Ref542plus Modbus-Rtu TRM 755868 Enb
Ref542plus Modbus-Rtu TRM 755868 Enb
Ref542plus Modbus-Rtu TRM 755868 Enb
Technical Reference
1MRS755868
Issued: Version: 01.06.2004 B/30.09.2006
Modbus RTU
Technical Reference
REF 542plus
Contents
Copyrights ................................................................................. 7 1. Introduction.... ..................................................................... 9
1.1. 1.2. 1.3. 1.4. 1.5. This manual.................................................................... ...... 9 Use of symbols.... .......................................................... ...... 9 Intended audience.......................................................... .... 10 Product documentation.... .............................................. .... 10 Revision history.... .......................................................... .... 11
5. Communication channels................................................ 19 6. Configuration mode.... ..................................................... 21 7. System architecture.... ..................................................... 23 8. Technical data of the communication ports.... ............. 25
8.1. Optoisolated RS485.... ................................................... .... 25 8.2. Fibre Optic interface....................................................... .... 25
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
10.1.7. Function 7 (read exception status).... ............. .... 42 10.1.8. Function 8 (loopback test).... .......................... .... 43 10.1.9. Function 11 (fetch communications event counter)............................................................ .... 44 10.1.10. Function 12 (fetch communications event log).... ............................................................... .... 44 10.1.11. Function 15 (force multiple coils).................... .... 44 10.1.12. Function 16 (preset multiple registers).... ....... .... 45 10.1.13. Function 17 (report slave ID).... ...................... .... 46 10.1.14. Function 19 (reset communications link)........ .... 47 10.1.15. Function 20 (read general reference)............. .... 47 10.1.16. Function 21 (write general reference).... ........ .... 55
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
11.1.22.
11.1.29. 11.1.30.
11.1.21.1. Time reading................................... .... 88 11.1.21.2. Time setting.... ................................ .... 89 Re-programming the communication board.... .... 89 11.1.22.1. Re-Programming the Boot Loader.... ......................................... .... 96 Sessions.... ...................................................... .... 96 Writing command session............................... .... 97 Writing parameter session.... .......................... .... 98 Configuration session...................................... .... 99 Programming session...................................... .. 101 Other operations.............................................. .. 102 11.1.28.1. Reading the communication board working status................................. .. 102 Communication channel test........................... .. 103 Reading REF 542plus information.................. .. 106
13. Configuring the Modbus board.... ................................ 109 14. Commissioning.... ........................................................... 113 15. Configuring SPA communication.... ............................. 115 16. Updating firmware.... ...................................................... 117 17. Abbreviations.... .............................................................. 119 Appendix A: Modbus error codes..................................... 121 Appendix B: Led lighting sequences.... ........................... 123 Appendix C: Network communication led on RHMI.... ... 125
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Copyrights
The information in this document is subject to change without notice and should not be construed as a commitment by ABB Oy. ABB Oy assumes no responsibility for any errors that may appear in this document. In no event shall ABB Oy be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, nor shall ABB Oy be liable for incidental or consequential damages arising from use of any software or hardware described in this document. This document and parts thereof must not be reproduced or copied without written permission from ABB Oy, and the contents thereof must not be imparted to a third party nor used for any unauthorized purpose. The software or hardware described in this document is furnished under a license and may be used, copied, or disclosed only in accordance with the terms of such license. Copyright 2006 ABB Oy All rights reserved.
Trademarks
ABB is a registered trademark of ABB Group. All other brand or product names mentioned in this document may be trademarks or registered trademarks of their respective holders.
Guarantee
Please inquire about the terms of guarantee from your nearest ABB representative.
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
1.
1.1.
Introduction
This manual
The Multifunction Protection and Switchgear Control Unit REF 542plus handle several data for protection, control and monitoring of the switch panel, as well as for the GIS panels type ZX as also for the AIS panels ZS1. All of the data are available on the internal main controller serial port. The application of Modbus RTU board within the Multifunction Protection and Switchgear Control Unit REF 542plus allows one or two control systems to be connected. In case of two control systems it is possible to send and to receive the same command and monitoring data using Modbus RTU communication protocol. The ASCII mode is not available.
1.2.
Use of symbols
This publication includes the following icons that point out safety-related conditions or other important information: The electrical warning icon indicates the presence of a hazard which could result in electrical shock.
The warning icon indicates the presence of a hazard which could result in personal injury.
The caution icon indicates important information or warning related to the concept discussed in the text. It might indicate the presence of a hazard which could result in corruption of software or damage to equipment or property.
The information icon alerts the reader to relevant facts and conditions.
Although warning hazards are related to personal injury, it should be understood that operation of damaged equipment could, under certain operational conditions, result in degraded process performance leading to personal injury or death. Therefore, comply fully with all warning and caution notices.
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
1.3.
Intended audience
This manual is intended for operators and engineers to support normal use of as well as configuration of the product.
1.4.
Product documentation
Name of the Manual Application Notes CAN Manual Configuration Manual iButton Programmer User Manual Manual Part 3, Installation and Commission Manual Part 4, Communication Motor Protection with ATEX Certification, Manual Operators Manual Protection Manual Technical Catalogue Technical Reference Modbus RTU Web Manual, Installation Web Manual, Operation Document ID 1MRS755870 1VTA100189-Rev 1, en 1MRS755871 1MRS755863 1 VTA100004 1VTA100005 1MRS755862 1MRS755869 1MRS755860 1MRS755859 1MRS755868 1MRS755865 1MRS755864
10
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
1.5.
Revision history
Version 1VTA100065 A Date 01.06.2004 28.02.2006 History First release Document updated * language * layout Document updated
30.09.2006
11
12
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
2.
Safety information
Dangerous voltages can occur on the connectors, even though the auxiliary voltage has been disconnected. Non-observance can result in death, personal injury or substantial property damage. Only a competent electrician is allowed to carry out the electrical installation. National and local electrical safety regulations must always be followed. The frame of the device has to be carefully earthed.
The device contains components which are sensitive to electrostatic discharge. Unnecessary touching of electronic components must therefore be avoided.
13
14
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
3.
Main features
Main features of the Multifunction Protection and Switchgear Control Unit REF 542plus communication by using Modbus RTU:
Description Type of transmission Protocol Baud rate Features Serial asynchronous Modbus RTU slave 300, 600, 1.200, 2.400, 4.800, 9.600, 19.200, 38.400, 76.800, 153.600 bauds 11 (including start, stop, parity) start bit (1) data bits (7,8) stop bits (0,1,2 ) None, even, odd
Data bits
Parity check First communication mode Data flow Connections Connectors Maximum distance Second communication mode Data flow Connections Connector Maximum distance
Number of channels
15
16
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
4.
Processed data
All the data listed in the SPA bus table in REF 542plus User Manuals can be processed by the Modbus RTU board.
* * * * * * * * * * * *
Measurement values Status of binary input and output Control command Reading and setting parameters values Reset Alarm Reading System parameters Reading of protection events from the Start / Trip page Reading fault recorder data Time synchronisation Time setting Re-programming the application software Configuration and program description
The communication between the Multifunction Protection and Switchgear Control Unit REF 542plus and the upper system level is based on masterslave procedures.
4.1.
Event chronology
The event chronology is codified in the SPA bus table. The buffer is in position to record the last 100 events. As the master unit sends out a request, the Multifunction Protection and Switchgear Control Unit REF 542plus transmits the stored events, marked by the absolute time (year-month-day-hour-second-millisecond). REF 542plus shows the number of stored events in a dedicated location, so that the master unit can read the event table (polling).
4.2.
Fault recording
The 7 analog signals and the 32 binary signals can be recorded by the Multifunction Protection and Switchgear Control Unit REF 542plus. On request, the transmission to the master unit is possible as well. In the master unit, the file must be converted in COMTRADE format. Therefore, the corresponding conversion software, SMSCONVERT, will be provided. The records of the system faults are stored in a buffer of maximal recording time of 5 s and the buffer can contain a maximum of 5 records, which means that the minimum recording time is 1 s. If required, the maximal recording time can also be set for an arbitrary number of records up to 5. The Multifunction Protection and Switchgear Control Unit REF 542plus is designed with a dedicated memory for storing recorded events, so that the master unit can read the records by polling.
17
18
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
5.
Communication channels
The communication board is available in two hardware versions. The first is a version with a serial communication channel according to the RS485 Standard on twisted shielded pair. The second is a version with glass fiber optic connections type ST. The two-channel version can be used for the connection between Switchgear Protection and Control Unit REF 542plus and two separates systems working independently (such as DCS and SCADA). The two channels can work simultaneously and operate separately. In order to guarantee a high level of safety, the data is processed as described in the following table:
R/W Data readout Access Always active on both channels. Always active on both channels. Always active on both channels. Active on a single channel after the opening of a control session. Mode Simultaneous readout
Events readout
Simultaneous readout
Simultaneous readout
After one of the two channels get the input to open a control session the same operation cannot be performed on the other channel. A further control session is made possible only after the conclusion of the previous session. After one of the two channels get the input to open a parameter session the same operation cannot be performed on the other channel. A further parameter session is made possible only after the conclusion of the previous session.
Parameter writing
Both the control and the parameter session can work independently; they can be activated simultaneously either on the same channel or separately on the two channels. The controls and the parameters can be accessed only after the opening of the relevant sessions. The sessions can be closed in two different ways: on request or automatically, should the opening time exceed the maximum preset time of 10 minutes. The session opening does not affect the local or remote functionality of REF 542plus.
19
20
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
6.
Configuration mode
All the reading and writing activities performed by the Multifunction Protection and Switchgear Control Unit REF 542plus and the Modbus RTU communication systems are based on a memory map located in the communication board. A dedicated PC for the configuration contains the configuration tool to define this map. Connecting RS485 or the optical fibres communication channel with the serial channel of the PC configures the communication board. The ABB Modbus Configuration Tool is able to program all the units connected to the same communication bus as well as to work on one single unit. While the memory map is unique for both channels the two channels on the communication boards can be configured independently on both sides:
R/W Configuration writing Access Active on a single channel after the opening of a configuration session. Mode After one of the two channels get the input to open a configuration session, the same operation cannot be performed on the other channel. A further configuration session is made possible only after the conclusion of the previous session.
The communication board can be configured after opening of the relevant session. The opening of a session does not affect the local functionality of REF 542plus. Only the communication to the upper level control system is stopped. The only limitation of the information flow is to change the status of the switching devices. In case of a direct connection between the PC and the communication bus, all of the communication activities of REF 542plus, which are not involved in the session, remain active. The sessions can be closed in two different ways: on request or automatically, if the opening time exceeds the maximum preset time of 5 minutes.
21
22
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
7.
System architecture
The different possible architectures can be seen in Fig. 7.-1 and Fig. 7.-2.
