CA2 Y9772 en
CA2 Y9772 en
CA2 Y9772 en
PX Modbus
Engineering guide
Versions 5.1 SP and higher
CA2Y9772en_05
2015-03-31 Building Technologies
2 / 34
3 / 34
The following trade names and product names are registered trademarks:
BACnet American National Standard (ANSI/ASHRAE 135-1995)
Modbus® MODICON, Inc., Industrial Automation Systems, North
Andover, Massachusetts USA, and see modbus.org
4 / 34
The Desigo building automation and control system supports the integration of
third-party devices and systems at all levels (see the topology diagram above).
Modbus devices and systems are integrated at the automation level using the PX
Open Modbus solution, which runs on the PXC001.D system controller.
Integration can be achieved in either direction:
· When Modbus devices or systems are integrated into a Desigo system
à the PXC001.D or PXC001-E.D with a PXA40-RS… extension module if
necessary) acts as the Modbus master.
The values of the Modbus data points and the state of the existing data
connection with the data point are mapped to BACnet objects by the PX Open
Modbus solution. In this way, the Modbus data points can be made available in
all the devices in the Desigo system.
· When a Desigo system or Desigo device is integrated into a Modbus system,
à the PXC001.D with or PXC001-E.D (with a PXA40-RS… extension module if
necessary) acts as a Modbus slave.
A third-party Modbus master can be used to integrate the data points from the
Desigo system via the PX Open Modbus slave.
Further, the data traffic on the Modbus can be monitored and analyzed by use of
the PX Open Monitor software, which is described in the User's Guide for the
Desigo PX Open Monitor [3].
5 / 34
Limitations In RTU mode, the Modbus slaves can only be operated in a point-to-point
configuration. In a multi-drop configuration, it must either be possible to program
the Modbus master with appropriate time settings, or the network must be operated
in ASCII mode.
For details of the Modbus settings, refer to chapter 4.2.
6 / 34
The parameter IOAddress contains information about how to address a data point
of an I/O block on the Modbus, which function code to use and which format
conversion procedures are required.
The structure of the parameter IOAddress is always as follows (see also Data
conversion, chapter 5.2):
M = MappingInfo1(MappingInfo2.MappingInfo3.MappingInfo4.MappingInfo5.MappingInfo6[DataType])/Free syntax
Example of two function blocks with an associated "IOAddr" pin in CFC chart
7 / 34
8 / 34
Modbus view
Description of the
Modbus function
Function blocks in
(MappingInfo1)
(MappingInfo4)
(MappingInfo2)
Application
CFC Editor
XXX YYYY 1 0X Read Coil Status DI Read multiple DIs
XXX YYYY 2 1X Read Input Status DI Read multiple DIs
XXX YYYY 3 4X Read Holding Register AI Read multiple AIs
XXX YYYY 4 3X Read Input Register AI Read multiple AIs
XXX YYYY 5 0X Force Single Coil DO Write single DO
XXX YYYY 6 4X Preset Single Holding AO Write single AO
Register
XXX YYYY 15 0X Force Multiple Coils DO Write multiple DOs
XXX YYYY 16 4X Preset Multiple Holding AO Write multiple AOs
Registers
For the IOAddr of function blocks, the following "mapping strings" must be added:
9 / 34
Siemens Desigo PX Open Modbus CA2Y9772en_05
Building Technologies Project engineering overview 2015-03
03-31
15 Write multiple DO's M = ...
to successive Coils M = ....
M = XXX(15.0.YYYY.0.0...
16 Write multiple AO's M = ...
to successive Holding Registers M = ....
M = XXX(16.0.YYYY. 0.0...
16 (cont'd) Write multiple DO's M = ...
to one (or multiple successive) M = ....
Modbus Holding Registers M = XXX(16.0.YYYY. BitPos.0...
10 / 34
Important! These two Discipline I/Os must be present in every CFC program (application) of a
system controller.
