Desigo PX Open PX Modbus: Engineering Guide
Desigo PX Open PX Modbus: Engineering Guide
PX Modbus
Engineering guide
Versions 5.1 SP and higher
CA2Y9772en_06
2017-04-24 Building Technologies
Table of Contents
0 Before you start ................................................................................... 3
0.1 Revision history ..................................................................................... 3
0.2 Reference to trade names and product names ....................................... 3
0.3 Related documents ................................................................................ 3
1 Introduction ......................................................................................... 4
1.1 Positioning ............................................................................................. 4
1.2 Requirements and limitations ................................................................. 5
2 Project engineering overview ............................................................. 6
2.1 I/O address ............................................................................................ 6
2.2 Setting parameters .............................................................................. 10
3 Application functionality ................................................................... 13
3.1 Overview ............................................................................................. 13
3.2 Communication.................................................................................... 14
3.2.1 Protocol definition ................................................................................ 14
3.2.2 Polling mechanism............................................................................... 15
3.2.3 Updating mechanism ........................................................................... 16
3.2.4 Multiple data points in a telegram ......................................................... 16
3.2.5 BACnet Reliability ................................................................................ 17
3.2.6 Communications monitoring................................................................. 18
4 Project engineering ........................................................................... 20
4.1 I/O address .......................................................................................... 20
4.1.1 Overview ............................................................................................. 20
4.1.2 Mapping information ............................................................................ 21
4.2 Special settings ................................................................................... 23
5 Protocol details.................................................................................. 25
5.1 Protocol Extension ............................................................................... 25
5.1.1 Force single telegram .......................................................................... 25
5.1.2 BitPos function..................................................................................... 25
5.1.3 Feedback function ............................................................................... 26
5.1.4 Adjustable Offset for MI/MO ................................................................. 28
5.1.5 Multi Register Values (>=32Bit) ............................................................ 29
5.1.6 Periodic writing .................................................................................... 31
5.1.7 Format conversion ............................................................................... 31
5.2 Data conversion................................................................................... 32
6 Commissioning .................................................................................. 36
7 Technical data .................................................................................... 36
8 Software and firmware versions ....................................................... 36
2 / 38
The following trade names and product names are registered trademarks:
BACnet American National Standard (ANSI/ASHRAE 135-1995)
Modbus® MODICON, Inc., Industrial Automation Systems, North
Andover, Massachusetts USA, and see modbus.org
3 / 38
The Desigo building automation and control system supports the integration of
third-party devices and systems at all levels (see the topology diagram above).
Modbus devices and systems are integrated at the automation level using the PX
Open Modbus solution, which runs on the PXC001 system controller.
Integration can be achieved in either direction:
· When Modbus devices or systems are integrated into a Desigo system
à the PXC001.D or PXC001-E.D with a PXA40-RS… extension module if
necessary) acts as the Modbus master.
The values of the Modbus data points and the state of the existing data
connection with the data point are mapped to BACnet objects by the PX Open
Modbus solution. In this way, the Modbus data points can be made available in
all the devices in the Desigo system.
· When a Desigo system or Desigo device is integrated into a Modbus system,
à the PXC001.D with or PXC001-E.D (with a PXA40-RS… extension module if
necessary) acts as a Modbus slave.
A third-party Modbus master can be used to integrate the data points from the
Desigo system via the PX Open Modbus slave.
Further, the data traffic on the Modbus can be monitored and analyzed by use of
the PX Open Monitor software, which is described in the User's Guide for the
Desigo PX Open Monitor [3].
4 / 38
Limitations In RTU mode, the Modbus slaves can only be operated in a point-to-point
configuration. In a multi-drop configuration, it must either be possible to program
the Modbus master with appropriate time settings, or the network must be operated
in ASCII mode.
For details of the Modbus settings, refer to Chapter 4.2.
5 / 38
The parameter IOAddress contains information about how to address a data point
of an I/O block on the Modbus, which function code to use and which format
conversion procedures are required.
