STS Third Party Protocols Support

8/10/2019 STS Third Party Protocols Support

1/51

0

Third Party Protocols Support

ACE3600 System ToolsSuite (STS)Version 15.50

6802979C25-H

AB

MOTOROLA, MOTO, MOTOROLA SOLUTIONS and the Stylized

M Logo aretrademarks or registered trademarks of Motorola

Trademark Holdings, LLC and are used under license. All other

product or service names are the property of their respective

owners.

Copyright 2011 Motorola Solutions, Inc. All rights reserved


2/51

COMPUTER SOFTWARE COPYRIGHTS

The Motorola products described in this instruction manual may include copyrighted Motorola computer programs stored insemiconductor memories or other media. Laws in the United States and other countries preserve for Motorola certainexclusive rights for copyrighted computer programs including the exclusive right to copy or reproduce in any form the

copyrighted computer program. Accordingly, any copyrighted Motorola computer programs contained in the Motorolaproducts described in this manual may not be copied or reproduced in any manner without the express written permission ofMotorola. Furthermore, the purchase of Motorola products shall not be deemed to grant either directly or by implication,estoppel, or otherwise, any license under the copyrights, patents or patent applications of Motorola, except for the normalnon-exclusive, royalty free license to use that arises by operation of law in the sale of a product.

This media, or Motorola Product, may include Motorola Software, Commercial Third Party Software, and Publicly AvailableSoftware.

The Motorola Software that may be included on this media, or included in the Motorola Product, is Copyright by MotorolaSolutions, Inc., and its use is subject to the licenses, terms and conditions of the agreement in force between the purchaserof the Motorola Product and Motorola Solutions, Inc.

The Commercial Third Party Software that may be included on this media, or included in the Motorola Product, is subject tothe licenses, terms and conditions of the agreement in force between the purchaser of the Motorola Product and MotorolaSolutions, Inc., unless a separate Commercial Third Party Software License is included, in which case, your use of theCommercial Third Party Software will then be governed by the separate Commercial Third Party License.

The Publicly Available Software that may be included on this media, or in the Motorola Product, is listed below. The use ofthe listed Publicly Available Software is subject to the licenses, terms and conditions of the agreement in force between thepurchaser of the Motorola Product and Motorola Solutions, Inc., as well as the terms and conditions of the license of eachPublicly Available Software package. Copies of the licenses for the listed Publicly Available Software, as well as allattributions, acknowledgements, and software information details, are included below. Motorola is required to reproduce thesoftware licenses, acknowledgments and copyright notices as provided by the Authors and Owners, thus, all suchinformation is provided in its native language form, without modification or translation.

The Publicly Available Software in the list below is limited to the Publicly Available Software included by Motorola. ThePublicly Available Software included by Commercial Third Party Software or Products, that is used in the Motorola Product,are disclosed in the Commercial Third Party Licenses, or via the respective Commercial Third Party Publicly AvailableSoftware Legal Notices.

For instructions on how to obtain a copy of any source code being made publicly available by Motorola related to softwareused in this Motorola Product you may send your request in writing to:

Motorola Solutions, Inc.

Open Source Software Management1301 E. Algonquin RoadSchaumburg, IL 60196USA.

In your request, please include the Motorola Product Name and Version, along with the Publicly Available Software specifics,such as the Publicly Available Software Name and Version.

Note, the source code for the Publicly Available Software may be resident on the Motorola Product Installation Media, or onsupplemental Motorola Product Media. Please reference and review the entire Motorola Publicly Available Software LegalNotices and End User License Agreement for the details on location and methods of obtaining the source code.

Note, dependent on the license terms of the Publicly Available Software, source code may not be provided. Pleasereference and review the entire Motorola Publicly Available Software Legal Notices and End User License Agreement foridentifying which Publicly Available Software Packages will have source code provided.

To view additional information regarding licenses, acknowledgments and required copyright notices for Publicly AvailableSoftware used in this Motorola Product, please select Legal Notices display from the GUI (if applicable), or review the Legal

Notices and End User License Agreement File/README, on the Motorola Install Media, or resident in the Motorola Product.

MOTOROLA and the Stylized M logo are registered in the US Patent and Trademark Office. All other trademarks, logos, andservice marks ("Marks") are the property of the respective third party owners. You are not permitted to use the Marks withoutthe prior written consent of Motorola or such third party which may own the Marks.


3/51

PUBLICLY AVAILABLE SOFTWARE LIST

Name: Info-ZIP

Version: 2005-Feb-10 (2.32, 2.52)

Description: General compression library

Software Site: http://www.info-zip.org/

Source Code: The Source Packages for this software are available from the original Software Site, or may be acquiredfrom Motorola. To obtain the Software from Motorola, please contact Motorola using the methodsdescribed in the preamble of this Legal Notices and End User License Agreement Document.

License: This is version 2005-Feb-10 of the Info-ZIP copyright and license. The definitive version of thisdocument should be available at ftp://ftp.info-zip.org/pub/infozip/license.html indefinitely.

Copyright 1990-2005 Info-ZIP. All rights reserved.

For the purposes of this copyright and license, "Info-ZIP" is defined as the following set of individuals:

Mark Adler, John Bush, Karl Davis, Harald Denker, Jean-Michel Dubois, Jean-loup Gailly, Hunter Goatley, Ed Gordon,Ian Gorman, Chris Herborth, Dirk Haase, Greg Hartwig, Robert Heath, Jonathan Hudson, Paul Kienitz, David Kirschbaum,Johnny Lee, Onno van der Linden, Igor Mandrichenko, Steve P. Miller, Sergio Monesi, Keith Owens, George Petrov,Greg Roelofs, Kai Uwe Rommel, Steve Salisbury, Dave Smith, Steven M. Schweda, Christian Spieler, Cosmin Truta,

Antoine Verheijen, Paul von Behren, Rich Wales, Mike White

This software is provided "as is," without warranty of any kind, express or implied. In no event shall Info-ZIP or itscontributors be held liable for any direct, indirect, incidental, special or consequential damages arising out of the use of orinability to use this software.

Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter i t andredistribute it freely, subject to the following restrictions:

1. Redistributions of source code must retain the above copyright notice, definition, disclaimer, and this list of conditions.

2. Redistributions in binary form (compiled executables) must reproduce the above copyright notice, definition, disclaimer,and this list of conditions in documentation and/or other materials provided with the distribution. The sole exception to thiscondition is redistribution of a standard UnZipSFX binary (including SFXWiz) as part of a self-extracting archive; that ispermitted without inclusion of this license, as long as the normal SFX banner has not been removed from the binary ordisabled.

3. Altered versions--including, but not limited to, ports to new operating systems, existing ports with new graphical interfaces,and dynamic, shared, or static library versions--must be plainly marked as such and must not be misrepresented as beingthe original source. Such altered versions also must not be misrepresented as being Info-ZIP releases--including, but notlimited to, labeling of the altered versions with the names "Info-ZIP" (or any variation thereof, including, but not limited to,different capitalizations), "Pocket UnZip," "WiZ" or "MacZip" without the explicit permission of Info-ZIP. Such altered versionsare further prohibited from misrepresentative use of the Zip-Bugs or Info-ZIP e-mail addresses or of the Info-ZIP URL(s).

4. Info-ZIP retains the right to use the names "Info-ZIP," "Zip," "UnZip," "UnZipSFX," "WiZ," "Pocket UnZip," "Pocket Zip," and"MacZip" for its own source and binary releases.

Credits: N/A

Motorola Solutions, Inc.

1301 E. Algonquin Road,

Schaumburg, IL 60196 U.S.A.


