GEI100517a-Modbus For HMIs

GEI-100517A
g
GE Industrial Systems
Modbus
for HMI Applications
Document: GEI-100517A
Issued: 2002-06-06
Modbus
for HMI Applications
These instructions do not purport to cover all details or variations in equipment, nor to
provide for every possible contingency to be met during installation, operation, and
maintenance. The information is supplied for informational purposes only, and GE makes
no warranty as to the accuracy of the information included herein. Changes,
modifications, and/or improvements to equipment and specifications are made
periodically and these changes may or may not be reflected herein. It is understood that
GE may make changes, modifications, or improvements to the equipment referenced
herein or to the document itself at any time. This document is intended for trained
personnel familiar with the GE products referenced herein.
GE may have patents or pending patent applications covering subject matter in this
document. The furnishing of this document does not provide any license whatsoever to
any of these patents. All license inquiries should be directed to the address below. If
further information is desired, or if particular problems arise that are not covered
sufficiently for the purchaser’s purpose, the matter should be referred to:
Post Sales Service
1501 Roanoke Blvd.
Salem, VA 24153-6492 USA
Phone: + 1 888 GE4 SERV (888 434 7378, United States)
+ 1 540 378 3280 (International)
Fax: + 1 540 387 8606 (All)
(“+” indicates the international access code required when calling from outside the
USA)
This document contains proprietary information of General Electric Company, USA and
is furnished to its customer solely to assist that customer in the installation, testing,
operation, and/or maintenance of the equipment described. This document shall not be
reproduced in whole or in part nor shall its contents be disclosed to any third party
without the written approval of GE Industrial Systems.
GE PROVIDES THE FOLLOWING DOCUMENT AND THE INFORMATION
INCLUDED THEREIN AS IS AND WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY IMPLIED STATUTORY
WARRANTY OF MERCHANTABILITY OR FITNESS FOR PARTICULAR PURPOSE
ARCNET is a registered trademark of Datapoint Corporation.

Ethernet is a trademark of Xerox Corporation.
SPEEDTRONIC is a trademark of General Electric Company, USA.
Windows® is a registered trademark of Microsoft Corporation.
Safety Symbol Legend
Indicates a procedure, condition, or statement that, if not

strictly observed, could result in personal injury or death.
Indicates a procedure, condition, or statement that, if not

strictly observed, could result in damage to or destruction of
equipment.
Indicates a procedure, condition, or statement that should be

strictly followed in order to optimize these applications.
Note Indicates an essential or important procedure, condition, or statement.
GEI-100517A Modbus for HMI Applications Safety Symbol Legend • i

This equipment contains a potential hazard of electric shock
or burn. Only personnel who are adequately trained and
thoroughly familiar with the equipment and the instructions
should install, operate, or maintain this equipment.
Isolation of test equipment from the equipment under test

presents potential electrical hazards. If the test equipment
cannot be grounded to the equipment under test, the test
equipment’s case must be shielded to prevent contact by
personnel.
To minimize hazard of electrical shock or burn, approved

grounding practices and procedures must be strictly followed.
To prevent personal injury or equipment damage caused by

equipment malfunction, only adequately trained personnel
should modify any programmable machine.
ii • Safety Symbol Legend GEI-100517A Modbus for HMI Applications

To:
g Reader Comments
Documentation Design, Rm. 291
1501 Roanoke Blvd.
General Electric Company Fax: 1-540-387-8651
(GE Internal DC 8-278-8651)
We welcome comments and suggestions to make this publication more useful.

Your Name Today’s Date If needed, how can we contact you?
Fax No.
Your Company’s Name and Address Job Site
Phone No.
GE Requisition No.
E-mail
Your Job Function / How You Use This Publication Publication No.
Address
Publication Issue/Revision Date
General Rating
Excellent Good Fair Poor Additional Comments
Contents { { { { ____________________________________________________________
Organization { { { { ____________________________________________________________
Technical Accuracy { { { { ____________________________________________________________
Clarity { { { { ____________________________________________________________
Completeness { { { { ____________________________________________________________
Drawings / Figures { { { { ____________________________________________________________
Tables { { { { ____________________________________________________________
Referencing { { { { ____________________________________________________________
Readability { { { { ____________________________________________________________
Specific Suggestions (Corrections, information that could be expanded on, and such.)
Page No. Comments
_____ _________________________________________________________________________________
_____ _________________________________________________________________________________
_____ _________________________________________________________________________________
_____ _________________________________________________________________________________
_____ _________________________________________________________________________________
_____ _________________________________________________________________________________
Other Comments (What you like, what could be added, how to improve, and such.) ________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
Overall grade (Compared to publications from other manufacturers of similar products, how do you rate this publication?)
{ Superior { Comparable { Inferior { Do not know Comment ____________________________________________
Detach and fax or mail to the address noted above.

........................................................................ Fold here and close with staple or tape ..........................................................................................
____________________________ Place
stamp
____________________________ here.
____________________________
Documentation Design, Rm. 291
1501 Roanoke Blvd.
.......................................................................................... Fold here first ........................................................................................................

Contents
Chapter 1 Overview 1-1
Introduction.............................................................................................................................1-1
System Summary ....................................................................................................................1-1
Communication ........................................................................................................1-2
Features....................................................................................................................1-2
Modbus Slave Mode ...............................................................................................................1-3
Modbus Master Mode.............................................................................................................1-4
Alarm Handling ......................................................................................................................1-4
Chapter 2 Modbus Slave Mode 2-1

Introduction.............................................................................................................................2-1
Modbus Communication.........................................................................................................2-1
Specifications............................................................................................................2-1
System Operation .....................................................................................................2-2
RS-232C and Modbus...............................................................................................2-2
Physical Link Layer/Format, RS-232C Communications .......................................................2-3
Link Layer.................................................................................................................2-3
Physical Layer..........................................................................................................2-3
Physical Link Layer/Format, Ethernet Communications.........................................................2-6
TCI Modbus Configuration.....................................................................................................2-6
F:\IO_PORTS.DAT: Modbus Link Definition ..........................................................2-6
Modbus Slave Configuration: Holding Coils, Input Coils, Holding Registers, Input
Registers ...................................................................................................................2-8
Modbus Slave: @SPARE: Unused Coils and Registers ...........................................2-9
F:\UNITn\MODBUS.DAT: Mapping File Format ...................................................2-9
CimMod ..................................................................................................................2-13
MODBUS_L.EXE: MODBUS Listing Program .....................................................2-17
Modbus Data Format and Scaling.........................................................................................2-21
Modbus Data Conversions: Logics ........................................................................2-21
Modbus Data Conversions: Analogs......................................................................2-21
RS16 .......................................................................................................................2-22
RU16.......................................................................................................................2-22
UN12 ......................................................................................................................2-22
HW12......................................................................................................................2-23
Native .....................................................................................................................2-24
Modbus Command and Response Definition........................................................................2-25
RTU Transmission Mode ........................................................................................2-25
Statistics, Diagnostics, and Testing.......................................................................................2-27
Trace Global Sections ............................................................................................2-27
CIMMOD Diagnostics............................................................................................2-29
Modbus Master Simulation.....................................................................................2-29
GEI-100517A Modbus for HMI Applications Contents • i

Chapter 3 Modbus Master Mode 3-1
Introduction.............................................................................................................................3-1
External Communication Links...............................................................................................3-1
Modbus Master Setup .............................................................................................................3-2
Modbus Master Configuration ................................................................................................3-2
Statistics..................................................................................................................................3-6
Modbus Master Diagnostics ...................................................................................................3-7
Chapter 4 Applications 4-1

Introduction.............................................................................................................................4-1
Mark V Systems......................................................................................................................4-1
Mark IV Systems ....................................................................................................................4-2
Mark VI Systems ....................................................................................................................4-3
Systems with GE Fanuc PLCs.................................................................................................4-4
Systems with non-GE PLCs ....................................................................................................4-5
Appendix A 5-1
Exception Code Responses .....................................................................................................5-1
Exception Code Response Format............................................................................5-1
Function Code Details.............................................................................................................5-2
Function Code 01: Read Holding Coils ...................................................................5-2
Function Code 02: Read Input Coils........................................................................5-3
Function Code 03: Read Holding Registers.............................................................5-4
Function Code 04: Read Input Registers .................................................................5-4
Function Code 05: Force Single Holding Coil ........................................................5-5
Function Code 06: Preset Single Holding Register .................................................5-6
Function Code 07: Read Exception Status...............................................................5-6
Function Code 16: Preset Multiple Holding Registers ............................................5-8
Serial Line Driver Settings......................................................................................................5-8
Fiber-Optic Line Driver Settings ..........................................................................................5-11
Glossary of Terms 5-1
ii • Contents GEI-100517A Modbus for HMI Applications

Chapter 1 Overview
Introduction
Modbus™ is an industry standard protocol for exchanging real time data and
commands between various control systems. This document describes the addition of
Modbus communication between the SPEEDTRONIC™ Turbine Control system and
the distributed control system to provide two-way transmission of control data and
operator commands. It covers the three Modbus modes of communication and the
interfaces to the various controller types.
System Summary
Modbus can be used in three different modes of communication, Slave mode, Master
mode, and CIMPLICITY® Modbus Master mode. The most used is Modbus Slave
mode for communication with the distributed control system (DCS).
Ethernet
Mark VI
Ethernet
DCS
ARCNET HMI
Mark V Server
Serial
DCS
Mark V LM
CSF
Mark IV
or Serial
Figure 1-1. Physical Communication with DCS through the HMI

The Turbine Control Interface (TCI) software resides in the Human-Machine Interface
(HMI) Server. It provides a communication interface with the SPEEDTRONIC turbine
control, including data collection and an interface with the CIMPLICITY software.
TCI Modbus provides a communication link from the HMI Server to the DCS
controlling the plant. The DCS is usually located remotely from the turbine control
system; refer to the conceptual diagram in Figure 1-1.
GEI-100517A Modbus for HMI Applications Chapter 1 Overview • 1-1

The Modbus link allows the DCS to gather turbine performance data and display it for
the plant operator in the central control room, and allows the operator to control the
turbine startup, load, and shutdown. When the HMI is responding to DCS requests, the
mode of operation is known as Modbus Slave mode.
The HMI can also run in Modbus Master mode, where it sends requests to another
intelligent device. For example, the HMI can communicate over a serial link with a
Bently Nevada system, and issue requests for turbine vibration data. When the HMI
is running Modbus Master mode, however, Slave mode can run at the same time to
supply data to a DCS or Historian.
In Modbus master mode the TCI can gather data from attached Modbus slaves. The
data gathered is requested and stored in the TCI database based on points and update
rates specified in a Modbus data file.
Refer to the GFK-1181G CIMPLICITY Modbus Master is a third mode used to communicate with PLCs
CIMPLICITY HMI Base controlling balance of plant (BOP) equipment, including GE Fanuc PLCs and other
System-Device manufacturers PLCs.
Communication Manual.
Communication
Modbus communication between the HMI and the DCS can be over Ethernet or over
an RS-232C serial link. If Ethernet is available, it is preferred because of the higher
speed.
As shown in Figure 1-1, the HMI can communicate with any of the Mark IV, V, and
VI SPEEDTRONIC controllers. Communication with Mark VI is over Ethernet,
while the Mark V uses ARCNET, and Mark IV uses CSF or a serial link. It is very
rare to have all these controller and communication types present in one system.
Note In this document the term controller refers to either the Mark IV, Mark V,
Mark V LM, or Mark VI SPEEDTRONIC turbine controller.
Modbus Slave is the most In Modbus Slave mode, the DCS can request information from each controller or
used mode. CIMPLICITY project by sending a Modbus data request message over the Modbus
link to a specific slave address. The DCS master can also issue Modbus command
messages to initiate operator commands to each controller or CIMPLICITY. These
command messages support both pushbutton commands (such as START, STOP)
and analog setpoint commands (such as a preselected load setpoint). A Modbus data
file specifies the correspondence between Modbus coil and register numbers and the
unit’s (controller’s) data.
Features
Important characteristics of the turbine control Modbus link are as follows:
• Modbus Master and Slave mode each support four data categories: Holding Coil,
Holding Register, Input Coil, and Input Register
• Time tags are not available with the data
• In general, alarms cannot be obtained (refer to Alarm Handling section below).
• Alarm ACK ALL and Alarm Silence commands can be sent over Modbus to the
controller, where logic must be triggered to perform the function
• The DCS may write to no more than 10 coils or registers per second
1-2 • Chapter 1 Overview GEI-100517A Modbus for HMI Applications

• Modbus function codes 15 and 16 should be avoided unless the user takes care
to not write more than 10 coils or registers per second
• An extra Ethernet board is not required to implement Modbus over Ethernet
Two Masters can be connected to one HMI using two separate serial ports. The HMI
processes requests from each Master as they arrive, returning the reply to the Master
that made the request. Modbus communication over a multidrop (RS-485 or RS-422)
link is a non-standard configuration.
Modbus Slave Mode

Data can be supplied from Mark IV, Mark V, and Mark VI controllers to the DCS
when running Modbus Slave mode. Figure 1-2 shows the data flow paths through
CIMPLICITY to the TCI Modbus Slave to the DCS. Mark V data flows directly to
the TCI Modbus Slave, whereas Mark IV and VI data passes through CIMMOD first.
PLC data can also be supplied to the DCS or Historian through the TCI Modbus
Slave. While many different interfaces are used between the various PLCs and the
HMI, the TCI Modbus interface can be used with any of these devices. For more
information on transferring data from PLCs to the DCS or Historian, refer to Chapter
4 Applications.
HMI SERVER
Mark VI
TCI
Mark IV TCI CIMPLICITY CIMMOD Modbus DCS
Slave
Mark V and
Mark V LM
Figure 1-2. Data Flow from controllers in Modbus Slave Mode
The rate at which the data can be collected from a serial Modbus slave is limited by
the transmission rate on the RS-232C link, and by the turn-around times of the
computers on each end of the link. The rate at which the data can be collected from
an Ethernet Modbus slave is limited by the Ethernet traffic and by the turn-around
times of the computers on each end of the connection. The DCS may issue no more
than ten operator commands per second.
A maximum of eight serial links may be configured for a single HMI. The number of
Ethernet connections an Ethernet Modbus slave will accept is configurable. Ethernet
and serial links may both be used at the same time. All data to and from a controller
is serialized and operated on one at a time.
For more information, refer The TCI Modbus slave, configured with the appropriate address, replies with the
to Chapter 2 Modbus Slave requested data. A single HMI can respond to multiple slave addresses. Up to a
Mode. maximum of 16 slave addresses may be configured. Normally each separate slave
address would be assigned to gather data from a separate unit control.