A051038
A051039
Fig. 7.-2 Double communication channel with two distinct and independent channels
23
24
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
8.
Isolated RS-485 with two independent channels Fiber optic with two independent channels
The two different communication channels are selectable. In the RS-485 version, the communication flows as half duplex channel for each port. In the fibre optic version, the communication flows as full duplex channel for each port.
8.1.
Optoisolated RS485
Technical data of the optoisolated RS485 interface is the following:
* * * *
* *
Electrical isolation. 2000 V 50 Hz, 1 minute Interface signals: Data-A, Data-B (no ground reference) Connector: 2-pin, 5.08 mm spacing Cable: twisted pair (if shielded, connect the shield, one side only, on the earth screw of the case) Maximum baud rate: 153600 bit/s Maximum cable length: 130 m
8.2.
Wavelength
25
REF 542plus
Modbus RTU
Technical Reference Table 7.-2 (Continued)
Glass Fiber interface Transmitted power Receiver sensitivity Maximum baud rate -12 dBm (typical) -24 dBm 115000 bit/s
1MRS755868
26
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
9.
Full compliant
Full compliant
Full compliant
Full compliant
Preset single register Read exception status Loopback diagnostic test Program 1 Poll program complete - 1 Fetch event counter communications Fetch communications event log Program 2 Poll program complete 2 Force multiple coils
Full compliant
Full compliant
Compliant
9 10
11
Not implemented
12
Not implemented
13 14
15
Full compliant
16
Full compliant
27
REF 542plus
Modbus RTU
Technical Reference Table 7.-2 (Continued)
Function 17 18 19 Meaning Report slave Id Program 3 Reset communications link Read general reference Write general reference Reserved for expanded functions Implementation Compliant Not implemented Not implemented Notes
1MRS755868
20
On 12 custom files
21
On 12 custom files
22 ... 64
Each Communication board serial channel may have a different Modbus Slave Address. These addresses are supplied to the communication board following the steps described in the following sections.
9.1.
1 bit data
INPUT STATES
Unused
16 bits (word)
INPUT REGISTERSa
4 (read)
16 bits (word)
REGISTER OUTPUTb
28
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Devices variables that the control system can read but not modify. Devices variables that the control system can read and modify.
In order to permit a faster transmission of disturbance records, the Modbus communication board protocol reserves the Modbus range 39900 .. 39931 to the REF 542plus variable M31.
9.2.
DataAddress
0xFFFF = DDEF not valid 1..50000 = Modbus address 1 = AI (reading analog inputs) 2 = DI (reading digital inputs) 4 = AO (writing analog outputs) 8 = DO (writing digital outputs) 0x10 = WP (parameter write protected) 0x20 = WC (command write protected) 1,2,4 : data dimension (in bytes) of each member in the DDEF 0 = Off 1 = LP (low priority) 2 = HP (high priority)
DataType
DataLength
Polling
1 14 14 ASCII char including the ending character (\0) +3..-3 : scale factor: value multiplied by 10
(Scale Factor)
29
REF 542plus
Modbus RTU
Technical Reference Table 7.-2 (Continued)
Field Dimension (in bytes) 1 Meaning
1MRS755868
Members
1..255 Number of REF542 elements involved in the DDEF The record identifier string (i.e., the name of the variable/s mapped in the record) The class of the variable mapped in the record, according to the following enumeration list: 0 = measure 1 = status 2 = command 3 = parameter 4 = reading/writing FUPLA variable 5 = event 6 = disturbance record 7 = information
Name
20
Class
9.3.
DataAddress
It points out the starting address in the Modbus address space according to the classification described in the previous paragraph. The 0xFFFF address value means an unused DDEF. As reading and writing operations on a given REF 542plus, that is REF 542plus variable, must have the same Modbus address, but different SPA bus telegrams (one for reading and one for writing). It is possible to have two DDEFs with the same DataAddress (or with range overloaded), but with different DataType direction.
9.4.
DataType
It points out the type of each member and the data access direction: AI each member is a readable analog variable1); the members value is required by means of the function 4, if it corresponds to a device input register (that is measurement, event, read-only Fupla variable, fault record) or by means of the function 3, if it corresponds to a device output register (that is parameter). DI each member is a readable digital variable2); the members value is required by means of the function 2, if it corresponds to a device input status (that is digital input) or by means of the function 3, if it corresponds to a device coil (that is command, digital output).
1) 2)
The term analog, in this context, means datum whose value is 1/2/4 bytes wide. The term digital, in this context, means datum whose value is 1 bit wide.
30
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
AO each member is a writable analog variable; the members value is transferred by means of the function 6, if it corresponds to a single 2 byte's device output register (single writing) or by means of the function 16 in the other analog writing cases (multiple writing). DO each member is a writable digital variable; the members value is transferred by means of the function 5 in case of single device coil writing or by means of the function 15 in case of multiple device coil writing. The DI, DO, AI and AO bits are mutually exclusive. The WP bit can be used only with AO variables; when set to 1, it means that all the members involved in the DDEF (parameters) are to be modified only within a writing parameter session. The WC bit can be used only with DO variables; when set to 1, it means that all the members involved in the DDEF (commands) are modifiable only within a writing command session.
9.5.
DataLength
It indicates the dimension, in bytes, of each DDEF member Referring to [3], the following rules are valid: For US-type SPA bus variables (unsigned integer variables, format X{X{X {X}}} ), DataLength must be 2. Each member is mapped into one Modbus register and is transmitted and received in a 16-bits integer format:
High byte Low byte
For UL-type (unsigned long variables, format X{X{X{X}}}. X{X{X}}) and SL-type SPA bus variables (signed long variables, format {+} | - X{X{X {X}}}. X{X{X}}), DataLength should be 4. Each member is mapped into two Modbus registers. The communication board converts each member in a 4-bytes signed integer format before transmitting it. If a scale factor is defined for the members, such a factor is applied during the conversion. In the same way, the communication board receives members in the 4-bytes signed integer format. After reception, the communication board converts each member in the IEEE float format. If a scale factor is defined for the members, such a factor is applied during conversion. The transmission format is:
High word High byte Low byte High byte Low word Low byte
In order to use less Modbus addresses, UL/SL-type may be accessed with a 2bytes DataLength. In this case, the communication board converts each member in a 2-bytes signed integer format before transmitting it. If a scale factor is defined for the members, such a factor is applied during conversion (possible truncations are not controlled). In the same way, the communication
31
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
board receives members in the 2-bytes signed integer format and converts each member in the IEEE float format. If a scale factor is defined for the members, such a factor is applied during conversion. UL and SL-type may be mapped both on 1 and 2 Modbus registers, (DataLength 2 or 4) with and without the scale factor. In the old version, only 4 bytes DataLength were allowed. For ST-type SPA bus object (string) or for not typed objects (that is variables M28 and M31 of disturbance records), DataLength must be 1 and the member field must be equal to the maximum length (in bytes) of the object. If the object length is odd, the member field must be extended to the next even value (word alignment). This way, the number of Modbus addresses used by the object is equal to the number of members divided by 2. In each DDEF the total number of Modbus registers used is:
Data Length * Members / 2
9.6.
Polling
It indicates the optional polling class to apply to all the variables involved in DDEF:
* * *
HP (2) = high polling priority LP (1) = low polling priority OFF (0) = no polling
Polling variables are requested directly by the communication board to REF 542plus and stored inside the internal memory of the communication board. These requests are cyclic and asynchronous with regard to the control system requests. They allow the communication board to answer immediately to the control system, without waiting for interaction with REF 542plus. The polling cycle follows the sequenceHP, HP, HP, LP, HP, HP, HP, LP, . (3 high priority polling and 1 low priority polling). Only DDEFs with Data Type DI or AI can be defined as polled.
9.7.
32
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
The length of the SPA buss telegram is 14 characters, including the ending character (\0). For a telegram whose length is less than 13 characters, the characters following the ending character (\0) are not significant, but must always be inserted.
9.8.
ScaleFactor
Indicates the optional scale factor (sf) to apply to the data exchanged with REF 542plus according to the following formulas: MODBUSValue = REFValue * 10sf REFValue = MODBUSValue / 10sf The scale factor ranges between 3 and +3. If a DDEF has no scale factor, the field must be set to 0.
9.9.
Members
Points out the number of homogeneous elements mapped on the Modbus area starting at DataAddress. The total length of the Modbus area, in number of Modbus registers, is then (DataLength * Members) / 2. Note that the SPA bus strings should be mapped on DDFEs with DataLength = 1 and Members = size of the string.
9.10.
Name
Name is a free string with a maximum of 20 characters identifying the record.
9.11.
Class
Class is the data class owning the record according to the following list: 0 = measurement 1 = status 2 = command 3 = parameter 4 = reading/writing FUPLA variable 5 = event 6 = disturbance record
33
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
7 = information
DDEF example 1: (Applicable from Modbus firmware version 2.0) Referring to the list showed in [5], the following DDEF permits to read the actual currents L1,L2,L3 (variable IL123, SL-type, scale factor /1000) from channel 1: Value (in decimal) DataAddress 30031 dim.in bytes 2 Notes Start Modbus address = 30031 Reading analog data 4 bytes per member No polling
DataType
2 (= AI)
DataLength
0 = OFF
1 1
R1I1/3
14
Read channel 1- I type from 1 to 3 /1000 scale factor to apply 3 members; next valid MODBUS address is 30031 + (4*3) / 2 = 30037)
Member
Name Class
IL123 0
20 2 Measurements
DDEF example 2: (Applicable from Modbus firmware version 2.0) The actual currents L1,L2,L3 may be addressed in a short form too: in this case only the integer part of the values is transferred value (in decimal) DataAddress 30031 Dim in bytes 2 Notes Start Modbus address = 30031 Reading analog data 2 bytes per member No polling
DataType
2 (= AI)
DataLength
Polling Reserved
0 = OFF
1 1
34
1MRS755868
Modbus RTU
Technical Reference Table 7.-2 (Continued)
REF 542plus
DDEF example 2: (Applicable from Modbus firmware version 2.0) The actual currents L1,L2,L3 may be addressed in a short form too: in this case only the integer part of the values is transferred SPABUSTelegram R1I1/3 14 Same SPA Telegram Decimal part is not required 3 members; next valid Modbus address is 30031 + (2*3) / 2 = 30034)
ScaleFactor
Member
Name Class
IL123 0
20 2 Measurements
DDEF example 3: (Applicable from Modbus firmware version 2.0) a DDEF corresponding to the REF542 software version string could be: value(in decimal) DataAddress 40001 dim. in bytes 2 Notes Start Modbus address = 40001 Reading analog data 1 byte per member No polling
DataType
2 (= AO)
DataLength
0 = OFF
1 1
R0F2
14
Read channel 0 type F- element 2 No scale factor to apply String length = 21 bytes, + 1 byte to align to the word.
