

RS16
If a scaling is of type SIGN16, it is a signed 16-bit number. In this mode, the most
significant bit of the 16-bit analog signal is treated as a sign bit, where a 1 is used for
negative values.
C2 type signals are transmitted modulo 32768 to prevent the sign bit from being set.
H2 and X2 types are transmitted directly with an assumed value of (-32768 to
+32767). The convention of assuming the raw value is a fraction from -1.0 to +1.0
was used in defining the Modbus Gain and Offset. This allows the Gain to indicate
the maximum (and minimum) value when the Offset is zero. The Modbus listing file
defines the Modbus Gain and Offset required to calculate the value in engineering
units, with the conversion being as follows:
Engineering units = (Raw_value) / 32768 * Gain + Offset
For example, thermocouples are scaled with a gain of 2048 and an offset of 0 for
conversion to F. If the register value is 1120, the conversion to engineering units is:
Engineering units = (1120) / 32768 * 2048 + 0
Engineering units = 70 F

RU16
If a scaling is of type UNS16, it is an unsigned 16-bit number. This mode transmits
F2 analog signals as unsigned 16-bit numbers by adding 32768. The most significant
bit, therefore, turns from a sign bit into a bit with a weight of 32768. This transforms
the range of F2 signals to [0,+65535]. The Modbus listing file defines the Modbus
Gain and Offset required to calculate the value into engineering units, with the
conversion being:
Engineering units = (Raw_value) / 65536 * Gain + Offset
Example 1: If an UNS16 is used for a normal counter, the raw value is the value of
the counter. If a counter has the value of 418, it is converted as:
Engineering units = (418) / 65536 * 65536 + 0
Engineering units = 418
Example 2: A number that is normally a signed number in the controller is requested
as an unsigned number. If the register value of a thermocouple was requested, it
shows that in UNS16 mode the Modbus Gain is 4096, and the Offset is -2048 for F.
The conversion of the raw data value of 33888 to engineering units is as follows:
Engineering units = (33888) / 65536 * 4096 2048
Engineering units = 70 F
Converting a SIGN16 to an UNS16 causes no loss of resolution.

UN12
If a scaling is of type UN12, it is an unsigned 12-bit number. The function of this
mode is to restrict signals to a range of [0,+4095]. The Modbus listing files Modbus
Gain and Offset define the conversion into engineering units, where the conversion
is:
Engineering units = (Raw_value) / 4096 * Gain + Offset

2-22 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

For example, if the register value of a thermocouple is requested, the listing file
shows that the Modbus Gain is 4096 and the Offset is -2048 to get to F. The
conversion of the register value of 2118 to engineering units is:
Engineering units = (2118) / 4096 * 4096 2048
Engineering units = 70 F
The conversion from SIGN16
to UN12 causes a loss in
resolution of 16:1 and should
be avoided

Certain internal signal types (for example H2, X2) become meaningless if restricted
to the UN12 range and are therefore transmitted directly without conversion (if
requested by the DCS). Logics packed into registers also become meaningless if the
registers value is converted. The Modbus listing file lists these points with a mode
of UN16. Most analog signals that are of interest to the DCS are in an F2
representation. A gain of 1/16 is applied to F2 signals and 2048 is added to convert
the range from [-32767, +32767] to [0, +4095]. The unsigned 16-bit signal type C2
is transmitted Modulo 4096 to also restrict the range to [0, +4095].

HW12
A special version of the UN12 mode is available for use with some models of DCS
systems. These systems collect data using the normal UN12 mode described above,
but are unable to send analog setpoints to the controller using the same GAIN and
OFFSET conversion. In these DCS systems, no OFFSET is allowed in the conversion
of analog setpoint commands to Modbus register values, only a GAIN.
To accommodate these systems, the HW12 mode reports data to the DCS using
UN12 mode, but uses a different formula for analog setpoint commands sent from the
DCS to the controller. This scheme allows the DCS the full positive range of the
controller command, but does prevent sending negative values. Analog setpoint
commands in these systems are usually scaled in percentages.
The HW12 mode analog
setpoint command is the only
place where this is true.

Make sure that the programming in the DCS reflects the fact that the scaling of the
analog setpoint command to the controller is different than the scaling of the
feedback signal from the controller.
For data from the controller to the DCS, the conversion is the same as the UN12
mode:
Engineering units = (Raw_value) / 4096 * Gain + Offset
For setpoint commands from the controller to the DCS, and the DCS to the
controller, the conversion is:
Engineering units = (Raw_value) / 8192 * Gain
Raw_command_value = (Engineering units / Gain) * 8192
Example: If a valve position is requested, the listing file shows that the Modbus
Gain is 256 and the Offset is 0 to get percent. The conversion of the register value of
1216 to engineering units is :
Engineering units = (1216) / 8192 * 256
Engineering units = 38%
To send the analog setpoint command to set the valve to this same position of 38%,
the analog setpoint command value that must be sent is:
Raw_command_value = (38) / 256 * 8192
Raw_command_value = 1216

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-23

Native
If a point is of data type Native, all analog signals are transmitted in their internal
controller representation. This is the recommended mode because the signals can be
transmitted directly without any manipulation, which could result in decreased
resolution. Any 32-bit signal requires two registers to be assigned to it. These data
points are defined in F:\UNITn\MODBUS_N.DAT, not the standard definition file.
The most common signal types used in the controller are as follows:

L1

logic signal, least significant bit indicating state 0 or 1.

F2

16-bit signed twos complement representation, range: [-32767, +32767]

C2

16-bit unsigned representation, range: [0,+65535].

S2

16-bit signed representation, range: [-32768,+32767].

H2

16-bit unsigned representation used for bit masks.

X2

16-bit unsigned representation used to form the lower 16-bits of long,


32-bit values.

F4

32-bit signed twos complement representation.

C4

32-bit unsigned representation.

H4

32-bit unsigned representation used for bit masks.

R4

32-bit real floating point number.

2-24 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

Modbus Command and Response Definition


MSB means Most Significant
Byte.
LSB means Least Significant
Byte.

This section describes the commands and responses supported to implement required
Modbus slave communications and control functions. Messages are transmitted and
received using the Remote Terminal Unit (RTU) 8-bit transmission mode, which is
one of two Modbus transmission modes, where RTU transmits data in eight bit bytes.
The other mode, where characters are transmitted in ASCII, is not supported. The
RTU transmission mode uses the format below (where slave address, function code,
CRC-16 MSB, CRC-16 LSB are all bytes):
+-----------------------------------------+
SLAVE FUNCTION

CRC-16CRC-16
ADDRESS CODE
...DATA...
(MSB) (LSB)

+-----------------------------------------+

RTU Transmission Mode


slave address a number from 0 to 255 that specifies the unit with which to
communicate (a slave address of 0 is considered a broadcast message to all slaves).
function code this specifies the purpose and format of the remaining message
portion.
CRC-16 This is two bytes that complete each Modbus message. CRC (Cycle
Redundancy Check), MSB, and LSB are bytes used for error checking and are
calculated for each transmitted and received message to insure that no transmission
error has occurred while the message was in transit. The method for calculating the
CRC-16 is a public protocol and is described in numerous textbooks and the Gould
Modicon Modbus Protocol Reference Guide. Please refer to these other documents
for information on calculation of a correct CRC.
Modbus over Ethernet adds the header below to the message formats. All the same
functions are supported over Ethernet that are supported over the serial ports, but the
CRC is not included at the end of the Modbus message; the CRC is included in the
Ethernet message.
+---------------------------------------------------INV INV PROTOPROTO

Standard serial
ID
ID
ID
ID
LEN LEN function message
(MSB)(LSB)(MSB)(LSB)(MSB)(LSB)
+----------------------------------------------------

invocation id is not used by TCI Modbus.


proto id is not used by TCI Modbus.
length is the byte count of the remaining part of the message. This is used by TCI
Modbus to receive the rest of the message, which is exactly what is sent and received
over the serial connections.

