EIM Modbus RTU
Introduction
This document describes an overview of Modbus and how it is used in the ETS system. Modbus (RTU) can be used to read a variety of data from the ETS system to some sort of Modbus master device, to be used remotely or on-site. A proper understanding of how the items are addressed and scaled in ETS will help ensure your system setup works correctly.
Brief Modbus Overview
Modbus is a serial communication protocol that is designed for reading and writing individual data items from a set of devices on the serial network. The device sending the commands is called the Modbus Master, and each other device on the network is called a Modbus Slave. Each slave will have a unique address, called the “Slave Address”, “Station Address”, or “Slave ID”. This address can run from 1 – 247.
Each slave ID will have a set of “Modbus Registers” that link to certain data items. The registers are broken into four sets, each numbered in a different range:
- (1-9999) Discrete Output Coils
- (10001-19999) Discrete Input Contacts
- (30001-39999) Analog Input Registers
- (40001-49999) Analog Output Holding Registers
While the register numbers, as referenced in documentation, will be numbered as they are above, it is important to note that in an actual Modbus command the data address (not to be confused with station address above) is always numbered 0-9999, and the register set that is actually read is based on the function code.
A command will contain a specific “Function code”, which indicates whether it is a read or write, whether it covers one or multiple registers, and which of the four register sets is used. There are 8 function codes in standard Modbus.
A Modbus Master command will contain:
- The slave ID for which the command is intended
- The function code
- The data address of the register
- The number of registers requested (for some function codes)
- The “CRC”, which is an error-checking number
As an example, we might want to read register 40002. The Modbus will send a command to the slave ID in question with function 4 (read input registers) from data address 1. Since the function code links to analog input registers, then the slave will know that the data address “1” is referring to register 40002, because analog input registers are register set 40001-49999, and address 1 is the second register (the first being address 0).
MODBUS in ETS
Wiring / Port Setup
The primary modbus port is the RS-485 connection on the back of the EIM (screen). This port is configured on the Modbus setup page, shown below. Select the correct option in the 'communications' dropdown to match the SCADA system. The most common two port settings used in the field are "9600,N,8,1" or "19200,E,8,1". Wire the SCADA RS-485 A/B connection to the EIM RS-485 A/B connection. If the EIM is in an EMIT panel, this connection may have already be ran to empty terminal blocks for convenience, and the SCADA RS-485 connection can be wired there instead (check the panel schematic).
Some panels will have an EDT present, which also has a duplicate slave 485 port in case there are two SCADA systems. This port is set up separately: under the "EDT Setup" -> "Slave modbus port settings".
Separately, the ethernet port can be used with Modbus/TCP, and it set up on the 'ethernet' setup page under 'system settings'.
Any or all of the three connection options above can be used, but in all cases the register numbers and IDs being read (discussed below) are the same.
Slave IDs
In ETS, each module in the system will have its own slave ID. However, all Modbus responses will come from the EIM only, which has the Modbus connection. The slave ID can be changed on the EIM on the Modbus screen.
For example, the EIM might have an ID of 10 and the AFRC Lite might be connected and have an ID of 11. If a Modbus master command arrives addressed to either ID 10 or 11, the EIM will respond. For any other address, the EIM will not respond.
If a Modbus request arrives matching a module ID, but that module is not actually attached currently, the EIM will not respond.
Register Scaling
Each module in ETS has its own Modbus table showing the data at different registers. An example section of the AFRC Lite Modbus table is shown below.
For many registers, the value is scaled to go from a decimal number to an integer. To decode from a Modbus register value to the real value, use the equation below
[real value] = [register value]*[Resolution/Bit] + [Offset]
The last two items in the above equation are in the Modbus tables. As an example, perhaps the register 30001 (Pre-Cat Exhaust Temp) was read and the value was 37,077. Using the values from the above table:
[real value] = 37077*0.03125 + (-273) = 885.6 degrees
Register Addressing
Note also in the table above that there is a separate column for “Register” and “Address”. The difference between the two has been previously discussed, and both are listed for convenience. Different Modbus and SCADA systems use various methods for specifying the register that is read. The register itself might be entered in a high-level program, and it will determine the data address on its own by using the last 4 digits. Alternately, a program might need the data address specified directly. The ETS uses “PLC Addressing” which is base 0 addressing. If this is not an option in a Modbus Master program, the address that is requested might have to be decremented by 1.