ScaleFactor
Member
22
Name Class
Software version 7
20 2 Information
35
36
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
10.
10.1.
Modbus functions
10.1.1.
Xx
0 ... 9999a
1 ... 2000
Data of word (2 bytes) or long (4 bytes) type are transmitted in the big-endian order, that is High_word Low_word and, inside a single word, High_byte-Low_byte. Data of word (2 bytes) or long (4 bytes) type are transmitted in the big-endian order, that is High_word Low_word and, inside a single word, High_byte-Low_byte.
Verify the Slave Address (broadcast not allowed). Verify Coil Start Number and Number Of Data limits. Verify that all the coil addresses are in the range 0..9999 (that is Coil Start Number = 9998 and Number Of Data = 10 is not a valid addressing).
37
REF 542plus
Modbus RTU
Technical Reference
*
1MRS755868
If the limits are not respected, an error message is sent back, indicating ILLEGAL_DATA_ADDRESS error. Verify if it exists one or more consecutive (and not overloaded) DDEFs whose addresses hold the range Coil Start Number + 1,3), .. Coil Start Number + Number Of Data + 1. All the DDEFs must have the DataType equals to DI. The values are taken from the internal memory for DDEFs polled or are requested to REF542 for DDEFs not polled. As many REF 542plus coils have 3 values; 0 = off 1 = on 9 = unused a multiple addressing with at least one unused coil generates an ILLEGAL_DATA_ADDRESS error answer. To avoid this behaviour, the control system may modify the accessing DDEF, reducing the access range (that is from R2I1/7 to R2I1/6 if the 7 coil is unused) or consider such coils as analog variables and use function 3.
10.1.2.
xx
0 ... 9999
1 ... 2000
Verify the Slave Address (broadcast not allowed). Verify Input Start Number and Number Of Data limits. Verify that all the input addresses are in the range 0..9999 (that is Input Start Number = 9998 and Number Of Data = 10 is not a valid addressing). The Modbus protocol specifies that CoilNumbers start from 0, while addresses start from 1.
3)
38
1MRS755868
Modbus RTU
Technical Reference
*
REF 542plus
If the limits are not respected, an error message is sent back, indicating ILLEGAL_DATA_ADDRESS error. Verify if there exists one or more consecutive (and not overloaded) DDEFs whose addresses hold the range InputStartNumber + 10001, .. InputStartNumber + NumberOfData + 10001. All the DDEFs must have the DataType equals to DI. The values are taken from the internal memory for DDEFs polled or are requested to the REF 542plus for DDEFs not polled.
10.1.3.
xx
0 ... 9999
1 ... 125
Verify the Slave Address (broadcast not allowed). Verify Input Start Number and Number Of Data limits. Verify that all the input addresses are in the range 0..9999 (that is Input Start Number = 9998 and Number Of Data = 10 is not a valid addressing). If the limits are not respected, an error message is sent back, indicating ILLEGAL_DATA_ADDRESS error. Verify if there exists one or more consecutive (and not overloaded) DDEFs whose addresses hold the range RegisterStartNumber + 40001, .. RegisterStartNumber + NumberOfData + 40001. All the DDEFs must have the DataType equals to AI. The values are taken from the internal memory for DDEFs polled or are requested to REF 542plus for DDEFs not polled. The values received by REF 542plus are scaled (and broken to the integer value) according to the optional scale factor (sf) defined inside the DDEF: Modbus Value = REF 542plus Value * SF 10 .
39
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
10.1.4.
xx
0 ... 9999
1 ... 125
Verify the Slave Address (broadcast not allowed). Verify Register Start Number and Number Of Data limits. Verify that all the register addresses are in the range 0..9999 (that is Register Start Number = 9998 and Number Of Data = 10 is not a valid addressing). If the limits are not respected, an error message is sent back indicating ILLEGAL_DATA_ADDRESS error. Verify if there exists one or more consecutive (and not overloaded) DDEFs whose addresses hold the range Register Start Number + 30001, .. Register Start Number + Number Of Data + 30001. All the DDEFs must have the DataType equals to AI. The values are taken from the internal memory for DDEFs polled or are requested to REF542 for DDEFs not polled. The values received by REF 542plus are scaled (and broken to the integer value) according to the optional scale factor (sf) defined inside the DDEFModbus Value = REF 542plus Value * SF 10 .
Reading the REF 542plus variable M31 (that is a single line of a disturbance record), whose predefined Modbus address is 39900, the received bytes are packed transforming each pair of ASCII chars (2 bytes) into the corresponding binary value (1 byte). That is, the pair 5D is transformed into the byte 0x5D.
10.1.5.
40
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
xx
0 ... 9999
Verify the Slave Address (broadcast is allowed). Verify Coil Number and Value limits. If the limits are not respected, an error message is sent back, indicating ILLEGAL_DATA_ADDRESS error. Verify if there exists one DDEF whose address is Coil Number + 1; the DDEF must have the DataType equals to DO.
If the bit WC of the DDEF is set and the control system is not within a writing command session, an error message is sent back, indicating ILLEGAL_FUNCTION error. Otherwise, the value is converted (0/1) and transferred to REF 542plus and a Modbus message answer is sent back after the REF 542plus operation.
10.1.6.
xx
0 ... 9999
Verify the Slave Address (broadcast is allowed). Verify RegisterNumber limits. If the limits are not respected, an error message is sent back, indicating ILLEGAL_DATA_ADDRESS error. Verify if it exists one DDEF whose address is Coil Number + 40001; the DDEF must have the DataType equals to AO.
41
REF 542plus
Modbus RTU
Technical Reference
*
1MRS755868
If the bit WP of the DDEF is set and the control system is not within a writing parameter session, an error message is sent back, indicating ILLEGAL_FUNCTION error. Otherwise, the value is converted (0/1) and transferred to REF 542plus and a Modbus message answer is sent back after the REF 542plus operation. Before being transferred to REF 542plus, the value is scaled according to the optional scale factor (sf) defined inside the SF DDEF. Modbus Value = REF 542plus Value * 10 .
As function 6 can address only a single Modbus register (2 bytes), it is necessary to use function 16 in order to preset a 4bytes SPA bus parameter.
10.1.7.
0x40 (bit 7)
0x20 (bit 6)
0x10 (bit 5)
xx
1MRS755868
Modbus RTU
Technical Reference
* * *
REF 542plus
Verify the Slave Address (broadcast not allowed). Pack the 4 events. Sent back the response, in case the communication board is correctly operating and has the following format:
Field Dimension (in bytes) Value Slave Address 1 Function 1 CoilValue 1
xx
0xE0/0xF0
10.1.8.
43
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
xx
0 ... 20
0 ... 0xFFFF
Verify the Slave Address (broadcast not allowed) and the DiagData field Send back the response with the following format:
Field Slave Address 1 Function DiagCode DiagData
xx
0 ... 20
0 ... 0xFFFF
10.1.9.
10.1.10.
10.1.11.
Xx
15
0 ... 9999
1 ... 10000
1.255
any
any
1MRS755868
Modbus RTU
Technical Reference
* *
REF 542plus
Verify the Slave Address (broadcast is allowed). Verify the values of the fields Coil Start Number, N. Coils and N. Bytes: the number of bytes must be compatible with the number of coils (8 coils for byte). The total address range must be within the range 0..9999. If the limits are not respected, an error message is sent back, indicating ILLEGAL_DATA_ADDRESS error. Verify if there exists one or more consecutive (and not overloaded) DDEFs, whose addresses hold the range Coil Start Number + 1, .. Coil Start Number + N. Coils + 1. All the DDEFs must have the Data Type equals to DO. If the bit WC of at least one DDEF is set and the control system is not within a writing command session, an error message is sent back, indicating ILLEGAL_FUNCTION error. Otherwise, the values are transferred to REF 542plus and a Modbus message answer is sent back after the REF 542plus operation. In case of success, the answer has the following format:
Field Slave Address 1 Function 1 CoilStartNumber 2 N.Coils
xx
15
10.1.12.
Xx
16
0 ... 9999
1 ... 60
2.120
any
any
45
REF 542plus
Modbus RTU
Technical Reference
* *
1MRS755868
Verify the Slave Address (broadcast is allowed). Verify the values of the fields Reg Start Number, N. Regs and N. Bytes: the number of bytes must be compatible with the number of registers. The total address range must be within the range 0..9999. If the limits are not respected, an error message is sent back, indicating ILLEGAL_DATA_ADDRESS error. Verify if there exists one or more consecutive (and not overloaded) DDEFs whose addresses hold the range Reg Start Number + 40001, .. Reg Start Number + N. Regs + 40001. All the DDEFs must have the DataType equals to AO. If the bit WP of the DDEF is set and the Control System is not within a writing parameter session, an error message is sent back indicating ILLEGAL_FUNCTION error. Otherwise, the values are transferred to REF 542plus and a Modbus message answer is sent back after the REF 542plus operation. In case of success, the answer has the following format:
Field Slave Address 1 Function 1 RegStart Number 2 N.Regs
xx
16
As in input message
As in input message
Before being transferred to REF 542plus, all the values are scaled according to the optional scale factor (sf) defined inside the DDEFModbus Value = REF 542plus Value * 10 SF.
10.1.13.
46
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Field
Slave Address
Function
ByteCount
Slave Id
Runlight
DeviceDepended 20 reserved
dim value
1 Xx
1 17
1 2
1 0x32
The function 17 may be accessed also by using the pseudo-broadcast address 255:
Field Dimension (in bytes) Value Slave Address 1 255 Function 1 17
dim value
a)
The slave address is replied inside the message according to the need of some configuration tools. b) For version V2.6 the version string is AP_V2.6
10.1.14.
10.1.15.
4)
File 6:
47
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Time and Date Program Command table Program Image Configuration and Program Descriptor table (Not deleted with the rest of the board) (RCE table): as File 2 - Read and Clear of Events (RCE extended table): as File 5 - Read and Clear of Extended Events
The format of each DDEF has been defined in Section 9.2. Modbus address configuration (Data Definitions). The dimension of the file 1 is 1000*22 Modbus registers. It is not compliant with [1] that limits a file to 10000 registers.
Table 10.1.15.-2 File 2 (RCE table)
Register 0 Meaning Number of available events Overflow indicator Clear RCE Event 1 Direction r
1 2 3 D+2
r w r
48
1MRS755868
Modbus RTU
Technical Reference Table 10.1.15.-2 File 2 (RCE table) (Continued)
Register D+3 (D*2) + 2 (D*(MAX-1)) + 3 (D*MAX) + 2 (D*MAX) + 3 9999 Unused Unused Event MAX Meaning Event 2
REF 542plus
Direction r
... r
With D = sizeof(Event)/2 = 14 bytes2 = 7 word MAX = 100 The full description of the RCE table is in Section 11.1.15. Reading events.
