GEI-100696E

WorkstationST Modbus® Feature

Instruction Guide
These instructions do not purport to cover all details or variations in equipment, nor to provide for every possible
contingency to be met during installation, operation, and maintenance. The information is supplied for informational
purposes only, and GE makes no warranty as to the accuracy of the information included herein. Changes, modifications,
and/or improvements to equipment and specifications are made periodically and these changes may or may not be reflected
herein. It is understood that GE may make changes, modifications, or improvements to the equipment referenced herein or to
the document itself at any time. This document is intended for trained personnel familiar with the GE products referenced
herein.
This document is approved for public disclosure.
GE may have patents or pending patent applications covering subject matter in this document. The furnishing of this
document does not provide any license whatsoever to any of these patents.
GE provides the following document and the information included therein as is and without warranty of any kind, expressed
or implied, including but not limited to any implied statutory warranty of merchantability or fitness for particular purpose.
For further assistance or technical information, contact the nearest GE Sales or Service Office, or an authorized GE Sales
Representative.

Revised: Jul 2014

Issued: Dec 2007

Copyright © 2007 - 2014 General Electric Company, All rights reserved.

___________________________________
* Indicates a trademark of General Electric Company and/or its subsidiaries.
All other trademarks are the property of their respective owners.

We would appreciate your feedback about our documentation.

Please send comments or suggestions to controls.doc@ge.com

For public disclosure

 Document Updates
Document Date Update Description
GEI-100696E July 2013 New format Create a pdf in the new format.

2 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Contents
1 Overview ....................................................................................................................................................4
2 Configuration...............................................................................................................................................5
2.1 Enable the Modbus Feature.......................................................................................................................7
2.2 Configure the Modbus Feature ..................................................................................................................9
2.3 Modbus Properties ................................................................................................................................ 15
2.4 Hardware Interface Properties ................................................................................................................. 18
2.5 Master Message Properties ..................................................................................................................... 19
2.6 Slave Properties.................................................................................................................................... 20
2.7 Data Structure Properties........................................................................................................................ 20
2.8 Scaling ............................................................................................................................................... 21
2.9 Spare Values ........................................................................................................................................ 24
2.10 Importing or Exporting .csv Files ........................................................................................................... 25
2.11 Error/Warning Messages....................................................................................................................... 26
3 Runtime.................................................................................................................................................... 31
3.1 WorkstationST Status of Features............................................................................................................. 31
3.2 WorkstationST Additional Status.............................................................................................................. 33
3.3 Tracing ............................................................................................................................................... 39
3.4 Ethernet Messages ................................................................................................................................ 41
3.5 Serial Messages .................................................................................................................................... 42
3.6 Modbus Protocol Quick Reference ........................................................................................................... 43
3.7 Slave Exception Response Format............................................................................................................ 43
3.8 Monitoring Live Values.......................................................................................................................... 44
4 Troubleshooting ......................................................................................................................................... 45
4.1 Slave Exception Responses..................................................................................................................... 45
5 Terms ....................................................................................................................................................... 47

Instruction Guide GEI-100696E 3

For public disclosure
1 Overview
The ToolboxST* application allows you to configure the Modbus® feature that runs in a
workstation configured with the WorkstationST* application (WorkstationST computer).
Modbus is an application layer messaging protocol for client/server communication
between components connected on different types of busses or networks. The
WorkstationST application supports both serial and Ethernet communication, and can
operate as both a Master and a Slave. It is possible to have serial and Ethernet Masters
and Slaves all running at the same time, within the limits of the computer used.

4 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
2 Configuration
When the Modbus item in the component Tree View is selected, the properties that
display in the Property View apply to all connections. When the Modbus item is
expanded, Master and Slave items display. These are organizational categories with no
configuration properties. When you insert a hardware interface into either a Master or a
Slave, several configuration properties display in the Property Editor. One or more Slaves
may be inserted under each hardware interface. Slave definitions consist of four types of
data structures:

• Holding Registers
• Holding Coils
• Input Registers
• Input Coils
The Slave data structures represent different data depending on whether the Slave
definition being configured is under the Masters or the Slaves item in the Modbus Tree
View. A Slave definition under the Slaves item is the WorkstationST Modbus data
structure sent to the remote Master. A Slave definition under the Masters item reflects a
local copy of the remote Slave data that is mapped to ToolboxST variables. Each Slave
under the Masters item also contains configuration properties for each Modbus message
to be sent by the Master, including the rate at which the messages are sent.

Modbus Data Flow

Instruction Guide GEI-100696E 5

For public disclosure
 Modbus Slaves are configured in two steps:

• Creating the Modbus data structures, which comprise the memory map (address and
datatype) of every message to be sent or received by Modbus.
• Attaching each Modbus data point to a ToolboxST variable, which is then used to
transfer data to or from the corresponding Modbus data point.
Each data structure contains Modbus data points that are created by connecting a
ToolboxST variable to a Modbus address in one of the data structures. Each Modbus data
point is configured with an address and a data type to be sent or received over Modbus.
When the WorkstationST computer is operating as a Master, the data structure to be
configured is determined by the remote Slave component. This means that the user must
know the details of the remote Slave component to configure the WorkstationST
computer's Master data structure.
When the WorkstationST computer is operating as a Slave, the data structure to be
configured is primarily determined by the WorkstationST application. Any address and
datatype can be assigned. However, in this case, you must also communicate with the
remote Master to determine if any special addressing or data types are required. Once the
data structures are determined, the Modbus data points are connected to the ToolboxST
variables.
Once the Slave definitions are configured, the Modbus Master Messages must be
configured for each Slave under the Masters item. These messages determine the values
to be read from, or written to the Slave, and at what frequency.

6 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.1 Enable the Modbus Feature
� To enable the Modbus feature
1. From either the System Editor Tree View or the Summary View, doubleclick
the WorkstationST component. The WorkstationST Component Editor
displays.

Note The EGD Configuration Server must be set to True in one of the configured
WorkstationST computers (it does not have to be the WorkstationST computer with
Modbus enabled).

Instruction Guide GEI-100696E 7

For public disclosure
 2. From the Tree View, select Network Adapter 0.

8 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.2 Configure the Modbus Feature

Note Modifying the Modbus configuration results in a minor difference in the

configuration, however, removal of all Modbus points will result in a major difference
forcing an offline load.

� To configure a Modbus Master

1. From the Modbus tab, right-click the Masters item, then select Insert New HW
Interface.

Instruction Guide GEI-100696E 9

For public disclosure
 2. From the Tree View, right-click the interface you inserted, and select Insert New
Modbus Slave.

3. From the Tree View, select the Slave you inserted. From the Summary View,
Holding Registers and Input Registers tabs, add variables. From the Holding
Coils and Input Coils tabs, enter Boolean variables.

Note Many vendors refer to Coil/Register Numbers without including the Table Name,
because it is implied by the numbers they use.