Example
In the program “Modbus Poll”, the following setup was used for Read/Write definition:
- Slave ID: 20 (which was the AFRC Lite configured slave ID)
- Function 04 Read Input registers (This uses the table above, registers 30001-39999)
- Address: 1
- Quantity: 3 (Address 1 and quantity 3 should read registers 30001-30003)
- PLC Addresses (Base 1) checked
The response was the three temperatures (Precat, Postcat, and Diff temp) as desired. Modbus Poll sent a “0” as the data address since the PLC Addresses was checked. If the program did not have this option, the same result could be obtained by using the address “0” to refer to address 1.
Table Types
The convention for table types generally used in ETS is the following:
(1-9999) Discrete Output Coils
Discrete output coils are for settings that can be represented as binary (0/1 or off/on). For example, valve auto or manual mode.
(10001-19999) Discrete Input Contacts
Discrete input contacts are for board inputs that can be represented as binary (0/1 or off/on). For example, the state of the oil pressure switch.
(30001-39999) Analog Input Registers
Analog input registers are for almost all other values that are not binary. E.g. temperatures, pressures, etc.
(40001-49999) Analog Output Holding Registers
Analog output holding registers are for settings that can be read and written over Modbus. For example, annunciator alarm limits fall into this category.
Custom Modbus Map
The EIM has the capability to re-map the register numbers to a custom map. This custom map is stored in a csv file, and can be used to create a block of registers with data from various modules. This allows a single read to the EIM Slave ID to pick up all the desired data across multiple modules. This file can be downloaded / uploaded by going to the EIM Modbus screen and choosing “Custom Map…”. More detail can be found on this article: EIM Custom Modbus Map
Modbus Table
The modbus table(s) can be downloaded here: https://drive.google.com/open?id=0BzOiNHLPWdg1UGQzLUktcTZfTVU
Note that the Dynamic Control Touchscreen (12" model) has a different modbus table, available here: https://drive.google.com/open?id=1uZHGhsb_jMc-kCS1jnT7NDkBjcN0WOxf
Modbus TCP/IP
For versions 1.89 and later, Modbus TCP/IP is supported if the EIM and kernel have ethernet enabled. The register maps and slave IDs are the same whether using Modbus serial or Modbus TCP/IP. Both connections (TCP/IP and serial) can be used at the same time. Additionally, multiple simultaneous Modbus TCP/IP connections are supported.
Annunciator Modbus
The annunciator modbus table is a section in the document linked in the above section "Modbus Table". The annunciator modbus table refers to sensors by the annunciator input name instead of the sensor name, since the actual sensor name is configurable.
Note: If desired, EMIT can generate a table automatically with sensor names added if the annunciator config file is available.
Example
If SUCTION sensor is attached to AI-1 (analog input 1), In the annunciator modbus table, register 35150 is "Analog In 1 Reading". Since suction is attached to this input, reading 35150 will get the suction pressure. Note that the "Annunciator ID" has to be used during the read, as mentioned in "Slave IDs" above.
The returned value for analog inputs will be scaled to the user value. If one input is 0-250 PSI and another is 0-1000 PSI, the actual range doesn't need to be known because the modbus response will always be in PSI.
Annunciator Shutdowns
On shutdown, the shutdown code can be read using a variety of registers. There are several options, which are just arranged different ways. The tables decoding these registers can be found here:
Annunciator Reg 35015 and 35017: https://drive.google.com/open?id=1GyCeOG0lYrgj97tP3rrb8Hv76WeVYChp
Annunciator Register 35016: https://drive.google.com/open?id=1de1KlMhbg3ZsiZHVexJuSIFBHFOrKVJ_
Note that in the "Unified Data Table", Register 32042 pulls the same value as Annunciator Register 35015 above.
You can generate a labeled version of the shutdown code registers by uploading a config file here: https://data.emittechnologies.com/tools/
CAT Shutdowns
If the CAT ECM triggers the shutdown, the annunciator shutdown code mentioned above will simply be the "CAT Run Status" digital in contact. In this case, the CAT shutdown code can be read from EDT register 30125, which is also on the unified data table at register 32020. This value can be decoded from this list: https://drive.google.com/open?id=1zGHh2RmHCGNMZBgyr9QDblb_LLB5ipP3