Table 10.1.15.-3 File 3 (General Register table)
Register Session Config Pos. 0 Meaning 0 = Request of ending configuration session using current values 1 = Request of starting configuration session 2 = Request of ending configuration session with abort 0 = Request of ending parameter session 1 = Request of starting parameter session 0 = Request of ending command session 1 = Request of starting command session 0 = No configuration session is active 1 = Configuration session is active on channel 1 2 = Configuration session is active on channel 2 Direction w
Session Parameter
Session Command
Status Config
49
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Status Command
Session Programming
Status Programming
8 ... 9999
8 ... 9999
error
50
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
SlaveAddress
r/w
BaudRate
r/w
NumBits
8 = 8 data bits (fixed value) 0 = no parity (default) 1 = even parity 2 = odd parity 0 ... 2 (default = 1)
r/w
Parity
r/w
NumStopBit Timeout
r/w
r/w
Reserved
7 ... 9
n/a
51
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
SlaveAddress
r/w
BaudRate
r/w
8 = 8 data bits (fixed value) 0 = no parity (default) 1 = even parity 2 = odd parity 0 ... 2 (default = 1)
Parity
r/w
NumStopBit Timeout
r/w
r/w
Reserved Unused
a)
n/a error
Note : the channel type configuration has no effect on the Modbus board.
The full description of the Serial Channel Descriptor table is in Section 11.1.2. Serial Channel Descriptor table configuration.
Table 10.1.15.-5 File 5 (RCE Extended table)
Register 0 Meaning Number of available events Overflow indicator Clear RCE Direction r
1 2
r w
52
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
With D = sizeof(Event)/2 = 22 bytes2 = 11 word MAX = 100 The full description of the RCE extended table is in Section 11.1.16. Reading events in extended form.
Table 10.1.15.-6 File 6 (Configuration and Program Descriptor table)
Register 0 ... 9 10 ... 19 20 ... 29 30 ... 39 Meaning Application FW version BootLoader version Configurator version Configuration time and date Configuration Filename Configuration file time and date Unused Direction r r r/w r/w
40 ... 49 50 ... 59
r/w r/w
60 ... 9999
error
53
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
The full description of the Configuration and Program Descriptor table is in Section 11.1.3. Configuration and program description.
Table 10.1.15.-7 File 7 (Time and Date)
Register 0 ... 3 4 ... 9999 Meaning Time and date Unused Direction r/w error
The full description of the Time and Date file is in Section 11.1.20. Time synchronization.
Table 10.1.15.-8 File 8 (Program Command table)
Register 0 ... 1 2 ... 3 4 ... 5 6 ... 9999 Meaning Program checksum Program start address Program length Unused Direction r w w error
The full description of the Program command table is in Section 11.1.22. Re-programming the communication board.
Table 10.1.15.-9 File 9 (Program Image)
Register 0 ... MAX-1 MAX ... 9999 Meaning Program image Unused Direction w error
Where MAX = 2032 The method of accessing the file is not compliant with [1]. Each register addresses a virtual stream of 64 bytes, and therefore the maximum program length is 2032*64 = 127Kbytes. The full description of the Program image file is in Section 11.1.22. Re-programming the communication board
54
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
File 11 (RCE table): as File 2 - Read and Clear of Events File 12 (RCE extended table): as File 5 - Read and Clear of Extended Events
10.1.16.
55
56
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
11.
11.1.
11.1.1.
Each record in File 1 stores one DDEF, whose structure is defined in Section 9.2. Modbus address configuration (Data Definitions). To configure the complete DDEF table, the control system must perform the following procedures:
* *
To request the start of the configuration session. To make x-cycles (where x is the number of DDEFs) sending one DDEF at a time.
57
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
11.1.2.
Dimension Value
Xx Data1 (PortType)
21 Data2 (Address)
21 Data3 (BaudRate)
6 Data4 (NumBits)
10 Data5 (Parity)
2 0 (rs485)
2 1 (1)
2 6 (19200)
2 8 (8 bit)
2 0 (no parity)
2 3 (3 chars )
The communication board, in case of success, answers with the complete echo of the received message. After ending a configuration session, if a channel descriptor has been modified, the communication channel will be restarted with the new parameters. During this operation, the communication will be lost for a few seconds. This is true even if the modified channel descriptor is not the channel on which the configuration is running. Be careful during configuring the channel descriptors when both channels are in use. To read a channel descriptor or a part of it, the control system must use function 21 as in the following example (reading channel 2 descriptor):
58
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Field
Slave Address 1
Function
ByteCount 1
RefType
Filenumber 2
ReqAddress 2
RegCount
Dimension Value
Xx
21
10
Dimension Value
xx Data1 (PortType)
21 Data2 (Address)
16 Data4 (NumBits)
15 Data5 (Parity)
2 0 (rs485)
2 1 (1)
2 8 (8 bit)
2 0 (no parity)
2 1 (1 stop bit)
2 3 (3 chars)
Reading the Channel Descriptor table or a part of it may be performed outside the configuration session too.
11.1.2.1.
11.1.3.
59
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
The first table (File 6) contains information that is deleted with the board reset, while the second table (File 10) contains information that remains with the board reset.
Register 0 ... 9 10 ... 19 20 ... 29 30 ... 39 Meaning Application FW version BootLoader version Configurator version Configuration time and date Configuration Filename Configuration file time and date Unused Meaning Board serial number Production time and date Main board serial number Unused Direction r r r/w r/w
40 ... 49 50 ... 59
r/w r/w
BootLoader version
Configurator version
60
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Configuration filename
It is the name of the file containing (in the host environment) the last DDEF table downloading. The value is written by the configuration tool or by other master Modbus tools. The string should be 0terminated. It is the absolute time (in the string format gg/mm/ aaaa hh:mm:ss) of the last DDEF table modification in the host environment. The value is written by the configuration tool or by other master Modbus tools. The string should be 0-terminated. The communication board does not perform any control on the format received. It is the serial number of the communication board (string format). The value is written by the configuration tool or by an other master Modbus tools. The string should be 0-terminated. It is the absolute time (in the string format gg/mm/ aaaa hh:mm:ss) of REF 542plus containing the communication board. The value is automatically available after start-up. It is the serial number of the main board of the REF 542plus containing the communication board. The value is automatically available after start-up.
All strings are 20 bytes long. All the writable fields are optional as the communication board does not use any of them. In any case, the writing operations are allowed only within a configuration session. All fields may be read and/or written by using the function 20 and 21 messages on file 6. For example, in order to set the Configuration Time and Date field, the control system may use the following message:
Field Slave Address 1 Function Byte Count Ref Type File number 2 Req Address 2 Reg Count
Dimension Value
Xx
21
27
6 Data1..20 20
30
10
12/04/2002 14:55:50
61
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
The communication board, in case of success, answers with the complete echo of the received message. Anyway, the string is permanently stored only after a stop configuration command.
11.1.4.
Reading measurements
In order to access to a given REF 542plus measurement in reading mode, a DDEF with DataType AI and Start Modbus Address in the range 30001..40000 must be configured. The same DDEF may map more than one measurement at a time. It is possible:
* * *
To read a single measurement. To read all the measurements mapped in one DDEF. To read measurements mapped in more than one consecutive DDEFs.
Reading is requested by means of a function 4 message applied to the Start Modbus Address of the first DDEF. If the DDEF maps more than one measurement, it is not possible to request the value of a single measurement, unless the first measurement in DDEF. For each DDEF having a scale factor, all the measurements belonging to it are scaled before sending them to the control system. The returned values are always in signed integer format (2 or 4 bytes).
Example
If the actual currents IL1, IL2, IL3 of channel 1 are mapped by:
Field Data Address Data Type Data Length Polling SPABUS Telegram 14 R1I1/ 3 Scale Factor Members
Dim Value
2 30031
1 AI
1 4
1 LP
1 3
1 3
xx
30
62
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
xx
12
AAAA
BBBB
CCCC
11.1.5.
To read a single input. To read all the inputs mapped in one DDEF. To read inputs mapped in more than one consecutive DDEFs.
Reading is requested by means of a function 2 message applied to the Start Modbus Address of the first DDEF. If the DDEF maps more than one input, it is not possible to request the value of a single input, unless it is the first input in DDEF.
Example
If the 7 digital inputs of the input_board_1 are mapped by:
Field Data Address Data Type Data Length Polling SPABUS Telegram 14 R2I1/ 7 Scale Factor Members
dim value
2 10001
1 DI
1 2
1 HP
1 0
1 7
63
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
xx
xx
0x2F
n/a
Off
On
Off
On
On
On
On
11.1.6.
Writing commands
In order to access to a given REF 542plus command5) in writing mode, a DDEF with Data Type DO, Start Modbus Address in the range 1..10000 must be configured. The commands can be protected (in this case the WC bit is set) or not protected. It is possible to preset one or more protected commands only within a command session. Otherwise, the request ends with an ILLEGAL FUNCTION message error. The same DDEF may map more than one command at a time. It is possible:
*
To preset a single command, refer to Section 10.1.5. Function 5 (preset single coil). To preset all the commands mapped in one DDEF, refer to Section 10.1.11. Function 15 (force multiple coils). To preset commands mapped in more than one consecutive DDEFs, all with WC set, refer to Section 10.1.11. Function 15 (force multiple coils). The term command means the setting of a digital output (coil).
5)
64
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
If the DDEF maps more than one command, it is not possible to preset the value of a single command, unless it is the first command in DDEF.
Example
If the coils O1 and O2 of channel 10 are mapped by:
Field Data Address Data Type Data Length Polling SPABUS Telegram 14 W10O1 W10O2 Scale Factor Members
Dim O1
2 30
1 DO & WC DO & WC
1 2
1 Off
1 0
1 1
O2
31
Off
The closing command (status = ON) on the single O1 coil will be:
Field dimension (in bytes) Value
a)
Address 1
Function 1
Coil Number 2
Value 2
Xx
29
0xFF00a
xx
29
0xFF00
xx
15
29
0x3
65
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Field
Address
Function
N. Coils
xx
15
29
11.1.7.
Reading parameters
In order to access to a given REF 542plus parameter in reading mode, a DDEF with DataType AI and Start Modbus Address in the range 40001 ... 50000 must be configured The same DDEF may map more than one parameter at a time. It is possible:
* * *
To read a single parameter. To read all the parameters mapped in one DDEF. To read parameters mapped in more than one consecutive DDEFs.
Reading is requested by means of a function 3 message applied to the Start Modbus Address of the first DDEF. If the DDEF maps more than one parameter, it is not possible to request the value of a single parameter, unless the first parameter in DDEF. For each DDEF having a scale factor, all the parameters belonging to it are scaled before sending them to the control system. The returned values are always in signed integer format (2 or 4 bytes).