Modbus Master Mode
In Modbus Master mode, the HMI gathers data from attached Modbus slaves and
stores it in the TCI database. The rate at which the data can be collected on an RS-
232C link is limited by the following:
• The transmission rate on the RS-232C link
• The turn-around times of the computers on each end of the link
• The periodic rate specified in the configuration data file
The rate at which the data can be collected from an Ethernet Modbus slave is limited
by the Ethernet traffic, by the turn-around times of the computers on each end of the
connection, and the periodic rate specified in the configuration data file.
The TCI Modbus Master, configured with the appropriate address, requests data
from a third party device at a specified rate. A single HMI can communicate with
multiple slave addresses over various communication ports. Up to a maximum of
For more information, refer eight communication ports may be used to communicate with up to 48 separate slave
to Chapter 3 Modbus Master addresses. Nine function codes are supported; five for reading, and four function
Mode. codes for writing to coils and registers in the slave device.
Alarm Handling
Modbus cannot transmit alarms, but can transmit the source logic in the controller
GSM is recommended for that triggers the alarms. Many of these logics are not latched, so it is possible that a
alarm transmission to the Modbus link could miss some of the logic transitions. For this reason GE Industrial
DCS Systems Standard Messages (GSM) is recommended for the transmission of alarms,
not a Modbus link. Refer to GEI 100516 GSM for SPEEDTRONIC Turbine Control
for details.
Alarm handling bits in the Mark V controller are as follows:
• L86AACK_CPB Alarm ACK
• L86ARST_CPB Alarm Reset
• L86ASIL_CPB Alarm Silence
Designations in the Mark IV are similar; check the alarm dialog in the toolbox for the
Mark VI names. Messages setting and resetting these bits can be used by the DCS to
ACK ALL or Silence the controller's alarms.
Alarm ACK and Alarm Silence

The DCS usually has its own The controller alarm is usually located in the turbine control area. The Mark V
alarm in the central control controller has an internal alarm beeper and a contact closure for an external alarm.
room, controlled from the The internal alarm is jumper-enabled. Alarm silence logic controlled by Modbus can
main console. This is separate be configured in the controller to switch these off. Similarly the Mark VI controller
from any turbine control has a contact closure for an external alarm. This alarm can be switched off by alarm
alarms discussed above, silence logic in the controller that can be controlled by Modbus.
which may be located in the
There is normally no need for the DCS to ACK and Silence the turbine alarm system.
turbine control area.
Because the controller alarm system holds only the last 64 alarms, if there is no
native alarm management from the GE operator interface, DCS ACKs and Resets can
keep the controller alarm queue from filling.
1-4 • Chapter 1 Overview GEI-100517A Modbus for HMI Applications

Notes

Chapter 2 Modbus Slave Mode
Introduction
This chapter describes how the HMI is set up to act as a slave to the DCS and pass on
data requests and operator commands to the controllers for execution. Modbus
communication, the physical link layer, I/O port definition, data mapping, and data
format are covered.
Modbus Communication
Modbus is an industry standard communication link used by the HMI to provide the
current value of plant variables to any system that requests it over the Modbus link.
The HMI acts as a Modbus slave, which means it waits for requests from another
computer (a Modbus master) and answers by returning the current value of the
variables requested.
Modbus is a popular The Modbus protocol is implemented as a set of registers and coils. The HMI
communication protocol for supports up to 10,000 registers and coils of each type from each turbine control.
control systems These registers and coils are not mixed in any particular table. The mapping of the
Modbus register number to the turbine signal name is done using the MODBUS.DAT
or MODBUS_N.DAT file, or both, in the unit configuration directory. The TCI port
definition and configuration file, F:\IO_PORTS.DAT, assigns the available I/O ports.
Once the Modbus configuration has been done, the MODBUS_L program can be
used to generate a formatted list of the Modbus register numbers, turbine signal
names, and scaling information for each signal defined. This information is stored in
the MODBUS.LST file. The MODBUS.LST file can be used to configure the master
side of the Modbus link.
Specifications
The Modbus interface uses Gould Modicon’s Modbus Protocol (Gould Modicon is
now part of Schneider Automation). The following text provides application
information only. It does not specify the Modbus Protocol.
Detailed information on the Modbus protocol is available from Gould Inc.’s
Reference Guide PI-MBUS-300 Rev B, January 1985. This is not the Modbus Plus
specification. It is recommended that both this document and the Gould reference
guide be used together.
GEI-100517A Modbus for HMI Applications Chapter 2 Modbus Slave Mode • 2-1
The TCI system allows easy addition, deletion, or modification of the data lists by the
DCS vendor or customer after equipment installation. The data point capability of the
turbine control system generally far exceeds the actual needs of the DCS.
Ethernet communication does An HMI server can be located locally, remotely, or anywhere within the distance
not have the distance limitations of the Stage Link system (for details on the Stage Link, see GEH-6195B,
restrictions of the serial link Chapter 9). The DCS or remote control system can be located anywhere within the
restrictions of the RS-232C serial communication link, or anywhere on the Ethernet
link.
System Operation
An external communication link allows an operator at a remote location to initiate
operator commands by sending a logical command or an analog setpoint to the HMI.
Logical commands are used to initiate automated sequences, which reside in the
controller. They are also used to change analog setpoints, such as the turbine load, to
a predefined level.
It is occasionally more efficient to set targets with an analog number, such as
megawatts, rather than manually entering raise/lower commands. The operator can
send a target setpoint that the controller enters into its database and ramps to the
target at a predetermined ramp rate.
Most of the operator commands that can be initiated from the HMI can be initiated
from the DCS through the communication link. A traditional hard-wired remote
control interface can be used, however, this can be I/O intensive and needs to be
evaluated on a case-by-case basis. Maintenance commands, for example editing
application software or changing tuning constants, are generally restricted to being
issued from an HMI.
All application data in the controller can be monitored by the DCS over the remote
serial communication link. The controller database contains several thousand points,
but usually less than 500 points are of interest to the DCS. These consist of logical
data for alarm and event messages and analog or numeric data for such variables as
speed, load, vibration, and temperature.
One HMI can interface with up to 16 controllers. Therefore the external
communication link to the remote control system has the capability to communicate
through the HMI to up to 16 controllers.
RS-232C and Modbus

GE Industrial Systems offers Modbus protocol with an RS-232C link as a level one
communication link because it is compatible with most control systems. The
limitations are a 19,200 bit/sec transmission rate and the lack of individual time tags
for alarms and events.
The communication link load is a function of the amount of data that the DCS is
requesting and how often it is to be transmitted. Data in the controller typically
requires one word per analog point and one word for each 16 logic points (such as
the state of alarms and events). An evaluation of the link load for a specific
application requires reviewing the amount and frequency of the data transmissions
and the specified baud rate, and verifying that all is within the desired sampling rate.
2-2 • Chapter 2 Modbus Slave Mode GEI-100517A Modbus for HMI Applications
To minimize the sampling rate for alarms, a contact output can be provided from the
controller to the plant alarm horn system that informs the DCS that a new alarm has
occurred. The DCS can then request a transmission of the alarm states data. This
eliminates the need to continuously sample the alarm signals at a fast rate. Some sites
provide a remote printer to get high-resolution local alarm (62 ms), event (62 ms),
and sequence of event logs in the control room without investing in more
sophisticated equipment.
Physical Link Layer/Format, RS-232C Communications

This section details the physical link layer/format of the Modbus serial link.
Link Layer
Each HMI can provide up to eight point-to-point Modbus RS-232C serial links and a
defined number of Ethernet connections to a customer’s DCS. The HMI, acting as a
Modbus slave, responds to requests from Modbus masters on any of the Modbus
links.
Physical Layer
The HMI processor is used as the communications port for Modbus, typically using
the HMI's COM2 serial communications port. If the COM1 or COM2 ports are not
available, a serial expander board is required to supply eight more serial ports. The
port used is configured with a DB-9P plug connector as Data Terminal Equipment
(DTE). Figures 2-1, 2-2, and 2-3 show this connection.
The system is asynchronous RS-232C compatible, 300 to 19200 baud, with
programmable parity. It is compatible with full duplex data sets (modems). Modem-
generated signals such as CTS (Clear to Send), CD (Carrier Detect), and RI (Ring
Indicator) are not required to enable the transmitter. The RTS (Ready to Send) and
the DTR (Data Terminal Ready) are always equal to 1 when the HMI is powered up.
Refer to the TCI Modbus This prohibits any multi-drop DCS configurations, since these signals cannot enable
Configuration section in this or disable communications. Hardware handshaking (flow control using RTS/CTS
Chapter for timeout signals) is not supported. It is up to the master to only request data that it can
configuration. reasonably expect to handle in a single burst.
GE Industrial Systems does not recommend remote control of turbine products over a
telephone modem because of the inherent unreliability in this type of communication.
If it is necessary to collect data or operate over telephone modems, in most cases the
maximum number of bits that can be communicated is ten. Therefore the standard
eight bits of Modbus data and the two bits for start/stop is all that can be
accommodated. This means that parity is not supported over telephone modems.
RS-232C communications are RS-232C systems require two metallic shielded twisted-pair wires to connect the
limited to 50 feet without the short-haul modems. RS-232C transmission distances are defined in Table 2-1.
use of modems
Table 2-1. RS-232C Transmission Distances with Modems
Baud 26 Gauge 24 Gauge 22 Gauge 19 Gauge

Rate Miles km Miles km Miles km Miles km
300 10.0 16.1 12.0 19.3 15.0 24.1 25.0 40.2
1200 6.0 9.7 7.5 12.1 9.0 14.5 15.0 24.1
2400 4.5 7.2 5.5 8.9 7.5 12.1 11.0 17.7
4800 3.5 5.6 4.5 7.2 5.5 8.9 7.0 11.3
9600 2.2 3.5 3.2 5.1 4.0 6.4 5.0 8.0
19200 1.0 1.6 1.2 1.9 1.5 2.4 2.0 3.2
While modems are supplied by GE Industrial Systems, the customer must supply the
cabling and terminations. The standard modems supplied by GE Industrial Systems
require power on pin four. The modem connected to the HMI obtains its power from
the HMI serial port. The other modem must receive power on pin four from the DCS.
If the DCS cannot supply power, the optional modem set is required and must be
specified when ordering from GE Industrial Systems. This set is powered by an
external source. For line driver information, refer to Appendix A.
The DCS and the cabling are supplied by the customer. In figures 2-1, 2-2, and 2-3,
the following apply:
• NC means No Connection.
• LDDS means Limited Distance Data Set (short haul modem).
Typical HMI DCS

DB9P (DTE) DB25P (DTE)
RXD (2) Cable TXD (2)

TXD (3) RXD (3)
RTS (7) NC RTS (4)
CTS (8) NC CTS (5)
SCOM (5) Common (not shielded) SCOM (7)
CD (1) NC
DTR (4) NC
DSR (6) NC
RI (9) NC
Figure 2-1. RS-232C Connection to DB9 Serial Ports with No Modems
HMI Data Set Data Set DCS
DB9P (DTE) (Modem) (Modem)
RXD (2) (2) S1-2 R1-4 (2) RXD

TXD (3) (3) S2-1 R2-3 (3) TXD
DTR (4) (4) S1-4 S1-2 (4) V+
SCOM (5) (5) R2-3 S2-1 (5) SCOM
Shielded
Twisted-Pair Cable
wire
Figure 2-2. RS-232C Connection to DB9 Serial Port with Modems
The DCS power, V+, is 3-5 mA at 10 V dc. The nominal voltage is 12 V dc, with a
minimum of 6 V dc, and maximum of 25 V dc.
Typical HMI Data Set Data Set DCS

DB9P (DTE) LDDS LDDS DB25P (DTE)
RXD (2) (3) S1 R1 (3) RXD (3)
TXD (3) (2) S2 R2 (2) TXD (2)
RTS (7) NC R1 S1 (4) RTS (4)
CTS (8) NC R2 S2 (5) CTS (5)
SCOM (5) (7) (7) SCOM (7)
CD (1) NC (8) CD (8)
DTR (4) NC
DSR (6) NC
RI (9) NC
Power 120 V ac Power 120 V ac
Figure 2-3. Optional RS-232C Connection with LDDS

If a DB9 pin connector is used instead of a DB25 pin connector, change:
• pin 3 to pin 2 for RXD
• pin 2 to pin 3 for TXD
• pin 4 to pin 7 for RTS
• pin 5 to pin 8 for CTS
• pin 7 to pin 5 for SCOM
• pin 8 to pin 1 for CD
Physical Link Layer/Format, Ethernet Communications
The Mark VI system can use Ethernet communication with the DCS over the Plant
Data Highway (PDH). This is a 10Base-T, 10 Mbps (100 Mbps optional) Ethernet
The Mark VI system uses
data highway with optional 100Base-FX fiber-optic cables for longer distances. For
Ethernet data highways.
the link from the PDH to the DCS in the central control room, a fiber-optic cable
would normally be used. If required, Serial Modbus can be used with the Mark VI.
The PDH uses Fast Ethernet Switches. Some versions have both electrical ports for
RJ-45 connectors, and fiber-optic ports for 100 Base-FX connectors. Check the
Ethernet Switch description for the type of fiber-optic connector required.
The electrical cable is unshielded twisted-pair (UTP) cable, Category 5 EIA/TIA 568
A/B, or better. The fiber-optic cable is 62.5/125 micron, dual-window, graded index
profile, multimode glass-on-glass construction. Thermoplastic cable jackets for
indoor and outdoor use are available.
TCI Modbus Configuration

This section defines the required additions or modifications to configuration files on
an HMI to accomplish the following:
• Enable and configure the TCI Modbus task
• Enable and configure a serial port for Modbus communication
• Set up the Modbus mapping tables
• Generate the related document for the DCS vendor
F:\IO_PORTS.DAT: Modbus Link Definition