The following table displays how vendors’ Coil/Register Numbers correspond to

WorkstationST Table Names and Addresses:

Vendor's Coil/Register Table Name in Address in WorkstationST Access

Numbers WorkstationST configuration
configuration
0001 - 9999 Holding Coils 0001 - 9999 Read-Write

10001 - 19999 Input Coils 0001 - 9999 Read-Only

30001 - 39999 Input Registers 0001 - 9999 Read-Only

40001 - 49999 Holding Registers 0001 - 9999 Read-Write

Modbus protocol uses Function Code 3 to read Holding Registers, whose vendor numbers
start with a 4, and Function Code 4 to read Input Registers, whose vendor numbers start
with a 3.

10 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Note When you connect a Modbus variable, the data type defaults to the data type of the
variable that was connected. Some data types use more than one register. (Refer to the
section, Data Types.) If you want the data type to be different than the variable that was
connected, it is recommended that you change the data type before connecting the next
variable. This is because the program reserves as many registers as needed for that data
type and changing the data type later could leave you with either holes or overlapping
registers. For example, variables A and B are LREALs in the system, but you want to send
them over Modbus as REALs. Variable A would be put at address 00001 and variable B at
address 00005 unless you changed A’s data type to a REAL before connecting B.

Instruction Guide GEI-100696E 11

For public disclosure
 The Property Editor Message Settings are as follows:
Function Code is the function code used for this message.
Number of Registers is the number of registers or coils read or written for this message.
Period Multiplier is the number multiplied by the Master Message Base Period to
configure how frequently this message is sent.
Start Address is the start address for this message. Depending on which Function Code
was set, this refers to either a coil or register number.

Note The lowest start number is one.

12 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 � To configure a Modbus Slave
1. From the Modbus tab, right-click Slaves, then select Insert New HW Interface.
2. From the Property Editor, select the Interface Type (Ethernet or Serial)
configured for the master. If you are using Ethernet, select the IP Address of your
computer.

Instruction Guide GEI-100696E 13

For public disclosure
 3. From the Tree View, right-click the new interface you inserted, then select Insert
New Modbus Slave.

4. From the Tree View, select the Slave you inserted. From the Summary View, add
variables to the Holding Registers and Input Registers tabs. Enter Boolean
variables to the Holding Coils and Input Coils tabs.

14 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.3 Modbus Properties

Instruction Guide GEI-100696E 15

For public disclosure
 Modbus Properties
Property Lower/Upper Description
Limits or Allowed
Values
Big Endian for Data True/False If set to True (default), all data in the body of the Modbus message is
On Modbus converted to Big Endian before being placed on Modbus. It is assumed that
all data in the body of a received message is Big Endian, and if required by
the local computer, is converted to Little Endian before being used locally.

Big Endian For MBAP True/False If set to True (default), the fields in the Modbus Application Protocol Header
(Tcp Hdr) MBAP are converted to Big Endian before being placed on Modbus. It is
assumed that in received messages, these fields are in Big Endian, and if
required by the local computer, are converted to Little Endian before being
used locally.

Swap Words For True/False All Dint data types are 32 bits. If set to True, the words are swapped before
Dints being sent over Modbus, and before being used when read from Modbus.
For example,

32 bits Data 0x01234567

Transmits 0x45, 0x67, 0x01 and 0x23

Swap Words For True/False All LReal data types are 64 bits. If set to True, the words are swapped
LReals before being sent over Modbus, and before being used when read from
Modbus. For example,

64 bits Data 0x0123456789ABCDEF

Transmits 0x45, 0x67, 0x01, 0x23, 0xCD, 0xEF, 0x89 and 0xAB
Swap Words For True/False All Real data types are 32 bits. If set to True, the words are swapped before
Reals being sent over Modbus, and before being used when read from Modbus.
For example,

32 bits Data 0x01234567

Transmits 0x45, 0x67, 0x01 and 0x23

Swap Words For True/False All UDint data types are 32 bits. If set to True, the words are swapped
UDints before being sent over Modbus, and before being used when read from
Modbus. For example,

32 bits Data 0x01234567

Transmits 0x45, 0x67, 0x01 and 0x23

Clamp Values True/False If set to True, the value sent on Modbus is clamped between the RawMax
and RawMin values. The EngMax/EngMin and RawMax/RawMin are used
to determine how to scale a value when writing to/reading from Modbus.
However, if the actual Engineering value at runtime is greater than EngMax,
or less than EngMin, then a value could be sent on Modbus that is greater
than RawMax or less than RawMin. Some jobs may not find this desirable,
however, if the values are being sent to a computer that only supports 12
bits of data, these limits must be enforced.
Command Limit 0 / 25 Limits the number of EGD Command Message Protocol (CMP) commands
that any given register map writes to a controller in a second. This limit is
designed to prevent the controller from being overloaded with requests.

16 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Property Lower/Upper Description
Limits or Allowed
Values
However, if both the Holding Registers and the Holding Coils each contain
10 signals that are on a controller EGD page, and if the Master sends
messages to all 20 signals every second, it's possible for 20 CMP
messages to be sent to the controller.

Ethernet Port 502 / 503 The Ethernet port that Modbus uses to communicate, if there are any
Ethernet Modbus connections. (A Slave listens on this port, a Master tries to
connect to this port.) The Modbus Protocol Specification default is 502, but if
502 is already used, it can be changed to 503.

Timeout NAK 4/6 When data cannot be obtained from the OPC® Server before the
SlaveSendTimeout time, the Slave returns a Slave Exception Response to
the Master. Most jobs want a NAK Code 6 (Slave component Busy) in this
situation, but this value gives you the option to return a NAK Code 4 (Slave
Component Failure).

Master Message Base 200 / 2147483647 This number defines how frequently a Modbus Master Message can be
Period sent. This number is muliplied by the Period Multiplier on the Modbus
Master Message to indicate, in ms, how often a given message is sent over
Modbus.
Master Read Timeout 500 / 6000000 The Master Read Timeout is the time duration, in ms, to wait for a response
from a Slave before proceeding to the next message.

OPC Data Rate 100 / 15000 The OPC Data Rate is the rate, in ms, at which the Modbus feature gets
updated values from the OPC Server. It should be twice as fast as you
expect the Master to be asking for values over Modbus.

ReConnect Time 500 / 6000000 The ReConnect Time is the time duration, in ms, before the Master tries to
reconnect to the Slave after a connection error. (Also, if Serial Slave has a
problem communicating over a serial port, it closes the serial port and waits
for this time duration before attempting to re-open the port.)

ReStartCycle Time 500 / 6000000 The ReStartCycle Time is the time duration, in ms, before restarting the
Read/Write or Write/Read cycle after an error. If this time duration is too
short, and the error does not clear itself, too many processing cycles are
used.
Slave Read Timeout 500 / 6000000 The Slave Read Timeout is the length of time, in ms, to wait for a request
from a master before marking this transport as being ready to be shutdown.
(This only applies to Ethernet Slaves.)

The program is still waiting for any new connection from a Master, regardless
of the time set here.
Slave Send Timeout 100 / 6000000 The Slave Send Timeout is the length of time, in ms, to wait for data from
the OPC Server before sending back a Timeout NAK response to the
Master.