4/51

Table of Contents

MODBUS .......................................................................................................................................................... 1RTU as PLC........... .......... ........... .......... ........... .......... ........... .......... ........... .......... ........... ........... .......... .......... 1

Local RTU as PLC Master......... ........... .......... ........... ........... .......... ........... ........... .......... ........... .......... .......... 2General System.............................................................................................................................................. 3MODBUS Drivers...... ........... ........... .......... ........... ........... .......... ........... ........... .......... ........... .......... .......... ..... 4MODBUS Data Types........ ........... .......... ........... .......... ........... .......... ........... .......... ........... .......... ........... ........ 4Floating Point Numbers ................................................................................................................................ 7RTU Definitions for MODBUS Support ..... ........... .......... ........... ........... .......... ........... .......... ........... ........... ... 9

Data Types ..................................................................................................................................................................9PLC Table ...................................................................................................................................................................9PLC TCP/IP Access Control Table ...........................................................................................................................12Port Configuration and Protocol Downloading .........................................................................................................14

Step-by-Step Definitions .............................................................................................................................. 17RTU as PLC (Connected to Master Computer) Serial MODBUS..........................................................................17

Local RTU as PLC Master Serial MODBUS .........................................................................................................17RTU as PLC (Connected to Master Computer) MODBUS over TCP/IP ................................................................18Local RTU as PLC Master ........................................................................................................................................19

RTU as Master Ladder Diagram Consideration............... .......... ........... ........... .......... ........... .......... ......... 20I/O Link for PLC Data Type Columns ......................................................................................................................21Static I/O Link for PLC Data Type Columns ............................................................................................................21Dynamic I/O Link for PLC Data Type Columns .......................................................................................................22Scan from Rungs .......................................................................................................................................................24

RTU as PLC (Slave) Mapping of SCADA Element to ACE3600 Database .......... ........... ........... ........... ... 25PLC Translation File .................................................................................................................................................26PLC Diagnostics........................................................................................................................................................29

RTU Supported MODBUS Protocol Exceptions (Negative Acknowledges) ............ ........... ........... ........... ... 31

ALLEN BRADLEY PLC-5PROTOCOL................................................................................................................. 32Local RTU as PLC Master......... ........... .......... ........... ........... .......... ........... ........... .......... ........... .......... ........ 33Allen Bradley PLC5 Settings .......... ........... ........... ........... .......... ........... ........... ........... ........... .......... .......... 33

Allen Bradley PLC 5/40 Settings ..............................................................................................................................34PLC Address for Allen Bradley Protocol ..................................................................................................................35Data Type Compatibility Between RTU and PLC5.................................................................................................35Accessing PLC-5 Controllers ....................................................................................................................................37RTU Definitions for Allen Bradley PLC5 Support .................................................................................................38Step-by-Step Definitions ...........................................................................................................................................41RTU as Master Ladder Diagram.............................................................................................................................41

ALLEN BRADLEY SLC500PROTOCOL .............................................................................................................46SLC 500 Drivers ..........................................................................................................................................46

Static I/O Link for PLC Data Type Columns............................................................................................... 46Dynamic I/O Link for PLC Data Type Columns ........... ........... ........... .......... ........... ........... ........... ........... ... 47Accessing SLC 500 Controllers .......... .......... ........... .......... ........... ........... .......... ........... ........... .......... .......... 47


5/51

MODBUS

The MODBUS protocol support is applicable to the following situations:

a) Master Configuration: Polling/modifying the database of existing PLC(s). The RTU is

defined as a master and the PLC as a slave. The RTU provides the ability to access the

database of a PLC from the application ladder.

b) Slave Configuration: Connecting an RTU as a slave to any SCADA master using the

MODBUS protocol. The SCADA central can control all RTUs, as well as all PLCs.

In addition, the RTU communication may be used as a wide area communication network

between a MODBUS-based central and its PLCs.

The RTU-to-MODBUS connection is described in this chapter according to the following

configurations:

1) RTU as PLC

2) Local RTU as PLC Master

3) General System Configuration

RTU as PLC

The RTU as PLC configuration allows the connection of a MODBUS-based central computer

to an MDLC Network, via serial line or TCP/IP media.

The port of this RTU is defined as (Connected to) Master Computer. The central computer canaccess the database of this RTU that reflects the databases of all RTUs in the field.

In the RTU as PLC, definition of the PLC Table is required.

1


6/51

MODBUS

MODBUS PORT

TO MASTER

SCADA CENTRAL

(MASTER)

RTUAS PLC

Serial or

TCP/IP

RTU

RTU

RTU

MDLC NETWORK

PLC Table

Ind via Port (Name)Connected toRTU (Name)

PLCAddress

0 1 LOCAL RTU AS PLC

PLC#=1

For a detailed description of the site configuration and application definitions, refer toRTUas

PLC(Connected toMasterComputer).

Up to six ACE3600 RTU ports can be defined as third party protocol ports (including serial

and/or TCP/IP MODBUS ports.)

MODBUS over TCP supports the use of MODBUS messaging in an Intranet or Internet

environment using the TCP/IP protocol, where the RTU acts a MODBUS/TCP server (pure

slave). Note that the MODBUS TCP/IP slave works in a listening to master manner (i.e. it

opens a listening socket and waits for the MODBUS master incoming requests to connect to

the slave) and does not initiate communication with the master.

Local RTU as PLC Master

This configuration allows polling/modifying the database of the PLC from an MDLC-based

network. The RTU is connected to the PLC via a port defined as Connected to Slave. It

controls the Slave PLC by means of the Ladder Diagram.

The Local RTU as PLC Master configuration is for a serial MODBUS as well as TCP/IP

connection.

2


7/51

MODBUS

MODBUS PORT

TO SLAVE

Serial or TCP/IP

MDLC NETWORK

RTU

RTU

RTU

AS PLC

MASTERPLC

PLC#=1

PLC Table

Ind via Port (Name)Connected to

RTU (Name)

PLC

Address

0 1 LOCAL PLC1

PLC1RTU

MODBUS

For a detailed description of the Site Configuration and Application definitions, refer to

Step-by-StepDefinitionsbelow.

General System

MDLC NETWORK

MODBUS

RTU 14

MODBUS

RTU 15

MODBUS PORT

TO MASTER

SCADA CENTRAL

(MASTER)

RTU

FOX1

RTU

LOCAL

RTU

MODBUS PORTTO SLAVE

PLC1

MODBUS PORT

TO SLAVE

PLC1

MODBUS PORT

TO SLAVE

PLC2

MODBUS

RTU 13

RTU

FOX5

3


8/51

MODBUS

MODBUS Drivers

Six drivers are supplied for MODBUS protocol support. They are:

Driver file name Description

MB.2M_PLC1 MODBUS to Master driver; Port in RTU slave defined asPLC 1

MB.2M_PLC2 MODBUS to Master driver; Port in RTU slave defined as

PLC 2

MB.2M_PLC3 MODBUS to Master driver; Port in RTU slave defined as

PLC 3

MB.2S_PLC1 ACE3600 RTU Master; Port in RTU defined as PLC 1.



Note: If the appropriate driver (.fls file) is not downloaded to the RTU, MODBUS protocol

support will not be available.

MODBUS Data Types

The RTU defined as a Master can access the following MODBUS RTU data types/commands:

MODBUS Data Type Command MODBUS

Function

Code

RTU Equivalent

Logic Coils Read 1 Discrete Output

Discrete Inputs Read 2 Discrete Input

Holding Registers Read 3 Calculated Internal

Value

Input Registers Read 4 Value Input

Logic Coils Write (single

coil)

5 Discrete Output

Holding Registers Write (single

register)

6 Calculated Internal

Value

Logic Coils Write 15 Discrete Output

Holding Registers Write 16 Calculated Internal

Value

4


9/51

MODBUS

The RTU defined as a MODBUS slave supports the following data types/commands from the

MODBUS protocol:

Data Type Command MODBUS Function Code

Logic Coils Read 1

Discrete Inputs Read 2

Holding Registers Read 3

Input Registers Read 4

Logic Coil Write (single coil) 5

Holding Register Write (single

register)

6

None Loopback test 8

Logic Coils Write 15

Holding Registers Write 16

Report Slave ID 17 dec.

By default, ACE3600 uses function code 15 (Multiple Logic Coil Write) and does not use

function code 5 (Single Coil Force command). This is true even when writing to a Single Coil.

By default, ACE3600 uses function code 16 (Write Multiple Registers) and does not use

function code 6 (Single Register Preset command). This is true even when writing to a Single

Register.

In order to enable the Single Coil Force or Single Register Preset command perform the

instruction below for each MODBUS port defined as a port connected to a Slave:

1. Run the ACE3600 STS.

2. In the site port configuration, click on Advanced Configuration.

3. Select Driver specific parameter #3. This parameter is actually a mask, or set of bits, eachof which can be set or unset, each with a different meaning. To enable the Single Coil

Force command (function code 5), set the mask to 0x0002 (or decimal value 2).

To enable the Single Register Preset command (function code 6), set the mask to 0x0004

(or decimal value 4).

If you want to enable BOTH commands, set the mask to 0x0006 (or decimal value 6).

Note: when trying to write to more than one Coil, function code 15 (Multiple Coils Write) isalways used, even if the mask 0x0002 is set on.

Note: when trying to write to more than one Register, function code 16 (Multiple register

Write) is always used, even if the mask 0x0004 is set on.

Function code 5 (Single Coil Force command) is used if writing exactly one bit and the

corresponding mask 0x0002 is set on in Driver specific parameter #3.

5


10/51

MODBUS

Function code 6 (Single Register Preset command) is used if writing exactly one register and

the corresponding mask 0x0004 is set on in Driver specific parameter #3.

A Report Slave ID command has been added to support the VXL SCADA central. This may be

useful if the SCADA Central has to identify a communication failure (cause and location).

For example, the two RTUs may be defined as MODBUS slaves in the PLC Table. If the

communication to the PLC fails, the SCADA Central may issue the Report Slave ID command

to each of the RTUs.