Default
Communication Block Variabl Variable Data Description
Master
Slave
(COMBLK) e Name Type Type
01589 Baud VAR_INPUT UINT32 Baud rate on the Modbus
3 600 / 1200 / 2400 /4800 / 9600 9600 X X
COMBLK OB1
(38400 with PXC001.D)
Communic 7/- StopBit VAR_INPUT UINT16 Number of stop bits on the Modbus
0 OoServ Rlb 1 X X
1/2
600 Baud AlmSta
Parity VAR_INPUT MULTI Parity on the Modbus
1 StopBit Dstb None X X
No Parity / 2: Even / 3: Odd
1 Parity LstMsg
6 Length Length VAR_INPUT UINT16 Number of data bits per character on the
0 RegNum Modbus 8 X X
0.0 ChTmo 8 (fix)
0.0 FrTmo RegNum VAR_INPUT UINT32 License number for the
0.0 ScanDly 0 X X
Modbus solution 1)
0.0 Info1
0.0 Info2 ChTmo VAR_INPUT FLOAT Character timeout [mS]
0.0 Info3 Maximum time between two characters 100 X X
0.0 Info4 on the Modbus
0.0 Info5 FrTmo VAR_INPUT FLOAT Frame timeout [mS]
IOAddr 500 X X
Maximum time for the transmission of a
1 Reset
Modbus telegram
ScanDly VAR_INPUT FLOAT Polling time (Modbus Master) [mS]
Interval between two queries 500 X O
50…5000
Info1 VAR_INPUT FLOAT --- – – –
Info2 VAR_INPUT FLOAT --- – – –
Info3 VAR_INPUT FLOAT Device Address (Modbus slave)
Modbus slave address – O X
1...247
Info4 VAR_INPUT FLOAT --- – – –
Info5 VAR_INPUT FLOAT --- – – –
IOAddr VAR_INPUT Refers here only to the COMBLK and is
– 2) X X
used to define the internal mapping table
Rlb usw. Alarm handling for the entire block – X X
– = Reserved for other third-party solutions
1. Licensing mechanism:
Refer to the data sheet for the PX Open Modbus solution [2]
Important! 2. No default value. HOWEVER, the following value must be entered to ensure
that the correct internal mapping table is selected:
"M=1(1)"
Mapping table
Device (Pseudo-address)
11 / 34
Default
Name type type (see also DTS description)
01590 InsDate VAR_INPUT ASCII Entry of engineering date 0
4 ResetSub VAR_INPUT BOOL Reset PX Open 0
MSGBLK OB1
Message /- MeStep VAR_INPUT UINT16 Message Stepper 0
»
0 OoServ OpVers MeRes VAR_INPUT BOOL Reset Messages 0
16#FFFFFFFF InsDate State
Mode VAR_INPUT BOOL Tool Mode 0
0 ResetSub CntEr
1 MsgStep CntFail MeLev VAR_INPUT UINT16 Message Level 0
0 ResetMsg AddMsg2 LogLev VAR_INPUT UINT16 Logfile Level 0
0 ToolMod AddMsg1
0 MsgLvl License LogTrig VAR_INPUT UINT16 Trigger Mesnr 0
0 LogLvl ResetSta AmBefor VAR_INPUT UINT16 Before MesNr. 0
0 MsgTrig ToolCnct
AmAfter VAR_INPUT UINT16 After MesNr. 0
0 MsgBefor Res1
0 MsgAfter Res2 OpVers VAR_OUTPUT FLOAT SW Version 0
IOAddr Res3 State VAR_OUTPUT UINT16 SW State 0
1 Reset Res4
Res5 Couerr VAR_OUTPUT UINT16 Error Counter 0
Res6 Counter for program errors
Res7 CouCfai VAR_OUTPUT UINT16 Cfail Counter 0
Res8
Res9
Counter for communication errors
Res10 MeAdd1 VAR_OUTPUT FLOAT Mes. Additional 1 0
Rlb MeAdd2 VAR_OUTPUT FLOAT Mes. Additional 2 0
AlmSta
Dstb License VAR_OUTPUT BOOL License Ok 3) FALSE:
LstMsg TRUE = Identifies licensing as OK.