Example
If the parameters Overcurrent value Set 1 and Overcurrent op. time Set 1 are mapped by:
Field Data Address Data Type Data Length Polling SPABUS Telegram 14 R51S1/2 Scale Factor Members
Dim Value
2 40047
1 AI
1 4
1 Off
1 3
1 2
66
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Field
Address
Function
Number Of Regs
xx
46
xx
AAAA
BBBB
Overcurrent value Set 1 = AAAA / 1000 Overcurrent op. time Set 1 = BBBB / 1000
11.1.8.
Writing parameters
In order to access in writing mode to a given REF 542plus parameter, a DDEF with DataType AO and Start Modbus Address in the range 40001 ... 50000 must be configured. The parameters can be protected (in this case the WP bit is set) or not protected. It is possible to preset one or more protected parameters only within a parameter session. Otherwise, the request ends with an ILLEGAL FUNCTION message error. The same DDEF may map more than one parameter at a time. It is possible:
*
To pre-set a single parameter, refer to Section 10.1.6. Function 6 (preset single register). To pre-set all the parameters mapped in one DDEF, refer to Section 10.1.12. Function 16 (preset multiple registers) . To pre-set parameters mapped in more than one consecutive DDEFs, all with WP set, refer to Section 10.1.12. Function 16 (preset multiple registers) .
If the DDEF maps more than one parameter, it is not possible to pre-set the value of a single parameter, unless it is the first parameter in DDEF. For each DDEF having a scale factor, all the parameters belonging to it are scaled before transferring them to REF 542plus. The transmitted values are in signed integer format (if 2 bytes wide) or in IEE float format (if 4 bytes wide).
67
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Example
To modify with a single preset and with a multiple preset the two parameters Overcurrent value Set 1 (OvS1) and Overcurrent op. time Set 1, (OvS2) already defined in Section 11.1.7. Reading parameters, it is necessary to add two DDEFs as follows:
Field Data Address Data Type Data Length Polling SPABUS Telegram 14 W51S1 W51S2 Scale Factor Members
Dim OvS1
2 40047
1 WP|AO
1 4
1 Off
1 3
1 1
OvS2
40049
WP|AO
Off
xx
46
AAAA
(The value AAAA is divided by 100 before sending it to REF 542plus) In case of success, the communication board answers with the echo of the message:
Field Dimension (in bytes) Value Address 1 Function 1 Reg Number 2 Value 4
xx
46
AAAA
xx
16
46
AAAA
BBBB
68
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
(The values AAAA and BBBB are divided by 1000 before sending them to REF 542plus) In case of success, the communication board answers with the partial echo of the message:
Field Address Function Reg Start Number 2 N.Regs
xx
16
46
11.1.9.
Reset alarms
The alarm reset is treated as any command on the REF 542plus variable O100, channel 101. The corresponding DDEF could be:
Field Data Address Data Type Data Length Polling SPABUS Telegram 14 W101O100 Scale Factor Members
Dim Value
2 22
1 DO & WC
1 2
1 Off
1 0
1 1
xx
21
0xFF00
In case of success, the communication board answers with the echo of the message:
Field Dimension (in bytes) Value Address 1 Function 1 CoilNumber 2 Value 2
xx
21
0xFF00
69
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
The same rules are valid also for the other kinds of reset:
* * *
Reset maximum bar, variable O102 of channel 101. Reset energy, variable O103 of channel 101. Reset switch cycles, variable O104 of channel 101.
11.1.10.
11.1.11.
Read-type variables
They are the variables I1 ... I99 of channel 101 (read-only variables). Their handling is similar to the case of reading measurements. Therefore, to read read-type FUPLA variables, the control system must use functions 4 over the address range 30001 ... 40000.
Example
If the 4 variables I10 ... I13 are mapped by:
Field Data Address Data Type Data Length Polling SPABUS Telegram 14 R101I10/13 Scale Factor Members
Dim Value
2 30101
1 AI
1 2
1 LP
1 0
1 4
xx
100
70
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Field
Address
Function
Byte Count
Data 1 (30101) 2
Data 2 (30102) 2
Data 3 (30103) 2
Data 4 (30104) 2
xx
AAAA
BBBB
CCCC
DDDD
That means the REF 542plus values are: I10 = AAAA; I11 = BBBB; I12 = CCCC; I13 = DDDD.
11.1.12.
Write-type variables
They are the variables O1 ... O99 of channel 101 (write-only variables). Their handling is similar to the case of reading parameters. Therefore, to preset write-type FUPLA variables, the control system must use functions 6 and 16 over the address range 40001 ... 50000. The setting of the WP bit is not mandatory.
Example
If the 4 variables O10 ... O13 are mapped by:
Field Data Address Data Type Data Length Polling SPABUS Telegram 14 W101O10/ 13 Scale Factor Members
Dim Value
2 40101
1 AO
1 2
1 off
1 0
1 4
Dimension Value
Xx
16
100
AAAA
BBBB
CCCC
DDDD
71
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
In case of success, the communication board answers with the partial echo of the message:
Field Address Function Reg Start Number 2 N. Regs
xx
16
100
11.1.13.
Reading input states (DI) Reading input states (DI) Reading parameters (AI) Reading parameters (AI) Reading parameters (AI) Reading parameters (AI) Reading parameters (AI) Reading parameters (AI) Reading parameters (AI) Writing parameters (DO)
Interlocking status
Sensor 1 ... 7
Voltage/Current (s.7)
Frequency
72
1MRS755868
Modbus RTU
Technical Reference Table 10.1.15.-10 (Continued)
Parameter Referring class
REF 542plus
Note
Reading parameters (AI) Reading parameters (AI) Reading input states (DI) Writing commands (DO)
Event on/off
Programming/run mode
11.1.14.
Function 1:
*
The maximum number of the addressed coils must be lower than or equal to 2000 (125 Modbus registers). Start Modbus Address must correspond to a DDEF of type DI with the range 1 ... 10000. All the addressed registers must be mapped by one or more DDEFs of type DI in the range 1 ... 10000. All the DDEFs must be consecutive and have a total number of registers greater than or equal to the number of addressed registers.
73
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Function 2:
*
The maximum number of addressed inputs must be lower than or equal to 2000 (125 Modbus registers). Start Modbus Address must correspond to a DDEF of type DI with the range 10001 ... 20000. All the addressed registers must be mapped by one or more DDEFs of type DI in the range 10001 ... 20000. All the DDEFs must be consecutive and have a total number of registers greater than or equal to the number of addressed registers.
Function 3:
*
The maximum number of the analog outputs addressed must be lower than or equal to 125. The Start Modbus Address must correspond to a DDEF of type AI with the range 40001 ... 50000. All the addressed registers must be mapped by one or more DDEFs of type DI in the range 40001 ... 50000. All the DDEFs must be consecutive and have a total number of registers greater than or equal to the number of addressed registers. The number of registers supplied by each DDEF is given by the formula: DataLength * Members \ 2.
Function 4:
*
The maximum number of the analog input's addressed inputs must be lower than or equal to 125. The Start Modbus Address must correspond to a DDEF of type AI with the range 30001 ... 40000. All the addressed registers must be mapped by one or more DDEFs of type DI in the range 30001 ... 40000. All the DDEFs must be consecutive and have a total number of registers greater than or equal to the number of addressed registers. The number of register supplied by each DDEF is given by the formula: DataLength * Members \ 2.
The use of such a method could be very helpful, for instance, in case of reading polled variables. It is not possible to read with a single request not homogeneous variables from the Modbus protocol point of view (that is., coils and inputs states together).
11.1.15.
Reading events
The communication board keeps in its permanent memory the last 100 events raised by REF 542plus (RCE). The control system may read one or more REF 542plus events accessing to the file 2 registers according to the rules described in Section 10.1.15. Function 20 (read general reference).
74
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Clear RCE
Event 2
... r
Unused ...
9999
Unused
Events may be read one at a time or by groups (consecutive events). After reading, the events are still in RCE and cleared only after writing the value 0xFF00 in the register 2. The clear command has no effect on the RCE of the other channel.
75
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
If RCE is full and new events are raised by REF 542plus, the oldest events are lost and the overflow flag is set to 1. The overflow flag is cleared only clearing the entire RCE (writing 0xFF00 in the register 2). Possible operations on RCE are: Requiring the value of the incremental counter (reading register 0), that is the number of available events Mod 100. The incremental counter: Corresponds to the number of stored events, if the overflow flag is 0. Corresponds to the number of events generated after the overflow, if the overflow flag is 1. In this case, the number of stored events is 100.
Field Address Function Byte Count Ref Type File Number 2 Req Address 2 Reg Count
Dimension Value
xx
20
Dimension Value
xx
20
Dimension Value
xx
20
76
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Field
Address
Function
Byte Count
Ref Type
Data
Dimension Value
xx
20
Dim. Value
1 Xx
1 21
1 9
1 6
2 1
2 0xFF00
Dim. Value
1 Xx
1 21
1 9
1 6
2 1
2 0xFF00
Reading a single event (reading the relating registers): The request is valid if, and only if, the addressed event is available and the register range equals the dimension of the event structure. For example, if two events are stored, the following request (read the last event) is valid:
Field Address Function Byte Count Ref Type File number 2 Req Address 2 Reg Count
Dimension Value
xx
20
10
77
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Field
Address
Function
Byte Count
Ref Type
...
xx Data 1 2 xx NumChan
20 Data 2 2 Data 3 2
16 Data 4 2
15 Data 5 2
6 Data 6 2 Data 7 2
EvType
EvNum
Time
Parameter
On the contrary, the following message (still valid) does not return a valid event for the address (it is not an event starting register) or for the dimension (different from 7):
Field Address Function Byte Count Ref Type File number 2 Req Address 2 Reg Count
Dimension Value
xx
20
11
In this case, the communication board answers with an INVALID DATA error message. Reading a group of consecutive events (reading a block of registers): In order to minimize the communication overhead during the RCE transmission, it is helpful to require event blocks, where each block contains the maximum number of events sending with a single Modbus message. As the Modbus function 20 allows up to 250 bytes to be transmitted, a single event block can contain up to 250/14 = 17 events. The easier way to request an event block is to use a single sub request starting at the beginning of the first event in the block and to have as many registers as (7 * number of events). For example, the request for event 18 to 34 is:
78
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Field
Address
Function
Byte Count
Ref Type
File number 2
Req Address 2
Reg Count
Dimension Value
xx
20
3+7*17
7*17
If all the 17 events are stored, the communication board answers with a message like:
Field Address Function Byte Count Sub req byte Count 1 Ref Type Data 1 ... Data 7*17
Dimension Value
xx
20
14*17 +2
14*17 + 1
11.1.16.