The RTUs response to this command for the MODBUS RTU protocol is:

ADDR FUNC BYTE

COUNT

RESERVED FLAGS CRC

XX 11 3 BYTE1 BYTE2 BYTE3 XX XX

where:

ADDR: PLC address

FUNC: 11 hexa

BYTE COUNT: 3 bytes of RTU status data follow this field

RESERVED FLAGS: 24 bits for the Reserved Flags Table (one of RTU system tables).

This field consists of the 3 bytes described in the following tables:

BYTE1

Bit Position in

Byte1

Index in Reserved

Flags Table

Flag Name

0

1

2

3

4

5

6

7

0

1

2

3

4

5

6

7

I/O_Fl

Init

PwrUp

AC_Fal

BatFal

PushB1

PushB2

6


11/51

MODBUS

BYTE2

Bit Position in

Byte2

Index in Reserved

Flags Table

Flag Name

0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

TskPrA

TskPrB

TskPrC

TskPrD

BYTE3

Bit Position inByte3

Index in ReservedFlags Table

Flag Name

0

1

2

3

4

5

6

7

16

17

18

19

20

21

22

23

ErrLog

TimTag

DefC_Y

CntCom

IsEvnt

Note: Position 7 of a byte is the most significant bit, and position 0 the least significant bit.

CRC: 2 bytes of CRC.

Floating Point Numbers

To access floating MODBUS registers from ACE3600 ladder applications, columns of data

type PLC_RI and PLC_RO data types (seeDataTypesbelow) should be defined in theapplication database. The I/O link is the same as for general MODBUS registers or coils,

except for the data type, which should be set to PLCRel.

SCADA Central (Master) can access any floating point data type element in ACE3600 (REAL,

RPRM, PLC_RI, PLC_RO).

The maximum number of floating point numbers per one transaction is limited by the

MODBUS protocol (255 bytes) and is approximately 60.

7


12/51

MODBUS

MODBUS protocol does not define floating point data type (4 bytes). To allow floating point

data type transfer, each floating point element is represented by 2 integers (2 bytes each).

To enable correct floating point number transfer between the ACE3600 master and the

MODBUS slave, or between the MODBUS master and the ACE3600 slave, one should define

the format of how the floating point number is transmitted (for each MODBUS port):

1. Run the ACE3600 STS.

2. In the site port configuration, click on Advanced Configuration.

3. Select Driver specific parameter #3. This parameter is actually a mask, or set of bits, eachof which can be set or unset, each with a different meaning.

4. To designate that the low order integer register is sent first, followed by the high order

register, set the mask to 0x0001 (or decimal value 1). To designate that the high order

integer register is sent first, followed by the low order register, unset the mask bit 0x0001

(or decimal value 0). In most cases, the mask 0x0001 should be set on, though the format

depends on the vendor.

Recall that other bits in the parameter #3 mask enable/disable other functions. Therefore,

care should be taken when changing the value of the bits.

8


13/51

MODBUS

RTU Definit ions for MODBUS Support

Data Types

The following data types may be used when the RTU serves as a master:

PLC_VI PLC Value Input. This data type is used to read integer elements from a thirdparty RTU. Each element in a PLC_VI column is a 2-byte signed integer (value). The

column length must be defined as the number of the registers that are to be read.

PLC_VO PLC Value Output. This data type is used to write into the Holding Registers ina third party RTU.

PLC_DI PLC Discrete Input. This data type is used to read 1-bit elements from a third

party RTU, such as discrete inputs.

PLC_DO PLC Discrete Output. This data type is used to write 1-bit elements into a third

party RTU, such as logic coils.

PLC_RIPLC Real Input. .This data type is used to read real (floating point) elementsfrom a third party RTU. Each element in PLC_RI is a 4-byte real (floating point) number.

PLC_ROPLC Real Output. This data type is used to write real (floating point) elements

to a third party RTU. Each element in PLC_RO is a 4-byte real (floating point) number.

PLC Table

The PLC Table, one of the System Tables, is used to define the connectivity to the third party

PLC units in the system. This table must be defined for:

The RTU, which is connected to the Master Computer.

Any RTU, which serves as a PLC master for a PLC connected to one of its ports orconnected to one of the other RTUs in the network.

9


14/51

MODBUS

This table has five columns as detailed below:

PLC Address the address of the PLC RTUs (1255).

Connected to RTU (name) the name of the RTU to which the PLC is connected. Click thearrow to open the list. If the RTU is locally connected to one of the ports of the unit where

the PLC Table is to be defined, chooseLOCALfrom the choice list.

via Port (name) the name of the port for connection. Click the arrow to open the list.Choose the same name that was used when the port was defined.

Slave Addr The IP address of the TCP/IP slave/PLC (type IPAddrPrm). This column isvalid only when the 'Connected to RTU' field is set to Local and the via Port field is set

to PLC1/2/3 (not RTU as PLC.) Otherwise, N/A is displayed.

Comm Status (Slave) the status of the slave/PLC (0 = Inactive, 1 = Active) (type int)Note: If Comm Status = 1 and the PLCStt variable returns an error, this indicates a problem

with the user application. The status is displayed during the table monitor. The status isN/A when the communication is not MODBUS master over TCP/IP. For details on the

possible PLCStt returned errors, see the list from the PLC Status Defines table in Scan

from Rungsabove.

If the PLC is connected directly via a UART port to the RTU master, then define the

Connected to RTUfield asLOCALand the via Portfield as PLC 1, 2 or 3.

10


15/51

MODBUS

If the PLC is connected to a remote unit which acts as a router, then define the Connected to

RTUfield as the RTU router Site Name. Assign the name that was used in the Site Table.

If the remote is an RTU which acts as PLC slave, then define the Connected to RTUfield as the

RTUs remote Site Name and the via Portfield asRTU AS PLC.

11


16/51

MODBUS

PLC TCP/IP Access Cont rol Table

The PLC TCP/IP Access Control Table, one of the System Tables, is used to define the IP

connections to authorized PLC Masters. This table may be defined for the RTU, which is

connected to the Master Computer. This is relevant for MODBUS over IP only.

Additional/existing connections can be added/modified dynamically when a PLC MasterComputer port is configured as a DHCP client and receives its IP address dynamically from the

DHCP server.

This table has five columns as detailed below. Only entries with both a valid IP address and a

valid PLC port name are considered valid. All others are ignored.

AthrIPaddrs the authorized IP addresses of up to 16 masters. If all addresses are 0.0.0.0,the connection is open to all IP addresses.

PLCportName the name of the port (PLC1, PLC2, PLC3) on the master for connection tothe slave at the authorized IP address. Click the arrow to open the list. Choose the same

name that was used when the port was defined.

Note: If the PLCportName is undefined, the corresponding IP address is ignored.

#TotalConnection the total number of IP connections of the slave with the master,including active, disconnected and unstable connections. (read-only during monitor)

12


17/51

MODBUS

#ActiveConnection the number of active IP connections of the slave with the masterwhich are connected to the master and have not timed out. (read-only during monitor)

#UnstableConnection the number of IP connections of the slave with the master whichare unstable (erratic). (read-only during monitor)

Duplicate IP addresses may appear in the PLC TCP/IP Access Control Table. If a duplicaterow is deleted, the other rows remain.

Note: If the master port is defined as Ethernet Dynamic LAN, the IP address which is returned

by the DHCP server may generate unauthorized IP address error messages. In this case, this

IP address can be added to the PLC TCP/IP Access Control table via the Application

Programmer table monitor, ladder rungs or C application.

13


18/51

MODBUS

Port Configuration and Protocol Downloading

The configuration of an RTU port as a third party protocol port requires two levels of

configuration:

Physical port configuration

Third party protocol downloading

Port Configuration

The PI1, SI1, SI2, PI2 serial/plug-in CPU ports may be defined as a serial Third Party Protocol

PLC port. Ports SI1 and SI2 may also be defined as MODBUS ports over TCP/IP (PPP). Ports

PI1 and PI2 may also be defined as MODBUS ports over TCP/IP (Ethernet). Port ETH1 may

only be defined as an IP MODBUS port over TCP/IP (Ethernet).

Port Configuration - Serial MODBUS

Connected to Master or to Slave.

Link Name the name of the port: PLC 1, PLC 2, or PLC 3.

Data Speed This field defines the communication data speed of the selected ConnectionType. The default is 9600 bps.

(Advanced Configuration->) Format This field defines the UART's character format for

the communication port. The default is 8 bit, no parity, 1 stop bit. Click the arrow to open alist that includes all combinations of 7/8 bits, even/odd/no parity, and 1/2 stop bits.

(Advanced Configuration->)DTR/CTS Support This field defines the DTR/CTS Support.

Set this option to Yes ONLY if DTR/CTS support is provided by the computer

connected to the ACE3600 RTU.