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-25

Message Errors
When a message is received that cannot be acted upon, the message is either ignored
and the HMI waits for the next message, or it is responded to with an exception
message.
Any messages that are misunderstood, incomplete, or altered in some manner as
indicated by framing error, parity error, or CRC-16 error are always ignored because
it is not possible to reliably determine for which address the message was intended. It
is the masters responsibility to detect this timeout condition and resend the message
as necessary (see the section TCI Modbus Configuration in this Chapter).
Any time a message receipt is in progress and an interval of time corresponding to
3.5 character times (based on the baud rate) occurs without receipt of a character, the
message receipt in progress is aborted and ignored. Message failures from other
causes are responded to with an exception response if no reception error has occurred
and if the message was not a broadcast (slave address was 0).

2-26 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

Statistics, Diagnostics, and Testing


The Modbus Slave program gathers statistics and makes counters available for
diagnostic purposes. The program M_stat.exe is a special console program to
communicate with the Modbus Slave program, and retrieve and control these
diagnostic counters To determine whether Modbus slave is working correctly, run
M_stat and see if the error counters are incrementing
Running M_stat displays these counters as follows:
F:\USER>m_stat

Modbus Slave statistical summary:


Modbus Slave 1.
4815 = Count of messages sent by Modbus Slave.
0 = Count of bad messages sent by Modbus Slave.
4815 = Count of successful replies.
0 = Count of exception replies.
0 = Count of message timeouts.
0 = Count of buffer full, read error, and so on
0 = Count of CRC errors.
0 = Count of bad received messages.
Modbus Slave 2.
4815 = Count of messages sent by Modbus Slave.
0 = Count of bad messages sent by Modbus Slave.
4745 = Count of successful replies.
0 = Count of exception replies.
45 = Count of message timeouts.
0 = Count of buffer full, read error, and so on
0 = Count of CRC errors.
25 = Count of bad received messages.
When multiple Modbus Slaves appear, each group corresponds to a separate port as
specified in the F:\IO_PORTS.DAT file. The counters can be reset by passing reset as
a parameter to the M_stat program. Reset is case insensitive.

Trace Global Sections


Message traffic from the Modbus subsystems is stored in circular buffers in Global
Sections. This data can be collected from a command prompt and used for
diagnostics. A number of Global Sections are available to access different types of
messages.

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-27

Trace Global Names


The trace command format is GBL2FILE [global section name] [filename], for
example:
GBL2FILE modbus_trace C:\TEMP\MODBUS.DMP

GBL2FILE is the command name. The global section name is from the table below,
and is case sensitive. The output file name and its path are chosen by the user. GE
can assist with debugging a specific problem using this output file. On newer HMI
products, it is possible to collect and view the data via the Web Interface on the
system.
The table below shows useful Trace Global Section Names. In this listing, %d is
replaced by a number 1 through 8:
Table 2-2. Trace Global Section Names
Global Section Name

Global Section Description

cimmod_trace

CIMPLICITY - TCI MODBUS Traffic Log

MModbus_trace%d

MODBUS Master Traffic Log - Port %d

modb_fwd_trace

MODBUS Forwarder Traffic Log

modbus_trace

MODBUS Slave Traffic Log

Examples of trace commands are as follows:


For the Modbus Master Traffic log:
g:\exec\gbl2file MModbus_trace1 g:\log\mmbus.log

For the Modbus Forwarder Traffic log:


g:\exec\gbl2file modb_fwd_trace g:\log\modb_fwd.log

For the Modbus Slave Traffic log:


g:\exec\gbl2file modbus_trace g:\log\modbus.log

The output file name is any convenient identifier for storing the log.

Log File
If the Modbus driver encounters a serious error or warning, the result is placed in a
log file as well as the global section trace buffer. To view this log file, check the file
G:\LOG\Modbus.log.

2-28 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

CIMMOD Diagnostics
Information about CimMod and its configuration is available from several sources:

An error log entitled CimMod.log is created each time the CIMPLICITY project
runs the CimMod program. Configuration errors, details and information reside
in this file. This file is created in the directory:
%site_root%log

A program Cimmod_L provides detailed mapping information. This program


reads the configuration files to produce a file entitled CIMMOD.LST.
The CimMod global section trace may be viewed by executing the program
g:\exec\gbl2file. Give the global section trace name, cimmod_trace, and an

output filename. The trace name is case sensitive, for example:


g:\exec\gbl2file cimmod_trace g:\log\cimmod.log

If additional details concerning configuration and messages in the cimmod_trace


are desired, the keyword VERBOSE can be placed on a line by itself in either or
both of the configuration files Cimmod.DAT and Cimmod_n.dat.

Additional details are available using the normal Modbus slave diagnostics.

Modbus Master Simulation


If problems occur when the DCS system acts as a Modbus Master to the HMI, test
the Modbus link using the Modbus Master Simulation Program, MODSCAN32.
Modscan32 is a product of
Win TECH Software Design.
Program documentation and a
sample program is available
from:

MODSCAN32 is a Windows Modbus Master Program used for Modbus Testing.


The program runs on a separate laptop or other computer, and connects from one of
its COM ports to the COM port on the Modbus Slave or HMI. The COM port on the
HMI is defined in the F:\IO_PORTS.DAT file. A null modem cable is used for a
direct connection, or the Line Drivers that often ship with the unit can be used.

http://www.win-tech.com
/html/modscan32.htm

GEI-100517A Modbus for HMI Applications

Chapter 2 Modbus Slave Mode 2-29

Notes
.

2-30 Chapter 2 Modbus Slave Mode

GEI-100517A Modbus for HMI Applications

Chapter 3 Modbus Master Mode

Introduction
This chapter describes how the HMI can be set up as a Modbus Master to
communicate with intelligent devices that can be configured as Modbus slaves.
Differences between Master mode and the Slave mode discussed in Chapter 2 are as
follows:

Master mode does not use CimMod

Master mode does not use Modbus_L

The Modbus Master program adds two write items to the items in the Slave
program, as follows:
Read Items: Hold Coil, Hold Register, Input Coil, Input Register
Write Items: Write Coil, Write Register

Slave mode is used when the HMI is responding to Modbus requests for data,
such as from a DCS. Master mode is used when the HMI must make Modbus
requests for data from devices.

Master mode uses the same Modbus Data Conversions as Slave mode (refer to
Chapter 2 Modbus Data Format and Scaling).

External Communication Links


External communication links allow the HMI to communicate with other Modbus
slaves over up to eight serial communication ports. Communication is possible over
these links with up to 48 different Modbus slaves. The physical link layers are the
same as for the Slave mode (refer to Chapter 2 Modbus Slave Mode). Ethernet
communication using Modbus TCP/IP is supported.

GEI-100517A Modbus for HMI Applications

Chapter 3 Modbus Master Mode 3-1

Modbus Master Setup


The Modbus Master program first reads one or more sections of a file called
F:\IO_PORTS.DAT for information specifying Modbus port and hardware
characteristics. This section, [MODBUS_MASTER_PORT], provides details as
follows:

Port, baud rate, parity

Modbus address and software characteristics, such as slave address and unit
number. Up to 48 master entries may be specified.