Clear RCE
3 ... 13
79
REF 542plus
Modbus RTU
Technical Reference Table 10.1.15.-10 (Continued)
Register 14 ... 24 ... 1091 ... 1102 1103 Unused ... 9999 Unused error ... error ... Event 100 ... r Meaning Event 2 Direction r
1MRS755868
Values
The structure of the single event in extended format (22 bytes long) is:
typedef struct { unsigned short ChanNum; // channel number unsigned char Reserved; unsigned char EventType; // event type u n s i g n e d s h o r t E v e n t N u m ; / / e v e n t n u m b e r (0 . . 1 2 7 ) unsigned long time; // number of milliseconds // elapsed between the // REF542 power-on // and the event raising signed long par1; // optional parameter CP56Time2a AbsoluteTime // time of the event raising char Reserved; } DPM_EVENT_EXT
with:
typedef struct { char :1; char year :7; char :4; char month :4; char day_of_week :3; char day_of_month :5; char summer_time :1; char :2; char hour :5; char invalid :1; char :1; char min :6; char msec_high :8; char msec_low :8; } CP56Time2a ;
All the operation described for file 2 (event file) is also valid for file 5 (event file in extended form). Operations on file 5 apply on both file 2 and 5 and viceversa. It means, for example, that the Clearing RCE command (writing 0xFF00 on file 5 register 2) clears both file 2 and file 5.
80
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Refer to Section 11.1.15. Reading events the previous paragraph for a full description of operation on file 5. Just note that each event in extended form is 22 bytes long while an event in standard form is 14 bytes long.
11.1.17.
Dimension Value
xx
20
11
The board answers as in the case of reading events and after that deletes the read events.
Field Address Function Byte Count Sub req byte Count 1 Ref Type ...
xx Data 1 2 xx NumChan
20 Data 2 2 Data 3 2
16 Data 4 2
15 Data 5 2
6 Data 6 2 Data 7 2
EvType
EvNum
Time
Parameter
In case the RegAddress is not 3, the board answers with ILLEGAL_DATA_ADDRESS. The Read & Clear:
81
REF 542plus
Modbus RTU
Technical Reference
* * *
1MRS755868
Deletes the last n read events. Puts the overflow flag to false. Puts EVENT COUNTER = EVENT COUNTER n (if the overflow flag was TRUE, the EVENT COUNTER becomes 100 - n).
11.1.18.
Deletes the last n read events Puts the overflow flag to false Puts EVENT COUNTER = EVENT COUNTER n (if the overflow flag was TRUE, the EVENT COUNTER becomes 100 - n.
11.1.19.
82
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
V20
Direction Data Length / Member SPABUS Telegram Modbus access mode Modbus accessing function 4 Values
Read
2/1
R0V20
AI
Number of available records: 0..20 0 = session end 1 = select uncompressed mode 2 = select compressed mode other = error
Write
2/1
W0V20
AO
M28
Direction Data Length / Member SPABUS Telegram Modbus access mode Modbus accessing function 4 Values
Read
1 / 34
R0M28 W0M28
AI
Directory information, see [3] Record index : 1.. V20 current value
Write
2/1
AO
M29
Direction Data Length / Member SPABUS Telegram Modbus access mode Modbus accessing function 4 Values
Read
2/1
R0M29
AI
Number of lines (128 bytes each) contained in the record addressed by M28; range: 0..1023 0 = M28 not valid Error
Write
n/a
N/a
n/a
n/a
83
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
M30
Direction Data Length / Member SPABUS Telegram Modbus access mode Modbus accessing function 4 Values
Read
2/1
R0M30 W0M30
AI
Last line read (0..1023) Line to read (1..1023) Set to 1 on every access to M28 Incremented by REF 542plus to each valid access to M31
Write
2/1
AO
M31
Direction Data Length / Member SPABUS Telegram Modbus access mode Modbus accessing function 4 Values
Read
1 / 128-64
R0M31
AI
Single record line (128 byte if in ASCII format or 64 bytes if in binary format) Error
Write
n/a
n/a
n/a
n/a
As pointed out in Section 9.1. Modbus RTU addressing, the Modbus Address 39900 is reserved for reading access to the variable M31 to speed up disturbance record transferring. This way all the pairs of ASCII characters included in each line of a record are compressed in a single binary byte, that is the pair 5D becomes the byte 0x5D. To use this feature, the control system must configure a DDEF with:
* * * * *
Start Address = 39900 DataType = AI DataLength = 1 SPA bus telegram = R0M31 Members = 64
To avoid this optimization, the control system must configure a DDEF with :
* * *
Start Address = any address in the range 30001..40000, but 39900 DataType = AI DataLength = 1
84
1MRS755868
Modbus RTU
Technical Reference
* *
REF 542plus
V16
Direction Data Length / Member SPABUS Telegram Modbus access mode Modbus accessing function 4 Values
Read
2/1
R0V16
AI
REF disturbance record memory status: 0 = the memory is not full and is available 1 = the memory is full and available 2 = the memory is not available Clear the oldest disturbance record after a double writing access: first access : 0 second access : 1
Write
2/1
W0V16
AO
Be careful in clearing the oldest record, because the other Modbus connection is not notified about the event.
V17
Direction Data Length / Member SPABUS Telegram Modbus access mode Modbus accessing function 4 Values
Read
2/1
R0V16
AI
Current compression percentage (Delta) Compression percentage (Delta) for the compression algorithmRange: 0..5
Write
2/1
W0V17
AO
To make the complete procedure, the control system should perform the following steps:
*
Open the session by writing the transferring mode (uncompressed (1) or compressed (0)) on the V20 variable. Verify that some disturbance records exist by reading V20.
85
REF 542plus
Modbus RTU
Technical Reference
* * * *
1MRS755868
* *
If V20 > 0, select a record by writing the index on M28. Require the record directory by reading M28. Require the number of lines of the selected record by reading M29. Loop reading on M31 to obtain single lines. The operation can be manually controlled by reading/writing on M30, or leaving an automatic control to REF 542plus that increments M30 to every access to M31. Clear the last read record by means of two consecutive writing on V16, the first with value 0 and the second with value 1. Wait for the end of the memory re-ordering by reading V16: during re-ordering, the V16 value is 2. Close the session by writing 0 on V20. At any moment, V16 can be read to verify whether the REF 542plus recording memory is full (1) or not (0). At any moment, before requiring a record, V17 can be set with a new value for the compression percentage (Delta).
11.1.19.1.
The first (.cfg) with the configuration of the fault recorder. It follows the description of the configuration for 32 digital inputs, frequency, control of analogue section, control of digital section, digital data and analogue data. The second (.dat) with the stored data.
From DOS, it must be used a command line with two parameters (input and output file): Smsconvert.exe inputFile outputFile Where inputFile is the uploaded file, while outputFile is the path name of the two output files.
11.1.20.
Time synchronization
The absolute time may be sent from the control system to the communication board by using the extended file 7:
86
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Where CP56Time2a is the structure described in Section 11.1.16. Reading events in extended form. Each time the communication board receives a writing message on file 7, it forwards the entire AbsoluteTime field to the main board that applies the time. That means the entire file must be filled with a single function 21 message, otherwise a corrupted time value may be transferred to the main board. The communication board does not refuse partial writing. The communication board does not control the time format. In order to permit network synchronization, it is possible to write the file 7 in broadcast mode, even if this behavior is not allowed by [1]. Each register of the file 7 may be read by using function 20 messages, even with partial accesses. The communication boards returns the last value set and not the real current absolute time. For example, in order to set the main board absolute time, the control system may use the following message:
Field Slave Address 1 Function Byte Count 1 Ref Type File number 2 Req Address 2 Reg Count
Dimension Value
Xx
21
15
6 Data1..8
87
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
The communication board, in case of success, answers with the complete echo of the received message. The same message may be sent in broadcast mode:
Field Slave Address 1 Function Byte Count Ref Type File number 2 Req Address 2 Reg Count
Dimension Value
21
15
6 Data1..8
In this case the communication board does not answer. The REF 542plus generates an event E43 to indicate that is synchronized with the Modbus date-time.
11.1.21.
11.1.21.1.
Time reading
The SPA message to read the full REF 542plus time-date in Cp56time2a format is the following: >99R0M10:XXcr To read the time the following Ddef has to be mapped and downloaded:
DateHourR Info >30000 & <40000 AI 1 0 R0M10 0 22
The slave reply is: 99<D:yy-mo-dd hh.mm;ss.sss:XXcrlf The date-time data is on 11 registers (22 bytes with the last = 0) corresponding to the values of the single chars.
88
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
11.1.21.2.
Time setting
The time setting is an update of the date-time of REF 542plus in Cp56time2a format. The Cp56time2a time can be forwarded to REF 542plus and generates an event E46 each time the updating of date-hour from the REF 542plus is performed. The SPA message to write the full REF 542plus time-date has the following format (same as SPA date time): >99W0M10:Dyy-mo-dd hh.mm;ss.sss:XXcr Note: The initial character D must be added to interpret the message as string and not as number. To set the time, the following DDEF has to be downloaded:
DateHourW Info >40000 & <50000 AO 1 0 W0M10 0 22
Now, with the Modbus Function 16 it is possible to set the values of the 11 registers mapped in the DDEF by assigning the char D to the low byte of the first register.
Field Sl. Addr. Function Reg Start Number 2 N. Regs N. Bytes Reg1 (Hex) Reg2 (Hex) Reg 11
Xx
16
0..9999
11
22
<4430>
<332D>
any
11.1.22.
89
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Program checksum
Reports the checksum and the validity flag of the downloaded program according to the following structure:
Byte 0 Validity flag 0 0/1 High byte Byte 1 Byte 2 Checksum Low byte Byte 3
The programming session is active. The Program start address register has a valid value. The Program Length register has a valid value.
The Checksum sub-field is the 16 bits ones complement of the first Program Length / 2 words inside the Program Image. If the Validity flag is 0, the Checksum is not significant. The Program Checksum registers are computed each time they are accessed in reading. The Program Checksum registers must be read with a single command; the use of a function 20 message reading only one register is refused by the communication board. If Program Length register is null, Program Checksum returns 0x0001FFFF if the Program start address register is valid otherwise, 0x0000FFFF. The Program Checksum registers may be read outside a programming session. The Program Checksum registers cannot be written by the control system.
90
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Different addresses are refused by the communication board The Program start address must be written with a single command; the use of a function 21 message writing only one register is refused by the communication board. The Program start address must be written inside a programming session. The Program start address may be written in any phase of the programming session, even inside a program download. The Program start address may be written in broadcast mode. When the programming session is closed (stop or abort) the Program start address is reset to 0.
Program length
Using this 32 bit field, the control system communicates the length (in bytes) of the updated program. The maximum length is 0x1FC00 (127Kb). Higher values are refused by the communication board. Writing the value 0 means a request to clear the program at location Program start address without substituting it. The Program length must be written with a single command; the use of a function 21 message writing only one register is refused by the communication board. The Program length may be written inside a programming session only. The Program length may be written in any phase of the programming session, even inside a program download. The Program length may be written in broadcast mode.