The Modbus Master program (MModbus.exe) and the Modbus Slave program
(Modbus.exe) share a common configuration file entitled F:\IO_PORTS.DAT to
specify important site variable data such as the port, baud rate, and Modbus slave id.
The configuration file is an ASCII-based text file that may be modified with any
standard text editor. Lines are not case sensitive. The configuration file is divided
into sections and each section begins with a title enclosed in brackets [ ].
The Modbus Slave program uses three sections as follows:
• The [MODBUS_SLAVE_PORT] sections are repeated once for each I/O port to
be used as a Modbus slave link. Both serial and Ethernet ports are defined here.
Serial links can use the COM1 or COM2 port, or a port from a serial expansion
board. The Ethernet link, if used, can also be specified here, but is only needed
once (not once per Modbus master using this link).
• The [MODBUS_ASSIGNMENT] section is used to bind Modbus slave

addresses to internal unit numbers, and indicates what Modbus addresses the
TCI Modbus slave should answer as. It also controls the data format (mode) used
over the Modbus link.
• The [MODBUS_SLAVE_TIMEOUT] section controls the message level

timeouts, and the NAKs that are returned when a timeout occurs.
To customize F:\IO_PORTS.DAT, use any standard text file editor.
F:\IO_PORTS.DAT contains textual information to help define a MODBUS link. The
following sections are in the file:
The three sections are defined in more detail in the template file in
G:\DATA\IO_PORTS.DAT. The following sample IO_PORTS.DAT file illustrates how
slave Serial and Ethernet ports are set up.
;-------------------------------------------------------------------------
;-------------------------------------------------------------------------
;
; <HMI> PORT DEFINITION FILE - F:\IO_PORTS.DAT
;
;
; This file defines the serial ports that exist on this PC
; and that are to be controlled by TCI services.
;
;-------------------------------------------------------------------------
;-------------------------------------------------------------------------
;
; This section defines MODBUS SLAVE port and hardware characteristics.
; This section can be duplicated up to 8 times (Ethernet plus serial ports).
;
[MODBUS_SLAVE_PORT]
;port com2
port none
baud 9600
parity 0 ;0-4 (none,odd,even,mark,space)
databits 8 ;5-8
stopbits 0 ;0-2 (1, 1.5, 2 stop bits) (1.5 stop bits currently
unsupported)
xonxoff 0 ;0-1
port_it 40 ;Timeout interval between characters, msec. Default=40
port_tt 200 ;Timeout for total message, msec. Default=200
;-------------------------------------------------------------------------
;
; This section defines that the MODBUS can receive requests over the
; ethernet. There can only be one of these sections.
;
[MODBUS_SLAVE_PORT]
;port ethernet
port none
timeout 60 ; no activity disconnect time in minutes (0 = disable)
Max_Connections 10 ; Maximum number of socket connections allowed
;-------------------------------------------------------------------------
;
; This section defines MODBUS slave address and software characteristics
;
[MODBUS_ASSIGNMENT]
;
;format1: SLAVE nnn UNIT uu MODE keyword
;format2: SLAVE nnn CIMPLICITY project MODE keyword
; where: nnn is the SLAVE address (in decimal) to recognize when sent
; a message from a modbus master.
; uu is the two character unit name (defined in F:\CONFIG.DAT)
; project is the name of a CIMPLICITY project on this computer.
; keyword is either RS16, RU16, UN12, HW12, or NATIVE for Signed 16,
; Unsigned 16, Unsigned 12, Honeywell 12, and Native data
; respectively.
;
; SLAVE and MODE are required entries. UNIT or CIMPLICITY must also be
; on a valid line.
; A new line should appear for each definition. Normally this is one
; or two lines for typical data patterns. A maximum of 16
; definition lines may appear.
;
;SLAVE 1 UNIT <unit_name> MODE RS16
;SLAVE 2 CIMPLICITY <project_name> MODE RU16
;-------------------------------------------------------------------------
;
; This section defines MODBUS slave timeout and Nak characteristics
;
[MODBUS_SLAVE_TIMEOUT]
modbus_timeout 4000 ;Time (milliseconds) before we give up and send nak
modbus_timeout_nak 6 ;Nak code used if unit timeout occurs.
;To use timeout, specify 4 or 6 only.
;To disable timeout, specify 0.
;-------------------------------------------------------------------------
Modbus Slave Configuration: Holding Coils, Input

Coils, Holding Registers, Input Registers
For the Mark V and Mark V LM controllers, a Modbus Mapping file (Modbus.dat) is
created for each controller. This file contains mapping tables to associate the
registers and coils with controller signal database (CSDB) points.
Usually with the Mark IV and Mark VI controllers, a Modbus Mapping file
(CimMod.dat) is created for each CIMPLICITY project. This file contains mapping
tables to associate the registers and coils with the CIMPLICITY points.
There are two categories of point mapping tables: holding and input. The Modbus
protocol supports reading and writing of holding table points, and reading but not
writing of input table points.
There are no restrictions on what controller CSDB points can be in the input and
holding tables. The TCI knows on a point-by-point basis which points are controller
commands and which points are not. A controller command is one of the following:
• LOGICS: pushbuttons logic state variables
• ANALOGS: analog setpoints enumerated state variables
The DCS may not write to The holding tables may be used exclusively, and the input tables may be omitted
input coils or input registers completely. Sending a Modbus write command to a point on a holding table that is
not mapped to a controller command has no effect and is ignored. A NAK is
returned.
There are two classes of signals found on the two tables: coils and registers. A coil is
one bit and maps to a logic point, with a value of zero or one. A register is 16 bits,
and maps to an analog point, or to a set of (up to) 16 packed logicals.
Multiple holding coils or registers may be mapped to the same point. If the
pointname is a controller command, a write command to any of the mapped holding
coils or registers causes the command to be executed.
HC – holding coils are one-bit logic signals that are both readable and writable.
Logic commands must be in this table to issue the command to the controller;
however, not all points in this table must be logic controller commands. Logic
commands are not writable from the holding register table.
IC – input coils are one-bit logic signals that are readable but not writable. Any
controller logic signal can be in this table, but logic controller commands are not
writable from this table.
HR – holding registers are 16-bit analog signals that are both readable and writable.
Analog controller commands must be in this table to send the command to the
controller, but not all points in this table must be analog commands. They can be any
analog signal, or a set of (up to) 16 bit-packed logic signals. Logic commands can be
packed into a holding register, but they are not writable in that format. For the TCI to
issue a logic controller command, it must be in the holding coil table.
IR – input registers are 16-bit analog values that are readable but not writable. Any
analog control database signal, or a set of up to 16 bit-packed logic control database
signals may be in this table. Analog or logic controller commands are not writable
from this table.
Modbus Slave: @SPARE: Unused Coils and

Registers
If a request is made using a coil or register not mapped to a controller point, a NAK
code of 02 is returned, which is listed as INVALID ADDRESS (see the section on
Message Errors later in this chapter). This prevents the DCS from interpreting the
reply as data from the controller.
To define coils or registers without mapping them to controller CSDB points, map
them to @SPARE in the mapping table. This indicates that the coil or register is not
used, but is legally defined. A data value of zero is returned for all coils and registers
defined as @SPARE. It is not necessary to map all the points in the mapping table.
The @SPARE is used only to fill in the gaps or to format the table as required by the
DCS.
Bit packed registers (logic control database signals packed into a 16-bit register)
should not have unused bits defined as @SPARE. When any one bit of a register is
defined as a packed bit, the entire register is defined as a packed register. Therefore,
omit defining the unused bits. Bits in a packed register not mapped to a logic
controller CSDB pointnames always send a value of zero to the DCS. @SPARE can
only be used on an unpacked register when the entire register is unused.
F:\UNITn\MODBUS.DAT: Mapping File Format

If the Modbus Slave mode is Native, F:\UNITn\MODBUS_N.DAT is used for the point
configuration. If the Modbus Slave is in any mode except Native,
F:\UNITn\MODBUS.DAT is used for the point configuration. The following section
contains a simple template as an example for filling out the Modbus mapping file.
More details are in the sample file in g:\data\modbus.dat and g:\data\modbus_n.dat.
If the Slave is defined to be a CIMPLICITY project, the configuration file is

CIMMOD.DAT or CIMMOD_N.DAT. This is located in the data directory of the
CIMPLICITY project. For the CIMPLICITY data to work, the TCI Modbus option
must be installed in the CIMPLICITY project options. When this option is installed,
templates of these files are installed. There is information in the header of these files
on how to fill them out. They are almost the same as the unit configuration files. The
Mark VI uses CIMMOD.DAT
Adding or Modifying Entries in the MODBUS.DAT File
Rules and guidelines for adding or modifying entries in this file are as follows.
Rules:
• Never define a bit of a packed holding register (such as HR0001.1) as @SPARE.
Defining just one of the bits as packed defines the entire register as a packed
register. A 0 is returned for bits not mapped
• When a semi-colon is found in a line, the rest of the line is considered a

comment
• Do not map any one register to both packed controller CSDB logic pointnames
and to an analog controller CSDB pointname
• Do not have any one coil or register mapped more that once
• Never add page breaks (form feeds) in this file
Guidelines:
• The table entries may be in any order
• It is not necessary to define all the table points in this file, only the ones desired
• Group similar controller CSDB points together, such as temperatures, speed

signals, or controller command feedback signals
Table_Type, Table_Point, and CSDB_Pointname

The Table_Type is one of four kinds: HC, IC, HR, or IR.
The Table_Point ranges from 1 through 10000 points, and the CSDB_Pointname is a
valid control signal database pointname.
Following the CSDB_Pointname are optional fields to specify the minimum and
maximum values. These fields should always be specified except in the case of logic
points.
The following is a sample Modbus.Dat file:
;
; MODBUS.DAT
;
; This file should be put in the unit directory to configure the MODBUS Slave.
;
; Each line should begin with:
; HCxxxx - Holding Coil, xxxx = coil number, this should be followed by a
; pointname.
; ICxxxx - Input Coil, xxxx = coil number, this should be followed by a
; pointname.
; HRxxxx - Holding register, xxxx = register number, this should be followed
; by pointname, Minimum value, and Maximum value.
; IRxxxx - Input register, xxxx = register number, this should be followed by
; pointname, Minimum value, and Maximum value.
;
; The Minimum and Maximum values a not required by any point that will fit in
; 16 bits directly. They can be used if wanted to rescale the point. The
; minimum value is the point value that will correspond to the minimum value
; for the mode. For signed 16 this is -32768, for unsigned 16 this is 0. The
; maximum value is the point value that will correspond to the maximum value
; for the mode. For signed 16 this is 32767, for unsigned 16 this is 65535.
;
; Holding registers and Input registers can also be set so that a boolean fills
; in each bit of the register.
; HRxxxx.b and IRxxxx.b where b is the bit number from 0 to 15.
;
HC0001 L4
HC0002 L52GX
;C0001 L52GX
;C0002 L4
;
;REGISTER SIGNAL MINIMUM MAXIMUM
;NUMBER NAME VALUE VALUE
;
IR0001 T54_1 -200 2000 ;TC
IR0002 T54_2 -200 2000 ;TC
HR0001 T54_1 -200 2000 ;TC

HR0002 T54_2 -200 2000 ;TC
;
;PACKED REGISTERS
;
HR0200.0 L4
HR0200.15 L52GX
;
An example of a Modbus_N.Dat file, used for Native type data where no gain or
offset is used, is as follows:
;
; MODBUS_N.DAT - This file defines the points to be loaded by the HMI
; for retrieval via a RS232 link using MODBUS protocol.
;
;-----------------------------------------------------------------------
;
; The HMI acts as a slave to a MODBUS master, typically a customer
; supplied Distributed Control System (DCS).
;
; The HR (Holding Register) and HC (Holding Coil) tables support 10000
; points each. This list does not show all available spare points,
; but they may be added at any time. The HR and HC tables are defined
; by MODBUS as READ/WRITE points.
;
; Two Other tables, IR (Input Registers) and IC (Input Coils), are
; also available, but HR and HC tables have been selected as a GEDS
; standard. The IR and IC tables are defined by MODBUS as READ only.
;
; Points may be defined as spare by the @SPARE symbol in the controller
; Signal Name field.
;
; The points in the tables need not be in numerical order. Likewise,
; @SPARE points may exist anywhere in the table without affecting any
; of the other points (except packed registers, discussed later).
;
; Points in the HC table are 1 byte (8 bits) in length and typically
; used for READ/WRITE logics, i.e. push-buttons and logic states. If
; the MODBUS master requests a change of state in a HC point, the HMI
; will attempt to WRITE to that signal in the controller Control Signal
; Database.
;
; Points in the HR table are 2 bytes (16 bits) in length and are used
; for READ/WRITE analogs and READ only logics, such as alarms, etc.
; HR points may be defined as 16 individual logics, holding registers
; such as these are referred to as packed registers. Individual bits
; (HR0xxx.0,..,HR0xxx.15) in a packed HR can be assigned Control logic
; points. However, if any bit in a packed HR is defined as an @SPARE
; then the entire HR defaults to spare. Therefore, any packed register
; which is not entirely filled should omit definitions for the unused bits.
;
;MODBUS Mark V
;Table Point Signal Name
;-----------------------------------------------------------------------
HR0001 BB_MAX
HR0002 CPD
HR0003 @SPARE
HR0004 @SPARE
HR0005 CTD
HR0006 CTDA3
HR0007 CTDA2
HR0008 CTIF1
HR0009 GENHUM
HR0010 CTIM
HR0011 DF
HR0012 DPF
HR0013 DRPF_CMD
HR0014 DRVAR
HR0015 DRVAR_CMD
HR0016 DV
HR0017 DVAR
HR0018 DVX
HR0019 DWATT
HR0020 FLAME
HR0021 FSR
HR0022 FSR1
HR0023 FSRACC
HR0024 FSRMAN
HR0025 FSRMAX
HR0112 QTLO1
HR0113 QTLO2
HR0114 @SPARE
HR0115 DFL
HR0116 CAP
HR0117 DVOLT
HR0118 DAMP
HR0119 DVF
HR0120 DAF
In this example, it can be seen that not all table points are defined or in order,
comments are added using a semi-colon ( ; ), and there are no duplicate table point
definitions.
CimMod
CimMod is a program used with the Mark IV and Mark VI systems. CimMod co-
operates with the TCI Modbus Slave program to allow read and write access to data
in CIMPLICITY projects using normal Modbus messaging, and extends the data
capability of the TCI Modbus Slave program
The CimMod program gets data from the CIMPLICITY Point Manager (read) and
sets values in the CIMPLICITY Point Manager (write) based on messages to and
from the TCI Modbus slave program. CimMod is capable of scaling Modbus data for
presentation to the TCI Modbus slave program. Five Modbus modes are supported as
follows: (move fwd)
• RS16 - Signed 16
• RU16 - Unsigned 16
• UN12 - Unsigned 12
• HW12 - Honeywell 12
• NATIVE - Native
CimMod keeps its configuration files and log files in the following directories:
• %site_root%data
• %site_root%log
where %site_root% stands for an environment variable defined by the CIMPLICITY
project. For any given CIMPLICITY project, open the project workbench to
determine the variable of %site_root%
Ø To Determine the Value of %site_root%
1. From the Desk Top, click on Start, Programs, CIMPLICITY, HMI, then
Workbench
2. From the menu, select Tools, then Command Prompt. The resulting
Command Prompt window has the variable site_root defined for the selected
project. The percent signs surrounding site_root mean evaluate.
3. To display site_root, enter
set site_root
For example, if the set site_root command results in the display:
site_root=c:\site\cimproj\
then the directory %site_root%data is c:\site\cimproj\data.
CimMod is configured by two files. Both files reside in the directory
%site_root%data. One file is called Cimmod_n.DAT and the other file is
Cimmod.DAT. See the example files Cimmod_N.DAT and Cimmod.DAT for
formatting information.
The Cimmod_n.DAT file handles the assignment of Modbus coils and registers to
CIMPLICITY data points when scaling is Native, that is no gain or offset is used.
When CIMPLICITY data exists in a format that will not fit within a single Modbus
register (16-bits), the Cimmod_n.DAT file can map up to four registers (8-bytes) to a
single CIMPLICITY data point.
The Cimmod.DAT file handles the assignment of Modbus coils and registers to
CIMPLICITY data points when scaling is not Native. A gain and offset is used to
scale the data into a register. The user specifies the calculated gain and offset by
specifying in the Cimmod.DAT file the maximum and minimum value for each point
assigned to a Modbus register.
CimMod Example
A sample CimMod.DAT file follows:
;
; CimMod.DAT
;
; This file should be put in the CIMPLICITY projects data directory to ;
;configure the TCI-MODBUS Slave. This file is used for any slave mode other ;
than NATIVE.
; CimMod_N.dat is used for NATIVE mode.
;
; pointname.
; pointname.
; HRxxxx - Holding register, xxxx = register number, this should be followed ;
by
;
; The minimum value is the point value that will correspond to the minimum ;
value for the mode. For signed 16 this is -32768, for unsigned 16 this is 0.
; The maximum value is the point value that will correspond to the maximum ;
value
; for the mode. For signed 16 this is 32767, for unsigned 16 this is 65535.
;
; Holding registers and Inputs registers can also be set so that a boolean ;
fills in each bit of the register.
;
HC0001 BIT1
HC0002 BIT2
IC0001 BIT1
IC0002 BIT2
;
;NUMBER NAME VALUE VALUE
;
IR0001 ANALOG_16 -1000 1000
IR0002 ANALOG_32 0 2000
HR0001 ANALOG_16 -1000 1000