Modbus timeout and loop characteristics

This program ignores Modbus slave assignment.


The program then reads a Modbus data file in the unit directory for information
specifying a correspondence between Modbus data structures (for example holding
registers, holding coils, input registers, input coils) and the corresponding controller
data points and scaling information. The data file resides in the unit directory
(F:\UNITn) and has a filename in the form MMBUSnnn.DAT where nnn is the slave
address being referenced. Multiple MMBUSnnn.DAT files may exist in the same
directory. For example, if the F:\IO_PORTS.DAT file specified that we communicate
with slave address 3, with lines such as:
Master 3 Unit Mm Mode RS16

then the Modbus Master program would read file MMBUS3.DAT from the unit
directory to determine the register and coil correspondence. Leading zeros for nnn
are not used. Also, the default file name can be overriden as shown in the following
example:
Master 3 Unit Mm Mode RS16 File MMDATA.DAT

Next, the program opens the port specified above and starts sending out requests to
the up to 48 slave addresses it was configured to poll. Upon receiving a message
reply, the program stores the data in the unit data dictionary as appropriate.

Modbus Master Configuration


This section describes the
Modbus Master sections in
the TCI port
definition/configuration file,
F:\IO_PORTS.DAT, and in
the data configuration files,

In the TCI port definition/configuration file, F:\IO_PORTS.DAT, comments are


specified by a semicolon. Any semicolon makes the remainder of the line a comment,
which is ignored. There is only one section used by the Modbus Master entitled
[MODBUS_MASTER_PORT], but this section may appear up to eight times. Each
appearance should correspond to a separate communications port for the Modbus
Master.

F:\UNITn\MMBUSn.DAT

For example, the first [MODBUS_MASTER_PORT] section may be for com2 while
the next section might be for com3. These sections should appear as above, including
brackets. They may appear in any order. Sections other than
[MODBUS_MASTER_PORT] are ignored by this program. Data lines following
each section specify configuration information.

3-2 Chapter 3 Modbus Master Mode

GEI-100517A Modbus for HMI Applications

For the section [MODBUS_MASTER_PORT], some sample data lines follow:


[MODBUS_MASTER_PORT]
port
com2
baud
9600
parity
0 ;0-4 (none, odd, even, mark, space)
databits 8 ;5-8
stopbits 0 ;0-2 (1, 1.5, 2 stop bits)
xonxoff
0 ;0-1
port_it
4 ;Timeout interval between characters, msec. Default=40
;Normally, port_it should specify 3.5 character times as
;defined by the Modbus Gould specification. At 9600 baud,
;and 8 data bits, 1 start, and 1 stop bit, this yields
;a character time of 1.04 msec. 3.5 character times would
;therefore be 3.125 msec.
port_tt 200 ;Timeout for total message, msec. Default=200
;This is time to receive message only, not process it.
modbus_timeout 2000
;Time (milliseconds) before we give up
;waiting for a response from a slave.
;Default timeout is 2000 milliseconds.
;Minimum timeout is
100 milliseconds.
;Maximum timeout is 60000 milliseconds.
modbus_loop
5000
;Time (milliseconds) before we restart
;the request loop. This is the period of
;between asking the slave(s) for all the
;data specified and the time we start
;over and reask.
;Default loop is
5000 milliseconds.
;Minimum loop is
100 milliseconds.
;Maximum loop is 86400000 milliseconds.
MASTER 1 UNIT 62 MODE RS16
MASTER 2 UNIT T3 MODE RS16
[MODBUS_MASTER_PORT]
port
com3
baud
9600
MASTER 7 UNIT 63 MODE RU16

Comments
The above example defines two ports for use with Modbus Master. Both com2 and
com3 are used. Modbus slave ids 1 and 2 are reached using com2, and Modbus slave
id 7 is reached using com3.
For port, specify com1, com2, com3, ...
To disable, specify none
For baud, specify baud rates supported by the operating system.
For parity, specify 0 for none, 1 for odd, 2 for even, 3 for mark, or 4 for space.
For databits, always specify 8
This is a common error, check
carefully

For stop bits, specify 0 for 1 stop bit, 1 for 1.5 stop bits, or 2 for 2 stop bits.

GEI-100517A Modbus for HMI Applications

Chapter 3 Modbus Master Mode 3-3

For xonxoff, specify 0 to disable.


For port_it, specify intercharacter timeout as desired based on DCS transmission.
The Modbus specification specifies 3.5 character times. For 9600 baud in the
example above, show that 4 ms is appropriate for strict adherence to the Gould
Modbus specification.
For port_tt, specify the total time permitted for the HMI to receive a message from
the DCS, starting from receipt of the first character. Normally it will be most
convenient to make this number high and use only the intercharacter timeout, port_it.
The only required entries are port and MASTER-UNIT-MODE. Baud defaults to
9600. Parity, databits, stopbits, and xonxoff default as shown above. Port_it defaults
to 40. Port_tt defaults to 200.

MASTER-UNIT-MODE line
The MASTER-UNIT-MODE line is formatted as follows:
MASTER mmm UNIT uu MODE keyword
mmm is the Slave address (in decimal) to use when communicating with unit uu.
uu is the two-character unit name (defined in F:\CONFIG.DAT)
keyword is either RS16 or RU16 for Signed & Unsigned data respectively.
MASTER, UNIT, and MODE are required entries. A new line should appear for
each unit or slave address. Normally this is one or two lines for typical data patterns.
A maximum of 48 MASTER-UNIT-MODE lines may appear.
Each line requires the following:
MASTER followed by a slave entry specifying a Modbus Slave id number
UNIT followed by a two-character unit id. These IDs correspond to the units already
defined in F:\CONFIG.DAT.
MODE followed by RS16 or RU16. For analog data, use RS16 for signed mode,
RU16 for unsigned.

RS16 specifies a signed result, ranging from a minimum of -32768 (hex 8000) to
a maximum of 32767 (hex 7FFF).

RU16 specifies an unsigned result, ranging from a minimum of zero to a


maximum of 65535 (hex FFFF).
Raw data in the slave is rescaled based on the minimum and maximum numbers
provided in the F:\UNITn\MMBUSnnn.DAT data file to a result specified.

3-4 Chapter 3 Modbus Master Mode

GEI-100517A Modbus for HMI Applications

The following sample data configuration file MMBUS1.DAT shows register scaling
for thermocouple data:
;
;
MMBUSn.DAT for Modbus Master
;---------------------------------------------------------;
;
;HOLDING COILS (1)
;------------HC9
L5
;
;
;INPUT COILS (2)
;----------IC0001
L1
IC0002
L2
IC0003
L3
;
;HOLDING REGISTERS (3)
;--------------;REGISTER
SIGNAL
MINIMUM
MAXIMUM
;NUMBER
NAME
CDB VALUE
CDB VALUE
;SCALE TYPE
HR0002
ABC2
-200
2000
;TC
HR0003
ABC3
-200
2000
;TC
HR0004
ABC4
-200
2000
;TC
HR0005
ABC5
-200
2000
;TC
HR0006
ABC6
-200
2000
;TC
HR0007
ABC7
-200
2000
;TC
;
;INPUT REGISTERS (4)
;--------------;REGISTER
SIGNAL
MINIMUM
MAXIMUM
;NUMBER
NAME
CDB VALUE
CDB VALUE
;SCALE TYPE
IR0001
ABC1
-200
2000
;TC
IR0005
DEF1
-2147483648
2147483647
IR0006.1
L6
IR0006.2
L7
IR0006.3
L8
IR0006.4
L9
IR0006.5
L10
;
;WRITE HOLDING COIL (5)
;-----------------WC0004
L4
;
;WRITE HOLDING REGISTER (6)
;---------------------WR0010
ABC10
-200
2000
;TC
WR0011
ABC11
-200
2000
;TC