Port Conf iguration for MODBUS over TCP/IPFor MODBUS over TCP/IP, configure the port as depicted in the figures below.

Protocols Select MODBUS Slave or MODBUS Master.

Port Name Set to PLC1-3. The Port Name must be set to PLC1-3 if Protocols is set to

MODBUS slave/master.

14


19/51

MODBUS

Port Configuration RS232 over PPP

Port Configuration - Ethernet 10/100 Base-T - Static LAN

Port Configuration - Ethernet 10/100 Base-T - Dynamic LAN

Host Full Name (DHCP Client only) The full name of the port as provided by the DNS

Server. The DHCP Server will update the DNS Server when allocating or changing the IP

address of that host, keeping it up to date with the recent address of port. If a DHCP

Server/router does not support this option, a warning will be logged. For more information

on DHCP/DNS, see the ACE3600 STS Advanced Features manual.

Note: The MODBUS master should know in advance either the MODBUS slave IP addressor its Host Full Name, so that it can connect to a known IP address/Host Full Name of the

MODBUS slave. In the case of MODBUS over GPRS (PPP port), the GPRS modem

should have a fixed (predefined) IP address and the master should use this IP address to

connect to the slave.

(Advanced Configuration->)Master communication interval the maximum time in

seconds during which a request is expected to be received from the Master. If no

communication occurs, the connection is considered unstable. Range 0-86400. Default 0.

(Advanced Configuration->)Check alive mode the Check alive mode can be set to Active

or Passive:

Active TCP is controlled by the TCP stack of the VxWorks operating system. The

MODBUS slave is polled by the masters connection using the TCP sockets Check alive

option. If the idle time on the connection exceeds 60 seconds, a Check alive probe is

triggered. After the first Check alive probe, a probe is sent every 75 seconds (up to four

times), unless a probe response is received. If no probe response is received after sending

out four Check alive probes, the TCP connection is dropped.

Passive(Default) TCP is controlled by the application. In this case, the Check alive

timeout parameter must be set. The application checks whether the server received any

15


20/51

MODBUS

communication until the Check alive timer expires. If the Check alive timeout parameter is

set to 0, the check alive mechanism will not be used.

(Advanced Configuration->)Check alive timeout the timeout in seconds from the lastcommunication received from a master. If this parameter is 0, a master will always be

considered as reachable, once a single reception has been received from it. Otherwise the

slave RTU disconnects from the master. Range 0-65535. Default 35. (Relevant only ifCheck Alive mode is set to Passive.)

(Advanced Configuration->)TCP listen port The TCP port used by the Slave forMODBUS communications. Default 502. This default value is standard in TCP.

Therefore, it is highly recommended to leave the default as is.

(Advanced Configuration->Remote TCP port The TCP port used by the Slave forMODBUS communications. Default 502. This default value is standard in TCP.

Therefore, it is highly recommended to leave the default as is.

(Advanced Configuration->)Connection create timeout The number of milliseconds theMaster will wait after trying to create a connection with the slave. Range 0-65535. Default

500.

(Advanced Configuration->)Maximum number of connections The number of entries in

the internal connections table. If a new connection is requested when the table is full, the

oldest existing connection will be closed and the corresponding entry deleted from the

table to make room for the new connection. Range 0-65535. Default 500.

Third Party Protocol Downloading

After the configuration of the RTU physical port, according to the type of connection (to

Master Computer or PLC), STS provides you with the Downloader utility.

Note: The protocol should be loaded only to the RTUs whose ports have been defined asConnected to Master or Connected to Slave (PLC).

Before downloading the Third Party Protocol file, verify that the required files have been

added to the STS site Add-Ons. To do so, click on the General tab in the site view and add the

required Third Party Protocol (MODBUS) files from the "config" directory under the STS

installation path (e.g. C:\STS1150\Config.)

The Downloader supports downloading to RTUs either locally or remotely via the network.

For instructions on how to operate Downloader, see the ACE3600 STS User Guide.

16


21/51

MODBUS

Step-by-Step Definitions

RTU as PLC (Connected to Master Computer) Serial MODBUS

Site Configuration

1. Define one of the ports as RS232, Async, Third party protocols, (Connected to) Master.

2. Define the Link Name: PLC 1, PLC 2, or PLC 3.

3. Select the appropriate Data Speed.

4. Click on the Advanced Configuration button, and select (if supported by the Master) theDTR/CTS Support parameter to Yes.

5. In the Advanced Properties, set the Format parameter to the appropriate format. (Thedefault is 8 bit, no parity, 1 stop bit.)

6. Save the Advanced Configuration and the port configuration in the site.


1. In the ACE3600 STS Downloader utility, make sure that the ACE3600 STS is connected tothe proper site ID/link ID.

2. Select the site configuration to be downloaded to the RTU.

3. Select the appropriate protocol file as described inThird Party Protocol Downloading

above.

4. Download the selected files to the RTU.

Application Programmer System Tables

1. In the Application Programmer Database tab, open the PLC Table under System Tables

and set the values as follows:

PLC address as required

Connected to RTU (Name) LOCAL

Via Port (Name) RTU AS PLC

2. Define the database tables and process.

Local RTU as PLC Master Serial MODBUS

Site Configuration

1. Define one of the ports as RS232, Async, Third party protocols, (Connected to) Slave.



17


22/51

MODBUS

4. Click on the Advanced Configuration button, and select (if supported by the Slave) theDTR/CTS Support parameter to Yes.





3. Select the appropriate protocol file as described in Third Party Protocol Downloadingabove.


System Tables

1. In the Application Programmer Database tab, open the PLC Table under System Tablesand set the values as follows:

PLC address: 1

Connected to RTU (Name): LOCAL

via Port (Name): PLC1

RTU as PLC (Connected to Master Computer) MODBUS over TCP/IP

Site Configuration

1. Define one of the ports as one of the following:

Description Port Configuration Settings Additional Configuration

RS232 PPP port - connected

to a packet data (PPP)

modem via RS232.

RS232 -> Async -> PPP ->

[Null modem | Standard

modem | TETRA | iDEN]

User must specify Link ID

and baud rate of modem.

Ethernet 10/100 Base-T port

configured for static LAN -

connected to LAN with a

static IP address.

10/100 BasetT -> Static LAN

-> Ethernet LAN

10 BasetT -> Static LAN ->

Ethernet LAN

User must specify Self IP

address, subnet mask, and

default router. User must

specify Link ID of port.


configured for dynamicLAN - connected to LAN

having a DHCP server

which allocates IP address.

10/100 BasetT -> DHCP

Client-> Ethernet ->LAN

10 BasetT -> DHCP Client->

Ethernet ->LAN

User must specify Link ID.

A host name of port isoptional but recommended.

2. Click on the Protocols button and select the Modbus Slave Protocol.

3. Define the Port Name: PLC 1, PLC 2, or PLC 3.

18


23/51

MODBUS

4. Click on the Advanced Configuration button, and set the standard MODBUS advancedparameters (described in Appendix A: Site Configuration Parameters in the ACE3600 STS

User Guide) and the special MODBUS TCP/IP parameters described in Port Configuration

for MODBUS over TCP/IPabove, as necessary.

Note: In general, no changes to the default values of the advanced parameters are required.










PLC address as required

Connected to RTU (Name) LOCAL

Via Port (Name) RTU AS PLC

2. In the Application Programmer Database tab, open the PLC IP Access Control Table andcreate an entry for each authorized master and the corresponding PLC port on the slave to

which master will connect.

3. Define the database tables and process.

Local RTU as PLC Master - MODBUS over TCP/IP

Site Configuration

1. Define one of the ports as one of the following:

Description Port Configuration Settings Additional Configuration

RS232 PPP port - connected

to a packet data (PPP)

modem via RS232.

RS232 -> Async -> PPP ->

[Null modem | Standard

modem | TETRA | iDEN]

User must specify Link ID

and baud rate of modem.


configured for static LAN -

connected to LAN with a

static IP address.

10/100 BasetT -> Static LAN

-> Ethernet LAN

10 BasetT -> Static LAN ->

Ethernet LAN

User must specify Self IP

address, subnet mask, and

default router. User must

specify Link ID of port.


configured for dynamic

10/100 BasetT -> DHCP

Client-> Ethernet ->LAN

User must specify Link ID.

A host name of port is

19


24/51

MODBUS

LAN - connected to LAN

having a DHCP server

which allocates IP address.

10 BasetT -> DHCP Client->

Ethernet ->LAN

optional but recommended.

2. Click on the Protocols button and select the Modbus Master Protocol.

3. Define the Port Name: PLC 1, PLC 2, or PLC 3.








System Tables



PLC address: 1


via Port (Name): PLC1

IP address: to IP address of slave

RTU as Master Ladder Diagram Consideration

The read/write of data from/to MODBUS PLC is done by SCAN operation in rungs. The

SCAN itself is performed on one of the new data type columns: PLC_VI, PLC_VO, PLC_DI,

or PLC_DO.