HR0002 ANALOG_32 0 2000
;
;PACKED REGISTERS
;
HR0200.0 BIT1
HR0200.15 BIT2
;
A sample CimMod_N.Dat file, used for Native type data where no gain or offset is
used, is as follows:
;
; CimMod_N.DAT
;
; This file should be put in the CIMPLICITY projects data directory to ;
configure
; the TCI-MODBUS Slave. This file is used when the slave mode is NATIVE.
;
; pointname.
; pointname.
; HRxxxx - Holding register, xxxx = register number, this should be followed ;
by
; a pointname.
; a pointname.
;
; Multiple Holding registers and Input registers can be filled in by one
; point when data is requested in NATIVE mode. In NATIVE mode, a 32 bit value
; will take two registers and a 64-bit value will take four registers to ;
return.
; All the registers must be requested in the same message to get the correct
; value. Also all the registers must be sent in the same message to be set
; correctly.
; HRxxxx-yyyy and IRxxxx-yyyy where xxxx is the first register and yyyy is
; the last register.
;
; Holding registers and Inputs registers can also be set so that a boolean ;
fills
; in each bit of the register.
;
HC0001 BIT1
HC0002 BIT2
IC0001 BIT1
IC0002 BIT2
;
;REGISTER SIGNAL
;NUMBER NAME
;
IR0001 ANALOG_16
IR0002 ANALOG_32
HR0001 ANALOG_16
HR0002 ANALOG_32
;
;PACKED REGISTERS
;
HR0200.0 BIT1
HR0200.15 BIT2
;32 bit value

;
HR0010-0011 ANALOG_32
;
;64 bit value
;
HR0012-0015 REAL_64
;
The CIMPLICITY project and TCI must be restarted for changes to take effect. After
the TCI has restarted, inspect the file G:\LOG\MODBUS.LOG and %site-
root%log\CIMMOD.LOG for any errors or warnings.
Beware when configuring data from multiple devices. If one

device is down, Modbus requests will fail (exception code 4) if
they contain registers configured for points from the device
that is down.
It is best to group registers by device to help avoid a Modbus failure. For example, if
configuring data for two Mark VI controllers avoid interspersing data as follows:
HR0001 G1\DWATT
HR0002 G2\DWATT
HR0003 G1\DVAR
HR0004 G2\DVAR
It is preferable to group them so that each controller's points are in a contiguous
range of addresses as follows:
HR0001 G1\DWATT
HR0002 G1\DVAR
HR0003 G2\DWATT
HR0004 G2\DVAR
MODBUS_L.EXE: MODBUS Listing Program

After F:\UNITn\MODBUS.DAT is completed, the file F:\UNITn\MODBUS.LST can be
created as a convenience for use by the DCS vendor for setting up the DCS. This file
documents the Modbus tables.
MODBUS_L is a command line utility program run from the unit configuration
directory. It does not require any command line parameters, but a few are available to
change the default format or scale codes generated. If run with the /? parameter, it
produces a help screen, as shown in the example below:
F:\UNIT1>MODBUS_L /?
MODBUS_L: MODBUS LISTING PROGRAM
Command format: MODBUS_L [options]

options:
ENGLISH, METRIC, CUSTOM, HARDWARE
These options control the scale code set used to supply the gain,
offset, and engineering units for each point.
RS16, RU16, UN12, HW12, NATIVE

These options control the formatting of the raw data, with the
appropriate changes to the gain and offset for each point.
QUIET
This option disables the printout to the terminal of messages
indicating that a point name was not found in the dictionary.
The messages, however, will be indicated in the MODBUS.LST file.
NOLONG
This option produces a MODBUS.LST file without longnames.
LONG
This option makes a MODBUS.LST with a nonlogic longname field of
66 characters. The nonlogic longname field default is 40 char.
/LOG
Redirect output sent to the screen into MODBUS_L.LOG.
F:\UNIT1>
The Modbus listing file The Modbus Listing Program, G:\EXEC\MODBUS_L.EXE, reads the necessary
defines the format and scaling configuration files in the TCI and creates F:\UNITn\MODBUS.LST. This file contains
of each mapped coil and a list of the coil and register maps, complete with scaling information. It is
register. Included in this list recommended that a new listing file be created each time F:\UNITn\MODBUS.DAT is
is an indication of which changed, or when the mode defined for the Modbus link is changed in
signals are controller F:\IO_PORTS.DAT. This Modbus listing file is the key to programming the DCS end
commands of the Modbus link.
Ø To create a new listing file F:\UNITn\MODBUS.LST
w From the Command Prompt in F: , enter:
\UNITn
MODBUS_L
The new listing is created.
There is a corresponding Modbus listing program for CIMPLICITY. It is
CimMod_L.exe.
Ø To run CimMod_L.exe
1. From the Command Prompt for the CIMPLICITY Workbench, change
directory to the data directory. Enter:
cd data
2. Enter:
CimMod_L
The message Modbus list processing complete displays.
MODBUS_L Command Format
The options described below are used to modify the format of
F:\UNITn\MODBUS.LST.
scaling (ENGLISH, METRIC, CUSTOM, HARDWARE) determines which
F:\UNITn\*.SCA file is used (ENGLISH.SCA is the default file).
mode (RS16, RU16, UN12, HW12, NATIVE) used must match the mode defined in
F:\IO_PORTS.DAT. Since different Modbus links can be running in different modes
at the same time, the desired mode should be specified.
quiet if used, F:\UNITn\MODBUS.LST should be checked for error messages, as the
errors will not be displayed on the screen.
nolong omits longnames (controller control signal database pointname definitions)
defined in the file F:\UNITn\LONGNAME.DAT.
long is used to widen F:\UNITn\MODBUS.LST to avoid trimming longnames of
nonlogic (analog) signals.
MODBUS_L flags errors such as duplicate coil or register assignments, undefined
controller CSDB pointnames, invalid formats, invalid coil or register numbers, and
conversion errors. Resolve all errors before communicating with the DCS.
F:\UNITn\MODBUS.LST: MODBUS Listing File

The following is a sample F:\UNITn\MODBUS.LST file:
+HR0001 | SWREF_CMD | SIGN16 | 512 | 0 | MW |
+HR0002 | DRVAR_CMD | SIGN16 | 512 | 0 | MVAR |
+HR0003 | SC43LOAD | UNS16 | 65536 | 0 | STATE |
HR0004 | @SPARE | spare |
HR0005 | @SPARE | spare |
+HR0006 | L90PSEL_CMD | SIGN16 | 512 | 0 | MW | PRESELECTED LOAD ANALOG SETPOINT
+HR0009 | SC43 | UNS16 | 65536 | 0 | STATE | TURBINE CONTROL SELECTION
HR00010 | SS43 | UNS16 | 65536 | 0 | STATE | TURBINE COMMAND STATE SELECTION
HR0200.00| L52GX | PACKED | GENERATOR BREAKER CLOSURE
HR0200.01| L94X | PACKED | NORMAL SHUTDOWN
HR0200.02| L30D_SD | PACKED | NORMAL DISPLAY MESSAGE “ SHUTDOWN STATUS”
HR0200.03| L30D_SU | PACKED | NORMAL DISPLAY MESSAGE “ STARTUP STATUS”
+HC0001 | L1FAST_CPB | LOGIC | FAST LOAD START SIGNAL
+HC0002 | L1START_CPB | LOGIC | START SIGNAL
+HC0003 | L70R4R_CPB | LOGIC | SPEED SETPOINT RAISE COMMAND PUSHBUTTON
+HC0004 | L70R4L_CPB | LOGIC | SPEED SETPOINT LOWER COMMAND PUSHBUTTON
Each line in F:\UNITn\MODBUS.LST contains the information below in the following
order:
• (Write Status + means writable)
• Table Point
• CSDB Pointname
• Data Format
• Gain
• Offset
• Units
• Longname
(Write Status) – A preceding plus sign (+) indicates that this is mapped to a
controller command. In this case it is legal for the DCS to request a write to the point,
and thus issue the command to the controller. The sample listing shows holding
register 1 as an analog command, holding coil 1 as a logic command, and holding
register 9 as an enumerated state variable that can be written to the controller. Logic
controller commands cannot be written if packed into holding registers (see above
section Modbus Slave Configuration: Holding Coils, Input Coils, Holding Registers,
Input Registers). In this sample, a 0 may select OFF, 1 may select CRANK, and 2
may select AUTO.
Table Point – indicates which one of the four Mapping Types and what point on the
table is used for this point.
CSDB Pointname – controller control signal database pointname that the coil or
register maps.
Data Format – transmission mode used to send the data over the Modbus link.
Packed 16 bit register containing packed logics
Sign16 signed 16 bit signal
Uns16 unsigned 16 bit signal
Logic true/false
Spare spare
Hw12 Hardware 12 bit signal
Real32 32 bit real signal
? error conditions will contain the character “?”
Gain – required to convert the Modbus value of registers to engineering units.
Offset – required to convert the Modbus value of registers to engineering units.
Engineering Units – displayed units associated with the above Modbus Gain and
Offset for registers. An entry of HEX indicates that this point is not normally
converted into engineering units, but displayed in hexadecimal. Special points, such
as bit masks, are defined this way.
Longname – description of the signal found in F:\UNITn\LONGNAME.DAT.
When F:\UNITn\MODBUS.LST is generated, do not edit it since running MODBUS_L
overwrites any changes.
Modbus Data Format and Scaling

The data formats used for logic and analog signals are described below.
Modbus Data Conversions: Logics

Logic control database signal values can be transmitted to the DCS using either coils
or registers. Coil data conversion corresponds to a single logic control database
signal with the least significant bit (LSB) indicating its state.
When registers are used to transmit logic control database signal values, each bit
corresponds to the state of a logic signal. A register having 16 bits corresponds to a
group of (up to) 16 logicals with the LSB being the first logic signal in the group,
and the most significant bit (MSB) as the last logic signal in the group. The two bytes
are packed into the Modbus message using the normal rules for MSB and LSB order.
The values of undefined bits in a packed register are transmitted as 0. Read carefully
for details on the modes used in transmission of data, because some modes may not
be suitable for bit packed registers.
Modbus Data Conversions: Analogs

