Modbus for VLTFC-series6
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
Modbus RTU for FC 100
Agenda
Overview
Modbus ASCII/RTU
Frame Structure
Exception codes
Function codes
Coils
Holding registers
Drive parameters
RS-485
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
Modbus RTU for FC 100
Overview
MODBUS Protocol is a messaging structure created by MODICON
company to connect PLC to programming tools.
It is now widely used to establish master-slave communication between
intelligent devices.
MODBUS is independent of the physical layer.
It can be implemented using RS232, RS422, or RS485 or over a variety
of media (e.g. fibre, radio, cellular, etc...).
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
Modbus RTU for FC 100
MODBUS is independent of the physical layer:
Modbus Application Layer
Modbus on TCP
TCP
IP
Other
Modbus+/HDLC
Master/Slave
Ethernet II
802.3
Other
RS-485
RS-485/RS-232
Ethernet
physical layer
Modbus +
Modbus RTU
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
Modbus RTU for FC 100
Modbus ASCII and Modbus RTU
The MODBUS protocol comes in 2 versions :
ASCII transmission mode:
Each eight-bit byte in a message is sent as 2 ASCII characters.
RTU transmission mode
Each eight-bit byte in a message is sent as two four-bit hexadecimal characters.
The main advantage of the RTU mode is that it achieves higher throughput.
ASCII mode allows time intervals of up to 1 second to occur between characters without
causing an error (e.g. bar-code scanners).
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
Modbus RTU for FC 100
Modbus frame structure
The Modbus frame structure is the same for requests (master -> slave) and responses
(slave -> master):
Modbus RTU:
silence
Address
Function
Data
Checksum
silence
Silence >= 3.5 characters
Modbus ASCII:
Start
Address
Function
Data
3A hex
CR
0D hex
2009-June-22
Flemming Huusmann DD-SMPM
Checksum
LF
0A hex
Drives Division
Confidential / Property of Danfoss Drives A/S
Modbus RTU for FC 100
Address field
Address
Function
Data
Checksum
Valid slave device addresses are in the range of 0 ... 247 decimal.
The individual slave devices are assigned addresses in the range of 1 ... 247.
Value 0 is reserved for broadcast messages (no response).
Request:
A master addresses a slave by placing the slave address in the address field of
the message.
Response:
When the slave sends its response, it places its own address in this address field
of the response to let the master know which slave is responding.
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
Modbus RTU for FC 100
Function Field
Address
Function
Data
Checksum
Valid codes are in the range of 1 -> FF hex.
Request:
The function code field tells the slave what kind of action to perform.
Response:
For a normal response, the slave simply echoes the original function code.
For an exception response, the slave returns a code that is equivalent to the original
function code with its most significant bit set to a logic 1.
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
Modbus RTU for FC 100
Data Field
Address
Function
Data
Checksum
Request:
The data field contains additional information which the slave must use to take the action
defined by the function code. This can include items like register addresses, quantity of
items to be handled, etc...
Response:
If no error occurs, the data field contains the data requested.
If an error occurs, the field contains an exception code that the master application can use
to determine the next action to be taken.
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
Modbus RTU for FC 100
FC 100 Modbus Exception Codes
code in
data field
Exception code description
0x00
The parameter number does not exist
0x01
There is no write access to the parameter
0x02
The data value exceeds the parameter limits
0x03
The sub-index in use does not exist
0x04
The parameter is not of the array type
0x05
The data type does not match the parameter called
0x06
Only reset
0x07
Not changeable
0xB
No write access
0x11
Data change in the parameter called is not possible in the present mode
0x12
Other error
0x40
Invalid data address
0x41
Invalid message length
0x42
Invalid data length or value
0x43
Invalid function code
0x82
There is no bus access to the parameter called
0x83
Data change is not possible because factory set-up is selected
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
10
Modbus RTU for FC 100
Checksum Field
Address
Function
Data
Checksum
Modbus RTU uses CRC: Cyclical Redundancy Check (2 byte)
Modbus ASCII uses LRC: Longitudinal Redundancy Check (1 bytes)
Request:
The checksum is calculated by the master and sends to the slave.
Response:
The checksum is re-calculated by the slave and compared to the value sent by the master.
If a difference is detected, the slave will not construct a response to the master.
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
11
Modbus RTU for FC 100
Modbus RTU Frame example:
Function code = 03hex : Read Holding Registers...