GEI-100517A Modbus for HMI Applications

Chapter 3 Modbus Master Mode 3-5

Statistics
The Modbus Master program gathers statistics and makes counters available for
diagnostic purposes. The program MM_stat.exe is a special console program to
communicate with the Modbus Master program and retrieve and control these
diagnostic counters. Running MM_stat displays the counters as follows:
F:\USER>mm_stat
Modbus Master statistical summary:
Modbus Master 1.
4815 = Count of messages sent by Modbus Master.
0 = Count of bad messages sent by Modbus Master.
4815 = Count of successful replies.
0 = Count of exception replies.
0 = Count of message timeouts.
0 = Count of buffer full, read error, and so on
0 = Count of CRC errors.
0 = Count of bad received messages.
Modbus Master 2.
4815 = Count of messages sent by Modbus Master.
0 = Count of bad messages sent by Modbus Master.
4745 = Count of successful replies.
0 = Count of exception replies.
45 = Count of message timeouts.
0 = Count of buffer full, read error, and so on
0 = Count of CRC errors.
25 = Count of bad received messages.
When multiple Modbus Masters appear, each group corresponds to a separate port as
specified in the F:\IO_PORTS.DAT file.
The counters can be reset by passing reset as a parameter to the MM_stat program.
Reset is case insensitive and does not include the quotation marks.

3-6 Chapter 3 Modbus Master Mode

GEI-100517A Modbus for HMI Applications

Modbus Master Diagnostics


Diagnostic data from a Trace Global Section can be collected as for Modbus Slave
mode (refer to Chapter 2). When debug is on, which it is by default, the global
section trace buffer may be viewed with the command:
gbl2file MModbus_trace# <some_file_name>

where # is 1,2,3,...8 depending on which [MODBUS_MASTER_PORT] section


corresponds to the information required. If only one [MODBUS_MASTER_PORT]
section exists, then the global section trace command can be viewed with:
gbl2file MModbus_trace1 modbus1.dat

This displays some debugging and program status information.


The trace option may be turned off by adding /NOTRACE to the command line:
MModbus /NOTRACE

If the program encounters a serious error or warning, the result is placed in a log file
as well as the global section trace buffer. To view this log file, check the file
G:\LOG\MModbus#.log where # is defined as above.

GEI-100517A Modbus for HMI Applications

Chapter 3 Modbus Master Mode 3-7

Chapter 4 Applications

Introduction
This chapter discusses the application of Modbus Slave mode to the three types of
turbine controllers, the Mark IV, Mark V, and Mark VI, and to several different
PLCs that can be interfaced to the system for control of balance of plant equipment.

Mark V Systems
The HMI can be configured as a Modbus slave to provide Mark V data to the DCS.
Figure 4-1 shows the data flow through the HMI from the controller to the DCS, and
the commands from the DCS to the controller. Data flow for the Mark V LM
controller is similar.

HMI SERVER

Mark V
Turbine
Controller

TCI
Modbus
Data Slave

Commands

Commands
Data

DCS
(Modbus
Master)

Figure 4-1. Data Flow from the Mark V System in Modbus Slave Mode

Configuration of the TCI Modbus Slave is discussed in detail in Chapter 2. The main
steps are summarized as follows:
1.

Choose the wiring hardware and HMI port for communication with the DCS,
serial or Ethernet.

2.

Configure the communication ports, baud rate, and slave identification to create
the IO_PORTS.DAT file.

3.

Map the registers and coils to the controller signal database point names to
create the Modbus.dat file, or Modbus_N.dat file for native data.

GEI-100517A Modbus for HMI Applications

Chapter 4 Applications 4-1

4.

Run the listing program to obtain the Modbus.LST file, containing a list of the
coil and register maps along with scaling information. This can be used to
configure the DCS Modbus master.

Logic Commands
A logic command to the controller can be sent as either a Control Pushbutton (CPB)
or as a Logic State Command. The CPB command is written once, and the controller
acts on it and resets the function afterwards. The Logic State Command sets a
memory location in the controller, which stays in that state until reset.
Commands to the Mark V should be limited to a rate of less than 10 per second. In
the case of setpoint control, this rate excludes the use of cascaded setpoints, as used
in cascade loops. The DCS functions are therefore limited to supervisory control.

Mark IV Systems
The HMI can be configured as a Modbus slave to provide Mark IV data to the DCS.
The data flow through the HMI from the controller to the DCS, and the flow of
commands from the DCS to the controller is shown in Figure 4-2.

HMI SERVER

Mark IV Commands
Turbine
Data
Controller

TCI

CIMPLICITY

CIMMOD

TCI
Commands
Modbus
Data
Slave

DCS
(Modbus
Master)

Figure 4-2. Data Flow from the Mark IV System in Modbus Slave Mode

Configuration of TCI as a
Modbus Slave is discussed in
detail in Chapter 2.

The main steps to configure the TCI are summarized as follows:


1.

Choose the wiring hardware and HMI port for communication with the DCS,
serial or Ethernet.

1.

Configure the communication ports, baud rate, and slave identification to create
the IO_PORTS.DAT file.

2.

Map the registers and coils to the controller signal database point names to
create the CimMod.dat file, or CimMod_N.dat file for native data.

3.

Run the listing program to obtain the CimMod.LST file, containing a list of the
coil and register maps along with scaling information. This can be used to
configure the DCS Modbus master.

Modbus Points
If some of the desired Modbus points are not in the CIMPLICITY project, they must
be added. Use the Signal Manager to add these Mark IV points.

4-2 Chapter 4 Applications

GEI-100517A Modbus for HMI Applications

Logic Commands
A logic command to the controller can be sent as either a CPB or as a Logic State
Command. The CPB command is written once, and the controller acts on it and resets
the function afterwards. The Logic State Command sets a memory location in the
controller, which stays in that state until reset.
Commands to the Mark IV should be limited to less than 10 per second. For setpoint
control, this rate excludes the use of cascaded setpoints, as used in cascade loops.
The DCS functions are therefore limited to supervisory control.

Mark VI Systems
The HMI can be configured as a Modbus Slave to provide Mark VI data to the DCS.
Figure 4-3 shows the data flow through the HMI from the controller to the DCS, and
the flow of commands from the DCS to the controller. The DCS usually connects to
the PDH with an Ethernet cable, but a serial cable is possible.
HMI SERVER
Mark VI
Turbine
Controller

Commands
Data

EGD
Service

CIMPLICITY

CIMMOD

TCI
Modbus
Slave

Commands
Data

DCS
(Modbus
Master)

Figure 4-3. Data Flow from the Mark VI System in Modbus Slave Mode

Configuration of the TCI and CIMMOD is discussed in detail in Chapter 2. The main
steps are summarized as follows:

Refer to document GEH6403E Control System


Toolbox for Configuring a
Mark VI Turbine Controller.

1.

Choose the wiring hardware and HMI port for communication with the DCS,
serial or Ethernet.

2.

Configure CIMPLICITY with the desired points using the Turbine HMI
Configuration software in the toolbox.

3.

Configure the communication ports, baud rate, and slave identification to create
the IO_PORTS.DAT file.