Analog signal values can be transmitted using registers only. Since DCS vendors
handle analog signals in different ways, for example 12-bit positive numbers, analog
data may be transmitted in one of several modes. The following modes are currently
supported to meet customer needs. This section defines how to convert each data type
to engineering units. The Modbus listing file (see above) defines the data type for
each signal.
The conversion algorithms presented here define the conversion process at the most
understandable level. The implementation of these algorithms does not always follow
these algorithms directly as there are many different schemes used to prevent
mathematical overflows in the computations. The choice of the final implementation
is left to the DCS vendor.
RS16
If a scaling is of type SIGN16, it is a signed 16-bit number. In this mode, the most
significant bit of the 16-bit analog signal is treated as a sign bit, where a 1 is used for
negative values.
C2 type signals are transmitted modulo 32768 to prevent the sign bit from being set.
H2 and X2 types are transmitted directly with an assumed value of (-32768 to
+32767). The convention of assuming the raw value is a fraction from -1.0 to +1.0
was used in defining the Modbus Gain and Offset. This allows the Gain to indicate
the maximum (and minimum) value when the Offset is zero. The Modbus listing file
defines the Modbus Gain and Offset required to calculate the value in engineering
units, with the conversion being as follows:
Engineering units = (Raw_value) / 32768 * Gain + Offset
For example, thermocouples are scaled with a gain of 2048 and an offset of 0 for
conversion to ºF. If the register value is 1120, the conversion to engineering units is:
Engineering units = (1120) / 32768 * 2048 + 0
Engineering units = 70 ºF
RU16
If a scaling is of type UNS16, it is an unsigned 16-bit number. This mode transmits
F2 analog signals as unsigned 16-bit numbers by adding 32768. The most significant
bit, therefore, turns from a sign bit into a bit with a weight of 32768. This transforms
the range of F2 signals to [0,+65535]. The Modbus listing file defines the Modbus
Gain and Offset required to calculate the value into engineering units, with the
conversion being:
Example 1: If an UNS16 is used for a normal counter, the raw value is the value of
the counter. If a counter has the value of 418, it is converted as:
Engineering units = (418) / 65536 * 65536 + 0
Engineering units = 418
Example 2: A number that is normally a signed number in the controller is requested
as an unsigned number. If the register value of a thermocouple was requested, it
shows that in UNS16 mode the Modbus Gain is 4096, and the Offset is -2048 for ºF.
The conversion of the raw data value of 33888 to engineering units is as follows:
Engineering units = (33888) / 65536 * 4096 – 2048
Converting a SIGN16 to an UNS16 causes no loss of resolution.
UN12
If a scaling is of type UN12, it is an unsigned 12-bit number. The function of this
mode is to restrict signals to a range of [0,+4095]. The Modbus listing file’s Modbus
Gain and Offset define the conversion into engineering units, where the conversion
is:
For example, if the register value of a thermocouple is requested, the listing file
shows that the Modbus Gain is 4096 and the Offset is -2048 to get to ºF. The
conversion of the register value of 2118 to engineering units is:
Engineering units = (2118) / 4096 * 4096 – 2048
The conversion from SIGN16 Certain internal signal types (for example H2, X2) become meaningless if restricted
to UN12 causes a loss in to the UN12 range and are therefore transmitted directly without conversion (if
resolution of 16:1 and should requested by the DCS). Logics packed into registers also become meaningless if the
be avoided register’s value is converted. The Modbus listing file lists these points with a mode
of UN16. Most analog signals that are of interest to the DCS are in an F2
representation. A gain of 1/16 is applied to F2 signals and 2048 is added to convert
the range from [-32767, +32767] to [0, +4095]. The unsigned 16-bit signal type C2
is transmitted Modulo 4096 to also restrict the range to [0, +4095].
HW12
A special version of the UN12 mode is available for use with some models of DCS
systems. These systems collect data using the normal UN12 mode described above,
but are unable to send analog setpoints to the controller using the same GAIN and
OFFSET conversion. In these DCS systems, no OFFSET is allowed in the conversion
of analog setpoint commands to Modbus register values, only a GAIN.
To accommodate these systems, the HW12 mode reports data to the DCS using
UN12 mode, but uses a different formula for analog setpoint commands sent from the
DCS to the controller. This scheme allows the DCS the full positive range of the
controller command, but does prevent sending negative values. Analog setpoint
commands in these systems are usually scaled in percentages.
The HW12 mode analog Make sure that the programming in the DCS reflects the fact that the scaling of the
setpoint command is the only analog setpoint command to the controller is different than the scaling of the
place where this is true. feedback signal from the controller.
For data from the controller to the DCS, the conversion is the same as the UN12
mode:
For setpoint commands from the controller to the DCS, and the DCS to the
controller, the conversion is:
Engineering units = (Raw_value) / 8192 * Gain
Raw_command_value = (Engineering units / Gain) * 8192
Example: If a valve position is requested, the listing file shows that the Modbus
Gain is 256 and the Offset is 0 to get percent. The conversion of the register value of
1216 to engineering units is :
Engineering units = (1216) / 8192 * 256
Engineering units = 38%
To send the analog setpoint command to set the valve to this same position of 38%,
the analog setpoint command value that must be sent is:
Raw_command_value = (38) / 256 * 8192
Raw_command_value = 1216
Native
If a point is of data type Native, all analog signals are transmitted in their internal
controller representation. This is the recommended mode because the signals can be
transmitted directly without any manipulation, which could result in decreased
resolution. Any 32-bit signal requires two registers to be assigned to it. These data
points are defined in F:\UNITn\MODBUS_N.DAT, not the standard definition file.
The most common signal types used in the controller are as follows:
• L1 logic signal, least significant bit indicating state 0 or 1.
• F2 16-bit signed two’s complement representation, range: [-32767, +32767]
• C2 16-bit unsigned representation, range: [0,+65535].
• S2 16-bit signed representation, range: [-32768,+32767].
• H2 16-bit unsigned representation used for bit masks.

• X2 16-bit unsigned representation used to form the lower 16-bits of long,
32-bit values.
• F4 32-bit signed two’s complement representation.
• C4 32-bit unsigned representation.
• H4 32-bit unsigned representation used for bit masks.
• R4 32-bit real floating point number.
Modbus Command and Response Definition
This section describes the commands and responses supported to implement required
Modbus slave communications and control functions. Messages are transmitted and
received using the Remote Terminal Unit (RTU) 8-bit transmission mode, which is
MSB means Most Significant one of two Modbus transmission modes, where RTU transmits data in eight bit bytes.
Byte. The other mode, where characters are transmitted in ASCII, is not supported. The
LSB means Least Significant RTU transmission mode uses the format below (where slave address, function code,
Byte. CRC-16 MSB, CRC-16 LSB are all bytes):
+------------------------- -----------------+
¦ SLAVE ¦FUNCTION¦ ¦ ¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦ ¦ ...DATA... ¦(MSB) ¦(LSB) ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦
+-------------------------- ----------------+
RTU Transmission Mode

slave address –a number from 0 to 255 that specifies the unit with which to
communicate (a slave address of 0 is considered a broadcast message to all slaves).
function code – this specifies the purpose and format of the remaining message
portion.
CRC-16 –This is two bytes that complete each Modbus message. CRC (Cycle
Redundancy Check), MSB, and LSB are bytes used for error checking and are
calculated for each transmitted and received message to insure that no transmission
error has occurred while the message was in transit. The method for calculating the
CRC-16 is a public protocol and is described in numerous textbooks and the Gould
Modicon Modbus Protocol Reference Guide. Please refer to these other documents
for information on calculation of a correct CRC.
Modbus over Ethernet adds the header below to the message formats. All the same
functions are supported over Ethernet that are supported over the serial ports, but the
CRC is not included at the end of the Modbus message; the CRC is included in the
Ethernet message.
+----------------------------------------------------
¦INV ¦INV ¦PROTO¦PROTO¦ ¦ ¦Standard serial
¦ID ¦ID ¦ID ¦ID ¦LEN ¦LEN ¦function message
¦(MSB)¦(LSB)¦(MSB)¦(LSB)¦(MSB)¦(LSB)¦
+----------------------------------------------------
invocation id – is not used by TCI Modbus.

proto id – is not used by TCI Modbus.
length – is the byte count of the remaining part of the message. This is used by TCI
Modbus to receive the rest of the message, which is exactly what is sent and received
over the serial connections.
Message Errors
When a message is received that cannot be acted upon, the message is either ignored
and the HMI waits for the next message, or it is responded to with an exception
message.
Any messages that are misunderstood, incomplete, or altered in some manner as
indicated by framing error, parity error, or CRC-16 error are always ignored because
it is not possible to reliably determine for which address the message was intended. It
is the master’s responsibility to detect this timeout condition and resend the message
as necessary (see the section TCI Modbus Configuration in this Chapter).
Any time a message receipt is in progress and an interval of time corresponding to
3.5 character times (based on the baud rate) occurs without receipt of a character, the
message receipt in progress is aborted and ignored. Message failures from other
causes are responded to with an exception response if no reception error has occurred
and if the message was not a broadcast (slave address was 0).
Statistics, Diagnostics, and Testing
The Modbus Slave program gathers statistics and makes counters available for
diagnostic purposes. The program M_stat.exe is a special console program to
communicate with the Modbus Slave program, and retrieve and control these
diagnostic counters To determine whether Modbus slave is working correctly, run
M_stat and see if the error counters are incrementing
Running M_stat displays these counters as follows:
F:\USER>m_stat
Modbus Slave statistical summary:
Modbus Slave 1.
4815 = Count of messages sent by Modbus Slave.
0 = Count of bad messages sent by Modbus Slave.
4815 = Count of successful replies.
0 = Count of exception replies.
0 = Count of message timeouts.
0 = Count of buffer full, read error, and so on
0 = Count of CRC errors.
0 = Count of bad received messages.
Modbus Slave 2.
4815 = Count of messages sent by Modbus Slave.
0 = Count of bad messages sent by Modbus Slave.
When multiple Modbus Slaves appear, each group corresponds to a separate port as
specified in the F:\IO_PORTS.DAT file. The counters can be reset by passing reset as
a parameter to the M_stat program. Reset is case insensitive.
Trace Global Sections

Message traffic from the Modbus subsystems is stored in circular buffers in Global
Sections. This data can be collected from a command prompt and used for
diagnostics. A number of Global Sections are available to access different types of
messages.
Trace Global Names
The trace command format is GBL2FILE [global section name] [filename], for
example:
GBL2FILE modbus_trace C:\TEMP\MODBUS.DMP
GBL2FILE is the command name. The global section name is from the table below,
and is case sensitive. The output file name and its path are chosen by the user. GE
can assist with debugging a specific problem using this output file. On newer HMI
products, it is possible to collect and view the data via the Web Interface on the
system.
The table below shows useful Trace Global Section Names. In this listing, %d is
replaced by a number 1 through 8:
Table 2-2. Trace Global Section Names
Global Section Name Global Section Description

cimmod_trace CIMPLICITY - TCI MODBUS Traffic Log
MModbus_trace%d MODBUS Master Traffic Log - Port %d
modb_fwd_trace MODBUS Forwarder Traffic Log
modbus_trace MODBUS Slave Traffic Log
Examples of trace commands are as follows:

For the Modbus Master Traffic log:
g:\exec\gbl2file MModbus_trace1 g:\log\mmbus.log
For the Modbus Forwarder Traffic log:
g:\exec\gbl2file modb_fwd_trace g:\log\modb_fwd.log
For the Modbus Slave Traffic log:
g:\exec\gbl2file modbus_trace g:\log\modbus.log
The output file name is any convenient identifier for storing the log.
Log File
If the Modbus driver encounters a serious error or warning, the result is placed in a
log file as well as the global section trace buffer. To view this log file, check the file
G:\LOG\Modbus.log.
CIMMOD Diagnostics
Information about CimMod and its configuration is available from several sources:
• An error log entitled CimMod.log is created each time the CIMPLICITY project
runs the CimMod program. Configuration errors, details and information reside
in this file. This file is created in the directory:
%site_root%log
• A program Cimmod_L provides detailed mapping information. This program
reads the configuration files to produce a file entitled CIMMOD.LST.
• The CimMod global section trace may be viewed by executing the program
g:\exec\gbl2file. Give the global section trace name, cimmod_trace, and an
output filename. The trace name is case sensitive, for example:
g:\exec\gbl2file cimmod_trace g:\log\cimmod.log
• If additional details concerning configuration and messages in the cimmod_trace
are desired, the keyword VERBOSE can be placed on a line by itself in either or
both of the configuration files Cimmod.DAT and Cimmod_n.dat.
Additional details are available using the normal Modbus slave diagnostics.
Modbus Master Simulation

If problems occur when the DCS system acts as a Modbus Master to the HMI, test
the Modbus link using the Modbus Master Simulation Program, MODSCAN32.
Modscan32 is a product of MODSCAN32 is a Windows Modbus Master Program used for Modbus Testing.
Win TECH Software Design. The program runs on a separate laptop or other computer, and connects from one of
Program documentation and a its COM ports to the COM port on the Modbus Slave or HMI. The COM port on the
sample program is available HMI is defined in the F:\IO_PORTS.DAT file. A null modem cable is used for a
from: direct connection, or the Line Drivers that often ship with the unit can be used.
http://www.win-tech.com
/html/modscan32.htm
Notes
.
Chapter 3 Modbus Master Mode
Introduction
This chapter describes how the HMI can be set up as a Modbus Master to
communicate with intelligent devices that can be configured as Modbus slaves.
Differences between Master mode and the Slave mode discussed in Chapter 2 are as
follows:
• Master mode does not use CimMod
• Master mode does not use Modbus_L
• The Modbus Master program adds two write items to the items in the Slave
program, as follows:
Read Items: Hold Coil, Hold Register, Input Coil, Input Register
Write Items: Write Coil, Write Register
• Slave mode is used when the HMI is responding to Modbus requests for data,
such as from a DCS. Master mode is used when the HMI must make Modbus
requests for data from devices.
Master mode uses the same Modbus Data Conversions as Slave mode (refer to
Chapter 2 Modbus Data Format and Scaling).
External Communication Links

External communication links allow the HMI to communicate with other Modbus
slaves over up to eight serial communication ports. Communication is possible over
these links with up to 48 different Modbus slaves. The physical link layers are the
same as for the Slave mode (refer to Chapter 2 Modbus Slave Mode). Ethernet
communication using Modbus TCP/IP is supported.
GEI-100517A Modbus for HMI Applications Chapter 3 Modbus Master Mode • 3-1
Modbus Master Setup
The Modbus Master program first reads one or more sections of a file called
F:\IO_PORTS.DAT for information specifying Modbus port and hardware
characteristics. This section, [MODBUS_MASTER_PORT], provides details as
follows:
• Port, baud rate, parity
• Modbus address and software characteristics, such as slave address and unit
number. Up to 48 master entries may be specified.
• Modbus timeout and loop characteristics
This program ignores Modbus slave assignment.