The structure of the parameter IOAddress is always as follows (see also Chapter
5.2 "Data conversion"):
M = MappingInfo1(MappingInfo2.MappingInfo3.MappingInfo4.MappingInfo5.MappingInfo6[DataType])/Free syntax
6 / 38
7 / 38
Modbus view
Description of the
Register address
(MappingInfo1)
(MappingInfo4)
(MappingInfo2)
function code
Slave address
Function code
Application
XXX YYYY 1 0X Read Coil Status BI Read multiple BI
XXX YYYY 2 1X Read Input Status BI Read multiple BI
XXX YYYY 3 4X Read Holding Register AI Read multiple AI
XXX YYYY 4 3X Read Input Register AI Read multiple AI
XXX YYYY 5 0X Force Single Coil BO Write single BO
XXX YYYY 6 4X Preset Single Register AO Write single AO
XXX YYYY 15 0X Force Multiple Coils BO Write multiple BO
XXX YYYY 16 4X Preset Multiple Registers AO Write multiple AO
For the IOAddr of function blocks, the following "mapping strings" must be added:
8 / 38
9 / 38
Important! These two Discipline I/Os must be present only once in every CFC program
(application) of a system controller.
Communication
Recommended
Variable Name
Variable Type
Description
Master
Slave
(COMBLK)
Data Type
Block
10 / 38
Recommended
(see also DTS
Variable type
description)
Description
(MSGBLK)
Variable
Name
Data
type
InsDate VAR_INPUT ASCII Entry of engineering date 0
RstSsys VAR_INPUT BOOL Reset PX Open subsystem 0
MsgStppr VAR_INPUT UINT16 Message Stepper 0
ResetMsg VAR_INPUT BOOL Reset Messages 0
ToolMod VAR_INPUT BOOL Tool Mode 0
MsgLvl VAR_INPUT UINT16 Message Level 0
LogfLvl VAR_INPUT UINT16 Logfile Level 0
MsgTrg VAR_INPUT UINT16 Trigger MesNr 0
PrvMsgNr VAR_INPUT UINT16 Before MesNr. 0
NxMsgNr VAR_INPUT UINT16 After MesNr. 0
SfWVn VAR_OUTPUT FLOAT SW Version –
SfwSta VAR_OUTPUT UINT16 SW State –
NumEr VAR_OUTPUT UINT16 Error Counter –
Counter for program errors
ComEr VAR_OUTPUT UINT16 Cfail Counter –
Counter for communication errors
AddMsg2 VAR_OUTPUT FLOAT Mes. Additional 2 –
AddMsg1 VAR_OUTPUT FLOAT Mes. Additional 1 –
License VAR_OUTPUT BOOL License Ok 1) –
TRUE = Identifies licensing as OK.
Res1 VAR_OUTPUT UINT16 License level –
Res2 VAR_OUTPUT UINT16 Number of active data points –
Res3 VAR_OUTPUT SINT16 Number of data points still available –
in the license range
(negative if higher than license)
ErCksum VAR_OUTPUT UINT16 Checksum Error Counter –
IOAddr VAR_INPUT STRING Refers here only to the MSGBLK M=1(1)
and is used to define the internal
mapping table
Rlb usw. Alarm handling for the entire block –
– = Reserved for other third-party solutions
Encoding SwStatus The Pin SwStatus of the MSGBLK shows more detailed and more reliable
information about the subsystem status:
SwStatus Description
0 (EStartCreate) Getting MAC address or Neuron ID.
1 (EStartSuspend) DETDriver terminated, delayed start message will be sent (delay of 1000ms).
2 (EStartDET) Waiting for a valid ID
3 (EStartLicence) License check
4 (EStartRunApplication) New DBase sort
5 (EApliReset) Reset application
6 (EApliDBaseOK) DBase OK, start application init
7 (EApliDBaseContinue) The dbase sort is not finished,
8 (EApliInitOK) Application init OK, start the Driver3rd
9 (EApliInitContinue) The initialization for user data is not finished
10 (EApliDriverOK) Driver init OK
11 (EApliDriverContinue) Driver third init is in process
12 (EApliUserState) Start user application
13 (EApliActivePolling) Polling
14 (EApliActiveServer) Processing server services
11 / 38
12 / 38
· The PX Open Modbus solution integrates data points from Modbus devices to
the Desigo system.