Instruction Guide GEI-100696E 17

For public disclosure
 2.4 Hardware Interface Properties
When the hardware interface is selected in the Tree View, the following properties display
in the Property Editor.

Note You can only change Ethernet Settings when the Interface Type is Ethernet, and
Serial Settings when it is Serial.

Property Lower/Upper Limits Or Description

Allowed Values
Ethernet Settings

IP Address Valid IP Address format IP address for Ethernet connection. For a Master, this is the IP
Address of the Slave that you are connecting to. For the Slave,
this is the IP Address at which you'll be listening for a connection
from a Master. If you're a Slave, verify that the WorkstationST
has a Network Adapter defined to support this IP Address.

Interface Settings

Detailed Description Text Allows the user to enter a detailed description of this hardware
interface to help the user keep track of their configuration. It can
be left blank.
Enabled True or False If True, the configuration for this hardware interface will be
downloaded to the WorkstationST computer.

Interface Type Serial or Ethernet Modbus hardware interface type

Tree View Description Text Allows the user to enter a shorter description for this hardware
interface to display in the Tree View. If left blank, the IP address
or ComPort will display in the Tree View.

Serial Settings

Baud Rate 300 / 256000 Communication baud rate for serial network
Data Bits 8 Communication data bits for serial network
Parity None / Even / Odd Communication Parity for serial network

Port COM1 / COM 16 Communication Port for serial network

Response Delay 0 / 999 Additional delay time, in ms, before the Slave responds to a
Master request. Change this from zero only if the Master cannot
handle a quick response.

Stop Bits 1/2 Communication Stop Bits for serial network

18 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.5 Master Message Properties
Property Lower/Upper Description
Limits or Allowed
Values
Function Code FuncCode1 / 1 - Read Holding Coils

FuncCode2 / 2 - Read Input Coils

FuncCode3 / 3 - Read Holding Registers

FuncCode4 / 4 - Read Input Registers

FuncCode5 / 5 - Write Single Holding Coil

FuncCode6 / 6 - Write Single Holding Register

FuncCode8 / 8 - Diagnostic, sub Function Code 0, Return Query Data

This sends a piece of canned data to the Slave, which the Slave then returns.
This code can be used to test the health of a Slave without needing to know the
register map.

FuncCode15 / 15 - Write Multiple Holding Coils

FuncCode16 / 16 - Write Multiple Holding Registers

Number of 1/65535 The number of Registers (or Coils) to be read or written for this message.
Registers
This is not the number of variables. A 4-byte data type uses two registers, and an
8-byte data type uses four registers.

Period Multiplier 1/2147483647 This number is multiplied by the Master Message Base Period to determine
how frequently, in ms, this message should be sent. (The Master Message
Base Period is an item in the Property Editor when Modbus is selected in the
Tree View)

Start Address 1/65535 The starting address for this message. This refers to either a coil number or
register number, depending on which function code is configured. A variable
must be connected to this address, or you cannot validate the Modbus
configuration and select the Build command.

Instruction Guide GEI-100696E 19

For public disclosure
 2.6 Slave Properties
Property Lower/Upper Limits Description
Or Allowed Values
Slave Settings

Detailed Description Text Allows the user to enter a detailed description for this Slave to help
the user keep track of their configuration. It can be left blank.

Enabled True or False If True, the configuration for this Slave will be downloaded to the
WorkstationST computer.

Measurement System Native The measurement system that is used when WorkstationST Modbus
gets data from, or writes data to the OPC DA Server for this Slave.

Slave ID Number The Slave ID on the Modbus network.

Tree View Description Text Allows the user to enter a shorter description for this hardware
interface to display in the Tree View. If left blank, the Slave address
will display in the Tree View.

2.7 Data Structure Properties

Property Lower/Upper Limits or Allowed Values
Raw Min The value used to scale the data before it is sent or read from Modbus.
Raw Max
Eng Min

Eng Max

where Ymod is the value to be sent over Modbus and XEng is the value of
the connected variable.

2.7.1 Data Types

When variables are sent over Modbus, the following data types are allowed. Note the
number of registers that each data type uses on a Modbus page.

Data Type Number of Registers Needed

BOOL 1 (Can pack up to 16 Booleans into one register).

INT 1
UINT 1
DINT 2
UDINT 2
REAL 2
LREAL 4

20 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.8 Scaling
The relationship between Y (the value sent over Modbus) and X (the engineering value)
is linear. This equation:

can be converted into the slope intercept form:

y = mx + b
Where m = slope
b = offset
For the engineering value in the system:

For the value that is sent over Modbus:

Instruction Guide GEI-100696E 21

For public disclosure
 If all min/max values are zeros, a gain of one (1) and an offset of zero are realized. If the
Clamp Values property is set to True, the value sent on Modbus is clamped between the
RawMax and RawMin. The EngMax/EngMin and RawMax/RawMin are used to
determine how to scale a value when writing to or reading from Modbus. However, if the
actual Engineering value at runtime is greater than EngMax, or less than EngMin, a value
could be sent that is greater than RawMax or less than RawMin. Therefore, RawMax and
RawMin are not true minimums and maximums unless the Clamp Values Boolean is set.
They are only used to determine the scale factors. However, before values are sent over
Modbus, they are always clamped, regardless of the state of the Clamp Values Boolean,
based on the range of the Modbus data type. If values are sent to a computer that only
supports 12 bits of data, verify that your RawMax and RawMin values respect the 12 bits
of data limitation, and set the Clamp Values Boolean to True.
When a Master writes to a WorkstationST Slave, the Slave converts the Modbus value to
an Engineering value. If the calculated Engineering value is outside the range of the
Engineering variable’s data type, that value will not be set, and a Slave Exception
Response (Code 3, Illegal Data Value) is returned to the Master. Any other valid values in
the write request are written. In this case, the OPC Server Write Errors counters increase.
When a Master reads from a WorkstationST Slave, the Slave converts the Engineering
value to a Modbus value. If the calculated Modbus value is outside the range of the
Modbus data type, the value is clamped by the Modbus data type range. This clamping
based on data type occurs even if the Clamp Values property is not set. The clamped value
is returned to the Master. In this case, no Slave Exception response is returned.
Before a WorkstationST Master writes to a Slave, the Master converts the Engineering
value to the Modbus value. If the calculated Modbus value is outside the range of the
Modbus data type, the value is clamped by the Modbus data type range and the clamped
value is written to the Slave. This clamping based on data type occurs even if the Clamp
Values property is not set.
After a WorkstationST Master reads from a Slave, the Master converts the Modbus value
to an Engineering value. If the calculated Engineering value is outside the range of the
Engineering variable’s data type, that value will not be set, and the OPC Server Write
Errors counters increase. Any other valid values in the write request are still written.
At runtime, you can determine the number of times a value was clamped by monitoring
the corresponding counters in the Additional status detail window (for example, Slave 1
on 3.29.17.149 HR has 0 Current, 0 Total Modbus Values being Clamped occurrences).

