Documente Academic
Documente Profesional
Documente Cultură
Step-by-Step Definitions
1. Define one of the ports as RS232, Async, Third party protocols, (Connected to) Master
(or RS485, Async, Third party protocols, (Connected to) Master).
4. Click on the Advanced Configuration button, and select (if supported by the Master) the
DTR/CTS Support parameter to Yes.
5. In the Advanced Properties, set the Format parameter to the appropriate format. (The
default is 8 bit, no parity, 1 stop bit.)
6. Save the Advanced Configuration and the port configuration in the site.
1. In the ACE3600 STS Downloader utility, make sure that the ACE3600 STS is connected
to the proper site ID/link ID.
3. Select the appropriate protocol file as described in Third Party Protocol Downloading
above.
1. In the Application Programmer Database tab, open the PLC Table under System Tables
and set the values as follows:
1. Define one of the ports as RS232, Async, Third party protocols, (Connected to) Slave
(or RS485, Async, Third party protocols, (Connected to) Master).
17
MODBUS
4. Click on the Advanced Configuration button, and select (if supported by the Slave) the
DTR/CTS Support parameter to Yes.
5. In the Advanced Properties, set the Format parameter to the appropriate format. (The
default is 8 bit, no parity, 1 stop bit.)
1. In the ACE3600 STS Downloader utility, make sure that the ACE3600 STS is connected
to the proper site ID/link ID.
3. Select the appropriate protocol file as described in Third Party Protocol Downloading
above.
System Tables
1. In the Application Programmer Database tab, open the PLC Table under System Tables
and set the values as follows:
PLC address: 1
Connected to RTU (Name): LOCAL
via Port (Name): PLC1
RS232 PPP port - connected RS232 -> Async -> PPP -> User must specify Link ID
to a packet data (PPP) [Null modem | Standard and baud rate of modem.
modem via RS232. modem | TETRA | iDEN]
Ethernet 10/100 Base-T port 10/100 BasetT -> Static LAN User must specify Self IP
configured for static LAN - -> Ethernet LAN address, subnet mask, and
connected to LAN with a default router. User must
10 BasetT -> Static LAN ->
static IP address. specify Link ID of port.
Ethernet LAN
Ethernet 10/100 Base-T port 10/100 BasetT -> DHCP User must specify Link ID.
configured for dynamic Client-> Ethernet ->LAN A host name of port is
LAN - connected to LAN optional but recommended.
10 BasetT -> DHCP Client->
having a DHCP server
Ethernet ->LAN
which allocates IP address.
18
MODBUS
2. Click on the Protocols button and select the Modbus Slave Protocol.
4. Click on the Advanced Configuration button, and set the standard MODBUS advanced
parameters (described in Appendix A: Site Configuration Parameters in the ACE3600 STS
User Guide) and the special MODBUS TCP/IP parameters described in Port
Configuration for MODBUS over TCP/IP above, as necessary.
Note: In general, no changes to the default values of the advanced parameters are required.
5. Save the Advanced Configuration and the port configuration in the site.
1. In the ACE3600 STS Downloader utility, make sure that the ACE3600 STS is connected
to the proper site ID/link ID.
3. Select the appropriate protocol file as described in Third Party Protocol Downloading
above.
1. In the Application Programmer Database tab, open the PLC Table under System Tables
and set the values as follows:
2. In the Application Programmer Database tab, open the PLC IP Access Control Table and
create an entry for each authorized master and the corresponding PLC port on the slave to
which master will connect.
RS232 PPP port - connected RS232 -> Async -> PPP -> User must specify Link ID
to a packet data (PPP) [Null modem | Standard and baud rate of modem.
modem via RS232. modem | TETRA | iDEN]
Ethernet 10/100 Base-T port 10/100 BasetT -> Static LAN User must specify Self IP
configured for static LAN - -> Ethernet LAN address, subnet mask, and
connected to LAN with a default router. User must
19
MODBUS
static IP address. 10 BasetT -> Static LAN -> specify Link ID of port.
Ethernet LAN
Ethernet 10/100 Base-T port 10/100 BasetT -> DHCP User must specify Link ID.
configured for dynamic Client-> Ethernet ->LAN A host name of port is
LAN - connected to LAN optional but recommended.
10 BasetT -> DHCP Client->
having a DHCP server
Ethernet ->LAN
which allocates IP address.
2. Click on the Protocols button and select the Modbus Master Protocol.
4. Click on the Advanced Configuration button, and select (if supported by the Slave) the
DTR/CTS Support parameter to Yes.
5. In the Advanced Properties, set the Format parameter to the appropriate format. (The
default is 8 bit, no parity, 1 stop bit.)
1. In the ACE3600 STS Downloader utility, make sure that the ACE3600 STS is connected
to the proper site ID/link ID.
3. Select the appropriate protocol file as described in Third Party Protocol Downloading
above.
System Tables
1. In the Application Programmer Database tab, open the PLC Table under System Tables
and set the values as follows:
PLC address: 1
Connected to RTU (Name): LOCAL
via Port (Name): PLC1
When the SCAN operation is performed on one of the above columns, the system accesses the
destination MODBUS PLC by selecting one of the supported commands, according to the data
type of the column and the I/O link.