· The values of the Modbus data points and the status of the existing data
connection are mapped to BACnet objects by the PX Open Modbus solution.
· The PX Open Modbus solution can be used either as a Modbus master or as a
Modbus slave.
13 / 38
The following section provides only a brief overview of the Modbus protocol.
For the full specification, refer to Modicon Modbus Protocol Reference Guide [1],
[5], [6].
Master/slave protocol The Modbus is a master/slave protocol. By definition, this means that a Modbus
network contains only one master and at least one slave.
Transactions on the The Modbus master starts the transactions on the network with a slave query. The
Modbus slave either responds positively with the requested service (response) or transmits
an "exception message". In the remainder of this document, these query/response
sequences are also referred to as "Modbus telegrams".
Function codes The type of transaction is defined by the function code transmitted in the Modbus
telegrams. A function code defines the following:
· Structure of the telegram, query and response
· Direction of data transmission (read / write)
· Data format of data point (bit or 16-bit register)
Transmission modes The Modbus protocol defines two alternative serial transmission modes:
These modes have the following characteristics:
RTU mode (Remote Terminal Unit)
· Binary-coded data
· Start and end of telegrams marked by timed pauses (a "silent interval") between
the characters transmitted.
· Check sum algorithm: CRC (Cyclic Redundancy Check)
ASCII mode
· Data in hexadecimal notation
· Start and end of telegrams marked by start and end characters.
· Check sum algorithm: LRC (Longitudinal Redundancy Check)
Telegrams with Certain types of Modbus transactions permit the transmission of a variable number
multiple data points of Modbus data points (bit or 16-bit register) in a single telegram.
14 / 38
The Modbus master reads the data points from the slaves at regular intervals.
Read function codes are 01, 02, 03 or 04.
The Modbus master writes the data points at startup, change of value (COV) and
periodically repeated (R-Functions à see Chapter 5.1.6). Write function codes are
05, 06, 15 or 16.
If a slave fails to respond, the master waits after each query for the parameterized
response timeout time to elapse. This causes a delay in the data exchange.
The following two failure cases are described:
A) Slave fails to · Telegram is repeated 3x or configurable via Diagnostics Point 97 à see Chapter
respond to query from 4.2.
master · If the slave still fails to respond, any pending queries (read or write) for this slave
are skipped until all the pending queries for the other slaves have been
processed once.
B) Slave responds to a · Telegram is repeated 3x or configurable via Diagnostics Point 97 à see Chapter
query by sending an 4.2.
exception message · If the slave continues to respond with an exception message, the next pending
query is transmitted.
Note The state of the Modbus data points is mapped to the "Reliability" parameter, Rlb
(refer to BACnet Reliability, Chapter 3.2.5).
15 / 38
Function Codes 05, 06, 15 and 16 serve to write data point values to the Modbus
slave. These values are written once when the master is started (with a positive
acknowledgement) and are subsequently rewritten only in the event of a change in
the data point value.
If a Modbus slave remains disconnected for 20 seconds (default), when the
connection will be reestablished, all the output values will be rewritten.
This disconnection timeout can be set with the Diagnostics Point D=59 (see
Chapter 4.2)
Modbus master Function Code 01, 02, 03 and 04 are used to read multiple data points from the
Modbus slaves. Function Code 15 and 16 are used to write multiple data points to
the Modbus slave. This collection of multiple data points will be done automatically
in a telegram.
Important! Only the data points with addresses in continuous ascending order are collected
automatically in a telegram.
Modbus slave The number of data points in a telegram is defined by the master request.
The PX Open Modbus slave returns an exception message if it cannot resolve all
the data points of a query.
Error behavior If the Modbus master asks a slave for a data point which does not exist, the master
stops sending collected data points in a telegram, which means the Modbus
master changes to one data point per telegram. Be aware that one data point may
consist of multiple registers, according to the chosen data type (e.g. UINT32 à 2
register). Periodically, the master retries to send collected data points in a
telegram.
The maximum number of register in one telegram can be set with the Diagnostics
Point D=56 and the maximum number of bits (Coils or Inputs) can be set with the
Diagnostics Point D=57 à see Chapter 4.2.