The program then reads a Modbus data file in the unit directory for information
specifying a correspondence between Modbus data structures (for example holding
registers, holding coils, input registers, input coils) and the corresponding controller
data points and scaling information. The data file resides in the unit directory
(F:\UNITn) and has a filename in the form MMBUSnnn.DAT where nnn is the slave
address being referenced. Multiple MMBUSnnn.DAT files may exist in the same
directory. For example, if the F:\IO_PORTS.DAT file specified that we communicate
with slave address 3, with lines such as:
Master 3 Unit Mm Mode RS16
then the Modbus Master program would read file MMBUS3.DAT from the unit
directory to determine the register and coil correspondence. Leading zeros for nnn
are not used. Also, the default file name can be overriden as shown in the following
example:
Master 3 Unit Mm Mode RS16 File MMDATA.DAT
Next, the program opens the port specified above and starts sending out requests to
the up to 48 slave addresses it was configured to poll. Upon receiving a message
reply, the program stores the data in the unit data dictionary as appropriate.
Modbus Master Configuration

This section describes the In the TCI port definition/configuration file, F:\IO_PORTS.DAT, comments are
Modbus Master sections in specified by a semicolon. Any semicolon makes the remainder of the line a comment,
the TCI port which is ignored. There is only one section used by the Modbus Master entitled
definition/configuration file, [MODBUS_MASTER_PORT], but this section may appear up to eight times. Each
F:\IO_PORTS.DAT, and in appearance should correspond to a separate communications port for the Modbus
the data configuration files, Master.
F:\UNITn\MMBUSn.DAT
For example, the first [MODBUS_MASTER_PORT] section may be for com2 while
the next section might be for com3. These sections should appear as above, including
brackets. They may appear in any order. Sections other than
[MODBUS_MASTER_PORT] are ignored by this program. Data lines following
each section specify configuration information.
3-2 • Chapter 3 Modbus Master Mode GEI-100517A Modbus for HMI Applications
For the section [MODBUS_MASTER_PORT], some sample data lines follow:
[MODBUS_MASTER_PORT]
port com2
baud 9600
parity 0 ;0-4 (none, odd, even, mark, space)
databits 8 ;5-8
stopbits 0 ;0-2 (1, 1.5, 2 stop bits)
xonxoff 0 ;0-1
port_it 4 ;Timeout interval between characters, msec. Default=40
;Normally, port_it should specify 3.5 character times as
;defined by the Modbus Gould specification. At 9600 baud,
;and 8 data bits, 1 start, and 1 stop bit, this yields
;a character time of 1.04 msec. 3.5 character times would
;therefore be 3.125 msec.
port_tt 200 ;Timeout for total message, msec. Default=200
;This is time to receive message only, not process it.
modbus_timeout 2000 ;Time (milliseconds) before we give up
;waiting for a response from a slave.
;Default timeout is 2000 milliseconds.
;Minimum timeout is 100 milliseconds.
;Maximum timeout is 60000 milliseconds.
modbus_loop 5000 ;Time (milliseconds) before we restart
;the request loop. This is the period of
;between asking the slave(s) for all the
;data specified and the time we start
;over and reask.
;Default loop is 5000 milliseconds.
;Minimum loop is 100 milliseconds.
;Maximum loop is 86400000 milliseconds.
MASTER 1 UNIT 62 MODE RS16
MASTER 2 UNIT T3 MODE RS16
[MODBUS_MASTER_PORT]
port com3
baud 9600
MASTER 7 UNIT 63 MODE RU16
Comments
The above example defines two ports for use with Modbus Master. Both com2 and
com3 are used. Modbus slave ids 1 and 2 are reached using com2, and Modbus slave
id 7 is reached using com3.
For port, specify com1, com2, com3, ...
To disable, specify none
For baud, specify baud rates supported by the operating system.
For parity, specify 0 for none, 1 for odd, 2 for even, 3 for mark, or 4 for space.
For databits, always specify 8
This is a common error, check For stop bits, specify 0 for 1 stop bit, 1 for 1.5 stop bits, or 2 for 2 stop bits.
carefully
For xonxoff, specify 0 to disable.
For port_it, specify intercharacter timeout as desired based on DCS transmission.
The Modbus specification specifies 3.5 character times. For 9600 baud in the
example above, show that 4 ms is appropriate for strict adherence to the Gould
Modbus specification.
For port_tt, specify the total time permitted for the HMI to receive a message from
the DCS, starting from receipt of the first character. Normally it will be most
convenient to make this number high and use only the intercharacter timeout, port_it.
The only required entries are port and MASTER-UNIT-MODE. Baud defaults to
9600. Parity, databits, stopbits, and xonxoff default as shown above. Port_it defaults
to 40. Port_tt defaults to 200.
MASTER-UNIT-MODE line
The MASTER-UNIT-MODE line is formatted as follows:
MASTER mmm UNIT uu MODE keyword
mmm is the Slave address (in decimal) to use when communicating with unit uu.
uu is the two-character unit name (defined in F:\CONFIG.DAT)
keyword is either RS16 or RU16 for Signed & Unsigned data respectively.
MASTER, UNIT, and MODE are required entries. A new line should appear for
each unit or slave address. Normally this is one or two lines for typical data patterns.
A maximum of 48 MASTER-UNIT-MODE lines may appear.
Each line requires the following:
MASTER followed by a slave entry specifying a Modbus Slave id number
UNIT followed by a two-character unit id. These IDs correspond to the units already
defined in F:\CONFIG.DAT.
MODE followed by RS16 or RU16. For analog data, use RS16 for signed mode,
RU16 for unsigned.
• RS16 specifies a signed result, ranging from a minimum of -32768 (hex 8000) to
a maximum of 32767 (hex 7FFF).
• RU16 specifies an unsigned result, ranging from a minimum of zero to a
maximum of 65535 (hex FFFF).
Raw data in the slave is rescaled based on the minimum and maximum numbers
provided in the F:\UNITn\MMBUSnnn.DAT data file to a result specified.
The following sample data configuration file MMBUS1.DAT shows register scaling
for thermocouple data:
;
; MMBUSn.DAT for Modbus Master
;----------------------------------------------------------
;
;
;HOLDING COILS (1)
;-------------
HC9 L5
;
;
;INPUT COILS (2)
;-----------
IC0001 L1
IC0002 L2
IC0003 L3
;
;HOLDING REGISTERS (3)
;---------------
;NUMBER NAME CDB VALUE CDB VALUE ;SCALE TYPE
HR0002 ABC2 -200 2000 ;TC
HR0003 ABC3 -200 2000 ;TC
HR0004 ABC4 -200 2000 ;TC
HR0005 ABC5 -200 2000 ;TC
HR0006 ABC6 -200 2000 ;TC
HR0007 ABC7 -200 2000 ;TC
;
;INPUT REGISTERS (4)
;---------------
;NUMBER NAME CDB VALUE CDB VALUE ;SCALE TYPE
IR0001 ABC1 -200 2000 ;TC
IR0005 DEF1 -2147483648 2147483647
IR0006.1 L6
IR0006.2 L7
IR0006.3 L8
IR0006.4 L9
IR0006.5 L10
;
;WRITE HOLDING COIL (5)
;------------------
WC0004 L4
;
;WRITE HOLDING REGISTER (6)
;----------------------
WR0010 ABC10 -200 2000 ;TC
WR0011 ABC11 -200 2000 ;TC
Statistics
The Modbus Master program gathers statistics and makes counters available for
diagnostic purposes. The program MM_stat.exe is a special console program to
communicate with the Modbus Master program and retrieve and control these
diagnostic counters. Running MM_stat displays the counters as follows:
F:\USER>mm_stat
Modbus Master statistical summary:
Modbus Master 1.
4815 = Count of messages sent by Modbus Master.
0 = Count of bad messages sent by Modbus Master.
Modbus Master 2.
4815 = Count of messages sent by Modbus Master.
0 = Count of bad messages sent by Modbus Master.
When multiple Modbus Masters appear, each group corresponds to a separate port as
specified in the F:\IO_PORTS.DAT file.
The counters can be reset by passing reset as a parameter to the MM_stat program.
Reset is case insensitive and does not include the quotation marks.
Modbus Master Diagnostics
Diagnostic data from a Trace Global Section can be collected as for Modbus Slave
mode (refer to Chapter 2). When debug is on, which it is by default, the global
section trace buffer may be viewed with the command:
gbl2file MModbus_trace# <some_file_name>
where # is 1,2,3,...8 depending on which [MODBUS_MASTER_PORT] section
corresponds to the information required. If only one [MODBUS_MASTER_PORT]
section exists, then the global section trace command can be viewed with:
gbl2file MModbus_trace1 modbus1.dat
This displays some debugging and program status information.
The trace option may be turned off by adding /NOTRACE to the command line:
MModbus /NOTRACE
If the program encounters a serious error or warning, the result is placed in a log file
as well as the global section trace buffer. To view this log file, check the file
G:\LOG\MModbus#.log where # is defined as above.
Chapter 4 Applications
Introduction
This chapter discusses the application of Modbus Slave mode to the three types of
turbine controllers, the Mark IV, Mark V, and Mark VI, and to several different
PLCs that can be interfaced to the system for control of balance of plant equipment.
Mark V Systems
The HMI can be configured as a Modbus slave to provide Mark V data to the DCS.
Figure 4-1 shows the data flow through the HMI from the controller to the DCS, and
the commands from the DCS to the controller. Data flow for the Mark V LM
controller is similar.
HMI SERVER
Mark V Commands TCI Commands DCS

Turbine Modbus (Modbus
Controller Data Slave Data Master)
Figure 4-1. Data Flow from the Mark V System in Modbus Slave Mode
Configuration of the TCI Modbus Slave is discussed in detail in Chapter 2. The main
steps are summarized as follows:
1. Choose the wiring hardware and HMI port for communication with the DCS,
serial or Ethernet.
2. Configure the communication ports, baud rate, and slave identification to create
the IO_PORTS.DAT file.
3. Map the registers and coils to the controller signal database point names to
create the Modbus.dat file, or Modbus_N.dat file for native data.
GEI-100517A Modbus for HMI Applications Chapter 4 Applications • 4-1

4. Run the listing program to obtain the Modbus.LST file, containing a list of the
coil and register maps along with scaling information. This can be used to
configure the DCS Modbus master.
Logic Commands
A logic command to the controller can be sent as either a Control Pushbutton (CPB)
or as a Logic State Command. The CPB command is written once, and the controller
acts on it and resets the function afterwards. The Logic State Command sets a
memory location in the controller, which stays in that state until reset.
Commands to the Mark V should be limited to a rate of less than 10 per second. In
the case of setpoint control, this rate excludes the use of cascaded setpoints, as used
in cascade loops. The DCS functions are therefore limited to supervisory control.
Mark IV Systems
The HMI can be configured as a Modbus slave to provide Mark IV data to the DCS.
The data flow through the HMI from the controller to the DCS, and the flow of
commands from the DCS to the controller is shown in Figure 4-2.
HMI SERVER
Mark IV Commands TCI DCS

Commands
Turbine TCI CIMPLICITY CIMMOD Modbus (Modbus
Data Data
Controller Slave Master)
Figure 4-2. Data Flow from the Mark IV System in Modbus Slave Mode
Configuration of TCI as a The main steps to configure the TCI are summarized as follows:
Modbus Slave is discussed in
detail in Chapter 2.
serial or Ethernet.
create the CimMod.dat file, or CimMod_N.dat file for native data.
3. Run the listing program to obtain the CimMod.LST file, containing a list of the
Modbus Points
If some of the desired Modbus points are not in the CIMPLICITY project, they must
be added. Use the Signal Manager to add these Mark IV points.
4-2 • Chapter 4 Applications GEI-100517A Modbus for HMI Applications

Logic Commands
A logic command to the controller can be sent as either a CPB or as a Logic State
Command. The CPB command is written once, and the controller acts on it and resets
the function afterwards. The Logic State Command sets a memory location in the
controller, which stays in that state until reset.
Commands to the Mark IV should be limited to less than 10 per second. For setpoint
control, this rate excludes the use of cascaded setpoints, as used in cascade loops.
The DCS functions are therefore limited to supervisory control.
Mark VI Systems
The HMI can be configured as a Modbus Slave to provide Mark VI data to the DCS.
Figure 4-3 shows the data flow through the HMI from the controller to the DCS, and
the flow of commands from the DCS to the controller. The DCS usually connects to
the PDH with an Ethernet cable, but a serial cable is possible.
HMI SERVER
TCI DCS
Mark VI Commands Commands
EGD Modbus (Modbus
Turbine CIMPLICITY CIMMOD
Data Service Slave Data Master)
Controller
Figure 4-3. Data Flow from the Mark VI System in Modbus Slave Mode
Configuration of the TCI and CIMMOD is discussed in detail in Chapter 2. The main
steps are summarized as follows:
serial or Ethernet.
Refer to document GEH- 2. Configure CIMPLICITY with the desired points using the Turbine HMI
6403E Control System Configuration software in the toolbox.
Toolbox for Configuring a
Mark VI Turbine Controller.
4. Map the registers and coils to the controller point names (located in
5. CIMPLICITY) to create the CimMod.dat file, or CimMod_N.dat file for native
data.

Logic Commands
Mark VI logic commands are different than for Mark V. All logic commands to the
controller are sent as a Control Pushbutton (CPB). The CPB command is written
once, and the controller acts on it according to the control program to create a
pushbutton or a latched function.
Commands to the Mark VI should be limited to less than 10 per second. In the case
of setpoint control, this rate excludes the use of cascaded setpoints as used in cascade
loops. The DCS functions are therefore limited to supervisory control.
Modbus Points
Refer to GEH-6403 Control If some of the desired Modbus points are not in the CIMPLICITY project they must
System Toolbox for be added. First add the points to EGD if they are missing. Use the Control System
Configuring a Mark VI Toolbox to add the desired Mark VI points to an Ethernet Global Data (EGD)
Turbine Controller. Exchange.
If the points are mapped to an EGD exchange, it is possible that the exchange has not
been added to the HMI Configuration, so add the exchange to the HMI
Configuration. If the exchange is in the HMI Configuration, then do a Get and a
Build to put the points into CIMPLICITY as EGD points.
Systems with GE Fanuc PLCs

GE Fanuc Series 90-70™ PLCs are often used on Mark V and Mark VI systems for
balance of plant control. The HMI can be configured as a Modbus Slave to provide
Series 90-70 PLC data to an Historian or DCS. Figure 4-4 shows the data flow
through the HMI from the 90-70 PLC to the Historian or DCS, and the flow of
requests from the Historian to the PLC. The Historian uses Modbus to collect PLC
data from the HMI.
HMI SERVER
PLC TCI Historian or

GE Fanuc Series 90 Modbus DCS
TCP/IP
CIMPLICITY CIMMOD (Modbus
Series 90-70 Slave
Master)
Figure 4-4. Data Flow from a 90-70 PLC in Modbus Slave Mode

CIMPLICITY® Series 90 TCP/IP Communications software provides Ethernet
communications to the Series 90 PLCs. This driver brings the desired PLC data into
CIMPLICITY. In most cases the Historian is located on the PDH so the Ethernet
communication hardware already exists. Configuration of the TCI and CIMMOD as
a Modbus Slave is discussed in detail in Chapter 2. The main steps are summarized
as follows:
1. Choose the wiring hardware and HMI port for communication with the Historian
or DCS, either serial or Ethernet.
2. Configure the Series 90 TCP/IP Communications software. For details, refer to
the GFK-1181G CIMPLICITY HMI Base System-Device Communication
Manual.
3. Configure the communication ports, baud rate, and slave identification in TCI to
create the IO_PORTS.DAT file.
create the Cimmod.dat file.
coil and register maps along with scaling information.
Note The Historian gathers data directly from the turbine controllers.
Systems with non-GE PLCs

PLCs from other manufacturers can be interfaced to the turbine control system. The
HMI can be configured as a Modbus Slave to provide PLC data to an Historian or
DCS. Figure 4-5 shows the data flow through the HMI from the PLC to the Historian
or DCS, and the flow of commands from the DCS to the PLC. In addition to PLCs,
other devices including meters and relays can be interfaced.
HMI SERVER
CIMPLICITY TCI Historian or

PLC
Modbus Modbus DCS
Other CIMPLICITY CIMMOD
Master
Slave (Modbus
Manufacturer Communications Master)
other Modbus
Slave devices
include Meters
and Relays
Figure 4-5. Data Flow from a non-GE PLC to the Historian
CIMPLICITY Modbus Master software provides Ethernet communications to most
Configuration of the TCI as a of the non-GE PLCs. The driver brings the desired PLC data into CIMPLICITY. The
Modbus Slave is discussed in Historian is located on the PDH and receives PLC data over Ethernet. The main
detail in Chapter 2. configuration steps are summarized as follows:
1. Choose the wiring hardware and HMI port for communication with the Historian
or DCS, either serial or Ethernet.