22 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.8.1 Scaling Examples
EngMax = 8.0 inches
EngMin = 0 inches
Engineering variable is an IEEE float (in ToolboxST, referred to as REAL).
First example:
RawMax = 65000
RawMin = 0
Engineering variable current value is 8.5.
Modbus data type is an unsigned 16-bit integer (in ToolboxST, referred to as UINT).

Modbus Value = 65535 if Clamp Values = False. (just clamped based on Modbus data
type range, for unsigned 16-bit integer is 0 to 65535.)
Modbus Value = 65000 if Clamp Value = True. (the tighter of the two clamps
(RawMax/RawMin versus the data type range) is applied.)
Second example:
RawMax = 32000
RawMin = -32000
Engineering variable current value is 8.07
Modbus data type is a signed 16-bit integer (in ToolboxST, referred to as INT).

Modbus Value = 32560 if Clamp Values = False. (No clamp was reached.)
Modbus Value = 32000 if Clamp Values = True. (RawMax clamp was reached.)

Instruction Guide GEI-100696E 23

For public disclosure
 2.9 Spare Values
A Master cannot read data that contains an empty register. If registers 1 through 100 are
being read by a single read, and there are no values connected to one or more registers, an
Illegal Data Address error occurs.

� To repair empty registers

1. From the WorkstationST component, OPC DA Server tab, select Client Driven
Variables.

Note The recommended variable name is Spare (for example, SpareInt1).

Note If more registers need to be filled, the data type can be INT (uses one register),
REAL (uses two registers) or LREAL (uses up to four registers).

2. Set the External Access to Read/Write.

3. Set the Initial Health to TRUE. If the Initial Health is not set to TRUE, the Master
gets Exception Response: Slave Component Failure 04 when a Read/Write
is attempted that includes this variable.
4. If required, set the Initial Value.
5. Select the Modbus tab to connect this new variable to the empty register.
6. Select the Build and Download commands.
7. Restart the OPC Server.

Note If Booleans are packed into a register, all 16 bits within a register do not have to be
mapped.

24 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.10 Importing or Exporting .csv Files
� To export or import a .csv file: From the Modbus item, right-click a Slave
(such as Slave 1) and select Export to .csv file or Import from .csv file.

The Export to .csv file option includes:

• Register Type (Example: HoldingReg, Coil, InputReg, Input)

• Register Address (Example: 00001)
• Signal Name (Example: TVNA)
• Writeable or Read Only (Example: W)
• Modbus Data Type (Example: UDINT)
• Signal Data Type (Example: UDINT)
• Scale Modbus Minimum
• Scale Modbus Maximum
• Scale Engineering Minimum
• Scale Engineering Maximum
• Signal Units
• Signal Description
The Import from .cvs file option includes:

• a .csv file that you exported

• a .csv file exported from a Mark VI or Mark VIe Modbus Master configuration

Instruction Guide GEI-100696E 25

For public disclosure
 2.11
Any errors/warnings in the Modbus configuration display in the WorkstationST
Component InfoView when the Build command is selected. Double-click an
error/warning to display the location that the error/warning occurs.
Error Message
Connection Bool8 is undefined (where
the connected variable name is the
name you entered)
Point Address 00001 must have a
unique address (where the address is
the value you entered)
Raw Min must be set to zero for point
HoldingReg8-00 when Data Type is a
BOOL (where the point is your Name,
and the parameter could also be Raw
Max, Eng Min or Eng Max)
Point Address 00001 is of type UDINT
and requires 2 addresses. The next
address is located at 00002 (where the
addresses and data types are yours)
A Slave under a Modbus Serial HW
Interface has to have a non-zero Slave
ID, since 0 is reserved for broadcast
messages in the Modbus Protocol
Specification.
26 GEI-100696E
For public disclosure
Error/Warning Messages
Possible Cause
The variable that was entered into the
Connected variable field is not defined
anywhere in the system.
For a specific Slave and register space
(such as Holding Registers), more than
one variable has been mapped to the
exact same address.
A non-zero scale factor (Raw Min, Raw
Max, Eng Min or Eng Max) was entered
for a Boolean point.
A variable that takes up more than one
register was connected to an address,
but not enough space was left in the
register map for it. Instead, another
variable was mapped to a following
address that would cause an overlap of
data.
The Slave ID is set to 0, and the
Interface Type is a serial link.
WorkstationST Modbus Feature Instruction Guide
Solution
If not, determine where the variable
should have been defined. If the
variable comes from another
component, make sure that:
-Variable was defined in that
component
-Variable was mapped to EGD page in
that component
-The component was built on a
computer that is working online with the
EGD ConfigServer so that their EGD
page maps are available.
-This component is set up to consume
pages from that component
-This computer is working online with
EGD ConfigServer to get the latest
EGD Map
Determine which variable you want at
that address. Is the other variable no
longer needed, or should it be at a
different address?
Put zero values in the Raw Min, Raw
Max, Eng Min, and Eng Max fields for
this Boolean variable (on either the
Holding Register or Input Register tab).
Do you want the first variable to be that
data type when it is sent over Modbus?
When you connect a variable to a
Modbus page, the data type defaults to
that of the variable that was connected,
but this may not be desired. If not, you
need to move the second variable.
Remember that two registers are
needed for DINT, UDINT, and REAL
variables, but four registers are needed
for LREAL variables.
Change the Slave ID to a non-zero
value.
 Error Message
HW I/F COM1, Slave 1, point Coil2 and
HW I/F COM2, Slave 5, point Coil8 are
both connected to T1.L27BN. Both pts
are being written to by values read over
Modbus, so they will overwrite each
other. Either change one connection or
one of the Modbus messages that
writes to this variable (where the
Hardware Interfaces, Slave numbers,
point names and connected variables
are yours)
More than one Workstation Modbus
HW Interface is configured to use the
COM1 Com Port (where Com Port is
the duplicate in your configuration)
Under Modbus, Masters, there is more
than one HW interface configured to
use the 172.20.100.151 IP Address.
Under Modbus, Slaves, there is more
than one HW Interface configured to
use the 172.20.100.151 IP Address.
Under Modbus, Masters,
172.20.100.151: Slave 17 does not
have any Messages defined for it.
Duplicate Slave IDs are not allowed in
any Modbus HW Interface
Configuration.
Instruction Guide
For public disclosure
Possible Cause
The same variable is connected to two
places in a Slave map under the
Masters item. (It can be, but does not
have to be on the same Slave, or even
under the same Hardware Interface.)
That condition alone is okay if in one
location the variable is being read to be
sent over Modbus, and in the other it’s
being read from Modbus and written to.
However, your configuration actually
has one or more Modbus messages
configured to read from Modbus and
write to both places where the same
variable is connected. Function Codes
that read values from Modbus and write
them to a variable are FuncCode 1, 2,
3, or 4.
More than one Hardware Interface is
configured to use the same Com Port.
There are two or more hardware
interfaces under the Masters category
that are using the same IP Address.
There are two or more Hardware
Interfaces under the Slaves category
that are using the same IP Address.
No messages were defined for a given
Masters slave map.
The same Slave ID was used for more
than one Slave, underneath any given
Hardware Interface.
Solution
If this was a spare variable being used
to fill a hole in a register map, define as
many spare variables as needed so
they can be unique. Otherwise, split
your Modbus message into two
messages, one that reads the values
before the hole, and a second that
reads the values after the hole. (Refer
to the section Spare Values.)
If this is not a spare variable, determine
which variable you want in each
instance.
If you have more than one serial
interface in the same WorkstationST,
the target computer must have enough
hardware to support it. Select the
appropriate Com Port in the
configuration or change one of the
interfaces to Ethernet.
Determine if one of the hardware
interfaces should really be a different
address, and if so, change it.
Otherwise, all of the slaves need to be
under one entry for this IP Address. Use
cut-and-paste to move the slave
definitions under one hardware
interface and delete the second
hardware interface.
Determine if one of the Hardware
Interfaces should really be a different
address, and if so, change it.
Otherwise, all of the slaves need to be
under one entry for this IP Address. Use
cut-and-paste to move the slave
definitions under one Hardware
Interface and delete the second
Hardware Interface.
Determine if you want to read or write
values to this slave map, and if so,
insert a ModbusMasterMessage.
Change duplicate Slave IDs. To
configure a redundant set of Slaves, the
backup Slaves should be under their
own Hardware Interface.
GEI-100696E 27
 Error Message
An IP Address 3.29.17.201 is
configured for a Modbus HW Interface
that has Slaves on this Workstation, but
the Workstation configuration itself does
not have a Network Adapter defined to
support this IP Address (where the IP
Address is yours)
An IP Address ASDFG is configured for
a Modbus HW Interface that has
Masters, but the format is not a valid IP
Address format (where instead of
ASDFG, it is the string you entered)
ModbusMasterMessage0 is configured
to send Function Code 5, which by the
Modbus Protocol Specification only
sends 1 coil of data. However, the
Number Of Registers configured is 12.
Consider changing this to a Function
code 15 (where the Message Name and
Number Of Registers are your values)
ModbusMasterMessage0 is configured
to send Function Code 6, which by the
Modbus Protocol Specification only
sends 1 register of data. However, the
Number Of Registers configured is 12.
Consider changing this to a Function
Code 16 (where the Message Name
and Number Of Registers are your
values)
ModbusMasterMessage0 is configured
to send a message to read a value from
Modbus and write it to Bool1, but that
variable is defined as Read-Only
(where the Message Name and
connected variable name are yours)
28 GEI-100696E
For public disclosure
Possible Cause
Under the Slaves item, an Ethernet
Hardware Interface is defined.
However, the IP address for it does not
match one of the IP addresses on the
WorkstationST Network Adapters. This
could have happened if the
WorkstationST Network Adapters
configuration was changed after the IP
address was selected for your Slaves.
Under the Masters item, there is an
Ethernet Hardware Interface whose IP
address doesn’t follow the format nnn.
nnn.nnn.nnn, where n is a numerical
digit.
Under the Masters category, a Slave is
defined that contains a Read-Only
variable. This Modbus Master message
is either a Function Code 1, 2, 3, or 4
which causes the Modbus Master to
read a value from a Slave, and try to
store the value in this Read-Only
Connected Variable.
WorkstationST Modbus Feature Instruction Guide
Solution
From the General tab, verify that all the
Network Adapters in your
WorkstationST computer have been
configured with the proper IP address.
Double-click the error message in the
Log View at the bottom of the screen to
go to the Hardware Interface with the
bad IP address. Select the IP Address
field, then select the correct IP address.
Change the string to the correct IP
format
Double-click the error message in the
Log View at the bottom of the screen to
go to the bad Modbus Master Message.
In the Summary View, select the Coil
tab. Determine if you want to write a
single point, and if so, change the
number of registers to 1. If you want to
write more than one point, change the
Function Code to 15.
Double-click the error message in the
Log View at the bottom of the screen to
go to the bad Modbus Master Message.
In the Summary View, select the
Holding Register tab. Determine if you
want to write a single variable, and if so,
change the number of registers to 1. If
you want to write more than one
variable, change the Function Code to
16.
Did you want to read from Modbus? If
not, change your function code. If so,
determine if you should be writing to a
different variable, or if this variable
should be changed to Read/Write.
 Error Message
ModbusMasterMessage1 is configured
to send a message with Starting
Address 2 that takes up 2 coils or
registers. However, there is no Variable
connected to address 2 (where the
Message Name, Start Address, Number
Of Registers, and first address that
does not line up are yours)
Instruction Guide
For public disclosure
Possible Cause
There is a hole in the signal map. An
example of a hole is a message that
tries to write 4 registers starting at
register 10, where there is a DINT at
register 10, no variable at register 12,
and an INT at register 13. Note that the
hole can be at the beginning or end of
the message span.
Solution
Select the Modbus Master Message.
Based on what the function code is,
select the appropriate tab in the right
hand pane. (1, 5, 15 select Coil; 3, 6, 16
select Holding Register; 2 select Input;
4 select Input Register.) Look at the
hole (address) indicated in the error
message.
Either move variables around to fill the
hole, add a spare variable to fill in the
hole (refer to the section, Spares
Values), or use two Modbus messages.
The first Modbus message includes
variables before the hole and the
second includes variables after the
hole.
If the hole is at the beginning, change
the Start Address in the Message. If the
hole is at the end, change the Number
of Registers in the Modbus Master
Message and verify that it does not
extend beyond the end of the last
connected variable.
If Booleans are packed into a register, all
16 bits within a register do not have to be
mapped.
GEI-100696E 29
 ModbusMasterMessage0 is configured
to send a message with Starting
Address 1 that takes up 12 coils or
registers. However, the last variable
LReal1 is long enough that it causes the
message to exceed the Number of
Registers by 1 register (where the
Message Name, Start Address, Number
Of Registers, Connected Variable
Name, and exceeded number are
yours)
ModbusMasterMessage1 is configured
to send Function Code 6, which by the
Modbus Protocol Specification only
sends 1 register of data (two bytes).
However, the variable LReal1
connected to the Starting Address 10
takes up 4 registers. Consider changing
it to a Function Code 16 (where the
Message Name, Connected Variable
Name, Starting Address and number of
registers needed are yours)
Error Message
ModbusMasterMessage1 is configured
to send a message with 2050 coils, but
the Maximum Number of Coils that can
be sent in any single Message is 2040.
Please split this into multiple messages.
ModbusMasterMessage0 is configured
to send a message with 200 registers,
but the Maximum Number of Registers
that can be sent in any single Message
is 127. Please split this into multiple
messages.
30 GEI-100696E
For public disclosure
The number of registers is not large
enough to incorporate the whole length
of the last variable in the message.
The number of registers needed for the
connected variable is greater than one.
Possible Cause
The Modbus protocol for the response
of a Function Code 1 (Read Holding
Coils) calls for 1 byte to specify the
number of bytes of data to follow. The
maximum value for a single byte is 255.
Each byte of data can contain values for
8 coils. Therefore, the maximum
number of coils that can be read is 255
x 8 =2040.
The Modbus protocol for the response
of a Function Code 3 (Read Holding
Registers) calls for 1 byte to specify the
number of bytes of data to follow. The
maximum value for a single byte is 255.
There are two bytes of data for each
register. Therefore, the maximum
number of registers that can be read is
255 / 2 =127.5, (127 whole registers).
WorkstationST Modbus Feature Instruction Guide
Select the Modbus Master Message.
Add the current number of registers and
the exceeded number, then put the
result into the Number of Registers. In
the example message, you would add
12 + 1 = 13 and change the Number of
Registers from 12 to 13.
Double-click the error message in the
Component InfoView to go to the poor
Modbus Master Message. In the
Summary View, select the Holding
Register tab. Either change the data
type for the point on the Modbus page
so that it only takes up a single register,
or change the Function Code to 16 to
pass the point over Modbus with its
current data type. If you change the
Function Code to 16, you must also
change the Number of Registers to
reflect the number of actual registers
used for that data type, as indicated in
the error message.
Solution
Add another ModbusMasterMessage
and read some of the values in the first
message, and the remaining values
with the second message.
Add another ModbusMasterMessage
and read some of the values in the first
message, and the remaining values
with the second message.
3 Runtime
There are three ways to monitor the status of a configured Modbus.