Modbus slave In the Modbus slave mode, the number of data points in a telegram is defined by
the master.
In slave mode, the PX Open Modbus solution returns an exception message if it
cannot resolve all the data points of a Write or Read query.
16 / 38
The status of the Modbus data points is mapped to the Rlb (Reliability) pin.
Reliability value Meaning in Modbus Master Meaning in Modbus Slave
0 / NO_FAULT_DETECTED No error has been found in the No error has been found in the connection to
connection to the slave. the master à It is possible, that the master
has never polled this data point.
2 / OVER_RANGE Value of the Modbus data point is Value of the Modbus data point is higher
higher than the defined value than the defined value range.
range.
3 / UNDER_RANGE Value of the Modbus data point is Value of the Modbus data point is lower than
lower than the defined value the defined value range.
range.
8 / PROCESS_ERROR The slave is responding with an Not applicable in slave mode.
exception code.
10 / Invalid data type configured for Invalid data type configured for data point.
CONFIGURATION_ERROR data point.
68 / INVALID_ADDR Syntax error in address string. Syntax error in address string.
70 / INVALID_PARAM Syntax error in address string Syntax error in address string parameter à
parameter. Only occurs with certain errors when the
master polls the data point.
80 / UNRELIABLE_OBJECT No connection possible. Not applicable in slave mode.
84 / Number of licensed data points Number of licensed data points has been
MEMORY_LIMIT_REACHE has been exceeded. exceeded.
D
In the event of an error, more information can be obtained by use of the PX Open
Monitor Tool (see also User's Guide, PX Open Monitor [3]).
Suppression of alarm If one or more slaves fail to respond, the Modbus master sets the Reliability
messages in the event parameter of all the affected I/O blocks to UNRELIABLE_OBJECT. In the case of a
of a bus failure common source, a very large number of alarms can be triggered (a "burst"), which
can overload the entire system.
To avoid this behavior, the Reliability can be suppressed. The "free syntax" in the
I/O Address string is used for this purpose:
M=X(Y.Y.Y.Y.Y[Z])/R15
We recommend that at least one DP per slave should NOT be suppressed, that the
slave failure can be seen.
17 / 38
For the communications monitoring and status information, there is the PX Open
Monitor [3].
The main screen displays the following information:
1. Version information of the PX Open application
2. Communication block information
3. Message block information
4. Log File information
5. Connection status
18 / 38
19 / 38
The I/O Address pin of the I/O block contains information which defines
· how to address a data point
· which function code to use
· which format conversion is required
M = MappingInfo1(MappingInfo2.MappingInfo3.MappingInfo4.MappingInfo5.MappingInfo6[DataType])/Free syntax
4.1.1 Overview
20 / 38
MappingInfo2 In Modbus "Master" and "Slave" modes, MappingInfo2 contains the function code.
Since the function code also defines the direction of the data traffic on the Modbus,
this means that the I/O block types with which the various function codes can be
linked will differ, depending on whether the Modbus solution is operated in master
or slave mode.
Function Code Operation as Master Operation as slave
Input type Output type Input type Output type
01 Read Single Coil Admissible Illegal Illegal Admissible
02 Read Input Register Admissible Illegal Illegal Admissible
03 Read Holding Register Admissible Illegal Illegal Admissible
04 Read Input Register Admissible Illegal Illegal Admissible
05 Force Single Coil Illegal Admissible Admissible Illegal
06 Preset Single Register Illegal Admissible Admissible Illegal
15 Force Multiple Coil Illegal Admissible Admissible Illegal
16 Preset Multiple Register Illegal Admissible Admissible Illegal
MappingInfo4 MappingInfo4 contains the Register address (= Register number – 1) à The same
is valid for Bit Registers.
For values transmitted in two or four registers (32 or 64 bit), the lowest register
address must be entered here.
MappingInfo5 The BitPos function can be enabled with values 1 … 16. Activation is only
permissible with the appropriate combination of data type and function code (see
Chapter 5.1.2).
A value of 0 disables the BitPos function.