2. Configure the PLC communications software. To select the correct driver for the
particular PLC, refer to the GFK-1181G CIMPLICITY HMI Base System-Device
Communication Manual.
3. Configure the communication ports, baud rate, and slave identification in TCI to
create the IO_PORTS.DAT file
create the Cimmod.dat file
coil and register maps along with scaling information.
For non-GE PLCs, the special control interface shown in Figure 4-6 is an alternate
that is sometimes used. This uses TCI as the Master to the PLC, and the Slave to the
Historian.
HMI SERVER
TCI Historian or
PLC TCI
Modbus DCS
Other Modbus TCI
Slave (Modbus
Manufacturer Master
Master)
Figure 4-6. Data Flow from a Non-GE PLC in special Modbus Slave Mode

Appendix A
Exception Code Responses

The exception code responses that are supported when a normal response is
impossible are shown in the chart below (refer to the section in Chapter 2 on TCI
Modbus Configuration concerning exception codes 04 and 06).
Table A-1. Exception Code Responses
Exception Code Name Description

01 Illegal Function The message function received is not supported
02 Illegal Data The address referenced in the data field is not in
Address a permissible range.
03 Illegal Data Value The value transmitted in the data field is illegal.
04 Failure in Information requested cannot be provided due to
Associated a communication failure with associated unit as
Device specified by the slave address.
06 Device Busy Information requested cannot be provided due to
a communication time out with the associated
unit as specified by the slave address.
The format of the exception message reply from the slave is shown below:
+----------------------------------------+
¦ SLAVE ¦FUNCTION¦EXCEPTION¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦CODE ¦(MSB) ¦(LSB) ¦
+----------------------------------------+
Exception Code Response Format

slave address – must be in the range [1-255]. Zero is not allowed as a reply, as it is
only used in broadcast messages from the master.
function code – is always equal to the master’s function code with the most
significant bit set. Therefore, an exception response sent back to a master that has
sent a message with function code 02 hex would have a function code of 82 hex (or
130 decimal) in the exception reply.
exception code – only codes 01 through 04 and 06 are supported, refer to Table A-1.
GEI-100517A Modbus for HMI Applications Appendix A • 1

Function Code Details
The following table lists the function codes supported by the TCI and included in the
messages sent from the DCS. Six of the eight function codes are used to read from
and/or write to the four table types. See the Modbus Slave section regarding mapping
tables.
Table A-2. DCS Function Codes
Function Code, Hex Description

01 Read Holding Coils
02 Read Input Coils
03 Read Holding Registers
04 Read Input Registers
05 Force (Write) Single Holding Coil
06 Preset (Write) Single Holding Register
07 Read Exception Status
0F Force (Write) Multiple Holding Coils
10 Force (Write) Multiple Holding Registers
Each function code and the replies are described below.
Function Code 01: Read Holding Coils

Function code 01 is used to read the holding coil table. The format of a message from
the master is shown below:
+------------------------------------------------------------+
¦ SLAVE ¦FUNCTION¦START ¦START ¦NUMB ¦NUMB ¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦COIL # ¦COIL # ¦COILS ¦COILS ¦(MSB) ¦(LSB) ¦
¦ ¦ 01 ¦(MSB) ¦(LSB) ¦(MSB) ¦(LSB) ¦ ¦ ¦
+------------------------------------------------------------+
slave address – must be in the range [1-255], 0 is not allowed.

starting holding coil number – two bytes in length and may be any value less than
the highest holding coil number available in the holding coil table. The starting
holding coil number is equal to one less than the number of the first holding coil
returned in the normal response to this request, that is, to get the first holding coil,
holding coil number 1, enter 0 for the starting holding coil number. The high order
byte of the starting holding coil number field is sent as the first byte. The low order
byte is sent next.
number of holding coils value – two bytes in length and must be in the range from 1
to 2000 inclusive. It specifies the number of holding coils returned in the normal
response. The sum of the starting holding coil value and the number of holding coils
value must be less than or equal to the highest holding coil number available in the
holding coil table. The high order byte of the number of holding coils field is sent as
the first byte. The low order byte is sent next.
The format of normal message reply from the slave is shown below:
+-------------------------------------+ --------------------+
¦ SLAVE ¦FUNCTION¦BYTE ¦DATA ¦DATA ¦ DATA ¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦COUNT ¦BYTE 1¦BYTE 2¦... BYTE n¦(MSB) ¦(LSB) ¦
¦ ¦ 01 ¦ ¦ ¦ ¦ ¦ ¦ ¦
+-------------------------------------+ --------------------+
A-2 • Appendix A GEI-100517A Modbus for HMI Applications

byte count – is a binary number from 1 to 250; the specified number of data bytes
follow.
data field – is packed holding coil status data. Each byte contains eight holding coil
values. The LSB of the first byte contains the value of the holding coil whose number
is equal to the starting holding coil number plus one. The value of the holding coils
are ordered by number starting with the LSB of the first byte of the data field and
ending with the MSB of the last byte of the data field. If the number of the holding
coils is not a multiple of eight, then the last data byte contains zeros in one to seven
of its highest order bits.
Function Code 02: Read Input Coils

Function code 02 is used to read the input coil table. The format of a message from
the master is shown below:
+------------------------------------------------------------+
¦ADDRESS¦ CODE ¦COIL # ¦COIL # ¦COILS ¦COILS ¦(MSB) ¦(LSB) ¦
¦ ¦ 02 ¦(MSB) ¦(LSB) ¦(MSB) ¦(LSB) ¦ ¦ ¦
+------------------------------------------------------------+

starting input coil number – two bytes in length and may be any value less than the
highest input coil available in the input coil table. The starting input coil number is
equal to one less than the number of the first input coil returned in the normal
response to this request, that is to get the first input coil, input coil number one, enter
zero for the starting input coil number. The high order byte of the starting input coil
field is sent as the first byte. The low order byte is sent next.
number of input coils value – two bytes in length and must be in the range from 1 to
2000 inclusive. It specifies the number of input coils returned in the normal response.
The sum of the starting input coil value and the number of input coils value must be
less than or equal to the highest input coil available in the input coil table. The high
order byte of the number of input coils field is sent as the first byte. The low order
byte is sent next.
+-------------------------------------+ --------------------+
¦ SLAVE ¦FUNCTION¦BYTE ¦DATA ¦DATA ¦ DATA ¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦COUNT ¦BYTE 1¦BYTE 2¦... BYTE n¦(MSB) ¦(LSB) ¦
¦ ¦ 02 ¦ ¦ ¦ ¦ ¦ ¦ ¦
+-------------------------------------+ --------------------+
byte count – binary number from 1 to 250; the specified number of data bytes
follow.
data field – is packed input coil status data. Each byte contains eight input coil
values. The LSB of the first byte contains the value of the input coil whose number is
equal to the starting input coil plus one. The value of the inputs is ordered by number
starting with the LSB of the first byte of the data field and ending with the MSB of
the last byte of the data field. If the number of the input coils is not a multiple of
eight, then the last data byte contains zeros in one to seven of its highest order bits.

Function Code 03: Read Holding Registers
Function code 03 is used to read holding registers. The format of a message from the
master is shown below:
+------------------------------------------------------------+
¦ADDRESS¦ CODE ¦REG # ¦REG # ¦REGS ¦REGS ¦(MSB) ¦(LSB) ¦
¦ ¦ 03 ¦(MSB) ¦(LSB) ¦(MSB) ¦(LSB) ¦ ¦ ¦
+------------------------------------------------------------+

starting holding register number – is two bytes in length and may be any value less
than the highest holding register number available in the holding register table. The
starting holding register number is equal to one less than the number of the first
holding register returned in the normal response to this request, that is, to get the first
holding register number, holding register number one, enter zero for the starting
holding register number. The high order byte of the starting holding register number
field is sent as the first byte. The low order byte is sent next.
number of holding registers – value is two bytes in length and must be in the range
from 1 to 128 inclusive. It specifies the number of holding registers returned in the
normal response. The sum of the starting holding register value and the number of
holding registers value must be less than or equal to the highest holding register
number available in the holding register table. The high order byte of the number of
holding registers field is sent as the first byte. The low order byte is sent next.
Format of normal message reply from the slave is shown below:
+-------------------------------------+ --------------------+
¦ SLAVE ¦FUNCTION¦BYTE ¦FIRST ¦FIRST ¦ LAST ¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦COUNT ¦REGSTR¦REGSTR¦... REGSTR¦(MSB) ¦(LSB) ¦
¦ ¦ 03 ¦ ¦(MSB) ¦(LSB) ¦ (LSB) ¦ ¦ ¦
+-------------------------------------+ --------------------+
byte count – even binary number from 2 to 254, or zero. If the byte count is zero (0),
then the master is to assume 256 data bytes follow. Otherwise, the specified number
of data bytes follow. The byte count specifies the total number of bytes in the
message following the byte count, not including the two CRC-16 bytes.
holding registers – are returned in the data field in order of number with the lowest
number holding register in the first two bytes, and the highest number holding
register in the last two bytes of the data field. The number of the first holding register
in the data field is equal to the starting holding register number plus one. The high
order byte is sent before the low order byte of each holding register.
Function Code 04: Read Input Registers

Function code 04 is used to read input registers. The format of a message from the
master is shown below:
+------------------------------------------------------------+
¦ADDRESS¦ CODE ¦REG # ¦REG # ¦REGS ¦REGS ¦(MSB) ¦(LSB) ¦
¦ ¦ 04 ¦(MSB) ¦(LSB) ¦(MSB) ¦(LSB) ¦ ¦ ¦
+------------------------------------------------------------+
slave address – must be in the range [1-255], zero is not allowed.

starting input register number – is two bytes in length and may be any value less
than the highest input register number available in the input register table. The
starting input register number is equal to one less than the number of the first input
register returned in the normal response to this request, that is, to get the first input
register, input register number one, enter zero for the starting input register number.
The high order byte of the starting input register number field is sent as the first byte.
The low order byte is sent next.
number of input registers – value is two bytes in length and must be in the range
from 1 to 128 inclusive. It specifies the number of input registers returned in the
normal response. The sum of the starting input register value and the number of input
registers value must be less than or equal to the highest input register number
available in the input register table. The high order byte of the number of input
registers field is sent as the first byte. The low order byte is sent next.
+-------------------------------------+ --------------------+
¦ SLAVE ¦FUNCTION¦BYTE ¦FIRST ¦FIRST ¦ LAST ¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦COUNT ¦REGSTR¦REGSTR¦... REGSTR¦(MSB) ¦(LSB) ¦
¦ ¦ 04 ¦ ¦(MSB) ¦(LSB) ¦ (LSB) ¦ ¦ ¦
+-------------------------------------+ --------------------+
byte count – even binary number from 2 to 254, or zero. If the byte count is zero (0),
then the master is to assume 256 data bytes follow. Otherwise, the specified number
of data bytes follow. The byte count specifies the total number of bytes in the
message following the byte count, not including the two CRC-16 bytes.
input registers – are returned in the data field in order of number with the lowest
number input register in the first two bytes, and the highest number input register in
the last two bytes of the data field. The number of the first input register in the data
field is equal to the starting input register number plus one. The high order byte is
sent before the low order byte of each input register.
Function Code 05: Force Single Holding Coil

Function code 05 is used to force (or write) a single holding coil in the holding coil
table. The format of a message from the master is shown below:
+------------------------------------------------------------+
¦ SLAVE ¦FUNCTION¦HOLDING¦HOLDING¦STATE ¦ ¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦COIL # ¦COIL # ¦00H OR¦ 00H ¦(MSB) ¦(LSB) ¦
¦ ¦ 05 ¦(MSB) ¦(LSB) ¦0FFH ¦ ¦ ¦ ¦
+------------------------------------------------------------+

holding coil number – is two bytes in length and may be any value less than the
highest holding coil number available in the holding coil table. The holding coil
number is equal to one less than the number of the holding coil forced, that is, to
change the first holding coil, holding coil number one, enter 0 for the holding coil
number. The high order byte of the starting holding coil number field is sent as the
first byte. The low order byte is sent next.
Format of normal message state byte – sent by the master with only two possible values. A 0 is sent (00h) to
reply from the slave is turn the specified holding coil off (set false). A value of 255 is sent (FFh) to turn the
identical to the received specified holding coil on (set true). The state byte is always followed by a single byte
message with value zero.

Function Code 06: Preset Single Holding Register
Function code 06 is used to preset (or write) to a single holding register. The format
of a message from the master is shown below:
+------------------------------------------------------------+
¦ SLAVE ¦FUNCTION¦HOLDING¦HOLDING¦REG ¦REG ¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦REG # ¦REG # ¦DATA ¦DATA ¦(MSB) ¦(LSB) ¦
¦ ¦ 06 ¦(MSB) ¦(LSB) ¦(MSB) ¦(LSB) ¦ ¦ ¦
+------------------------------------------------------------+

holding register number – is two bytes in length and may be any value less than the
highest holding register number available in the holding register table. The holding
register number is equal to one less than the number of the holding register changed
by this request, that is to change the first holding register, holding register number 1,
enter 0 for the holding register number. The high order byte of the starting holding
register number field is sent as the first byte. The low order byte is sent next.
holding register data field – is two bytes in length and contains the value to which
the holding register specified by the holding register number field is preset. The first
byte in the data field contains the high order byte of the preset value. The second byte
in the data field contains the low order byte.
Format of normal message reply from the slave is identical to the received message.
Function Code 07: Read Exception Status.

Function code 07 is used to read the exception status data, defined as the first eight
holding coils. These can be used to indicate slave controller status or condition of
any other state. Function code 07 thus provides a short form of request for the
purpose of reading these first eight holding coils, holding coils one through eight.
The format of a message from the master is shown below:
+------------------------------+
¦ SLAVE ¦FUNCTION¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦(MSB) ¦(LSB) ¦
¦ ¦ 07 ¦ ¦ ¦
+------------------------------+
slave address – must be in the range [1-255], zero is not allowed.