4.

Map the registers and coils to the controller point names (located in

5.

CIMPLICITY) to create the CimMod.dat file, or CimMod_N.dat file for native


data.

6.

Run the listing program to obtain the CimMod.LST file, containing a list of the
coil and register maps along with scaling information. This can be used to
configure the DCS Modbus master.

GEI-100517A Modbus for HMI Applications

Chapter 4 Applications 4-3

Logic Commands
Mark VI logic commands are different than for Mark V. All logic commands to the
controller are sent as a Control Pushbutton (CPB). The CPB command is written
once, and the controller acts on it according to the control program to create a
pushbutton or a latched function.
Commands to the Mark VI should be limited to less than 10 per second. In the case
of setpoint control, this rate excludes the use of cascaded setpoints as used in cascade
loops. The DCS functions are therefore limited to supervisory control.

Modbus Points
If some of the desired Modbus points are not in the CIMPLICITY project they must
be added. First add the points to EGD if they are missing. Use the Control System
Toolbox to add the desired Mark VI points to an Ethernet Global Data (EGD)
Exchange.

Refer to GEH-6403 Control


System Toolbox for
Configuring a Mark VI
Turbine Controller.

If the points are mapped to an EGD exchange, it is possible that the exchange has not
been added to the HMI Configuration, so add the exchange to the HMI
Configuration. If the exchange is in the HMI Configuration, then do a Get and a
Build to put the points into CIMPLICITY as EGD points.

Systems with GE Fanuc PLCs


GE Fanuc Series 90-70 PLCs are often used on Mark V and Mark VI systems for
balance of plant control. The HMI can be configured as a Modbus Slave to provide
Series 90-70 PLC data to an Historian or DCS. Figure 4-4 shows the data flow
through the HMI from the 90-70 PLC to the Historian or DCS, and the flow of
requests from the Historian to the PLC. The Historian uses Modbus to collect PLC
data from the HMI.

HMI SERVER
PLC
GE Fanuc
Series 90-70

Series 90
TCP/IP

CIMPLICITY

CIMMOD

TCI
Modbus
Slave

Historian or
DCS
(Modbus
Master)

Figure 4-4. Data Flow from a 90-70 PLC in Modbus Slave Mode

4-4 Chapter 4 Applications

GEI-100517A Modbus for HMI Applications

CIMPLICITY Series 90 TCP/IP Communications software provides Ethernet


communications to the Series 90 PLCs. This driver brings the desired PLC data into
CIMPLICITY. In most cases the Historian is located on the PDH so the Ethernet
communication hardware already exists. Configuration of the TCI and CIMMOD as
a Modbus Slave is discussed in detail in Chapter 2. The main steps are summarized
as follows:
1.

Choose the wiring hardware and HMI port for communication with the Historian
or DCS, either serial or Ethernet.

2.

Configure the Series 90 TCP/IP Communications software. For details, refer to


the GFK-1181G CIMPLICITY HMI Base System-Device Communication
Manual.

3.

Configure the communication ports, baud rate, and slave identification in TCI to
create the IO_PORTS.DAT file.

4.

Map the registers and coils to the controller signal database point names to
create the Cimmod.dat file.

5.

Run the listing program to obtain the CimMod.LST file, containing a list of the
coil and register maps along with scaling information.

Note The Historian gathers data directly from the turbine controllers.

Systems with non-GE PLCs


PLCs from other manufacturers can be interfaced to the turbine control system. The
HMI can be configured as a Modbus Slave to provide PLC data to an Historian or
DCS. Figure 4-5 shows the data flow through the HMI from the PLC to the Historian
or DCS, and the flow of commands from the DCS to the PLC. In addition to PLCs,
other devices including meters and relays can be interfaced.

HMI SERVER

PLC
Other
Manufacturer

CIMPLICITY
Modbus
Master
Communications

CIMPLICITY

CIMMOD

TCI
Modbus
Slave

Historian or
DCS
(Modbus
Master)

other Modbus
Slave devices
include Meters
and Relays
Figure 4-5. Data Flow from a non-GE PLC to the Historian

Configuration of the TCI as a


Modbus Slave is discussed in
detail in Chapter 2.

CIMPLICITY Modbus Master software provides Ethernet communications to most


of the non-GE PLCs. The driver brings the desired PLC data into CIMPLICITY. The
Historian is located on the PDH and receives PLC data over Ethernet. The main
configuration steps are summarized as follows:
1.

Choose the wiring hardware and HMI port for communication with the Historian
or DCS, either serial or Ethernet.

GEI-100517A Modbus for HMI Applications

Chapter 4 Applications 4-5

2.

Configure the PLC communications software. To select the correct driver for the
particular PLC, refer to the GFK-1181G CIMPLICITY HMI Base System-Device
Communication Manual.

3.

Configure the communication ports, baud rate, and slave identification in TCI to
create the IO_PORTS.DAT file

4.

Map the registers and coils to the controller signal database point names to
create the Cimmod.dat file

5.

Run the listing program to obtain the CimMod.LST file, containing a list of the
coil and register maps along with scaling information.

For non-GE PLCs, the special control interface shown in Figure 4-6 is an alternate
that is sometimes used. This uses TCI as the Master to the PLC, and the Slave to the
Historian.

HMI SERVER

PLC
Other
Manufacturer

TCI
Modbus
Master

TCI

TCI
Modbus
Slave

Historian or
DCS
(Modbus
Master)

Figure 4-6. Data Flow from a Non-GE PLC in special Modbus Slave Mode

4-6 Chapter 4 Applications

GEI-100517A Modbus for HMI Applications

Appendix A

Exception Code Responses


The exception code responses that are supported when a normal response is
impossible are shown in the chart below (refer to the section in Chapter 2 on TCI
Modbus Configuration concerning exception codes 04 and 06).
Table A-1. Exception Code Responses
Exception

Code Name

Description

01

Illegal Function

The message function received is not supported

02

Illegal Data
Address

The address referenced in the data field is not in


a permissible range.

03

Illegal Data Value

The value transmitted in the data field is illegal.

04

Failure in
Associated
Device

Information requested cannot be provided due to


a communication failure with associated unit as
specified by the slave address.

06

Device Busy

Information requested cannot be provided due to


a communication time out with the associated
unit as specified by the slave address.

The format of the exception message reply from the slave is shown below:
+----------------------------------------+
SLAVE FUNCTIONEXCEPTIONCRC-16CRC-16
ADDRESS CODE CODE
(MSB) (LSB)
+----------------------------------------+

Exception Code Response Format


slave address must be in the range [1-255]. Zero is not allowed as a reply, as it is
only used in broadcast messages from the master.
function code is always equal to the masters function code with the most
significant bit set. Therefore, an exception response sent back to a master that has
sent a message with function code 02 hex would have a function code of 82 hex (or
130 decimal) in the exception reply.
exception code only codes 01 through 04 and 06 are supported, refer to Table A-1.

GEI-100517A Modbus for HMI Applications

Appendix A 1

Function Code Details


The following table lists the function codes supported by the TCI and included in the
messages sent from the DCS. Six of the eight function codes are used to read from
and/or write to the four table types. See the Modbus Slave section regarding mapping
tables.
Table A-2. DCS Function Codes
Function Code, Hex

Description

01

Read Holding Coils

02

Read Input Coils

03

Read Holding Registers

04

Read Input Registers

05

Force (Write) Single Holding Coil

06

Preset (Write) Single Holding Register

07

Read Exception Status

0F

Force (Write) Multiple Holding Coils

10

Force (Write) Multiple Holding Registers

Each function code and the replies are described below.