91
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
When the programming session is closed (stop or abort) the Program length is reset to 0xFFFFFFFF.
The file 9 is a virtual image for incoming updated programs. Each register writing access allows a writing on an internal area (127Kbytes long) storing the incoming program. When the ith register is writing accessed, the data part of the message is written in the internal area starting at offset i*64. The last register in file 9 is: 127K / 64 1 = 130048 / 64 1 = 2032 1 = 2031 The Program Image registers may be written inside a programming session only. The Program Image register may be written in broadcast mode. The Application Program is updated with a valid Program Image at the end of the programming session with a Stop Programming command.
Re-programming procedure
1. Start a programming session, see Section 11.1.27. Programming session. 2. Send a function 21 message (on registers 2 and 3 of file 8) with a valid program start address (0x1040000).
Field Slave Address 1 Function Byte Count Ref Type File number 2 Req Address 2 Reg Count Data 1..4
Dimension Value
Xx or 0
21
27
The communication board (if not in Broadcast mode) answers with the echo of the message
92
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
3. Send a function 21 message (on registers 4 and 5 of file 8) with the length of the program to download (0x10644).
Field Slave Address 1 Function Byte Count Ref Type File number 2 Req Address 2 Reg Count Data 1..4
Dimension Value
Xx or 0
21
27
The communication board (if not in Broadcast mode) answers with the echo of the message 4. Send the program image: * Send a first function 21 message (starting at register 0 of file 9); the data part may contain any number of bytes (within the limit of Modbus messages). The simplest way is to use 64 bytes per message (32 registers); the most efficient way is to use 192 bytes per message (= 64 * 3, or 96 registers). 256 bytes cannot be used being outside the message limit.
Field Slave Address 1 Function Byte Count Ref Type File number 2 Req Address 2 Reg Count Data 1..192
Dimension Value
192
Xx or 0
21
199
96
...
The communication board (if not in Broadcast mode) answers with the echo of the message
*
Send the second frame, starting at register 1 if the previous message contained 64 bytes, or at register 3 if the previous message contained 192 bytes, or at any other register.
Slave Address 1 Function Byte Count Ref Type File number 2 Req Address 2 Reg Count Data 1..192
Field
Dimension Value
192
Xx or 0
21
199
96
...
93
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
The communication board (if not in Broadcast mode) answers with the echo of the message. Loop on file 8 registers, with a boundary of 1 (data part of 64 bytes) or 3 (data part of 192 bytes) until the last full message. * Send the last function 21 message with the remaining bytes (if necessary). 5. Verify the correct download by reading the program checksum with a function 20 message (on registers 0 and 1 of file 8):
*
Field
Slave Address 1
Function
Byte Count
Ref Type
File number 2
Req Address 2
Reg Count
Dimension Value
Xx
20
Dimension Value
*
Xx
20
The download is correct if the valid subfield (register 0) is 1 and the Checksum subfield equals the program checksum (computed by the control system in any off-line way). 6. If the download is valid, close the programming session with a Stop programming command, otherwise close the programming session with an Abort programming command or retry the procedure from step 2.
94
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Field
Slave Address 1
Function
Byte Count
Ref Type
File number 2
Req Address 2
Reg Count
Data 1..4
Dimension Value
Xx or 0
21
27
The communication board (if not in Broadcast mode) answers with the echo of the message. 3. Send a function 21 message (on registers 4 and 5 of file 8) with a 0 length for the program.
Field Slave Address 1 Function Byte Count Ref Type File number 2 Req Address 2 Reg Count Data 1..4
Dimension Value
Xx or 0
21
27
The communication board (if not in Broadcast mode) answers with the echo of the message. 4. Do not send any program image but just verify the correct program checksum with a function 20 message (on registers 0 and 1 of file 8):
Field Slave Address 1 Function Byte Count Ref Type File number 2 Req Address 2 Reg Count
Dimension Value
Xx
20
95
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Field
Slave Address
Function
Byte Count
Ref Type
Data
Dimension Value
Xx
20
11.1.22.1.
11.1.23.
Sessions
As two different control systems may be connected to REF 542plus via communication board at the same time, it is necessary to protect those operations requiring a mutually exclusive access. Critical operations belong to 3 classes:
* * *
Commanding digital outputs. Pre-setting parameters. Transferring or modifying the Communication board configuration.
The mutually exclusive access is guaranteed among operations within the same session and not among operations belonging to different sessions. To operate within a given session, each control system must perform the following steps:
96
1MRS755868
Modbus RTU
Technical Reference
*
REF 542plus
Require the starting of the session by writing the value 1 in the file 3 relevant register. The communication board acknowledges by echoing the receiving message; if another control system already holds the session, the communication board answers with an ILLEGAL_DATA_VALUE error message. Operate inside the class; in this phase the control system may also perform operations outside the class. Closing the session by writing the value 0 in the same register used to require the starting.
In any case, the communication board automatically closes a session after a given time after the last operation over an element of the class.
11.1.24.
Dimension Value
Xx
21
If the request is accepted, the communication board answers with the echo of the message Otherwise (the session is already held by the other connection), the communication board answers with an ILLEGAL_DATA_VALUE error message. Reading a command status is allowed outside the session as well. To close the session, it is necessary to write the value 0 in the register SessionCommand (register 2) of file 3. At any moment, the writing command session status may be required by reading the register StatusCommand (register 5) of file 3:
97
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Field
Address
Function
Byte Count
Ref Type
File number 2
Req Address 2
Reg Count
Dimension Value
xx
20
0 if no writing command session is currently active 1 if a writing command session is currently active by the control system connected on port 1 2 if a writing command session is currently active by the control system connected on port 2
Field Address Function Byte Count Sub resp Byte Count 1 Ref Type Data
Dimension Value
xx
20
0 ... 2
11.1.25.
Dimension Value
Xx
21
If the request is accepted, the communication board answers with the echo of the message. Otherwise (the session is already hoed by the other connection), the communication board answers with an ILLEGAL_DATA_VALUE error message. Reading a parameter value is allowed outside the session as well.
98
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
To close the session, it is necessary to write the value 0 in the register SessionParameter (register 1) of file 3. At any moment, the writing parameter session status may be required by reading the register StatusParameter (register 4) of file 3:
Field Address Function Byte Count Ref Type File number 2 Req Address 2 Reg Count
Dimension Value
Xx
20
0 if no writing parameter session is currently active 1 if a writing parameter session is currently active by the control system connected on port 1 2 if a writing parameter session is currently active by the control system connected on port 2
Field Address Function Byte Count Sub resp Byte Count 1 Ref Type Data
Dimension Value
Xx
20
0 ... 2
Not protected parameters may be preset outside a writing parameter session. Anyway, in order to preset parameters (protected or not), it is necessary to set the REF 542plus mode:
*
* * *
Set the Program mode before pre-setting parameters (either by using a writing parameter session or not). Set Run mode after the pre-setting phase. Send a Store parameter command for permanently storing parameters. Program mode (SPA telegram W0S198 with value 0), Run mode (SPA telegram W0S198 with value 1) and store in EEPROM (SPA telegram W0V151 with value 1) must be defined as commands or parameters themselves (protected or not) inside the DDEF list.
11.1.26.
Configuration session
Any writing access to the file 1 and/or file 4 registers, containing the DDEF table and the Serial Channel Descriptor table is to be considered configuration.
99
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
The configuration register writing is allowed only within a configuration session. To start the session, the control system must write the value 1 in the register SessionConfig (register 0) of file 3 with the following message:
Field Address Function Byte Count Ref Type File number 2 Req Address 2 Reg Count Data
Dimension Value
Xx
21
If the request is accepted, the communication board answers with the echo of the message. Otherwise (the session is already held by the other connection), the communication board answers with an ILLEGAL_DATA_VALUE error message. Reading a configuration register is allowed outside the session, too. To close the session it is necessary to write in the register SessionConfig (register 0) of file 3: The value 0, all new values are applied The value 2, all new values are discarded At any moment, the configuration session status may be required by reading the register StatusConfig (register 3) of file 3:
Field Address Function Byte Count Ref Type File number 2 Req Address 2 Reg Count
Dimension Value
xx
20
0 if no configuration session is currently active 1 if a configuration session is currently active by the control system connected on port 1 2 if a configuration session is currently active by the control system connected on port 2
100
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Field
Address
Function
Byte Count
Ref Type
Data
Dimension Value
Xx
20
0 ... 2
11.1.27.
Programming session
Any writing access to the file 8 and/or file 9 registers, containing the Program Parameters and the Program Image is to be considered programming. The programming register writing is allowed only within a programming session. To start the session, the control system must write the value 1 in the register SessionProgramming (register 6) of file 3 with the following message:
Field Address Function Byte Count Ref Type File number 2 Req Address 2 Reg Count Data
Dimension Value
Xx or 0
21
If the request is accepted, the communication board answers with the echo of the message. Otherwise (the session is already held by the other connection), the communication board answers with an ILLEGAL_DATA_VALUE error message. After a valid start programming session, the communication board fills with all 0s the entire file 8, in order to reset any previous programming. Reading a programming register (file 8 only) is allowed outside the session, as well. To close the session, it is necessary to write in the register SessionProgramming (register 7) of file 3: The value 0, all new values are applied and the Communication board restarts if a valid program image has been transferred The value 2, all new values are discarded At any moment, the programming session status may be required by reading the register StatusProgramming (register 7) of File 3:
101
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Field
Address
Function
Byte Count
Ref Type
File number 2
Req Address 2
Reg Count
Dimension Value
xx
20
0 if no programming session is currently active. 1 if a programming session is currently active by the control system connected on port 1. 2 if a programming session is currently active by the control system connected on port 2.
Field Address Function Byte Count Sub resp Byte Count 1 Ref Type Data
Dimension Value
Xx
20
0 ... 2
The start/stop/abort programming commands may be also sent in broadcast mode, in order to re-program all the slaves in the network with a single procedure. This behavior is not compliant with [1].
11.1.28.
Other operations
11.1.28.1.