Format of normal message reply from the slave is shown below:
+-------------------------------------+
¦ SLAVE ¦FUNCTION¦DATA ¦CRC-16¦CRC-16¦
¦ADDRESS¦ CODE ¦BYTE ¦(MSB) ¦(LSB) ¦
¦ ¦ 07 ¦ ¦ ¦ ¦
+-------------------------------------+
data byte field – the normal response is packed holding coil status data. The data
byte contains eight holding coil values. The LSB of the byte contains the value of the
holding coil number one (1). The MSB contains the value of holding coil number
eight.

Function Code 15: Force Multiple Holding Coils
Function code 15 (0x0F) is used to force (or write) multiple holding coils in the
holding coil table. The format of a message from the master is shown below:
+-------------------------------------------------------------------+
¦ SLAVE ¦FUNCTION¦START ¦START ¦NUMB ¦NUMB ¦BYTE ¦DATA ¦DATA ¦
¦ADDRESS¦ CODE ¦COIL # ¦COIL # ¦COILS ¦COILS ¦COUNT ¦BYTE 1¦BYTE .....
¦ ¦ 0x0F ¦(MSB) ¦(LSB) ¦(MSB) ¦(LSB) ¦ ¦ ¦ ¦
+-------------------------------------------------------------------+
--------------------+
DATA ¦CRC-16¦CRC-16¦
...BYTE n¦(MSB) ¦(LSB) ¦
¦ ¦ ¦
--------------------+

start coil number – is two bytes in length and may be any value less than the highest
holding coil number available in the holding coil table. The holding coil number is
equal to one less than the number of the holding coil forced, that is, to change the
first holding coil, holding coil number one, enter zero for the holding coil number.
The high order byte of the starting holding coil number field is sent as the first byte.
The low order byte is sent next.
number of holding coils value – two bytes in length. It specifies the number of
holding coils to set. The sum of the starting holding coil value and the number of
holding coils value must be less than or equal to the highest holding coil number in
the holding coil table. The high order byte of the number of holding coils field is sent
as the first byte. The low order byte is sent next.
byte count – is the number of data bytes to follow.
data field – is packed holding coil data. Each byte contains eight holding coil values.
The LSB of the first byte contains the value of the holding coil whose number is
equal to the starting holding coil number plus one. The value of the holding coils are
ordered by number starting with the LSB of the first byte of the data field and ending
with the MSB of the last byte of the data field. If the number of the holding coils is
not a multiple of eight, then the last data byte contains unused data in its highest
order bits.
Format of normal message reply from the slave is identical to the received message
without the byte count or the data.
Since Function Codes 15 and 16 generate multiple write

commands, care should be used to make sure that no more
than 10 coils or registers are written to per second, or
controller problems can result.

Function Code 16: Preset Multiple Holding
Registers
Function code 16 (0x10) is used to preset (or write) to a multiple holding registers.
The format of a message from the master is shown below:
+-------------------------------------------------------------------+
¦ SLAVE ¦FUNCTION¦START ¦START ¦NUMB ¦NUMB ¦BYTE ¦REG ¦REG ¦
¦ADDRESS¦ CODE ¦REG # ¦REG # ¦REGS ¦REGS ¦COUNT ¦DATA 1¦DATA1 ...
¦ ¦ 0x10 ¦(MSB) ¦(LSB) ¦(MSB) ¦(LSB) ¦ ¦(MSB) ¦(LSB) ¦
+-------------------------------------------------------------------+
--------------------+
REG ¦CRC-16¦CRC-16¦
...DATA n¦(MSB) ¦(LSB) ¦
(LSB) ¦ ¦ ¦
--------------------+

start register number – is two bytes in length and may be any value less than the
highest holding register number available in the holding register table. The holding
register number is equal to one less than the number of the holding register changed
by this request, that is, to change the first holding register, holding register number 1,
enter 0 for the holding register number. The high order byte of the starting holding
register number field is sent as the first byte. The low order byte is sent next.
number of holding registers value – two bytes in length. It specifies the number of
holding registers to set. The sum of the starting holding register value and the number
of holding registers value must be less than or equal to the highest holding register
number in the holding register table. The high order byte of the number of holding
registers field is sent as the first byte. The low order byte is sent next.
byte count – is the number of data bytes to follow.
Register data field – is two bytes for each holding register to set. The first byte in
the data field contains the high order byte of each preset value. The next byte
contains the low order byte.
The format of the normal message reply from the slave is identical to the received
message without the byte count or the data.
Serial Line Driver Settings

This section describes how to set up the DIP switches for powered serial line drivers.
These are used for Modbus communications between the HMI and the DCS. This
information also applies to serial MSP for connecting a Mark IV to an HMI or Smart
Remote. The type of interconnecting wire required is also described. The two line
drivers covered are as follows:
• 278A2181VRP8D - Black Box ME475A - 110VAC
• 278A2181VRP8E - Black Box ME475AE - 220VAC
These line drivers are used to connect the serial port on the HMI to the serial port on
the DCS when they are separated by long distances. (These settings are very similar
to the Develcon DS-511 serial line drivers).

The switch settings for 9600 baud, with 8 data bits and 1 stop bit, are shown in Table
A-4:
Table A-4. Dip Switch S1 Settings
Switch Position Function Generated

S1-1 On 9600 kbps
S1-2 Off 9600 kbps
S1-3 Off 9600 kbps
S1-4 On 9600 kbps
S1-5 On Clock Source - Internal
S1-6 On Clock Source - Internal
S1-7 On Operating Mode - Asynchronous
S1-8 Off Carrier Control - Constantly On

S2-1 Off Word Length – 10 bits
S2-2 Off Word Length – 10 bits
S2-3 Off Extended signaling rate – 2.5% to 1%
S2-4 Off RTS/CTS Delay – No delay
S2-5 Off RTS/CTS Delay – No delay
S2-6 Off V.54 Loopback Test Enable – Normal Operation
S2-7 Off 2-wire/4-wire Mode – 4-wire (Full or Half Duplex)
S2-8 Off Not Used

S3-1 On Input Impedance – 200 Ohms
S3-2 Off Input Impedance – 200 Ohms
S3-3 Off Not Used
S3-4 On Mode Selection – Point to Point
S3-5 Off Local Loopback - Disabled
S3-6 Off Remote Loopback - Disabled
S3-7 Off Antistream Control – Disabled
S3-8 Off Antistream Control – Disabled
Other Settings
For a different baud rate, adjust S-1, 2, 3, and 4 according to the settings in the line
driver manual.

If the MODBUS link is set up for 8 data bits, set S2-1 and S2-2 for 10 databits. This
is calculated as follows:
8 Data bits + 1 Start bit + 1 Stop bit = 10 bits
If the link has two stop bits, set S2-1 and S2-2 for 11 bits according to the settings in
the line driver manual.
Connecting the two line drivers

For runs up to 5.3 miles (8.53 km), 2 pairs of 24 AWG (or thicker) twisted pair
wiring are required. CAT-5 cable and other types of twisted pair cable will work.
Termination at the ME-475A can be by screw terminals or RJ-45 connector. The Tx
on one line driver connects to Rx on the other one. The interconnecting wiring is not
supplied by GE.

Fiber-Optic Line Driver Settings
This section describes the settings for Black Box type serial fiber-optic line drivers.
The types of fiber-optic drivers are as follows:
• 278A2181VRP42A - Black Box ME320 serial fiber-optic line drivers
• 278A2181VRP42B - Black Box ME320AE serial fiber-optic line drivers
Fiber-optic cable is preferred These line drivers are used to connect the serial port on the HMI to the serial port on
for noise-free, high-speed the DCS when they are separated by long distances. The link is usually used for a
communication Modbus connection. The required switch settings are shown in the tables below.
Table A-5. Switch Settings
Switch Position
S1 In the A position
S4 Test Switch – Down for Normal operation
S5 Up for DCS; Down for HMI
Table A-6. Baud Rate Settings
Baud Rate - kbps S1 S2 S3

115.2 Down Down Down
57.6 Down Down Up
38.4 Down Up Down
28.8 Down Up Up
19.2 Up Down Down
14.4 Up Down Up
9.6 Up Up Down
2.4 Up Up Up
The transmitter power should be set to low power (refer to Table A-7 below).
Table A-7. Transmitter Power Setting
Transmitter Power S6 S7
Low Up Up
Medium Down Up
Medium Up Down
High Down Down
Two fibers are required, each carrying signals in the opposite direction. In some
designs the two fibers are in the same cable. The Tx port (C4) on one driver should
plug into the Rx port (C3) on the other driver. ST type fiber-optic connectors are
used for the four ports.

Notes

Glossary of Terms
ARCNET
ARCNET is the high-speed data highway connecting the Mark V controller with the
HMI.
ASCII
ASCII stands for American Standard Code for Information Interchange, and 8-bit
code used for data.
CimMod
CimMod is an HMI program that allows TCI Modbus to read and write
CIMPLICITY project data.
CIMPLICITY
CIMPLICITY is a GE Fanuc software product that provides server and viewer
functions to create the HMI graphical operator interface, the HMI server, and
communication gateway functions.
COM2
COM2 is a standard serial communication port on the HMI.
Control Pushbutton
Control Pushbutton is a network message to the controller which initiates control
action such as a startup or shutdown.
CRC
CRC stands for cyclic redundancy check, a check on message integrity.
CSDB
CSDB stands for the real time Control Signal Data Base located in the controller.
GEI-100517A Modbus for HMI Applications Glossary of Terms • 1

DB9
DB9 is a 9-pin connector for RS-232C serial communication.
DCE
DCE stands for Data Communications Equipment, a means of setting up RS-232C
serial communications on the HMI and DCS.
DCS
DCS stands for Distributed Control System, used for process control applications
including power plant control.
DTE
DTE stands for Data Terminal Equipment, a means of setting up RS-232C serial
communications on the HMI and DCS.
Exception Code
Exception Code responses are generated when a normal response is impossible.
Hex
Hex stands for hexadecimal, a numbering system using the digits 0-9 and letters A-F
to represent the decimal numbers 0-15.
LDDS
LDDS stands for limited distance data set, a short haul modem, also known as a line
driver.
LSB
LSB or LSBit is the least significant bit of a byte of data.
Mark VI
Mark VI is GE's latest Speedtronic turbine control system.
Modem
Modem stands for Modulator Demodulator, as applied to electrical signals for long
distance transmission over cables.
MSB
MSB or MSBit is the most significant bit of a byte of data.
2• Glossary of Terms GEI-100517A Modbus for HMI Applications

Native
Native is an analog data type where the data is transmitted in the same format that it
has in the controller.
PDH
PDH stands for Plant Data Highway, which links HMI Servers to HMI Viewers and
other systems such as the DCS.
PLC
PLC stands for programmable logic controller, an industrial controller designed to
work with on-off type signals for applications such as motor control.
RTU
RTU stands for remote terminal unit, a Modbus data transmission mode.
TCI
TCI stands for Turbine Control Interface, the GE supplied software package on the
HMI that interfaces to the turbine control.
TCI Modbus
TCI Modbus is the software package that provides the interface between the HMI
and the DCS, or other device.
GEI-100517A Modbus for HMI Applications Glossary of Terms • 3

Notes
4• Glossary of Terms GEI-100517A Modbus for HMI Applications

GEI100517a-Modbus For HMIs

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

GEI100517a-Modbus For HMIs

Încărcat de

Drepturi de autor:

Formate disponibile

GEI-100517A

ARCNET is a registered trademark of Datapoint Corporation.

Indicates a procedure, condition, or statement that, if not

Indicates a procedure, condition, or statement that, if not

Indicates a procedure, condition, or statement that should be

Note Indicates an essential or important procedure, condition, or statement.

GEI-100517A Modbus for HMI Applications Safety Symbol Legend • i

Isolation of test equipment from the equipment under test

To minimize hazard of electrical shock or burn, approved

To prevent personal injury or equipment damage caused by

ii • Safety Symbol Legend GEI-100517A Modbus for HMI Applications

We welcome comments and suggestions to make this publication more useful.

Publication Issue/Revision Date

Detach and fax or mail to the address noted above.

.......................................................................................... Fold here first ........................................................................................................

Chapter 2 Modbus Slave Mode 2-1

GEI-100517A Modbus for HMI Applications Contents • i

Chapter 4 Applications 4-1

Glossary of Terms 5-1

ii • Contents GEI-100517A Modbus for HMI Applications

Figure 1-1. Physical Communication with DCS through the HMI

GEI-100517A Modbus for HMI Applications Chapter 1 Overview • 1-1

1-2 • Chapter 1 Overview GEI-100517A Modbus for HMI Applications

Modbus Slave Mode

Figure 1-2. Data Flow from controllers in Modbus Slave Mode

GEI-100517A Modbus for HMI Applications Chapter 1 Overview • 1-3

Alarm ACK and Alarm Silence

1-4 • Chapter 1 Overview GEI-100517A Modbus for HMI Applications

GEI-100517A Modbus for HMI Applications Chapter 1 Overview • 1-5

RS-232C and Modbus

Physical Link Layer/Format, RS-232C Communications

Baud 26 Gauge 24 Gauge 22 Gauge 19 Gauge

Typical HMI DCS

RXD (2) Cable TXD (2)

Figure 2-1. RS-232C Connection to DB9 Serial Ports with No Modems

RXD (2) (2) S1-2 R1-4 (2) RXD

Figure 2-2. RS-232C Connection to DB9 Serial Port with Modems

Typical HMI Data Set Data Set DCS

Power 120 V ac Power 120 V ac

Figure 2-3. Optional RS-232C Connection with LDDS

• pin 2 to pin 3 for TXD

• pin 4 to pin 7 for RTS

• pin 5 to pin 8 for CTS

• pin 7 to pin 5 for SCOM

• pin 8 to pin 1 for CD

TCI Modbus Configuration

• Enable and configure a serial port for Modbus communication

• Set up the Modbus mapping tables

• Generate the related document for the DCS vendor

F:\IO_PORTS.DAT: Modbus Link Definition

• The [MODBUS_ASSIGNMENT] section is used to bind Modbus slave

• The [MODBUS_SLAVE_TIMEOUT] section controls the message level

Modbus Slave Configuration: Holding Coils, Input

Modbus Slave: @SPARE: Unused Coils and

F:\UNITn\MODBUS.DAT: Mapping File Format

If the Slave is defined to be a CIMPLICITY project, the configuration file is

• When a semi-colon is found in a line, the rest of the line is considered a

• Never add page breaks (form feeds) in this file

• The table entries may be in any order

• Group similar controller CSDB points together, such as temperatures, speed

Table_Type, Table_Point, and CSDB_Pointname

HR0001 T54_1 -200 2000 ;TC

HR0001 ANALOG_16 -1000 1000