Function Code 01: Read Holding Coils


Function code 01 is used to read the holding coil table. The format of a message from
the master is shown below:
+------------------------------------------------------------+
SLAVE FUNCTIONSTART START NUMB NUMB CRC-16CRC-16
ADDRESS CODE COIL # COIL # COILS COILS (MSB) (LSB)

01
(MSB) (LSB) (MSB) (LSB)

+------------------------------------------------------------+

slave address must be in the range [1-255], 0 is not allowed.


starting holding coil number two bytes in length and may be any value less than
the highest holding coil number available in the holding coil table. The starting
holding coil number is equal to one less than the number of the first holding coil
returned in the normal response to this request, that is, to get the first holding coil,
holding coil number 1, enter 0 for the starting holding coil number. The high order
byte of the starting holding coil number field is sent as the first byte. The low order
byte is sent next.
number of holding coils value two bytes in length and must be in the range from 1
to 2000 inclusive. It specifies the number of holding coils returned in the normal
response. The sum of the starting holding coil value and the number of holding coils
value must be less than or equal to the highest holding coil number available in the
holding coil table. The high order byte of the number of holding coils field is sent as
the first byte. The low order byte is sent next.
The format of normal message reply from the slave is shown below:
+-------------------------------------+
SLAVE FUNCTIONBYTE DATA DATA
ADDRESS CODE COUNT BYTE 1BYTE 2...

01

+-------------------------------------+

A-2 Appendix A

--------------------+
DATA CRC-16CRC-16
BYTE n(MSB) (LSB)

--------------------+

GEI-100517A Modbus for HMI Applications

byte count is a binary number from 1 to 250; the specified number of data bytes
follow.
data field is packed holding coil status data. Each byte contains eight holding coil
values. The LSB of the first byte contains the value of the holding coil whose number
is equal to the starting holding coil number plus one. The value of the holding coils
are ordered by number starting with the LSB of the first byte of the data field and
ending with the MSB of the last byte of the data field. If the number of the holding
coils is not a multiple of eight, then the last data byte contains zeros in one to seven
of its highest order bits.

Function Code 02: Read Input Coils


Function code 02 is used to read the input coil table. The format of a message from
the master is shown below:
+------------------------------------------------------------+
SLAVE FUNCTIONSTART START NUMB NUMB CRC-16CRC-16
ADDRESS CODE COIL # COIL # COILS COILS (MSB) (LSB)

02
(MSB) (LSB) (MSB) (LSB)

+------------------------------------------------------------+

slave address must be in the range [1-255], 0 is not allowed.


starting input coil number two bytes in length and may be any value less than the
highest input coil available in the input coil table. The starting input coil number is
equal to one less than the number of the first input coil returned in the normal
response to this request, that is to get the first input coil, input coil number one, enter
zero for the starting input coil number. The high order byte of the starting input coil
field is sent as the first byte. The low order byte is sent next.
number of input coils value two bytes in length and must be in the range from 1 to
2000 inclusive. It specifies the number of input coils returned in the normal response.
The sum of the starting input coil value and the number of input coils value must be
less than or equal to the highest input coil available in the input coil table. The high
order byte of the number of input coils field is sent as the first byte. The low order
byte is sent next.
The format of normal message reply from the slave is shown below:
+-------------------------------------+
SLAVE FUNCTIONBYTE DATA DATA
ADDRESS CODE COUNT BYTE 1BYTE 2...

02

+-------------------------------------+

--------------------+
DATA CRC-16CRC-16
BYTE n(MSB) (LSB)

--------------------+

byte count binary number from 1 to 250; the specified number of data bytes
follow.
data field is packed input coil status data. Each byte contains eight input coil
values. The LSB of the first byte contains the value of the input coil whose number is
equal to the starting input coil plus one. The value of the inputs is ordered by number
starting with the LSB of the first byte of the data field and ending with the MSB of
the last byte of the data field. If the number of the input coils is not a multiple of
eight, then the last data byte contains zeros in one to seven of its highest order bits.

GEI-100517A Modbus for HMI Applications

Appendix A 3

Function Code 03: Read Holding Registers


Function code 03 is used to read holding registers. The format of a message from the
master is shown below:
+------------------------------------------------------------+
SLAVE FUNCTIONSTART START NUMB NUMB CRC-16CRC-16
ADDRESS CODE REG # REG # REGS REGS (MSB) (LSB)

03
(MSB) (LSB) (MSB) (LSB)

+------------------------------------------------------------+

slave address must be in the range [1-255], 0 is not allowed.


starting holding register number is two bytes in length and may be any value less
than the highest holding register number available in the holding register table. The
starting holding register number is equal to one less than the number of the first
holding register returned in the normal response to this request, that is, to get the first
holding register number, holding register number one, enter zero for the starting
holding register number. The high order byte of the starting holding register number
field is sent as the first byte. The low order byte is sent next.
number of holding registers value is two bytes in length and must be in the range
from 1 to 128 inclusive. It specifies the number of holding registers returned in the
normal response. The sum of the starting holding register value and the number of
holding registers value must be less than or equal to the highest holding register
number available in the holding register table. The high order byte of the number of
holding registers field is sent as the first byte. The low order byte is sent next.
Format of normal message reply from the slave is shown below:
+-------------------------------------+
SLAVE FUNCTIONBYTE FIRST FIRST
ADDRESS CODE COUNT REGSTRREGSTR...

03

(MSB) (LSB)
+-------------------------------------+

--------------------+
LAST CRC-16CRC-16
REGSTR(MSB) (LSB)
(LSB)

--------------------+

byte count even binary number from 2 to 254, or zero. If the byte count is zero (0),
then the master is to assume 256 data bytes follow. Otherwise, the specified number
of data bytes follow. The byte count specifies the total number of bytes in the
message following the byte count, not including the two CRC-16 bytes.
holding registers are returned in the data field in order of number with the lowest
number holding register in the first two bytes, and the highest number holding
register in the last two bytes of the data field. The number of the first holding register
in the data field is equal to the starting holding register number plus one. The high
order byte is sent before the low order byte of each holding register.

Function Code 04: Read Input Registers


Function code 04 is used to read input registers. The format of a message from the
master is shown below:
+------------------------------------------------------------+
SLAVE FUNCTIONSTART START NUMB NUMB CRC-16CRC-16
ADDRESS CODE REG # REG # REGS REGS (MSB) (LSB)

04
(MSB) (LSB) (MSB) (LSB)

+------------------------------------------------------------+

slave address must be in the range [1-255], zero is not allowed.

A-4 Appendix A

GEI-100517A Modbus for HMI Applications

starting input register number is two bytes in length and may be any value less
than the highest input register number available in the input register table. The
starting input register number is equal to one less than the number of the first input
register returned in the normal response to this request, that is, to get the first input
register, input register number one, enter zero for the starting input register number.
The high order byte of the starting input register number field is sent as the first byte.
The low order byte is sent next.
number of input registers value is two bytes in length and must be in the range
from 1 to 128 inclusive. It specifies the number of input registers returned in the
normal response. The sum of the starting input register value and the number of input
registers value must be less than or equal to the highest input register number
available in the input register table. The high order byte of the number of input
registers field is sent as the first byte. The low order byte is sent next.
The format of normal message reply from the slave is shown below:
+-------------------------------------+
SLAVE FUNCTIONBYTE FIRST FIRST
ADDRESS CODE COUNT REGSTRREGSTR...