102
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
11.1.29.
xx
0 ... 20
XX
where:
DiagCode 0 1 2 4 Meaning Return Query Data (echo) Restart Comm Option Return Diagnostic Register Force Slave to Listen Only Mode Clear Counter and Diagnostic Register Return Bus Message Count Return Bus CRC Error Count Return Bus Exception Error Count Return Slave Message Count Return Slave No Message Count Return Slave NAK Count Return Slave Busy Count Return Bus Character Overrun Count Return Overrun Error Count Clear Overrun Error Count and Flag DiagData Value to return n/a n/a n/a
10
n/a
11 12 13
14 15
n/a n/a
16 17 18
19 20
n/a n/a
103
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
Address 1
Function 1
DiagCode 2
DiagData 2
xx
0 ... 20
XX
Where:
DiagCode 0 Meaning Return Query Data (echo) Restart Comm Option Return Diagnostic Register Effect Echo the request DiagData Input data
(1)
n/a
Returns the bitwise status of the diagnostic register The communication board does not answer any more on this channel Counter and diagnostic register are cleared Returns the number of all the messages that the communication board has processed since the last restart (or power-on) was issued Returns the number of CRC errors that the communication board has encountered since the last restart (or power-on) was issued
Always 0
n/a
10
n/a
11
12
104
1MRS755868
Modbus RTU
Technical Reference Table 11.1.22.-1 (Continued)
DiagCode 13 Meaning Return Bus Exception Error Count Effect Returns the number of exception codes that the communication board has returned since the last restart (or poweron) was issued Returns the number of messages addressed to the communication board since the last restart (or poweron) was issued Returns the number of times the communication board has failed to respond since the last restart (or power-on) was issued Returns the number of times the communication board responded with a NACK (Negative Acknowledgement) since the last restart (or poweron) was issued Returns the number of times the communication board responded as busy since the last restart (or power-on) was issued
REF 542plus
14
15
16
17
105
REF 542plus
Modbus RTU
Technical Reference Table 11.1.22.-1 (Continued)
DiagCode 18 Meaning Return Bus Character Overrun Count Effect Returns the number of times a message was not handled due to an overrun or to a hardware malfunction since the last restart (or power-on) was issued As above
1MRS755868
19
Return Overrun Error Count Clear Overrun Error Count and Flag
20
n/a
(1) The communication board port is initialized and restarted and all of its communications event counters are cleared. If the port is currently in Listen Only Mode, no response is returned. This function is the only one that brings the port out of Listen Only Mode. If the port is not currently in Listen Only Mode, a normal response is returned. This occurs before the restart is executed. When the communication board receives the query, it attempts a restart and executes its power-up confidence tests. Successful completion of the tests will bring the port online.
11.1.30.
In this version, the type and the run-light status are handled only:
Field Address 1 Function 1 Byte Count 1 Slave Id Run-light Device Dependent 20
Dimension value
xx
17
0x32
Unused
106
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
12.
12.1.
12.2.
Uploading procedures
The events upload can be performed in two different methods:
*
The procedure to read the events from a generic SCADA with the read and clear of the oldest event in a unique telegram (R0P3) is faster but you can lose events. The procedure is: Read if the OVERFLOW flag with R0P0 is present. * Read if the number of events is more than zero by reading the register where R0P1 is mapped. * Read the oldest event and delete it by reading the 11 registers where R0P3 is mapped. * It is also possible to clear all the events by writing 1 to the register where W0P2 is mapped. The procedure to read the events from a generic SCADA with the read and clear of the oldest event in two different telegrams (R0P4 and W0P5) is slower, but you are sure not to lose events.
*
107
REF 542plus
Modbus RTU
Technical Reference
* *
1MRS755868
Read if the OVERFLOW flag with R0P0 is present. Read if the number of events is more than zero by reading the register where R0P1 is mapped. Read the oldest event by reading the 11 registers where R0P4 is mapped. Clear the oldest event writing 1 to the register where W0P5 is mapped.
12.3.
DDEF
A possible DDEF is with all the columns fixed except for the address that can be configurable in the range between 40000 and 49999:
DEFINITION NAME Oldest_event_ReadCl Number_Of_Events Events_overflow Oldest_event_Read Clear_events Clear_oldest_event CATEGORY ADDRESS TYPE LEN POLL SPA TEL. FACT MEMBERS
Parameters
40017
AI
R0P3
22
Parameters
40028
AI
R0P1
Parameters Parameters
40029
AI
R0P0
40030
AI
R0P4
22
Parameters Parameters
40405
AO
W0P2
40406
AO
W0P5
108
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
13.
Select automatic (smart) or not automatic handshake RTS485 converter type according to your device. Select the communication settings on the PC port (the default settings of the Modbus board are 19200, n, 8, 1).
The procedure to configure the Modbus board with the DDEFs and channel descriptors is: 1. Scan the network: * Single node: peer to peer to connect to a single REF. * Multiple nodes: on the bus to connect to all the REFs. 2. Try to connect in one of the following ways: * Manually with the right communication settings. * Automatically (all the settings are automatically updated to get the right one). 3. Return to the main, select one slave and go on line. The Modbus suite can configure both the channels descriptors for each port and the DDEFs table.
*
To change the channel descriptors of each port: * Read the descriptors from the Modbus board. * Start a session. * Choose the new channel descriptor settings. * Send the descriptors to REF. * Store or abort the session. If the storing option is chosen, the communication will be lost if descriptors of the channel you are connected to are modified.
109
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
A051141
* * *
Load an Excel file with the DDEF to download (see the DedfExample. xls and the Modbu config table commented.xls file given with the Modbus suite as examples). Start a session. Send the DDEF to REF. If the download is OK stop the session to store in flash memory the new configuration.
110
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
A051142
Uploading:
* *
Read and save the DDEFs from the Modbus board. After saving the DDEF file, it is possible to modify some parameters by opening the file in the yellow icon. To download the modified file, close it and start a download session.
111
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
A051143
112
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
14.
Commissioning
The commissioning section has the following functionality:
* * * * * * * *
Measurement reading States reading Commands Parameter reading /writing FUPLA reading /writing Events reading Disturbance record uploading Read REF 542plus general info and perform time reading/setting.
Scan the network and get the REF 542plus connected. Select the commissioning section. Select the REF 542plus slave. Upload the configuration from REF 542plus. The Modbus suite will divide the DDEF following the category in the related section.
A051137
Now, it is possible to enter the desired section. Each of them has a detailed online help to guide the usage.
113
114
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
15.
115
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
A051138
4. Download the configuration file to the main board. To come back to the Modbus communication, the only way is to reset the Modbus board in order to come back to the default Modbus settings (see Section 13. Configuring the Modbus board).
116
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
16.
Updating firmware
The firmware update is possible with
* *
Modbus Suite from the version 1.8 An automatic handshake RTS485 converter
The firmware update is possible only if the minimum previous version is AP_V2.0 and can be performed:
* *
Peer to peer from the Modbus suite to a single REF 542plus On the bus to all the REFs connected
From the Modbus suite it is possible to re-program both the firmware of the boot loader and the application program. Procedure:
*
Scan the network to get all the REFs in the bus and to connect them to the Modbus suite. Select the programmer section and choose bootloader or application reprogramming. Select the binary file whose name must start with "REF542plusBootLoaderModbus" or "REF542plusApplicationModbus". It is possible to upgrade more than one REF on the network in broadcast way or a single REF. If you choose to download the upgraded firmware to all the connected REFs, you must enable the flag with controlled programming to check the validity of the downloaded program before the storing in the Flash memory. If the procedure is without any error, you have to wait for the restart of the board with the downloaded firmware as described in Section 19. Led lighting sequences with the right blinking.
117
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
A051139
118
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
17.
Abbreviations
Abbreviation AI AIS AO ASCII DDEF DI DO EEPROM FUPLA GIS LED RHMI RTU SCADA SPA Description Analog Input Air Isolated Switchgear Analog Output American Standard Code for Information Interchange Data Definition Digital Input Data Object Electrically Erasable Programmable Read-Only Memory Function block Programming Language; Function Plan; Function Chart Gas Insulated Switchgear Light-Emitting Diode Remote Human-Machine Interface as control unit Remote Terminal Unit Supervision, Control and Data Acquisition Data communication protocol developed by ABB
119
120
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Appendix A:
02
ILLEGAL_DATA_ADDRESS ILLEGAL_DATA_VALUE
03
04
FAILURE_IN_DEVICE
121
122
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Appendix B:
A051140
Fig. B-1
2 3 4 5
= = = =
1 1 2 2
Rx Tx Rx Tx
At start-up As continuous monitoring The communication board owns 2 buttons B1 and B2 over the leds.
Push together the two buttons B1 and B2 for at least 5 seconds. Release the button B2: the first LED 1 blinks 3 times (while the board restarts), then it is off for some seconds and starts blinking continuously with 0.5 s frequency. Release the button B1 and the board restarts.
Startup monitoring
At startup, different led sequences are performed according to the different communication board situations:
*
Board without BootLoader and without Application Program * 2 blinks Board with BootLoader but without Application Program * 3 blinks Board with Application Program but without BootLoader * 4 blinks if starting as Modbus or * 6 blinks if starting as SPA bus * Continuous monitoring after a few seconds Board with BootLoader and Application Program starting as Modbus * 3 blinks * Led1 off for about 5 seconds when the BootLoader is connectable
123
REF 542plus
Modbus RTU
Technical Reference
1MRS755868
2 blinks at Application Program start-up * Continuous monitoring after a few seconds Board with BootLoader and Application Program starting as SPA bus * 3 blinks * Led1 off for about 5 seconds when the BootLoader is connectable * 4 blinks when the Application Program starts * Continuous monitoring after a few seconds Board with BootLoader re-programming the communication board * 8 blinks * Led1 off for a few seconds while the BootLoader re-programs * Some behaviour as one of the previous cases Board with a manual reset * 2 blinks * Led1 off for a few seconds during the pressing of the reset button * 4 blinks * Some behaviour as one of the previous cases
*
Continuous monitoring
The communication board shows its operating status by blinking the Led 1 at different frequencies:
*
0,250 Hz (4 seconds period) The Communication board is well configured (if in Modbus mode) and only good messages have been received in the last 30 seconds (on both channels).
0,5 Hz (2 seconds period) The communication board is well configured (if in Modbus mode) but not all the messages received in the last 30 seconds are good (that is, some communication error has occurred in one or both channels).
2 Hz (0,5 seconds period) The communication board is badly configured (only if in Modbus mode: the Ddef table is wrong or missing or the polling list is wrong) or only bad messages have been received in the last 30 seconds (on both channels).
If no messages (nor bad messages) are received in the last 30 seconds, the communication board still shows the previous status.
124
1MRS755868
Modbus RTU
Technical Reference
REF 542plus
Appendix C:
Static errors: at the Modbus board startup, the DDEF is not correct or is absent. The DDEF is not correct if: * The Polling field is not right: the only registers that can have a polling different from 0 are the DI (10000 < address < 19999) or the AI (30000 < address < 39999) Dynamic errors: at least one communication error in the last 30 seconds (errors as REF Not Ready, illegal data address from REF, illegal data value from REF or low level communication errors as CRC).
The communication led is green if no dynamic errors are present in the last 30 s and the DDEF is correct. The communication led goes from red to green if at least one packet has been sent with success, otherwise it has an amber color.
125
ABB Oy Distribution Automation P.O. Box 699 FI-65101 Vaasa FINLAND +358 10 2211 +358 10 224 1080 www.abb.com/substationautomation
1MRS755868 EN 9/2006