Res1 VAR_OUTPUT UINT16 Licence level
Res2 VAR_OUTPUT UINT16 Number of active data points
Res3 VAR_OUTPUT SINT16 Version 2.20.014 and higher:
Number of data points still available
in the licence range
(negative if higher than licence)
IOAddr Refers here only to the MSGBLK – 4)
and is used to define the internal
mapping table
Rlb usw. Alarm handling for the entire block – 5)
– = Reserved for other third-party solutions
1. Licensing mechanism:
Refer to the data sheet for the PX Open Modbus solution [2]
Important! 2. No default value. However, the following value must be entered to ensure
that the correct internal mapping table is selected:
"M=1(1)"
Mapping table
12 / 34
· The PX Open Modbus solution enables data points from Modbus devices to be
integrated into the Desigo system.
· The values of the Modbus data points and the status of the existing data
connection with the data point are mapped to BACnet objects by the PX Open
Modbus solution.
· The PX Open Modbus solution can be used either as a Modbus master or as a
Modbus slave.
Hardware platform The hardware platform is the system controller, type PXE-CRS, or a modular
PXC…-U automation station fitted with a PXA30-RS extension module.
13 / 34
The following section provides only a brief overview of the Modbus protocol.
For the full specification, refer to Modicon Modbus Protocol Reference Guide [1].
Master/slave protocol The Modbus is a master/slave protocol. By definition, this means that a Modbus
network contains one, and only one, master and at least one slave.
Transactions on the The Modbus master starts the transactions on the network with a slave query. The
Modbus slave either responds positively with the requested service (response) or transmits
an "exception message". In the remainder of this document, these query/response
sequences are also referred to as "Modbus telegrams".
Function codes The type of transaction is defined by the function code transmitted in the Modbus
telegrams. A function code defines the following:
· Structure of the telegram, query and response
· Direction of data transmission (master à slave or slaveàmaster)
· Data format of data point (bit or 16-bit register)
Transmission modes The Modbus protocol defines two alternative serial transmission modes:
These modes have the following characteristics:
RTU (Remote Terminal Unit) mode
· Binary-coded data
· Start and end of telegrams marked by timed pauses (a "silent interval") between
the characters transmitted.
· Check sum algorithm: CRC (Cyclic Redundancy Check)
ASCII mode
· Data in hexadecimal notation
· Beginning and end of telegrams marked by start and end characters.
· Check sum algorithm: LRC (Longitudinal Redundancy Check)
Telegrams with Certain types of Modbus transactions permit the transmission of a variable number
multiple data points of Modbus data points (bit or 16-bit register) in a single telegram.
14 / 34
The Modbus master reads the data points from the slaves at regular intervals,
using the relevant function code (01, 02, 03 or 04). If a slave fails to respond, the
master waits after each query for the (relatively long) response timeout time to
elapse. This causes a major delay in the exchange of data with those slaves that
still have to respond.
To overcome this, the PX Open Modbus solution works in "master mode" as
follows:
· If the slave continues to respond with an exception message, the next pending
query is transmitted.
Note The state of the Modbus data points is mapped to the "Reliability" parameter, Rlb
(refer to BACnet Reliability, chapter 3.2.5).
15 / 34
Function Codes 05, 06, 15 and 16 serve to write data point values to the Modbus
slave. These values are written once when the master is started (with a positive
acknowledgement) and are subsequently rewritten only in the event of a change in
the data point value.
Since the value update is initiated only in the master in the event of a change of
value, there is a risk of data inconsistency after a reset or after a replacement of
the Modbus slave device.
To overcome this, the PX Open Modbus solution uses the following mechanism
when operating as master:
If a slave takes longer than a predefinable period of time to respond to queries
from the master ("Disconnected"), communication is re-established ("Connected")
and all values are written to the slave again.
Modbus master Function Codes 02, 03 and 04 are used to read multiple data point values from the
Modbus slaves. In other words, these values are polled at regular intervals in the
slaves.
When operating as a master device, the PX Open Modbus solution automatically
constructs these polling telegrams so that within the predefined limits (max. length
of a telegram and max. number of registers) each telegram holds as many data
points as possible.