For each of the above columns, I/O Link should be performed.

When the SCAN operation is performed on one of the above columns, the system accesses the

destination MODBUS PLC by selecting one of the supported commands, according to the data

type of the column and the I/O link.

Note that if the column is of input type, read operation is performed from the PLC, and if the

column is of output type, write operation is performed to the PLC.

20


25/51

MODBUS

I/O Link for PLC Data Type Columns

I/O Link for PLC Data Type Column is a procedure of describing the slave database that we

want to access.

There are two options for performing I/O Link for each PLC Data Type Column:

Static I/O Link each column is bound to the slave database with the formal I/O Link(as for I/O)

Dynamic I/O Link each column is bound to the slave database by the ladder at

runtime, by programming the PLC Dynamic IOLINKsystem table before the SCAN

operation.

The ACE3600 RTU selects the method according the value of PlcElmNumin the PLC

Dynamic IOLINKsystem table. During the SCAN of the PLC column type, the ACE3600

RTU examines the value of PlcElmNum. If it is equal to 0, static I/O is selected. If it is not

equal to zero, the I/O Link parameters are expected to be programmed in the PLC Dynamic

IOLINKsystem table.

If PlcElmNum == 0, use Static I/O Link.

If PlcElmNum 0, use Dynamic I/O Link.

Static I/O Link for PLC Data Type Columns

Before performing the I/O Link, complete the definition of the PLC Table, otherwise you will

not be able to proceed to the I/O Link for PLC data type columns.

In I/O Link, for each PLC data type column you must define the following:

1) PLC Address the address of destination MODBUS PLC.

2) PLC Data Type the data type of destination PLC. For MODBUS PLC, only four data

types are relevant:

a) Logic Coils

b) Discrete Inputs

c) Holding Register

d) Input Registers

3) Coord1 the offset of the element corresponding to the first element of the column, from

the first element of the MODBUS PLC data type.

The elements at MODBUS PLC are referred (numbered) from zero;

(input 10001=zero=10001-10001,

input 10002=one=10002-10001,

input 10003=two=10003-10001,

etc., for 584 PLC).

21


26/51

MODBUS

If the first element of the column corresponds to input 10003, the PLC Coord1 must be set

to 2.

4) Coord1 Len should be set to 2. The length of Coord1 is 2 bytes.

Note: Do not change the last three lines for coordinates. They are reserved for protocols with

more than one coordinate.

Dynamic I/O Link for PLC Data Type Columns

The ACE3600 RTU allows dynamic I/O Link per each PLC data type column.

The advantage of this method is that one can define multiple I/O Links at runtime for the same

PLC type column (not at the same time). Instead of defining the static I/O Link for a PLC

column, it is possible to program the PLC Dynamic IOLINKsystem table (#232).

The contents of the PLC Dynamic IOLINKtable serves as an input for PLC column SCAN

operation and therefore programming this table should be done before the PLC column SCAN.

The programming of the PLC Dynamic IOLINKtable is as follows:

PlcElmNumshould be set to zero if Static I/O Link is used, otherwise it is generally setto the number of elements (rows in column) in the corresponding PLC_DI, PLC_DO,

PLC_VI, PLC_VO, PLC_RI, PLC_ROdata type column being accessed by the SCAN

operation. Note: PlcElmNum should be less than or equal to the number of elements (rows

in column) in the corresponding column accessed by SCAN.

PLcDstAddr Destination PLC address

PlcDataType 1 for PLC_RI ,PLC_RO(real floating point) column

2 for Logic Coils and Holding Registers

3 for Discrete Inputs and Input Registers

Special constants have been defined in the PLC Dynamic IOLINK Constants table for setting

the PlcDataType field: These include:

PLCBit

PLCVal

PLCRel

fc1_Read_Logic_Coil

fc2_Read_Discrete_Input

fc3_Read_Holding_Register

fc4_Read_Input_Register

fc3_Read_PLCRel

fc5_fc15_Write_Logic_Coil

fc6_fc16_Write_Holding_Register

22


27/51

MODBUS

fc16_Write_PLCRel

PlcCoordNum Number of coordinates should be set to 1

PlcCoord1Len Should be set to 2. The length of Coord1 is 2 bytes

PlcCoord1 Should be set the same as described for "Coord1" in the Static I/O Linksection above.

Other fields of the PLC Dynamic IOLINKtable are irrelevant for MODBUS protocol and

should be ignored.

23


28/51

MODBUS

Scan from Rungs

Before performing a SCAN on a PLC column, check the PLCStt status for communication

busy.

=PLCStt

PLCBsy

column( SCAN )

PLCStt is an integer status system variable. The purpose of this variable is to give an indication

of the communication with PLCs. The values for this variable are defined in the PLC Status

Defines table (one of the Constants Tables).

Note that if PLCStt=PLCBsy, the new SCAN will not be performed.

If the communication is successfully terminated, the PLCStt variable changes to PLCRdy.

(Ready for a new SCAN after having successfully finished the previous SCAN).

24


29/51

MODBUS

If the communication is not successfully terminated, the PLCStt variable is changed to one of

following values:

NO_Buf No buffers to perform the communication

PLCFal Failed to perform the communication

PLCIol I/O Link ErrorPLCAdr The address does not appear in PLC Table

PLCTim No response from the PLC slave

PLCRpl Reply error from PLC slave

During the communication, the PLCStt variable is equal to PLCBsy.

RTU as PLC (Slave) Mapping of SCADA Element toACE3600 Database

The ACE3600 RTU defined as a MODBUS slave supports the following data types:

Logic Coils

Discrete Inputs

Holding Registers

Input Registers

Real (floating point) Registers

The ACE3600 versatile database enables mapping of various data types to any MODBUS

register/bit address (0-65355). However, some SCADA Centrals address the data types

according to a predefined register mapping scheme such as:

Logic coils (bit output) range: 00001-10000

Discrete Input status (bit input) range: 10001-30000

Input registers range: 30001-40000

Holding (output) registers range: 40001-49999

The ACE3600 user database is accessible (for MODBUS read/write operation) from theSCADA using the MODBUS protocol.

ACE3600 data is mapped into the MODBUS database by using the following default formula,

where Z (=0-31) is the table number, X (=0-7) is the column number, and Y (=0-249) is the

row number:

MODBUS register/bit address = offset + Z*2048 +X*256+Y.

The offset may vary according for different SCADA software. See Offset Note below.

25


30/51

MODBUS

By default, the table number (Z) may vary from 0 to 31. If a higher numbered user table must

be accessed, then do the following:

1) In the ACE3600 STS site configuration, modify the Advanced Physical Register map

parameter for the PLC port configuration to the table=64 column=8 row=128 value.

2) Use the following formula where the user table number (Z) may vary from 0-63,X (=0-7) is the column number, and Y (=0-127) is the row number.

MODBUS register /bit address = offset + Z*1024 +X*128+Y.

Again, the offset may vary for different SCADA software. See Offset Note below.

Offset Note: There are some SCADA systems for which addressing does not depend on the

data type; there is no specific absolute range reference per data type. For such a SCADA, the

offset in the equation should be set to 0. For other SCADA software, the offset = 00001,

10001, 30001, and 40001 for logic coil, input status, input register, and holding register data

type respectively.

In addition, a PLC Translation file add-on to the STS enables access to all data available in

ACE3600 database user tables. For information on preparing such a file, see PLC Translation

Filebelow.

PLC Translation File

The register mapping scheme described above is limiting and does not enable access to all data

in the RTU database user tables. An additional mapping on top of the basic register mapping

scheme can be defined, based on PLC addresses, or MODBUS function codes, or both.

The PLC Translation file is a text file, created by the user, which defines the additional

mapping. When the file is configured and downloaded to the ACE3600 RTU, the additional

mapping becomes active.

The following example describes a system for which the PLC Translation File add-on is

applicable.

Four totally identical RTUs are accessed by an ACE36000 concentrator. The

database for the first RTU is mirrored (reflected) in the ACE3600 by tables

(0-31), the second RTU by tables (32-63), the third RTU by tables (64-95) and

the fourth RTU by tables (96-127). The four groups of tables are totally identical

and reflect the database of the corresponding RTU.

The MODBUS SCADA accesses the RTU by accessing the corresponding tableand element in the ACE3600 table.

In addition, on the SCADA, the application engineer would like to define four

copies of each element (tag) (per RTU) having the same MODBUS register/bit

number. Each tag will appear four times (having the same register/bit number),

but with four different MODBUS PLC addresses (1, 2, 3, 4).