MappingInfo6 Values 1 … 9 enable the data conversion functions. Activation is only permissible
with the appropriate combination of data type and function code.
If a value of 0 is defined, no data conversion will take place.
21 / 38
22 / 38
In most cases, the information provided by the COMBLK and MSGBLK is sufficient.
For special functions or modifications, the PX Open Modbus solution includes a
group of output blocks which can be used to set special settings.
It is not compulsory for the following I/O blocks to be present in the CFC program.
If they are not present, the default values will be used as listed.
Important! These parameters are read once only after power-up. Changes at runtime will only
take effect after a controller restart.
23 / 38
4)
Name Offset Name Slope
I/O Block Type AO I/O Block Type AO
Mapping Info D=109 Mapping Info D=115
Meaning General adjustable Offset for MI / MO Meaning General adjustable Slope for AI / AO
Eng. unit --- Eng. unit ---
Default 0 Default 0
Range Integer Range -3.403E38..3.403E38
4) Individual adjustable offset for MI/MO see Chapter 5.1.4
24 / 38
In some slave devices, the Modbus protocol is not fully implemented. Not all the
function codes are supported or there is a restriction about the maximum number
of registers in one telegram.
In order to ensure the efficient integration of these devices, the PX Open Modbus
solution provides the following functions.
Some slave devices may not support the transmission of several data points in a
combined Modbus telegram.
In such cases the process of combining data points can be suppressed for specific
individual data points. The "free syntax" in the IOAdress string is used for this
purpose:
M=X(Y.Y.Y.Y.Y[Z])/R0
The Modbus protocol only allows single bits to be read/write with Function Codes
01 (Read Coil Status), 05 (Force Single Coil) and 15 (Force Multiple Coils).
However, some slave devices do not support these function codes.
The Bit information of a 16 bit register can be read/written over the function codes
03 (Read Holding Registers), 04 (Read Input Registers), 06 (Preset Single
Register) and 16 (Preset Multiple Registers).
Example Following an example of the I/O block types "Binary Input" reading bits from Input
Register 1 of slave address1:
Binary Input 1 à M=1(4.0.1.16.0[BOOL])
Binary Input 2 à M=1(4.0.1.15.0[BOOL])
Binary Input 3 à M=1(4.0.1.7.0[BOOL])
Binary Input 4 à M=1(4.0.1.4.0[BOOL])
Example of a Modbus register 1 linked with Function Code 04 (Read Input Register)
25 / 38
Example of a Modbus register 1 linked with Function Code 06 (Force Single Register)
26 / 38
Analog Output
PrVal: 100
PrVal: 100
Analog Output
Response: Ok
PgmVal: 200 PrVal: 200
PrVal: 200
Feedback-addressing The Feedback address FbAddr has an offset of 1000 relative to IOAddr:
for the above example
27 / 38
Direct feedback The free syntax / R1 convert the UINT16 to a BACnet conform BOOLEAN.
from a BO
Example of the above direct feedback address:
M=1001(5.0.0.0.0[UINT16])/R1
The adjustable offset for MI/MO can be set over the following individual or general
settings:
M=X(Y.Y.Y.Y.Y[TYPE])/M=Offset
General settings:
28 / 38
The Modbus protocol defines the 16-bit register as the largest data unit. Multi
Register Values >= 32 bit values must therefore be transmitted in two or more
registers.
The PX Open Modbus solution automatically occupies two 16-bit registers for the
data types concerned (FLOAT, UINT32 and SINT32), and also ensures that they
are always combined for transmission in a shared telegram (note that this requires
a function code capable of transmitting several registers in a single telegram.
The following table contains the information about how to configure this 64-Bit
function in the free syntax of the mapping points in the CFC editor:
STOP Exception! For Float, only /x2 and /x0.5 are supported.
29 / 38
30 / 38
There are three levels which determine the period of the writing.
To activate the periodic writing of outputs, the following R functions must be added
to the free syntax of the address string.
New Function:
STOP Important! The writing interval must be defined in the output points in pin Hrtbt à This function
. will be supported from FW version V6.00.116.
For new solutions please do only use the periodic writing over the Hrtbt function in
the output points.