Function Codes 15 and 16 serve to write multiple data point values to the Modbus
slave. These values are written once when the program starts, and subsequently
whenever the data point value changes.
In master mode, the PX Open Modbus solution automatically constructs these
Write telegrams so that within the predefined limits (max. length of a telegram and
max. number of registers) each telegram holds as many modified (COV) data
points as possible.
Note As only the address of the first data point and the total number of data points can
be inserted in the Modbus telegram, it is only possible to combine data points with
addresses in continuous ascending order.
Response in the event If the Modbus master asks a slave for a data point which does not exist in that
of engineering errors slave, the master stops collating data points in combined telegrams, and reads or
writes the data points for each individual D-MAP parameter from the slave (this
may also be two Modbus data points). Periodically, the master repeats its attempt
to use combined telegrams for the exchange of data.
This approach ensures that the correct data point parameter settings are
transmitted despite the error.
Modbus slave
16 / 34
The status of the Modbus data points is mapped to the Rlb (Reliability) parameter.
In the standard I/O blocks, one Rlb parameter is available for each Modbus data
point. By contrast, the Discipline I/O blocks COMBLK and MSGBLK have only one
shared Rlb parameter for all the Modbus data points of the Discipline I/O together.
In the event of an error, more information can be obtained by use of the PX Open
Monitor (see also User's Guide, PX Open Monitor [3].
Suppression of alarm If one or more slaves fail to respond, the Modbus master sets the Reliability
messages in the event parameter of all the affected I/O blocks to UNRELIABLE_OBJECT. In the case of a
of a bus failure common source, a very large number of alarms can be triggered (a "burst"), which
can overload the entire system.
To prevent this, in cases where there is "No response from slave", it is possible to
selectively suppress this change to the Reliability parameter. The "free syntax" in
the I/OAdress string is used for this purpose:
M=X(Y.Y.Y.Y.Y[Z])/R15
17 / 34
18 / 34
19 / 34
The IOAddress pin of the I/O block contains information which defines
· how to address a data point of an I/O block on the Modbus,
· which function code to use and
· which format conversion procedures are required.
The structure of the parameter IOAddress is always as follows (see also chapter
5.2):
M = MappingInfo1(MappingInfo2.MappingInfo3.MappingInfo4.MappingInfo5.MappingInfo6[DataType]Free syntax
4.1.1 Overview
20 / 34
MappingInfo2 In Modbus "Master" and "Slave" modes, MappingInfo2 contains the function code
to be transmitted with the data point on the Modbus. Since the function code also
defines the direction of the data traffic on the Modbus, this means that the I/O block
types with which the various function codes can be linked will differ, depending on
whether the Modbus solution is operated in master or slave mode.
MappingInfo4 In Modbus "Master" and "Slave" modes, MappingInfo4 contains the register or bit
address to be transmitted with the data point on the Modbus.
For data types with a length of 32 bits, the PX Open Modbus solution automatically
uses two Modbus registers. After a data point with a length of 32 bits, therefore, the
next-but-one Modbus address must be allocated to the next data point.
MappingInfo5 The BitPos function can be enabled with values 1 … 16. Activation is only
permissible with the appropriate combination of data type and function code (see
the summary further below).
A value of 0 disables the BitPos function.
MappingInfo6 Values 1 … 9 enable the data conversion functions. Activation is only permissible
with the appropriate combination of data type and function code (see the summary
further below).
If a value of 0 is defined, no data conversion will take place.
21 / 34
22 / 34
In most cases, the information provided by the COMBLK and MSGBLK is sufficient.
For special functions or modifications, the PX Open Modbus solution includes a
group of output blocks which can be used to set special parameters.
It is not compulsory for these blocks to be present in the CFC program.
If they are not present, the default values will be used as listed.
Important! These parameters are read once only after power-up. Changes at runtime will
therefore only take effect after a system controller restart.
23 / 34
In may devices equipped with Modbus, the Modbus protocol is not fully
implemented. Not all the service codes can be used, and the data points are not
addressed strictly in accordance with the Modbus protocol.