04

(MSB) (LSB)
+-------------------------------------+

--------------------+
LAST CRC-16CRC-16
REGSTR(MSB) (LSB)
(LSB)

--------------------+

byte count even binary number from 2 to 254, or zero. If the byte count is zero (0),
then the master is to assume 256 data bytes follow. Otherwise, the specified number
of data bytes follow. The byte count specifies the total number of bytes in the
message following the byte count, not including the two CRC-16 bytes.
input registers are returned in the data field in order of number with the lowest
number input register in the first two bytes, and the highest number input register in
the last two bytes of the data field. The number of the first input register in the data
field is equal to the starting input register number plus one. The high order byte is
sent before the low order byte of each input register.

Function Code 05: Force Single Holding Coil


Function code 05 is used to force (or write) a single holding coil in the holding coil
table. The format of a message from the master is shown below:
+------------------------------------------------------------+
SLAVE FUNCTIONHOLDINGHOLDINGSTATE
CRC-16CRC-16
ADDRESS CODE COIL # COIL # 00H OR 00H (MSB) (LSB)

05
(MSB) (LSB) 0FFH

+------------------------------------------------------------+

slave address must be in the range [1-255], 0 is not allowed.


holding coil number is two bytes in length and may be any value less than the
highest holding coil number available in the holding coil table. The holding coil
number is equal to one less than the number of the holding coil forced, that is, to
change the first holding coil, holding coil number one, enter 0 for the holding coil
number. The high order byte of the starting holding coil number field is sent as the
first byte. The low order byte is sent next.
Format of normal message
reply from the slave is
identical to the received
message

state byte sent by the master with only two possible values. A 0 is sent (00h) to
turn the specified holding coil off (set false). A value of 255 is sent (FFh) to turn the
specified holding coil on (set true). The state byte is always followed by a single byte
with value zero.

GEI-100517A Modbus for HMI Applications

Appendix A 5

Function Code 06: Preset Single Holding Register


Function code 06 is used to preset (or write) to a single holding register. The format
of a message from the master is shown below:
+------------------------------------------------------------+
SLAVE FUNCTIONHOLDINGHOLDINGREG
REG
CRC-16CRC-16
ADDRESS CODE REG # REG # DATA DATA (MSB) (LSB)

06
(MSB) (LSB) (MSB) (LSB)

+------------------------------------------------------------+

slave address must be in the range [1-255], 0 is not allowed.


holding register number is two bytes in length and may be any value less than the
highest holding register number available in the holding register table. The holding
register number is equal to one less than the number of the holding register changed
by this request, that is to change the first holding register, holding register number 1,
enter 0 for the holding register number. The high order byte of the starting holding
register number field is sent as the first byte. The low order byte is sent next.
holding register data field is two bytes in length and contains the value to which
the holding register specified by the holding register number field is preset. The first
byte in the data field contains the high order byte of the preset value. The second byte
in the data field contains the low order byte.
Format of normal message reply from the slave is identical to the received message.

Function Code 07: Read Exception Status.


Function code 07 is used to read the exception status data, defined as the first eight
holding coils. These can be used to indicate slave controller status or condition of
any other state. Function code 07 thus provides a short form of request for the
purpose of reading these first eight holding coils, holding coils one through eight.
The format of a message from the master is shown below:
+------------------------------+
SLAVE FUNCTIONCRC-16CRC-16
ADDRESS CODE (MSB) (LSB)

07

+------------------------------+

slave address must be in the range [1-255], zero is not allowed.


Format of normal message reply from the slave is shown below:
+-------------------------------------+
SLAVE FUNCTIONDATA CRC-16CRC-16
ADDRESS CODE BYTE (MSB) (LSB)

07

+-------------------------------------+

data byte field the normal response is packed holding coil status data. The data
byte contains eight holding coil values. The LSB of the byte contains the value of the
holding coil number one (1). The MSB contains the value of holding coil number
eight.

A-6 Appendix A

GEI-100517A Modbus for HMI Applications

Function Code 15: Force Multiple Holding Coils


Function code 15 (0x0F) is used to force (or write) multiple holding coils in the
holding coil table. The format of a message from the master is shown below:
+-------------------------------------------------------------------+
SLAVE FUNCTIONSTART START NUMB NUMB BYTE DATA DATA
ADDRESS CODE COIL # COIL # COILS COILS COUNT BYTE 1BYTE .....

0x0F (MSB) (LSB) (MSB) (LSB)

+-------------------------------------------------------------------+
--------------------+
DATA CRC-16CRC-16
...BYTE n(MSB) (LSB)

--------------------+

slave address must be in the range [1-255], 0 is not allowed.


start coil number is two bytes in length and may be any value less than the highest
holding coil number available in the holding coil table. The holding coil number is
equal to one less than the number of the holding coil forced, that is, to change the
first holding coil, holding coil number one, enter zero for the holding coil number.
The high order byte of the starting holding coil number field is sent as the first byte.
The low order byte is sent next.
number of holding coils value two bytes in length. It specifies the number of
holding coils to set. The sum of the starting holding coil value and the number of
holding coils value must be less than or equal to the highest holding coil number in
the holding coil table. The high order byte of the number of holding coils field is sent
as the first byte. The low order byte is sent next.
byte count is the number of data bytes to follow.
data field is packed holding coil data. Each byte contains eight holding coil values.
The LSB of the first byte contains the value of the holding coil whose number is
equal to the starting holding coil number plus one. The value of the holding coils are
ordered by number starting with the LSB of the first byte of the data field and ending
with the MSB of the last byte of the data field. If the number of the holding coils is
not a multiple of eight, then the last data byte contains unused data in its highest
order bits.
Format of normal message reply from the slave is identical to the received message
without the byte count or the data.

Since Function Codes 15 and 16 generate multiple write


commands, care should be used to make sure that no more
than 10 coils or registers are written to per second, or
controller problems can result.

GEI-100517A Modbus for HMI Applications

Appendix A 7

Function Code 16: Preset Multiple Holding


Registers
Function code 16 (0x10) is used to preset (or write) to a multiple holding registers.
The format of a message from the master is shown below:
+-------------------------------------------------------------------+
SLAVE FUNCTIONSTART START NUMB NUMB BYTE REG
REG

ADDRESS CODE REG # REG # REGS REGS COUNT DATA 1DATA1 ...

0x10 (MSB) (LSB) (MSB) (LSB)


(MSB) (LSB)
+-------------------------------------------------------------------+
--------------------+
REG
CRC-16CRC-16
...DATA n(MSB) (LSB)
(LSB)

--------------------+

slave address must be in the range [1-255], 0 is not allowed.


start register number is two bytes in length and may be any value less than the
highest holding register number available in the holding register table. The holding
register number is equal to one less than the number of the holding register changed
by this request, that is, to change the first holding register, holding register number 1,
enter 0 for the holding register number. The high order byte of the starting holding
register number field is sent as the first byte. The low order byte is sent next.
number of holding registers value two bytes in length. It specifies the number of
holding registers to set. The sum of the starting holding register value and the number
of holding registers value must be less than or equal to the highest holding register
number in the holding register table. The high order byte of the number of holding
registers field is sent as the first byte. The low order byte is sent next.
byte count is the number of data bytes to follow.
Register data field is two bytes for each holding register to set. The first byte in
the data field contains the high order byte of each preset value. The next byte
contains the low order byte.
The format of the normal message reply from the slave is identical to the received
message without the byte count or the data.