A number of problems arise in building such a system:

26


31/51

MODBUS

1.The MODBUS to ACE3600 database mapping is limited by the range of tables that can beaccessed, because only the first 32 (0


32/51

MODBUS

STATI ON_TABLE( Z) _OFST_BY_ADDR_1 =0STATI ON_TABLE( Z) _OFST_BY_ADDR_2 =32STATI ON_TABLE( Z) _OFST_BY_ADDR_3 =64STATI ON_TABLE( Z) _OFST_BY_ADDR_4 =96

The four keywords above define additional offsets, each of which depends on the PLC address.The offsets 0, 32, 64, 96 correspond to PLC addresses 1, 2, 3, 4.

Each time a MODBUS packet is received via the port named PLC2, the MODBUS driver first

calculates the (z, x, y) coordinates of the element being accessed (using the register mapping

scheme for the MODBUS register /bit address formula above.) Based on the destination PLC

address (1, 2, 3, 4), the coordinates of the element are then changed to (z+offset,x,y). The table

number is shifted forward by the offset (namely 0 when accessing PLC address 1, 32 when

accessing PLC address 2, 64 when accessing PLC address 3, and 96 when accessing PLC

address 4). In other words, the tables for PLC address 1 start from Z=0, the tables for PLC

address 2 start from Z=32, the tables for PLC address 3 start from Z=64, and the tables for PLC

address 4 start from Z=96.

This increases the range of tables that can be accessed.

Notes: 1. PLC addresses 1, 2, 3, 4 should all be configured in PLC Table as legal PLC

addresses, otherwise the ACE3600 will not respond to accesses to PLC addresses 1, 2, 3, 4. See

the PLC Tabledescription.

2: Any of the optional STATION_TABLE (Z)_OFST_BY_ADDR_* keywords is

legal (0 < * < 255 and represents a legal MODBUS PLC address.)

Z=31

Z=1

Z=0

Z=95Z=65

Z=64

Z=127Z=97

Z=96

Z=63Z=33

Z=32

9640

6430

3220

010

Table

Offset

PLC

addr

96

64

32

0

PLC

AddrTable

Offset

4

3

2

1

TABLE( Z) _OFST_BY_FUNCTI ON_CODE_1 =0

TABLE( Z) _OFST_BY_FUNCTI ON_CODE_2 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_3 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_4 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_5 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_6 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_15=0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_16=0

28


33/51

MODBUS

The above keywords define an additional offset based on the MODBUS function code on the

PLC2 port. In the example file, all offsets are zero, so the final table number (Z) is not

impacted by the keywords. If, however, theTABLE( Z) _OFST_BY_FUNCTI ON_CODE_1keyword was set to 5, any access done with MODBUS function code 1 via port PLC2 would

increase the table number (Z) or shift Z forward by five tables.

Notes: 1. Any of the optionalTABLE( Z) _OFST_BY_FUNCTI ON_CODE_* keywords islegal (*= one of MODBUS function codes 1, 2, 3, 4, 5, 6, 15, 16.)

2: If both types of keywordsTABLE( Z) _OFST_BY_FUNCTI ON_CODE_* andSTATI ON_TABLE( Z) _OFST_BY_ADDR_* are defined the table number is advanced(shifted) forward by the sum of the two offsets.

The [ MODBUS_CONNECTED_TO_MASTER_COMPUTER_PORT_NAME_PLC3] sectionrepresents instructions which are relevant for an access done via PLC port PLC3. In this

example, no instructions are defined in this section.

PLC Diagnostics

The PLC Translation File which is downloaded to the ACE3600 can be viewed using the STS

SW Diagnostics utility (DEVICE= PLC1L for port name PLC1, PLC2L for port name PLC2,

PLC3L for port name PLC3, LEVEL=0.) See the example below. For more on the SW

Diagnostics utility, see the ACE3600 STS User Guide. For a description of the diagnostics, see

the TOSCADA (PLC1L, PLC2L, PLC3L) section of the ACE3600 Software Diagnostic

Output and Error Messages Manual.

29


34/51

MODBUS

Sun Nov 12 17: 55: 41 2006 Local DEVI CE: PLC2L LEVEL: 0

Por t name : PLC2Connect i on t o : Mast er Comput erAppl . code ar ea : 67b44a0HAppl . code l en : 11137Appl RAM area : 688a0f 4H

Appl . RAM l en : 20000# of di ag er r or s : 0Local pl c r epl y t i meout : 7000Remot e r epl y t i meout : 30000Mode of t r ansl at i on : 0No r esponse t i meout : 1000#of i dl es t i meout : 4Load modul e ver s : 1Load modul e r ev : 0Load modul e name : MODBUS DRI VER CONNECTED TO MASTER COMPUTERLoad modul e di ag : MODBUS SOFTWARE MODULE CONNECTED TO MASTER

STATI ON OFFSET TRANSLATI ON TABLE

PLCAddr TABLE( Z) _OFST2 323 644 96

FUNCTI ON CODE TRANSLATI ON TABLE

FUNCTI ON_CODE TABLE( Z)_OFSTDOWNLOADED TRANSLATI ON FI LE

[ MODBUS_CONNECTED_TO_MASTER_COMPUTER_PORT_ NAME_PLC1][ MODBUS_CONNECTED_TO_MASTER_COMPUTER_PORT_ NAME_PLC2]STATI ON_TABLE( Z)_OFST_BY_ADDR_1 =0STATI ON_TABLE( Z)_OFST_BY_ADDR_2 =32STATI ON_TABLE( Z)_OFST_BY_ADDR_3 =64STATI ON_TABLE( Z)_OFST_BY_ADDR_4 =96

TABLE( Z) _OFST_BY_FUNCTI ON_CODE_1 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_2 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_3 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_4 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_5 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_6 =0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_15=0TABLE( Z) _OFST_BY_FUNCTI ON_CODE_16=0[ MODBUS_CONNECTED_TO_MASTER_COMPUTER_PORT_ NAME_PLC3]

30


35/51

MODBUS

31

RTU Supported MODBUS Protocol Exceptions (NegativeAcknowledges)

In case of a failure, the RTU supported MODBUS protocol sends to the master the following

exceptions (negative acknowledges):

Exception Number Sent when

4 (Device FAIL) An internal buffer overflow occurs in RTU.

The database doesnt exist.

An internal buffer communication error occurs in RTU.

The number of elements is zero.

The master tries to access an integer data-type by

interrogating a bit data-type or vice versa.

An internal failure occurs in RTU.1 (Illegal function) The function code is not supported.

6 (BUSY) The access to the RTU database is temporarily shut off

by the system. Try polling again!

2 (Illegal Address) The master tries to access an element which is not

defined in the RTU database, or is out of range. This

error usually occurs when the accessed column is not

defined in the RTU database, or the column is defined,

but the first or the last accessed element is out of range.

(First or last Y of the accessed element is greater than the

number of rows.)


36/51

Allen Bradley PLC-5 Protocol

The PLC5 protocol support allows the connection of an Allen Bradley PLC5 controller to an

existing ACE3600 RTU system.

Some of PLC-5 controllers may be directly connected to a RTU, for example, the PLC-5/40

controller.

The RTU can also access PLC-5 controllers that are connected via the Allen Bradley Data

Highway/Data Highway Plus network.

Allen Bradley

Data Highway/

Data Highway PlusPLC/5

PLC/5

PLC/5

PLC/5

MDLC NETWORK

RTU

RTU

AS PLC

MASTER

1770-KF2

Interface

Module

RTU

RTU

In this case, the connection of the RTU to one of the PLC-5 controllers (e.g. the PLC-5/15),

must be via the 1770-KF2 RS-232 Interface module.

Note: To simplify the explanations in this chapter, the PLC-5 controller is illustrated, as if it is

directly connected to the RTU. Keep in mind that any PLC-5 controller on Data Highway/Data

Highway Plus is connected to RTU via the 1770-KF2 Interface module.

The PLC5 protocol support is the solution for polling/modifying the database of existing

PLC(s). In this case, the RTU is defined as a masterand the accessed PLC as a slave. The

RTU provides the ability to access the database of a PLC from the application ladder.

Three drivers are supplied for PLC-5 protocol support. They are:

32


37/51

1BAllen Bradley PLC-5 Protoco l

AB.2S_PLC1 Driver for RTU that is PLC master to Allen

Bradley PLC-5, whose Port is defined as PLC 1.

AB.2S_PLC2 Driver for RTU that is PLC master to Allen

Bradley PLC-5, whose Port is defined as PLC 2.

AB.2S_PLC3 Driver for RTU that is PLC master to AllenBradley PLC-5, whose Port is defined as PLC 3.

The RTU-to-PLC-5 connection is described in this section according to the following

configuration:

a) Local RTU as PLC master


This configuration allows polling/modifying the database of the PLC from an MDLC-basednetwork. The RTU is connected to the PLC via a port defined as Connected to Slave. It

controls the PLC by means of the Ladder Diagram.