Request :
1 byte
1 byte
2 bytes
2 bytes
2 bytes
Slave
Address
Function
code=0x03
First word
address
Number of
words to read
CRC16
Response :
1 byte
1 byte
2 bytes
2 bytes
2 bytes
2 bytes
Slave
Address
Function
code=0x03
Number of
bytes read
Value of the
first word
Value of the
last word
CRC16
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
12
Modbus RTU for FC 100
Modbus RTU Frame example:
Function code = 06hex : Write single Register
Request :
1 byte
1 byte
2 bytes
2 bytes
2 bytes
Slave
Address
Function
code=0x06
Word
address
Value of word
CRC16
Response :
1 byte
1 byte
2 bytes
2 bytes
2 bytes
Slave
Address
Function
code=0x06
Word address
Value of word
CRC16
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
13
Modbus RTU for FC 100
Modbus RTU Frame example:
Function code = 10hex : Write Multiple Registers
Request :
1 byte
1 byte
2 bytes
2 bytes
Slave
Address
Function
code=0x10
First word
address
Number of
words to write
1 byte
Number of
bytes
2 bytes
Value of the
first word
2 bytes
CRC16
Response :
1 byte
1 byte
2 bytes
Slave
Address
Function
code=0x10
First word
address
2 bytes
Number of
words to write
2 bytes
CRC16
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
14
Modbus RTU for FC 100
Supported Modbus Function Codes in FC 100
The Function Code tells what type of Modbus telegram it is...
Function
Function
code
Read coils
1 hex
Read holding registers
3 hex
Write single coil
5 hex
Write single register
6 hex
Diagnostics*
8 hex
Write multiple coils
F hex
Write multiple registers
10 hex
Get comm. event counter
B hex
Report slave ID*
11 hex
Read Device Identification*
2B hex
*=
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
15
Modbus RTU for FC 100
Supported Modbus Function Codes
Function Code 8: Diagnostics
Function
Diagnostics
Function
code
Sub-function code
Sub-function
Restart communication
Return diagnostic register
10 (0xA)
Clear counters and diagnostic register
11 (0xB)
Return bus message count
12 (0xC)
Return bus communication error count
13 (0xD)
Return bus exception error count
14 (0xE)
Return slave message count
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
16
Modbus RTU for FC 100
Supported Modbus Function Codes
Function Code 8: Diagnostics, sub-function 2 Return diagnostics register
Function
Function
code
Diagnostics
Sub-function code
Sub-function
Return diagnostic register
Response:
MSB
LSB
Description
Length
Data
Function code
1 byte
0x08
Sub-function code
2 bytes
0x0002
4 bytes
Alarm word
4 bytes
Warning word
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
17
Modbus RTU for FC 100
Supported Modbus Function Codes
Function Code 8: Diagnostics, sub-function 2 Return diagnostics register
Function
Function
code
Diagnostics
Sub-function code
11
Sub-function
Return Bus Message Count
Response:
MSB
LSB
Description
Length
Data
Function code
1 byte
0x08
Sub-function code
2 bytes
0x000B
Data
2 bytes
Par. 8-80 Bus Message Count
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
18
Modbus RTU for FC 100
Supported Modbus Function Codes
Function Code 8: Diagnostics, sub-function 2 Return diagnostics register
Function
Function
code
Diagnostics
Sub-function code
12
Sub-function
Return bus communication error count
Response:
MSB
LSB
Description
Length
Data
Function code
1 byte
0x08
Sub-function code
2 bytes
0x000C
Data
2 bytes
Par. 8-81 Bus Error Count
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
19
Modbus RTU for FC 100
Supported Modbus Function Codes
Function Code 8: Diagnostics, sub-function 2 Return diagnostics register
Function
Function
code
Diagnostics
Sub-function code
13
Sub-function
Return slave message count
Response:
MSB
LSB
Description
Length
Data
Function code
1 byte
0x08
Sub-function code
2 bytes
0x000D
Data
2 bytes
Par. 8-83 Slave Error Message Count
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
20
Modbus RTU for FC 100
Supported Modbus Function Codes
Function Code 8: Diagnostics, sub-function 2 Return diagnostics register
Function
Function
code
Diagnostics
Sub-function code
14
Sub-function
Return slave message count
Response:
MSB
LSB
Description
Length
Data
Function code
1 byte
0x08
Sub-function code
2 bytes
0x000E
Data
2 bytes
Par. 8-82 Slave Message Count
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
21
Modbus RTU for FC 100
Supported Modbus Function Codes
Function Code 11hex: Report Slave ID
Response:
MSB
LSB
Function
Length
Data
Function code
1 byte
0x11
FC
Parameter
Name
Byte count
1 byte
1-251(N)
15-40
FC Type
Slave ID
0-250 bytes
Slave ID
15-41
Power section
Run status Indicators
1 bytes
0x00 or 0xFF
15-42
Voltage
15-43
SW version
0x00 if coil Stopped / Running is 0 (coil no. 44)
0xFF if coil Stopped / Running is 1 (coil no. 44)
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
22
Modbus RTU for FC 100
Supported Modbus Function Codes
Function Code 2Bhex: Device Identification
Response:
MSB
Description
Length
Data
Function code
1 byte
0x2B
MEI type
1 byte
0x0E
Read device ID code
1 byte
1 or 2 or 3 or 4
Conformity level
1 byte
1 or 2 or 3 or 81 or 82
More Follows
1 byte
0x00 or 0xFF
Next Object ID
1 byte
Object ID number
Number of objects
1 byte
0x00 0x0F
1st object ID
1 byte
1st object length
1 byte
1st object Value
1st obj. length
Device Ident.