In order to ensure the efficient integration of these devices, the PX Open Modbus
solution provides the add-ons described below.
Some simple devices may not support the transmission of several data points in a
combined Modbus telegram.
In such cases the process of combining data points can be suppressed for specific
individual data points. The "free syntax" in the IOAdress string is used for this
purpose:
M=X(Y.Y.Y.Y.Y[Z])/R0
The Modbus protocol only allows single bits to be read with Function Codes 01
(Read Coil Status), 05 (Force Single Coil) and 15 (Force Multiple Coils).
However, many Modbus devices do not support all these function codes. The
BitPos function makes it possible to handle single bits despite this fact, and without
additional work in the CFC program.
BitPos can be used to link the I/O block types "Binary Input" and "Binary Output"
with single bits of a 16-bit Modbus register.
Example of a Modbus register linked with Function Code 04 (Read Input Register)
Note If different bit positions in the same register number are accessed (for example
100.1, 100.2, 100.3), the same Modbus function must be used for the writing of
all Bits from this register.
24 / 34
Analog Output
PrVal: 100
PrVal: 100
25 / 34
Analog Output
Response: Ok
PgmVal: 200 PrVal: 200
PrVal: 200
Feedback-addressing The Feedback address FbAddr has an offset of 1000 relative to IOAddr:
for the above example 01587 A
Io12
AO OB1
Analog o 5/-
0 OoServ PrVal
0.0 DefVal FbVal
1 Reset StaFlg
0 OpEn Rlb
0.0 OpVal AlmSta
1 PgmEn Dstb
0.0 PgmVal
M=1(16.0.0.0.0[UINT16]) IOAddr
M=1001(16.0.0.0.0[UINT16]) FbAddr
Fehler! Exception! In the block "Binary Output" the Feedback address has the data type UINT16
Es ist instead of BOOL:
nicht 01587 B
möglich, 3
durch BO OB1
Binary o 5/-
die 0 OoServ PrVal
Bearbeit 0.0 DefVal FbVal
ung von 1 Reset StaFlg
0 OpEn Rlb
Feldfunk 0.0 OpVal AlmSta
tionen 1 PgmEn Dstb
0.0 PgmVal
Objekte M=1(5.0.0.0.0[BOOL]) IOAddr
zu M=1001(5.0.0.0.0[UINT16]) FbAddr
erstellen
.
Direct feedback New for version 2.20.014 and higher:
from a BO
The R1 flag in the free syntax indicates a direct feedback from a BO.
This is required to convert the UINT16 to a BOOL in conformance with BACnet
Example of a direct feedback address:
M=1(1.0.0.0.0[UINT16])/R1
26 / 34
The Modbus protocol defines the 16-bit register as the largest data unit. 32 bit
values must therefore be transmitted in two registers.
The PX Open Modbus solution automatically occupies two 16-bit registers for the
data types concerned (FLOAT, UINT32 and SINT32), and also ensures that they
are always combined for transmission in a shared telegram (note that this requires
a function code capable of transmitting several registers in a single telegram.
In many devices incorporating the Modbus, special data formats (e.g. BCD, ACM
etc.) are used. There is a further problem, in that values which occupy two
registers, the sequence of the actual values can be defined in different ways.
The PX Open Modbus solution provides a whole range of conversion functions for
this application.
27 / 34
The specified data type defines the data type to which the Modbus data point is
mapped. The following data types are implemented:
· BOOL
· UINT16
· SINT16
· UINT32
· SINT32
· FLOAT
The selected data type is given in brackets at the end of the "MappingInfo" string.
Combination of The format of a Modbus data point can be influenced at various points on its
DataType, Format, journey through the PX Open system. The data format can be converted at the
BitPos and Function transition points A, B and C.
Code
Transition A is determined by the block type selected in CFC and the data type
selected in the IOAddress.
Transition B is determined by the data type selected in the IOAddress, the
conversion type in MappingInfo6 and the value for the BitPos function in
MappingInfo6.
Transition C is determined by the conversion type in MappingInfo6, the value for
the BitPos function in MappingInfo6 and the selected function code.