20
MODBUS
Note that if the column is of input type, read operation is performed from the PLC, and if the
column is of output type, write operation is performed to the PLC.
There are two options for performing I/O Link for each PLC Data Type Column:
Static I/O Link each column is bound to the slave database with the formal I/O Link
(as for I/O)
Dynamic I/O Link each column is bound to the slave database by the ladder at
runtime, by programming the PLC Dynamic IOLINK system table before the SCAN
operation.
The ACE3600 RTU selects the method according the value of PlcElmNum in the PLC
Dynamic IOLINK system table. During the SCAN of the PLC column type, the ACE3600
RTU examines the value of PlcElmNum. If it is equal to 0, static I/O is selected. If it is not
equal to zero, the I/O Link parameters are expected to be programmed in the PLC Dynamic
IOLINK system table.
In I/O Link, for each PLC data type column you must define the following:
2) PLC Data Type the data type of destination PLC. For MODBUS PLC, only four data
types are relevant:
a) Logic Coils
b) Discrete Inputs
c) Holding Register
d) Input Registers
3) Coord1 the offset of the element corresponding to the first element of the column, from
the first element of the MODBUS PLC data type.
(input 10001=zero=10001-10001,
21
MODBUS
input 10002=one=10002-10001,
input 10003=two=10003-10001,
If the first element of the column corresponds to input 10003, the PLC Coord1 must be set
to 2.
Note: Do not change the last three lines for coordinates. They are reserved for protocols with
more than one coordinate.
The advantage of this method is that one can define multiple I/O Links at runtime for the same
PLC type column (not at the same time). Instead of defining the static I/O Link for a PLC
column, it is possible to program the PLC Dynamic IOLINK system table (#232).
The contents of the PLC Dynamic IOLINK table serves as an input for PLC column SCAN
operation and therefore programming this table should be done before the PLC column SCAN.
The programming of the PLC Dynamic IOLINK table is as follows:
PlcElmNum should be set to zero if Static I/O Link is used, otherwise it is generally set
to the number of elements (rows in column) in the corresponding PLC_DI, PLC_DO,
PLC_VI, PLC_VO, PLC_RI, PLC_RO data type column being accessed by the SCAN
operation. Note: PlcElmNum should be less than or equal to the number of elements
(rows in column) in the corresponding column accessed by SCAN.
Special constants have been defined in the PLC Dynamic IOLINK Constants table for setting
the PlcDataType field: These include:
PLCBit
PLCVal
PLCRel
fc1_Read_Logic_Coil
fc2_Read_Discrete_Input
fc3_Read_Holding_Register
fc4_Read_Input_Register
22
MODBUS
fc3_Read_PLCRel
fc5_fc15_Write_Logic_Coil
fc6_fc16_Write_Holding_Register
fc16_Write_PLCRel
PlcCoord1 Should be set the same as described for "Coord1" in the Static I/O Link
section above.
Other fields of the PLC Dynamic IOLINK table are irrelevant for MODBUS protocol and
should be ignored.
23
MODBUS
PLCStt is an integer status system variable. The purpose of this variable is to give an
indication of the communication with PLCs. The values for this variable are defined in the
PLC Status Defines table (one of the Constants Tables).
24
MODBUS
If the communication is not successfully terminated, the PLCStt variable is changed to one of
following values:
Logic Coils
Discrete Inputs
Holding Registers
Input Registers
The ACE3600 versatile database enables mapping of various data types to any MODBUS
register/bit address (0-65355). However, some SCADA Centrals address the data types
according to a predefined register mapping scheme such as:
The ACE3600 user database is accessible (for MODBUS read/write operation) from the
SCADA using the MODBUS protocol.
ACE3600 data is mapped into the MODBUS database by using the following default formula,
where Z (=0-31) is the table number, X (=0-7) is the column number, and Y (=0-249) is the
row number:
25
MODBUS
The offset may vary according for different SCADA software. See Offset Note below.
By default, the table number (Z) may vary from 0 to 31. If a higher numbered user table must
be accessed, then do the following:
1) In the ACE3600 STS site configuration, modify the Advanced Physical Register map
parameter for the PLC port configuration to the table=64 column=8 row=128 value.
2) Use the following formula where the user table number (Z) may vary from 0-63,
X (=0-7) is the column number, and Y (=0-127) is the row number.
Again, the offset may vary for different SCADA software. See Offset Note below.
Offset Note: There are some SCADA systems for which addressing does not depend on the
data type; there is no specific absolute range reference per data type. For such a SCADA, the
offset in the equation should be set to 0. For other SCADA software, the offset = 000001,
100001, 300001, and 400001 for logic coil, input status, input register, and holding register
data type respectively.
In addition, a PLC Translation file add-on to the STS enables access to all data available in
ACE3600 database user tables. For information on preparing such a file, see PLC Translation
File below.