...
LSB
...
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
23
Modbus RTU for FC 100
Device Identification
FC Parameter
Name
Modbus Obj. ID
15-51
FC Serial
0x80
Private object
15-60 [0]
Option: Slot A
0x81
Private object
15-61 [0]
Option SW: Slot A
0x82
Private object
15-62 [0]
Opt. ord. no.: Slot A
0x83
Private object
15-60 [1]
Option: Slot B
0x84
Private object
15-61 [1]
Option SW: Slot B
0x85
Private object
15-62 [1]
Opt. ord. no.: Slot B
0x86
Private object
15-60 [2]
Option: Slot C0
0x87
Private object
15-61 [2]
Option SW: Slot C0
0x88
Private object
15-62 [2]
Opt. ord. no.: Slot C0
0x89
Private object
15-60 [3]
Option: Slot C1
0x8A
Private object
15-61 [3]
Option SW: Slot C1
0x8B
Private object
15-62 [3]
Opt. ord. no.: Slot C1
0x8C
Private object
15-45
Option: Slot D
0x8D
Private object
2009-June-22
Flemming Huusmann DD-SMPM
Modbus description
Drives Division
Confidential / Property of Danfoss Drives A/S
24
Modbus RTU for FC 100
Coils (single bit)
Coil number
Description
Signal direction
1 16
Frequency converter control word
Master -> slave
17 32
Frequency converter speed or setpoint reference
Range 0x0 0xFFFF (-200% ...
~200%)
Master -> slave
33 48
Frequency converter status word
Slave -> master
49 64
Open loop mode: Frequency converter
output frequency
Closed loop mode: Frequency
converter feedback signal
Slave -> master
65
Parameter write control
Master -> slave
66 - 65536
0=
Parameter changes are
written to the RAM of
the frequency converter
1=
Parameter changes are
written to the RAM and
EEPROM of the
frequency converter.
Reserved
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
25
Modbus RTU for FC 100
Holding registers (words)
Register number
Description
00001 00006
Reserved
00007
Last error code from an FC data object interface
00008
Reserved
00009
Parameter index*
00010 00999
000 parameter group (parameters 001 through 099)
01000 01999
100 parameter group (parameters 100 through 199)
02000 02999
200 parameter group (parameters 200 through 299)
03000 03999
300 parameter group (parameters 300 through 399)
04000 04999
400 parameter group (parameters 400 through 499)
49000 49999
4900 parameter group (parameters 4900 through 4999)
50000
Input data: Frequency converter control word register (CTW).
50010
Input data: Bus reference register (REF).
50200
Output data: Frequency converter status word register (STW).
50210
Output data: Frequency converter main actual value register
(MAV).
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
26
Modbus RTU for FC 100
Holding registers (words), addressing
Holding register 00001 is addressed as register 40001 in the data address
field of the message.
The function code field already specifies a holding register operation.
Therefore, the 4XXXX reference is implicit.
Example: Par 0-01 Language:
Holding reg. 00010, addressed as: 40010
Example: Par 20-21 Feedback: (NB: 32 bit)
Holding reg. 020210, addressed as: 420210 (high
word)
Holding reg. 020211, addressed as: 420211 (low
word)
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
27
Modbus RTU for FC 100
FC 100 Frequency Converter Set-up
To enable Modbus RTU on the FC 100, set the following parameters:
Parameter no.