In many devices incorporating the Modbus, special data formats (e.g. BCD, ACM
etc.) are used. There is a further problem, in that values which occupy two
registers, the sequence of the actual values can be defined in different ways.
The PX Open Modbus solution provides a whole range of conversion functions for
this application.
31 / 38
The specified data type defines the data type to which the Modbus data point is
mapped. The following data types are implemented:
· BOOL
· UINT16
· SINT16
· UINT32
· SINT32
· FLOAT
The selected data type is given in brackets at the end of the "MappingInfo" string.
Combination of The format of a Modbus data point can be influenced at various points on its
DataType, Format, journey through the PX Open system. The data format can be converted at the
BitPos and Function transition points A, B and C.
Code
Transition A is determined by the block type selected in CFC and the data type
selected in the IOAddress.
Transition B is determined by the data type selected in the IOAddress, the
conversion type in MappingInfo6 and the value for the BitPos function in
MappingInfo6.
Transition C is determined by the conversion type in MappingInfo6, the value for
the BitPos function in MappingInfo6 and the selected function code.
Checking There is no check of the selected combination in Transition A, but the combinations
used in Transition B and C are checked. The system will reject any conversion
processes which result in a loss of data (e.g. conversion from FLOAT to BIT).
The direction of data flow determines which combinations are possible. This
explains why there are only four different overview tables below.
Loss of accuracy with The conversion of 32-bit data types into FLOAT values is associated with a loss of
conversions into accuracy. The loss is 8 or 9 bits (for a signed and unsigned 32-bit value
FLOAT values respectively). This type of conversion arises with the combination of standard input
blocks with data types SINT32 and UINT32.
32 / 38
Permissible combinations for input block types with Modbus operating as Master:
MappingInfo5
33 / 38
Mapping Info6
Conv. Parameter
0 No Conv. 05 Force S. Coil
06 Preset S.Reg 06 Preset S.Reg 06 Preset S.Reg
15 Force M.Coil
16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg
1 Swap Register 16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg
2 BCD16A 06 Preset S.Reg
16 Preset M.Reg
3 BCD 16B 06 Preset S.Reg
16 Preset M.Reg
4 BCD32A 16 Preset M.Reg
5 BCD32B 16 Preset M.Reg
6 ACM16 16 Preset M.Reg
7 U32BITMOD10000 16 Preset M.Reg
8 S32BITMOD10000 16 Preset M.Reg
9 Swap Bytes 16 Preset M.Reg 16 Preset M.Reg 16 Preset M.Reg
BitPos 06 Preset S.Reg
16 Preset M.Reg
MappingInfo5
Permissible combinations for input block types with Modbus operating as Slave:
Mapping Info BOOL SINT16 UINT16 SINT32 UINT32 FLOAT
DataType (2 Registers) (2 Registers) (2 Registers)
MappingInfo6
Conv. Parameter
MappingInfo5
34 / 38
MappingInfo6
Conv. Parameter
0 No Conv. 01 Read Coil
02 Read Input
03 Read 03 Read 03 Read 03 Read 03 Read 03 Read
Holding Holding Holding Holding Holding Holding
04 Read Input 04 Read Input 04 Read Input 04 Read Input 04 Read Input 04 Read Input
1 Swap Register 03 Read 03 Read 03 Read
Holding Holding Holding
04 Read Input 04 Read Input 04 Read Input
2 BCD16A 03 Read
Holding
04 Read Input
3 BCD 16B 03 Read
Holding
04 Read Input
4 BCD32A 03 Read
Holding
04 Read Input
5 BCD32B 03 Read
Holding
04 Read Input
6 ACM16 03 Read
Holding
04 Read Input
7 03 Read
U32BITMOD10000 Holding
04 Read Input
8 03 Read
S32BITMOD10000 Holding
04 Read Input
9 Swap Bytes 03 Read 03 Read 03 Read
Holding Holding Holding
04 Read Input 04 Read Input 04 Read Input
BitPos
MappingInfo5
35 / 38
7 Technical data
For technical data, refer to the following documents:
· PX Open System controller PXC001, data sheet [4]
· PX Modbus solution, data sheet [2]
36 / 38
37/38
38 / 38