Checking There is no check of the selected combination in Transition A, but the combinations
used in Transition B and C are checked. The system will reject any conversion
processes which result in a loss of data (e.g. conversion from FLOAT to BIT).
Permitted data-type The direction of data flow determines which combinations are possible. This
combinations explains why there are only four different overview tables below.
Loss of accuracy with The conversion of 32-bit data types into FLOAT values is associated with a loss of
conversions into accuracy. The loss is 8 or 9 bits (for a signed and unsigned 32-bit value
FLOAT values respectively). This type of conversion arises with the combination of standard input
blocks with data types SINT32 and UINT32.
Important! If these combinations also include data conversion codes 1 (Swap Register) or 5
(BCD32B) the loss of accuracy moves to the most significant bits! These
combinations should therefore not be used.
28 / 34
MappingInfo5
29 / 34
Mapping Info6
Format Parameter
0 No Conv. 05 Force S. Coil
06 Preset S.Reg 06 Preset S.Reg 06 Preset S.Reg
15 Force M.Coil
16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg
1 Swap Register 16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg
2 BCD16A 06 Preset S.Reg
16 Preset M.Reg
3 BCD 16B 06 Preset S.Reg
16 Preset M.Reg
4 BCD32A 16 Preset M.Reg
5 BCD32B 16 Preset M.Reg
6 ACM16 16 Preset M.Reg
7 U32BITMOD10000 16 Preset M.Reg
8 S32BITMOD10000 16 Preset M.Reg
BitPos 06 Preset S.Reg
16 Preset M.Reg
MappingInfo5
Permissible combinations for input block types with Modbus operating as slave:
Mapping Info BOOL SINT16 UINT16 SINT32 UINT32 FLOAT
DataType (2 Registers) (2 Registers) (2 Registers)
Mapping Info6
Format Parameter
MappingInfo5
30 / 34
MappingInfo5
31 / 34
7 Technical data
For technical data, refer to the following documents:
· PX Open System controller PXE-CRS, data sheet [4]
· PX Modbus solution, data sheet [2]
32 / 34
A M
Alarm Mapping information ..............................................21
suppression ....................................................... 17 Mapping strings .......................................................9
Applications .......................................................... 13 Message Block MSGBLK ...................................... 11
ASCII mode .................................................... 13, 14 Modbus
functions.............................................................13
B master ..............................................................5, 6
BitPos function ................................................ 21, 24 protocol ........................................................14, 24
Bus failure ............................................................. 17 settings...............................................................23
slave .................................................................5, 6
C telegram .............................................................16
CFC view ................................................................ 9 view ......................................................................9
Checking ......................................................... 14, 28 Modbus master polling ..........................................15
Communication
monitoring.......................................................... 18 O
Communication Block COMBLK........................... 11 Output
Cyclic Redundancy Check CRC ........................... 14 writing.................................................................27
D P
Data conversion .................................................... 28 Polling ....................................................................15
Desigo PX Open MONITOR ................................... 5 Project engineering .................................................7
Discipline I/Os ....................................................... 11 PXE-CRS ..............................................................13
PXE-CRS system controller ....................................5
E
Engineering errors ................................................ 16 R
Errors .................................................................... 16 Redundancy Check ...............................................14
Reliability Rlb ...................................................15, 17
F Requirements ..........................................................6
Feedback address FbAddr ................................... 26 RTU (Remote Terminal Unit) mode ............ 6, 13, 14
Feedback function ................................................ 25
FLOAT values ....................................................... 28 S
Format conversion ................................................ 27 Serial transmission modes ....................................14
Function codes ............................................... 13, 14
T
H Telegrams ..............................................................16
Hardware platform ................................................ 13 Third-party Modbus master .....................................5
Topology ..................................................................5
I Transmission
I/O address ........................................................... 20 32-bit values.......................................................27
I/OAddress .............................................................. 7 data ....................................................................24
Integration ............................................................... 5
U
L Updating output values..........................................16
limitations ................................................................ 6
Longitudinal Redundancy Check .......................... 14 W
Writing
intervals..............................................................27
33/34
34 / 34