All enBrad ley PORTTO SLAVE

Allen Bradley

MDLC NETWORK

RTU

RTURTU

AS PLC

MASTER

PLC

PLC#=1

PLC Table

Ind via Port (Name)Connected to

RTU (Name)

PLC

Address

0 1 LOCAL PLC1

PLC1

RTU

Allen Bradley PLC5 Sett ings

To establish the connection between an RTU and an Allen Bradley PLC5 controller that is

directly connected to the RTU, you must configure the channel 0 port as follows:

a) In the Channel Overview screen, set channel 0 to SYSTEM (SLAVE).

b) In the Channel Config screen, set the Error Detect parameter to CRC.

c) Set the data speed, stop bits, and parity parameters similar to the RTU master parameters.

33


38/51


d) Set the station address of PLC5 (it must be in the range of 1 to 254).

Note: These parameters may be set either on-line or off-line.

After setting the channel port, you may connect it to the RTU master PLC port.

If you are using the 1770-KF2 Interface module or another interface module, set the following:

a) Communication=Half-duplex.

b) Set the Error Detect parameter to CRC.

c) Set the data speed, stop bits, and parity parameters similar to the RTU master parameters.

Al len Bradley PLC 5/40 Settings

If you are using the 1770-KF2 Interface module, set the following switches:

SW-8 SW-1 SW-2 SW-3 SW-4 SW-5 SW-6 SW-7

OFF ON ON ON OFF ON ON OFF OFF ON ON OFF OFF OFF OFF ON ON OFF ON ON ON ON OFF

1 2 1 2 3 4 5 1 2 1 2 3 1 2 3 1 2 1 2 3 4 1 2

The switch functions are listed below:

Switch Number Function

SW-8 RS-232

SW-1 Half-duplex, CRC, No Parity, Non-Embedded Responses,Accept All Messages, Use Handshaking

SW-2, SW-3, SW-4 Address 60 Octal, 48 Decimal

SW-5 DH+ at 57600 bps

SW-6 9600 bps

SW-7 DH+

RTU to PLC-5/40 Communication Using Port 2

The pin assignment of the cable to be used for RTU to PLC5/40 communication (using Port 2)

is given below.

34


39/51


TXD

RXD

GND

2

1

4

2

3

7

4

5

6

8

20

RTUPORT 2

PLC-5/40

DSR

CTS

RTS

DCD

DTR

RTU to 1770-KF2 Communication

The pin assignment of the cable to be used for RTU to 1770-KF2 communication is given

below.

TXD

RXD

DCD

1

2

3

3

2

4

7

20

5

6

RTU 1770-KF2

CTS

DTR

RTS

DSR

DCD

CTS

GND

RTS

12V

DTR

4

5

6

7

8

RXD

TXD

8

GND

PLC Address for Allen Bradley ProtocolAllen Bradley protocol uses destination and source addresses for each transmitted packet. The

address given to the RTU master is 0 by default. To change this default, consult the factory.

Data Type Compatibil ity Between RTU and PLC5

Bit Type

When PLC5 bits are accessed, the following adjustment is performed:

35


40/51


15 4 3 2 1 0

0

1

2

3

4

15

. . . .

:

:

:

1st word

accessedPLC_DI, PLC_DO,

columnindex

15 4 3 2 1 0

16

17

18

31

. . . .

:

:

2nd word

accessed

Float and Integer Types

element 0

element 1

element n

Float, Integer,

PLC05 File

.

.

.

.

.

.

0

1

n

RTU

PLC RI, PLC RO, PLC VI, PLC VO

Data Type Column

36


41/51


Timer File in PLC5

The timer file in PLC5 may be mapped to a PLC_VI or PLC_VO data type column in the

RTU. Each element consists of 3 words. The mapping is transparent and is as follows:

preset value

accumulated value

EN TT DN not used

15 14 13 8 7 00

PLC-5 File

Timer Element

0

1

2

RTU

PLC_VI, PLC_VO

Data Type Column

0

1

2

The same applies for counter and control elements.

preset value

accumulated value

CU CD DN OV UN

15 14 13 12 11 00

PLC-5 File

Counter Element

0

1

2

RTU

PLC_VI, PLC_VO

Data Type Column

length

position

status

15 8 7 00

PLC-5 File

Counter Element

0

1

2

RTU

PLC_VI, PLC_VO

Data Type Column

0

1

2

0

1

2

If you want to read n elements from a counter/control/timer file, you must define a column of

PLC_VI type with 3n word elements (last index=3n1).

If you want to write to n successive counters/controls/timers in a file, then you must define a

column of PLC_VO type with 3n word elements (last index=3n1).

Accessing PLC-5 Control lers

The following commands of the Allen Bradley protocol are used to access the PLC-5 controller:

Command Function

Word range read 01

Word range write 00

37


42/51


The file types below can be accessed by the ACE3600 implementation for the above commands:

Integer file

Floating point file

Bit file

Counter, timers, control

The above commands allow accessing most PLC-5 file types. The uniqueness of the above commands is

that it can access any file by referring it as a word (integer) file.

RTU Definit ions for Allen Bradley PLC5 Support

Data Types

The following data types have been added to be used when the RTU serves as a master:

PLC_VI PLC Value Input. This data type is used to read word elements from a third

party RTU. Each element in a PLC_VI column is a 2-byte signed integer (value). The

column length must be defined as the number of the words that are to be read. The

elements that can be read from PLC5 are: counters, controls, timers, integers, etc. In the

case of counters, controls, and timers, three successive words are read per one element (in

PLC5 each counter, control, and timer, consists of three words).

PLC_VO PLC Value Output. This data type is used to write into any word element ofAllen Bradley PLC5 controller. The elements are: counters, controls, timers, integers, etc.

In the case of counters, controls, and timers, three successive words are written to an

element (in PLC5 each counter, control, and timer, consists of three words).

PLC_DI PLC Discrete Input. This data type is used to read 1-bit elements from a thirdparty RTU, such as bits. The number of bits in a column must be defined as a multiple of

16.

PLC_DO PLC Discrete Output. This data type is used to write1-bit elements into a third

party RTU, such as bits. The number of bits in a column must be defined as a multiple of

16.

PLC_RI PLC Real Input. This data type is used to read real (floating point) elementsfrom a third party RTU. Each element in PLC_RI is a 4-byte real (floating point) number.

PLC_RO PLC Real Output. This data type is used to write real (floating point) elementsto a third party RTU. Each element in PLC_RO is a 4-byte real (floating point) number.

PLC Table

The PLC Table, one of the System Tables, is used to define the connectivity to the third party

PLC units in the system. This table must be defined for any RTU which serves as a PLC master

for a PLC connected to one of its ports or connected to one of the other RTUs in the network.

38


43/51


This table has three columns as detailed below:

PLC Address the address of the PLC RTUs (1254). Address 0 is the default address forthe Master. Refer to PLCAddressforAllenBradleyProtocolto change the RTUs default

PLC address.

Connected to RTU (name) the name of the RTU to which the PLC is connected. Click thearrow to open the list. If the RTU is locally connected to one of the ports of the unit where

the PLC Table is to be defined, chooseLOCALfrom the choice list.

via Port (name) the name of the port for connection. Click the arrow to open the list.Choose the same name that was used when the port was defined.

If the PLC is connected directly via a UART port to the Master, then define the Connected to

RTUfield asLOCALand the via Portfield as PLC 1, 2 or 3.

If the PLC is connected to an RTU which acts as a router, then define the Connected to RTU

field as the RTU router Site Name. Assign the name that was used in the Site table.

Port Configuration and Protocol Downloading

The configuration of an RTU port as a third party protocol port requires two levels of

configuration:

Physical port configuration

Third party protocol downloading

39


44/51


Port ConfigurationAny of the serial/plug-in (PI1, SI1, SI2, PI2) CPU ports may be defined as a Third Party

Protocol PLC port.

Port Advanced Configuration ->DTR/CTS Support this field defines the DTR/CTSSupport. Select this option only if DTR/CTS support is provided by the computer

connected to the ACE3600 RTU.

The default values may be changed according to the following:

Connected to Slave.

Port Name the name of the port: PLC 1, PLC 2, or PLC 3.

Data Speed This field defines the communication data speed of the selected ConnectionType. The default is 9600 bps.

(Advanced Configuration->)Format This field defines the UART's character format forthe communication port. The default is 8 bit, no parity, 1 stop bit. Click the arrow to open a

list that includes all combinations of 7/8 bits, even/odd/no parity, and 1/2 stop bits.

Third Party Protocol DownloadingAfter configuring the RTU physical port according to the type of connection (to Master

Computer or PLC), STS provides you with the Downloader utility.

Note: The protocol should be loaded only to the RTUs whose ports have been defined as

Connected to Slave.