• WorkstationST Status of Features window

• WorkstationST additional status window
• Detail Log

3.1 WorkstationST Status of Features

You can access the WorkstationST Status of Features screen in one of two ways:

• From the Start menu, select All Programs, GE ControlST, WorkstationST, and
WorkstationST Status Monitor.
or

• From ToolboxST, open a WorkstationST component and click the Go On/Offline

button. From the Component InfoView, select the Status tab of the
WorkstationST running the configured Modbus feature.

Instruction Guide GEI-100696E 31

For public disclosure
 The logic that drives the Error/Warning/OK status for the Modbus feature is as follows.
Errors

• Any current connection errors over Modbus

• No connection with the OPC Server
• Any current Checksum Errors
• Any current Read Message Errors
□ Endian mismatch
□ Unsupported function code or scrambled data in the receive buffer because of
serial port parameter mismatches
Warnings

• Any current application errors

• Any current slave exception responses
• Any current invalid Slave ID errors (for example, a Slave receives a message from a
Master for a Slave ID that is not configured.)
• A Master with current:
□ Read timeouts
□ OPC Server write errors
□ Skipped periodic messages
□ Unbound variables
□ Unhealthy variables
□ Exceeded command limit
□ Unsupported Function Code
□ Trying to write to a read-only variable
□ Data conversion error

Note If detail items listed under a Master occur in a Slave, the Slave sends back a Slave
Exception Response, which triggers a WARNING status.

32 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 3.2 WorkstationST Additional Status
� To view additional status information: From the Component InfoView
Features column, right-click the Modbus item and select View Additional
Status Detail.

The Error Level column that displays on the WorkstationST additional status window has
three possible values:

• OK – Value is zero
• Warning – Condition occurred at some point
• Error – Condition is still occurring

Instruction Guide GEI-100696E 33

For public disclosure
 Once a steady state condition has been reached, it is recommended that you set the
counters to zero to make it easier to identify any subsequent conditions that occur.
The following information displays in the WorkstationST additional status window, and
can be monitored at runtime.