The PLC Translation file is a text file, created by the user, which defines the additional
mapping. When the file is configured and downloaded to the ACE3600 RTU, the additional
mapping becomes active.
The following example describes a system for which the PLC Translation File add-on is
applicable.
The MODBUS SCADA accesses the RTU by accessing the corresponding table
and element in the ACE3600 table.
In addition, on the SCADA, the application engineer would like to define four
copies of each element (tag) (per RTU) having the same MODBUS register/bit
number. Each tag will appear four times (having the same register/bit number),
but with four different MODBUS PLC addresses (1, 2, 3, 4).
26
MODBUS
1. The MODBUS to ACE3600 database mapping is limited by the range of tables that can be
accessed, because only the first 32 (0<=Z<=31) or 64 (0<=Z<=63) tables can be mapped.
See RTU as PLC (Slave) Mapping of SCADA Element to ACE3600 Database above.
2. The MODBUS register/bit number has a unique mapping to the ACE3600 (z, x, y) element
and therefore it cannot be mapped to four different elements on the ACE3600
(representing different RTUs in different tables) with the same register/bit number on the
SCADA, as described above. If four elements on the SCADA are defined with the same
register/bit number, they will all be mapped to the same (z, x, y) element on the ACE3600.
The solution is to introduce an additional mapping on the top of the register mapping scheme
described above using a PLC Translation File.
The PLC Translation File uses the .ini format and includes three sections (one per PLC port)
and instructions. It is a text file and can be edited by any text file editor. The file can be built
from the example template, Modbus_Example.plc, which is located in the "config" directory
under the STS installation path (e.g. C:\STS1150\Config.) Once the file is configured and
downloaded to the ACE36000, the additional mapping will become active.
The example PLC Translation File looks as follows, and defines a mapping for the port
defined as PLC2:
The section
represents instructions which are relevant for access via PLC port PLC1. In this example, no
instructions are defined in this section.
The section
represents instructions which are relevant for access via PLC port PLC2. Four offsets are
defined based on the PLC address, and eight offsets are defined based on MODBUS function
codes.
27
MODBUS
The four keywords above define additional offsets, each of which depends on the PLC
address. The offsets 0, 32, 64, 96 correspond to PLC addresses 1, 2, 3, 4.
Each time a MODBUS packet is received via the port named PLC2, the MODBUS driver first
calculates the (z, x, y) coordinates of the element being accessed (using the register mapping
scheme for the MODBUS register /bit address formula above.) Based on the destination PLC
address (1, 2, 3, 4), the coordinates of the element are then changed to (z+offset,x,y). The
table number is shifted forward by the offset (namely 0 when accessing PLC address 1, 32
when accessing PLC address 2, 64 when accessing PLC address 3, and 96 when accessing
PLC address 4). In other words, the tables for PLC address 1 start from Z=0, the tables for
PLC address 2 start from Z=32, the tables for PLC address 3 start from Z=64, and the tables
for PLC address 4 start from Z=96.
Notes: 1. PLC addresses 1, 2, 3, 4 should all be configured in PLC Table as legal PLC
addresses, otherwise the ACE3600 will not respond to accesses to PLC addresses 1, 2, 3, 4.
See the PLC Table description.
Z=31
PLC
PLC Table
Table
addr
Addr Offset Z=1
Offset
Z=0
10 1 0 0 Z=63
Z=33
Z=32
20 2 3232
Z=95
Z=65
30 3 6464
Z=64
40 4 9696 Z=127
Z=97
Z=96
28
MODBUS
The above keywords define an additional offset based on the MODBUS function code on the
PLC2 port. In the example file, all offsets are zero, so the final table number (Z) is not
impacted by the keywords. If, however, the
keyword was set to 5, any access done with MODBUS function code 1 via port PLC2 would
increase the table number (Z) or shift Z forward by five tables.
The section
represents instructions which are relevant for an access done via PLC port PLC3. In this
example, no instructions are defined in this section.
PLC Diagnostics
The PLC Translation File which is downloaded to the ACE3600 can be viewed using the STS
SW Diagnostics utility (DEVICE= PLC1L for port name PLC1, PLC2L for port name PLC2,
PLC3L for port name PLC3, LEVEL=0.) See the example below. For more on the SW
Diagnostics utility, see the ACE3600 STS User Guide. For a description of the diagnostics,
see the TOSCADA (PLC1L, PLC2L, PLC3L) section of the ACE3600 Software Diagnostic
Output and Error Messages Manual.
29
MODBUS
30
MODBUS
31
MODBUS over RS485 Troubleshooting
If MODBUS communication is not working and the MODBUS RS485 port Tx LED is
constantly OFF, the ACE3600 may not be transmitting over RS485 multidrop. This is due to
bad idle conditions on the line caused by the peer RTU or device.
3. In the PLC MASTER or PLC SLAVE tab, set Driver specific parameters #4 to 1 (this sets
the mask to 0x0001 - one bit on and the others off.)
By setting the Driver specific parameters #4 bit mask to 1 (0x0001), the MODBUS driver will
force transmission regardless of the line idle conditions.
32