Before downloading the Third Party Protocol file, verify that the required files have been

added to the STS site Add-Ons. To do so, click on the General tab in the site view and add the

required Third Party Protocol files from the "config" directory under the STS installation path

(e.g. C:\STS1150\Config.)

The Downloader supports downloading to RTUs either locally or remotely via the network.

For instructions on how to operate Downloader, see the ACE3600 STS User Guide.

40


45/51


Step-by-Step Definitions


Site Configuration

1. Define one of the ports as RS232, Async, Third party protocols, (Connected to) Slave.









3. Download the appropriate protocol file as described in above.





PLC address: 1


Via Port (Name): PLC1

RTU as Master Ladder Diagram

The read/write of data from/to Allen Bradley PLC5 is done by the SCAN operation in the

ladder rungs of the application. The SCAN itself is performed on one of the new data type

columns: PLC_VI, PLC_VO, PLC_DI, PLC_DO, PLC_RI or PLC_RO.

For each of the above columns, I/O Link should be performed.

When the SCAN operation is performed on one of the above columns, the system accesses the

destination Allen Bradley PLC5 by selecting one of the supported commands, according to

the data type of the column and the I/O link.

Note that if the column is of input type, read operation is performed from the PLC, and if the

column is of output type, write operation is performed to the PLC.

41


46/51


I/O Link for PLC Data Type Columns

I/O Link for PLC Data Type Column is a procedure of describing the slave database that we

want to access.

There are two options for performing I/O Link for each PLC Data Type Column:

Static I/O Link each column is bound to the slave database with the formal I/O Link(as for I/O)

Dynamic I/O Link each column is bound to the slave database by the ladder at

runtime, by programming the PLC Dynamic IOLINKsystem table before the SCAN

operation.

The ACE3600 RTU selects the method according the value of PlcElmNumin the PLC

Dynamic IOLINKsystem table. During the SCAN of the PLC column type, the ACE3600

RTU examines the value of PlcElmNum. If it is equal to 0, static I/O is selected. If it is not

equal to zero, the I/O Link parameters are expected to be programmed in the PLC Dynamic

IOLINKsystem table.

If PlcElmNum == 0, use Static I/O Link.

If PlcElmNum 0, use Dynamic I/O Link.


Before performing the I/O Link, complete the definition of the PLC Table, otherwise you will

not be able to proceed to the I/O Link for PLC data type columns.

In I/O Link, for each PLC data type column you must define the following:

1) PLC Address the address of destination Allen Bradley PLC5. The address range is 1

254. Address 0 is the master address. Refer to PLCAddressforAllenBradleyProtocoltochange the default PLC address of the master.

2) PLC Data Type the data type of destination PLC. For Allen Bradley PLC5, only threedata types are relevant:

a) PLCBit Use this data type when the destination file to read or write is a file of bits.

b) PLCVal Use this data type when the destination file is of the following type:

integer

control

counter

timer

any word type file

c) PLCRel Use this data type when the destination file is a floating point file.

3) Coord1 the file number to access.

4) Coord1 Length should be set to 2. The length of Coord1 is 2 bytes.

42


47/51


5) PLC Coord2 the word element number (starting from word 0) in the PLC-5 file whichcorresponds to the ACE3600 PLC data type column start.

For integer files, PLC Coord2= integer element number in file.

For floating point files, PLC Coord2= (floating point element number in file)*2.

For bit files, PLC Coord2= (bit element number in file)/16.

For counter, timer and control files, PLC Coord2= (element number in file)*3.

6) Coord2 Length should be set to 2. The length of Coord2 is 2 bytes.

7) Coord3 the address (station number) of the Allen Bradley module that is directly

connected to the RTU. If a 1770-KF2 or other Interface module is connected to the RTU,

then PLC Coord3 should be the address of the interface module. If no interface module is

used (the PLC-5 is directly connected to the RTU), then PLC Coord3 should be the address

of the PLC-5 controller.

8) Coord3 Length should be set to 1. The length of Coord3 is 1 byte.

Note: Do not change the last lines for coordinates. It is reserved for protocols with more than

one coordinate.

Dynamic I/O Link for PLC Data Type Columns

ACE3600 allows dynamic I/O Link per each PLC data type column.

The advantage of this method is that one can define multiple I/O Links at runtime for the same

PLC type column (not at the same time). Instead of defining the static I/O Link for a PLC

column, it is possible to program the PLC Dynamic IOLINKsystem table (#232).

The contents of the PLC Dynamic IOLINKtable serves as an input for PLC column SCANoperation and therefore programming this table should be done before the PLC column SCAN.

The programming of the PLC Dynamic IOLINKtable is as follows:

PlcElmNumshould be set to zero if Static I/O Link is used, otherwise it is generally setto the number of elements (rows in column) in the corresponding PLC_DI, PLC_DO,

PLC_VI, PLC_VO, PLC_RI, PLC_ROdata type column being accessed by the SCAN

operation. Note: PlcElmNum should be less than or equal to the number of elements (rows

in column) in the corresponding column accessed by SCAN.

PLcDstAddr PLC Address the address of the destination Allen Bradley PLC5. The

address range is 1254. Address 0 is the master address. Refer to PLCAddressforAllen

BradleyProtocolto change the default PLC address of the master.

PlcDataType should be set to 1.

PlcCoordNum number of coordinates; should be set to 3.

PlcCoord1Len should be set to 2. The length of Coord1 is 2 bytes.

PlcCoord1 - the file number to access.

43


48/51


PlcCoord2Len should be set to 2. The length of Coord2 is 2 bytes.

PlcCoord2- word element number (starting from word 0) in the PLC-5 file whichcorresponds to the ACE3600 PLC data type column.start

For integer files, PlcCoord2 = integer element number in file.

For floating point files, PlcCoord2 = (floating point element number in file)*2.

For bit files, PlcCoord2 = (bit element number in file)/16.

For counter, timer and control files, PlcCoord2 = (element number in file)*3.

PlcCoord3Lenshould be set to 1. The length of Coord3 is 1 byte.

PlcCoord3- the address (station number) of the Allen Bradley module that is directlyconnected to the RTU. If a 1770-KF2 or other Interface module is connected to the RTU,

then PLC Coord3 should be the address of the interface module. If no interface module is

used (the PLC-5 is directly connected to the RTU), then PLC Coord3 should be the address

of the PLC-5 controller.

Other fields of the PLC Dynamic IOLINKtable are irrelevant for the Allen Bradley PLC-5

protocol and should be ignored.

Scan from Rungs

Before performing SCAN on a PLC column, check the PLCStt status for communication busy.

=PLCStt

PLCBsy

column

( SCAN )

PLCStt is an integer status system variable. The purpose of this variable is to give an indication

on the communication with PLCs. The values for this variable are defined in the PLC Status

Defines table (one of the Constants Tables).

44


49/51


45

Note that if PLCStt=PLCBsy, the new SCAN will not be performed.

If the communication is successfully terminated, the PLCStt variable is changed to PLCRdy.

(Ready for new SCAN after having successfully finished the previous SCAN).

If the communication is not successfully terminated, the PLCStt variable is changed to one of

following values:

NO_Buf No buffers to perform the communication

PLCFal Failed to perform the communication

PLCIol I/O Link Error

PLCAdr The address does not appear in PLC Table

PLCTim No respond from the PLC slave

PLCRpl Reply error from PLC slave

During the communication, the PLCStt variable is equal to PLCBsy.


50/51

Allen Bradley SLC 500 Protocol

The SLC 500 family protocol support allows the connection of an Allen Bradley SLC 500,

SLC5/01, SLC 5/02, SLC 5/03 and SLC 5/04 controller to an existing ACE3600 RTUsystem.

Most of the documentation for Allen Bradley PLC-5 controller is applicable for the SLC

500 family; please refer to theAllen Bradley PLC-5 Protocolsection in this document. The

following are differences which should be noted:

SLC 500 Drivers

Three drivers are supplied for SLC 500 protocol. They are:

SLC.2S_PLC1 Driver for RTU that is PLC master to Allen BradleySLC 500, whose Port is defined as PLC 1.

SLC.2S_PLC2 Driver for RTU that is PLC master to Allen Bradley

SLC 500, whose Port is defined as PLC 2.

SLC.2S_PLC3 Driver for RTU that is PLC master to Allen Bradley

SLC 500, whose Port is defined as PLC 3.


Coord2 element number (starting from 0) in the PLC500 file which corresponds tothe ACE3600 PLC data type column start.

For integer files, PLC Coord2= integer element number in file.

For floating point files, PLC Coord2= floating point element number in file.

For bit files, PLC Coord2= bit element number in file.

46


51/51

2BAllen Bradley SLC 500 Protocol

Dynamic

Documents

STS Third Party Protocols Support