Parameter name
Setting
8-30
Protocol
Modbus RTU
8-31
Address
1 247
8-32
Baud rate
2400 - 115200
8-33
Parity / Stop bits
Even parity, 1 stop bit (default)
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
28
Modbus RTU for FC 100
RS-485 physics
5V
Master
650
650
D1
120
1 nF
120
1 nF
D0
Common
Slave 2
Slave 1
Maximum length of bus
1000 m at 19200 bps
Maximum number of stations (without repeater)
32 (31 slaves)
Maximum length of tap links
20 m for one tap link
40 m divided by the number of tap links
Bus polarisation
650 at 5V and common for the master
Line terminator
120 - 0,25Wm in series with 1nF 10V
Common polarity
Yes (Common) connected to the PG
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
29
Modbus TCP
MCA 122
Modbus TCP is the oldest Industrial Ethernet
Protocol
Was introduced by Modicon back in 1999.
The Protocol is widely used inside:
Water/Wastewater and inside companies
standardizing their PLC system on
Modicon/Group Schneider PLCs
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
30
Modbus TCP
MCA 122
Modbus RTU to Modbus TCP
Easy connection to Group Schneider PLCs and leading
SCADA systems
High performance option, capable of execute
commands in 5mSec rate
Two Ethernet ports with build in switch, enabling line
structure.
No need for expensive switches, due to the build in
switch,
Build in web server, for easy status from remote PC
E-mail notify, that can send E-mail if Warning/alarm
occurs
Register mapping equal to Modbus RTU, which allows a
easy upgrade from
High speed access from MCT-10 Setup Software via
Ethernet
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
31
Modbus RTU/TCP
Read/write block of data (Process data)
Function code = 03hex : Read Holding Registers...
Request :
1 byte
1 byte
2 bytes
2 bytes
2 bytes
Slave
Address
Function
code=0x03
First word
address
Number of
words to read
CRC16
Function code = 10hex : Write Multiple Registers
Request :
1 byte
1 byte
2 bytes
2 bytes
Slave
Address
Function
code=0x10
First word
address
Number of
words to write
1 byte
Number of
bytes
2 bytes
2 bytes
Value of the
first word
CRC16
This is only possible with consecutive registers (no holes in the range)
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
32
Modbus RTU/TCP
Read/write block of data (Process data)
Since parameters are organized in registers
with jumps of 10, it is not possible to make
block-read/write.
Register #
10
11
12
13
14
15
16
17
18
19
20
21
2009-June-22
Flemming Huusmann DD-SMPM
Data
Par. 0-01
Par. 0-02
Drives Division
Confidential / Property of Danfoss Drives A/S
33
Modbus RTU/TCP
Read/write block of data (Process data)
To enable block-read/write, a block of
process-data has been defined.
Par. 281 and 291 is not used.
Can also be used for down-mapping of
parameters
WRITE
Block is below reg. #10,000 which is
accessible for all PLCs
Available on Modbus TCP
Will also be available on Modbus RTU
READ
Data
2810
CTW
12-21[0]
8-43[0]
2811
REF
12-21[1]
8-43[1]
2812
PCD 3
12-21[2]
8-43[2]
2813
PCD 4
12-21[3]
8-43[3]
2814
PCD 5
12-21[4]
8-43[4]
2815
PCD 6
12-21[5]
8-43[5]
2816
PCD 7
12-21[6]
8-43[6]
2817
PCD 8
12-21[7]
8-43[7]
2818
PCD 9
12-21[8]
8-43[8]
2719
PCD 10
12-21[9]
8-43[9]
2910
STW
21-22[0]
8-44[0]
2911
MAV
21-22[1]
8-44[1]
2912
PCD 3
21-22[2]
8-44[2]
2913
PCD 4
21-22[3]
8-44[3]
2914
PCD 5
21-22[4]
8-44[4]
2915
PCD 6
21-22[5]
8-44[5]
2916
PCD 7
21-22[6]
8-44[6]
2917
PCD 8
21-22[7]
8-44[7]
2918
PCD 9
21-22[8]
8-44[8]
2919
PCD 10
21-22[9]
8-44[9]
2009-June-22
Flemming Huusmann DD-SMPM
Modbus TCP
Modbus RTU
Mapping parameter
Register #
Drives Division
Confidential / Property of Danfoss Drives A/S
34
Modbus RTU/TCP
Read/write block of data (Process data)
...
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
35
Modbus
Want to know more?
VLT FC 100 LonWorks:
MG.11.E1.02
[Link]
2009-June-22
Flemming Huusmann DD-SMPM
Drives Division
Confidential / Property of Danfoss Drives A/S
36