34 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure

Message
Modbus initially started at
10/9/2007 2:06:24 PM.
Modbus last restarted at
10/9/2007 3:02:13 PM. (Due to
a download.)
Modbus last zeroed counters
at 10/9/2007 3:02:13 PM.
Instruction Guide
For public disclosure
Masters and Slaves Status Counters
Description
The time that the program was last started. If WorkstationST Service is configured to start
automatically when the computer restarts, and the Modbus feature is enabled, that service
starts the program. Otherwise, the WorkstationST Status Monitor can be used to stop and
start the Modbus feature.
When you download a new WorkstationST configuration from ToolboxST, the Modbus
program restarts, and the time of this restart is recorded. If nothing that affects the Modbus
configuration changes, then Modbus does NOT restart, and an INFO message indicating
this is added to the trace log file.
When Modbus restarts, it goes offline to allow enough time for the COM ports to be
released before the new configuration tries to use them. If another component that Modbus
consumes is downloaded, the lists used to communicate with the OPC Server Modbus are
stopped and restarted. This can cause unhealthy data, which generates a Slave Exception
Response if the Master asks for that data during this timeframe. Stopping and starting the
lists prevents unbound variables (caused by moved variables or changed data types),
which continually return Slave Exception Responses to the Master for this data.
Once a steady state condition is reached, it’s recommended that you set the counters to
zero.
Each status line has an Error Level, Current Count, and Total Count for a specific condition.
If the condition is still occurring (non-zero current count), the Error Level displays Error. As
long as the total count is non-zero, the Error Level displays Warning, indicating that at some
point this condition existed. Setting the counters to zero returns the Error Levels to OK.
This makes it easier to identify subsequent problems. A new problem causes the Error
Level to change to either Error (if the condition still is occurring) or Warning (if it occurred),
but has stopped, allowing you to detect transient problems.
The Zero Counters button also zeroes the counters for the number of messages sent and
received.
GEI-100696E 35
 Message
A Slave Manager is listening
on 3.29.17.149, Port 502 with
No Errors. There have been 3
successful TCP connections
since last Zeroed Counters.
Currently there are 2 Active
Slave Connections.
Slave(s) on 3.29.17.149 are
talking to a Master on TCP
Remote End Point
3.29.17.191:1451
Slave(s) on 3.29.17.149 have
1036 Received, 1036 Sent
Messages Total.
Slave(s) on 3.29.17.149 have
0 Messages Received in the
last Second, 0.4 Average
messages per second over the
last five seconds, 2 messages
per second Highwater Mark.
Slave(s) on 3.29.17.149 have
0 Current, 0 Total Connection
Errors.
Slave(s) on 3.29.17.149 have
0 Current, 0 Total Application
Errors. (An Unexpected
Exception that doesn't appear
to be related to a connection
problem.)
36 GEI-100696E
For public disclosure
Description
This lets you know that the program is actively listening for any Masters that might connect
over Ethernet. The message also shows which IP Address and Port the Master should use
when trying to connect, and how many successful connections have occurred since the
counters were last set to zero. You can also see how many Ethernet Slave connections are
currently running.
If a Master has disconnected and reconnected several times, it is possible that the total
number of connections is more than the current number of Slaves. (This number could also
be zero if the counters were just set to zero.)
If a Slave connection does not receive any messages from the Master for a configured
amount of time (refer to the Slave Read Timeout property), it is shut down. The Slave
connection corresponds to the Hardware Interface configured in the ToolboxST application.
More than one Slave ID may be configured to respond over any connection.
More than one Master can talk to the same Slave map at the same time, each Master using
their own Slave connection. This might be done to support a primary/backup redundant
setup. For example, 1.1.1.1 HW Interface has Slaves 1, 2, and 3 defined under it. One
Master connects, which displays as one connection, although the Master can get data from
Slaves 1, 2, and 3. A second Master connects, which displays two connections. This
second Master can also get data from Slaves 1, 2, and 3.
Since more than one Master can connect to a given Ethernet Slave Hardware Interface, this
tells you which Master connection all Status Counters following this line correspond to. If
another Master connects using the same listening port (but still having its own connection)
after the Status Counters display for the first connection, this status line is repeated for the
second Master connection, followed by the Status Counters for the second connection.
This is the number of messages that have been received and sent since the Counters were
last set to zero. For Slaves, if the received amount is significantly higher than the sent
amount, the Slave is having problems responding to messages received. Refer to the
additional error counters and the trace log file for information. If the Slave responds with a
Slave Exception Response, it still counts as a message sent.
If Masters send too many messages too quickly, this counter allows a field engineer to
report the rate to the person responsible for the Master so that the configuration can be
modified.
Possibly due to not being physically connected, having mismatched Hardware interface
configuration parameters, or having the connection closed by another program. When a
Connection error is received, Modbus closes the connection, waits the ReConnect Time
(configuration parameter), and then attempts to reconnect. Refer to the trace log file for
more information.
If an Application Exception occurs, the connection waits the ReStartCycle Time
(configuration parameter) and then restarts the cycle. (The ReStartCycle Time prevents the
restart from being caught in an infinite loop.) For a Master, restarting the cycle means
identifying and sending out the next message. For a Slave, restarting the cycle means
listening for the next message from a Master.
WorkstationST Modbus Feature Instruction Guide
 Message
Slave(s) on COM1 have 0
Current, 3 Total Checksum
Errors.
Slave(s) on 3.29.17.149 have
0 Current, 0 Total Read
Timeouts, where it waited 5
minutes for a request.
Slave(s) on 3.29.17.149 have
0 Current, 0 Total Invalid Slave
ID Errors, where a Master sent
a message for a Slave ID that
isn’t configured.
Slave(s) on 3.29.17.149 have
0 Current, 0 Total Slave
Exception Responses that
were sent.
Slave 1 on 3.29.17.149 has 0
Current, 0 Total Send
Timeouts, where it didn't get
data from the OPC Server in
0.5 seconds so it sent a Slave
Exception Response to the
Master.
Slave 1 on 3.29.17.149 HR has
0 Current, 0 Total OPC Server
Write Errors.
Slave 1 on 3.29.17.149 HR has
0 Current, 0 Total OPC Server
Connection Errors.
Slave 1 on 3.29.17.149 HR has
0 Current, 0 Total Illegal Data
Address Errors. This error
occurs when the Master asks
for an address for which no
variable was configured.
Slave 1 on 3.29.17.149 HR has
0 Current, 0 Total UnBound
Variable Errors.
Instruction Guide
For public disclosure
Description
When a Checksum error occurs, the Slave ignores the rest of the message, and waits to
read the next message. No Slave Exception Response is returned. This only applies to
Serial Hardware Interfaces.
For Slaves: The Slave has waited a configured amount of time (Slave Read Timeout
property) without receiving a request from a Master before marking this transport as ready
to be shut down. This only applies to Ethernet Slaves; Serial Slaves do not have a timeout.
The program waits for any NEW connection from a Master, regardless of the time set here.
For Masters: The Master has waited a configured amount of time (Master Read Timeout
property) without receiving a response from a Slave before reading the next message.
No Slave Exception Response is returned, but the status on the WorkstationST Status
Monitor changes to Warning if this occurs. The Master configuration or the Slave ID must
be modified. If the Slave ID is changed, the Build and Download commands must then be
selected. Use the trace log file to identify the invalid Slave ID.
Refer to the section, Exception Responses for more information about Slave Exception
Responses. The count does not differentiate between different error codes.
This is the length of time the Slave waited (configured in the Slave Send Timeout). The
Slave normally sends back a Slave Component Busy 06 Slave exception response to the
Master. However, if the NAK Code configuration parameter is set to 4, it returns a Slave
Component Failure 04 Slave exception response to the Master.
This Master/Slave tried to write values to the rest of the system through the OPC Server
and failed. A Slave then sent a Slave Component Failure 04 Slave Exception Response to
the Master. If the program detects a specific cause of this error (variable is read-only,
unbound, unhealthy, and such), it does not increment this generic counter. Use the trace log
file to identify errors.
This is a severe error. If the Modbus program cannot connect to the OPC server, it keeps
trying to reconnect. It will not send messages over Modbus until connected. A Slave returns
a Slave Component Failure 04 Slave Exception Response to the Master if it cannot connect
to the OPC Server. Start the OPC Server, if it is not running. If the OPC Server is running,
use the OPC Server’s trace log file to identify errors.
The Slave returns an Illegal Data Address 02 Slave Exception Response to the Master. If
this error occurs, the person responsible for the Master needs to determine why a message
is expected at this location. Are there data type mismatches that caused signals to get
shifted in the register map? Should a spare variable be added at this address? (Refer to the
section, Spare Values.) Use the trace log file to identify which variable has the error.
The Slave returns an Illegal Data Address 02 Slave Exception Response to the Master.
Normally, this occurs briefly when another component is downloaded, causing Modbus to
stop and restart the lists to the OPC Server. However, if another component deleted a
variable being used by Modbus and was then downloaded, this could continually occur. In
that case, talk with the component owner to see if another variable should be used. If not,
the person responsible for the Master must delete this variable. In either case, modify the
GEI-100696E 37
 Message
Slave 1 on 3.29.17.149 HR has
0 Current, 0 Total UnHealthy
Variable Errors.
Slave 1 on 3.29.17.149 HR has
0 Current, 0 Total Read-Only
Variable Errors. (This error is
when it's asked to write to a
variable that was configured as
read-only.)
Slave 1 on 3.29.17.149 HR has
0 Current, 0 Total Data
Conversion Errors.
Slave 1 on 3.29.17.149 HR has
0 Current, 0 Total Times that
the Commands Per Second
Limit was reached.
Slave 1 on 3.29.17.149 HR has
0 Current, 0 Total Modbus
Values being clamped
occurrences.
Slave 1 on 3.29.17.149 HR has
0 Current, 0 Total Times that a
Value has Not Changed so it
was Not Sent to a Controller
38 GEI-100696E
For public disclosure
Description
configuration, then select the Build and Download commands. Refer to the trace log file to
identify which variable has the error.
The Slave returns a Slave Component Failure 04 Slave Exception Response to the Master.
Normally this is only a momentary occurrence when another component gets downloaded,
and Modbus stops and restarts the lists to the OPC Server. However, it also occurs if a
component goes offline. Refer to the trace log file to identify which variable has the error.
The Slave returns a Slave Component Failure 04 Slave Exception Response to the Master.
Refer to the trace log file to identify which variable has the error, then determine if the
variable can be changed to Read/Write, or if another variable should be used. Modify your
configuration, then select the Build and Download commands. This error will not resolve
itself.
The Slave returns an Illegal Data Value 03 Slave Exception Response to the Master. When
a Master writes to a Slave, the Slave converts the Master value to an engineering value. If
the calculated engineering value is outside the range of the engineering value’s data type,
that value is not sent, and a Slave Exception Response is returned to the Master. (Any
other values in the write request will be written.) The OPC Server Write Errors counter also
increases. In this case, make changes to your data types, as required. When a Master
reads from a Slave, the Slave converts the engineering value to a Modbus value. If the
calculated Modbus value is outside the range of the Modbus data type, the value is
clamped by the Modbus data type range. This clamping based on data types occurs even if
the Clamp Value property is not set. The clamped value is returned to the Master. No Slave
Exception Response is returned. In this case, a Slave Exception Response indicates that
an unanticipated conversion problem exists. This could also occur if scrambled data was
received over Modbus. Use the trace log file to identify which variable has the error.
The Command Limit (configuration property) limits the number of EGD CMP commands
that any given register map writes to a controller to prevent the controller from being
overloaded with requests. (For example, if the Holding Registers and the Holding Coils
each contain 10 signals that are on a controller EGD page, and the Master sends
messages writing to all 20 signals every second, it's possible for 20 CMP messages to still
get sent to the controller.) The register does not buffer these change requests and send
them at a slower rate, but instead discards any messages that exceed the limit. Even if the
command limit is reached, other non-command values are sent. The Slave returns a Slave
Component Failure 06 Slave Exception Response to the Master.
If the Clamp Values (configuration property) is set to True, the value sent over Modbus is
clamped between the RawMax and RawMin. The EngMax/EngMin and RawMax/RawMin
are used to determine how to scale a value when writing to/reading from Modbus. However,
if the actual Engineering value at runtime is greater than EngMax, or less than EngMin, a
value could be sent over Modbus that is greater than RawMax or less than RawMin. Some
jobs may not find this desirable, but if the values are going to a computer that only supports
12 bits of data, these limits must be enforced. Also, if the Modbus value is outside the range
of the Modbus data type when an engineering value is converted to a Modbus value, the
Modbus value is clamped and the counter increases.
The Modbus program tries to reduce the number of unnecessary EGD commands and
minimize the chance of reaching the command limit. This is done by comparing the current
value of a variable coming from another component, to the value received over Modbus. If
the value is the same, it is not sent, but this counter is increased by one. If the value is
different, and the command limit was not reached, a command is sent to that component.
WorkstationST Modbus Feature Instruction Guide
 Masters Messages