Serial Line Driver Settings


This section describes how to set up the DIP switches for powered serial line drivers.
These are used for Modbus communications between the HMI and the DCS. This
information also applies to serial MSP for connecting a Mark IV to an HMI or Smart
Remote. The type of interconnecting wire required is also described. The two line
drivers covered are as follows:

278A2181VRP8D - Black Box ME475A - 110VAC

278A2181VRP8E - Black Box ME475AE - 220VAC

These line drivers are used to connect the serial port on the HMI to the serial port on
the DCS when they are separated by long distances. (These settings are very similar
to the Develcon DS-511 serial line drivers).

A-8 Appendix A

GEI-100517A Modbus for HMI Applications

The switch settings for 9600 baud, with 8 data bits and 1 stop bit, are shown in Table
A-4:
Table A-4. Dip Switch S1 Settings
Switch

Position

Function Generated

S1-1

On

9600 kbps

S1-2

Off

9600 kbps

S1-3

Off

9600 kbps

S1-4

On

9600 kbps

S1-5

On

Clock Source - Internal

S1-6

On

Clock Source - Internal

S1-7

On

Operating Mode - Asynchronous

S1-8

Off

Carrier Control - Constantly On

Table A-5. Dip Switch S2 Settings


Switch

Position

Function Generated

S2-1

Off

Word Length 10 bits

S2-2

Off

Word Length 10 bits

S2-3

Off

Extended signaling rate 2.5% to 1%

S2-4

Off

RTS/CTS Delay No delay

S2-5

Off

RTS/CTS Delay No delay

S2-6

Off

V.54 Loopback Test Enable Normal Operation

S2-7

Off

2-wire/4-wire Mode 4-wire (Full or Half Duplex)

S2-8

Off

Not Used

Table A-6. Dip Switch S3 Settings


Switch

Position

Function Generated

S3-1

On

Input Impedance 200 Ohms

S3-2

Off

Input Impedance 200 Ohms

S3-3

Off

Not Used

S3-4

On

Mode Selection Point to Point

S3-5

Off

Local Loopback - Disabled

S3-6

Off

Remote Loopback - Disabled

S3-7

Off

Antistream Control Disabled

S3-8

Off

Antistream Control Disabled

Other Settings
For a different baud rate, adjust S-1, 2, 3, and 4 according to the settings in the line
driver manual.

GEI-100517A Modbus for HMI Applications

Appendix A 9

If the MODBUS link is set up for 8 data bits, set S2-1 and S2-2 for 10 databits. This
is calculated as follows:
8 Data bits + 1 Start bit + 1 Stop bit = 10 bits
If the link has two stop bits, set S2-1 and S2-2 for 11 bits according to the settings in
the line driver manual.

Connecting the two line drivers


For runs up to 5.3 miles (8.53 km), 2 pairs of 24 AWG (or thicker) twisted pair
wiring are required. CAT-5 cable and other types of twisted pair cable will work.
Termination at the ME-475A can be by screw terminals or RJ-45 connector. The Tx
on one line driver connects to Rx on the other one. The interconnecting wiring is not
supplied by GE.

A-10 Appendix A

GEI-100517A Modbus for HMI Applications

Fiber-Optic Line Driver Settings


This section describes the settings for Black Box type serial fiber-optic line drivers.
The types of fiber-optic drivers are as follows:

Fiber-optic cable is preferred


for noise-free, high-speed
communication

278A2181VRP42A - Black Box ME320 serial fiber-optic line drivers

278A2181VRP42B - Black Box ME320AE serial fiber-optic line drivers

These line drivers are used to connect the serial port on the HMI to the serial port on
the DCS when they are separated by long distances. The link is usually used for a
Modbus connection. The required switch settings are shown in the tables below.
Table A-5. Switch Settings
Switch

Position

S1

In the A position

S4

Test Switch Down for Normal operation

S5

Up for DCS;

Down for HMI

Table A-6. Baud Rate Settings


Baud Rate - kbps

S1

S2

S3

115.2

Down

Down

Down

57.6

Down

Down

Up

38.4

Down

Up

Down

28.8

Down

Up

Up

19.2

Up

Down

Down

14.4

Up

Down

Up

9.6

Up

Up

Down

2.4

Up

Up

Up

The transmitter power should be set to low power (refer to Table A-7 below).
Table A-7. Transmitter Power Setting
Transmitter Power

S6

S7

Low

Up

Up

Medium

Down

Up

Medium

Up

Down

High

Down

Down

Two fibers are required, each carrying signals in the opposite direction. In some
designs the two fibers are in the same cable. The Tx port (C4) on one driver should
plug into the Rx port (C3) on the other driver. ST type fiber-optic connectors are
used for the four ports.

GEI-100517A Modbus for HMI Applications

Appendix A 11

Notes

A-12 Appendix A

GEI-100517A Modbus for HMI Applications

Glossary of Terms

ARCNET
ARCNET is the high-speed data highway connecting the Mark V controller with the
HMI.

ASCII
ASCII stands for American Standard Code for Information Interchange, and 8-bit
code used for data.

CimMod
CimMod is an HMI program that allows TCI Modbus to read and write
CIMPLICITY project data.

CIMPLICITY
CIMPLICITY is a GE Fanuc software product that provides server and viewer
functions to create the HMI graphical operator interface, the HMI server, and
communication gateway functions.

COM2
COM2 is a standard serial communication port on the HMI.

Control Pushbutton
Control Pushbutton is a network message to the controller which initiates control
action such as a startup or shutdown.

CRC
CRC stands for cyclic redundancy check, a check on message integrity.

CSDB
CSDB stands for the real time Control Signal Data Base located in the controller.

GEI-100517A Modbus for HMI Applications

Glossary of Terms 1

DB9
DB9 is a 9-pin connector for RS-232C serial communication.

DCE
DCE stands for Data Communications Equipment, a means of setting up RS-232C
serial communications on the HMI and DCS.

DCS
DCS stands for Distributed Control System, used for process control applications
including power plant control.

DTE
DTE stands for Data Terminal Equipment, a means of setting up RS-232C serial
communications on the HMI and DCS.

Exception Code
Exception Code responses are generated when a normal response is impossible.

Hex
Hex stands for hexadecimal, a numbering system using the digits 0-9 and letters A-F
to represent the decimal numbers 0-15.

LDDS
LDDS stands for limited distance data set, a short haul modem, also known as a line
driver.

LSB
LSB or LSBit is the least significant bit of a byte of data.

Mark VI
Mark VI is GE's latest Speedtronic turbine control system.

Modem
Modem stands for Modulator Demodulator, as applied to electrical signals for long
distance transmission over cables.

MSB
MSB or MSBit is the most significant bit of a byte of data.

2 Glossary of Terms

GEI-100517A Modbus for HMI Applications

Native
Native is an analog data type where the data is transmitted in the same format that it
has in the controller.

PDH
PDH stands for Plant Data Highway, which links HMI Servers to HMI Viewers and
other systems such as the DCS.

PLC
PLC stands for programmable logic controller, an industrial controller designed to
work with on-off type signals for applications such as motor control.

RTU
RTU stands for remote terminal unit, a Modbus data transmission mode.

TCI
TCI stands for Turbine Control Interface, the GE supplied software package on the
HMI that interfaces to the turbine control.

TCI Modbus
TCI Modbus is the software package that provides the interface between the HMI
and the DCS, or other device.

GEI-100517A Modbus for HMI Applications

Glossary of Terms 3

Notes

4 Glossary of Terms

GEI-100517A Modbus for HMI Applications