Master talking to COM1 has 0 These could occur if either the Master tries to send, or receives a function code that it
Current, 0 Total UnSupported cannot handle.
Function Code Errors.
Master talking to COM1 has 0 This normally occurs when:
Current, 0 Total Skipped
Periodic Modbus Messages. Modbus connection is down
Message would be skipped
OPC Server connection is down
when previously scheduled
messages haven’t completed Too many messages were scheduled to be sent at the same time. In this case, modify your
before new messages are configuration.
scheduled to be sent.

3.3 Tracing
Modbus writes messages to a trace log file to help identify problems.

� To display the Modbus trace log file: From the WorkstationST Status of
Features window, right-click the Modbus feature and select Advanced, then
View Detail Log to display the contents of the trace log file.

There are four message levels in the trace log file:

• Error
• Warning
• Info
• Verbose

Instruction Guide GEI-100696E 39

For public disclosure
 � To change the message level
1. From Windows® Explorer, select C:, Program Files, GE Energy, and
WorkstationST Features.
2. From the WorkstationST Features folder, use Notepad to open the
GeCssModbus.exe.config file.
3. Change the ApplicationDefaultSwitch value. (The program automatically detects
that the file has changed and starts using the new level.) The values are:
1 - Errors
2 - Warnings and Errors
3 - Info, Warnings, and Errors
4 - Verbose, Info, Warnings, and Errors

Note The default value is 3. To view the contents of each message received, change the
value to 4 to include Verbose. However, because this value quickly fills the trace log file,
return the value to 3 as soon as possible.

An example of an Error is when a Modbus Slave Exception Response is generated or

received. An example of a Warning would be a Master not receiving a response from a
Slave before the Master Read Timeout. An example of an Info message is successfully
opening a serial port.

40 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 3.4 Ethernet Messages
Change the message tracing level in the trace log file to Verbose to display raw data about
message content. Byte or word swapping has not yet occurred, if required. However,
when a message displays, for example, beginning to read 6 bytes to get the message body,
byte swapping has already taken place. This determines that 6 bytes were expected for the
message body.
Example:
2007-10-18 15:03:38.081 VERBOSE ModbusSlaveTcpTransport10/18/2007 5:34:32 AM.
BeginRead: Slave at IP Address 172.20.100.151 beginning to read 6 bytes to get the
message header.
2007-10-18 15:03:38.097 VERBOSE ModbusSlaveTcpTransport10/18/2007 5:34:32 AM.
ReadCompleted: Slave at IP Address 172.20.100.151 received Message Header 0, 0, 0, 0,
0, 6
The Message Header contents are as follows:

• The first two bytes are Transaction Identifier: 0, 0,

(The Slave returns what the Master sent it. The Master can use this to match the response
with the correct request.)

• The second two bytes are the Protocol Identifier: 0, 0,

(These should always be value 0 for Modbus protocol.)

• The last two bytes are the message length: 0, 6

(There are 6 bytes for the message body that follow this header.)
Example:
2007-10-18 15:03:38.097 VERBOSE ModbusSlaveTcpTransport10/18/2007 5:34:32 AM.
ReadCompleted: Slave at IP Address 172.20.100.151 beginning to read 6 bytes to get the
message body.
2007-10-18 15:03:38.097 VERBOSE ModbusSlaveTcpTransport10/18/2007 5:34:32 AM.
ReadCompleted: Slave at IP Address 172.20.100.151 Received Message Body 1, 3, 0, 9,
0, 5
The Message Body contents are as follows:

• The first byte is the Slave ID: 1,

• The second byte is the Function Code: 3,
(Everything after this point in the message could be different for specific Function Codes.
Refer to the Modbus Protocol Quick Reference table for details.)

• The next two bytes are the starting Address: 0, 9

(The address sent over Modbus is zero-based, even though the registers are one-based.
This message starts reading at Holding Register 10.)

• The last two bytes are the number of registers to read: 0, 5

Instruction Guide GEI-100696E 41

For public disclosure
 3.5 Serial Messages
Serial messages start by reading a 7-byte header. The program then displays, for example,
beginning to read 8 bytes to get the message body. This means that the entire message is 8
bytes. When reading serial trace messages, focus on the one that reads, Received Message
Body followed by data, not Received Message Header followed by data.
Example:
2007-10-18 14:57:31.977 VERBOSE ModbusSlaveSerialTransport10/16/2007 11:53:19
AM. ReadCompleted: Slave on Serial Port COM1 beginning to read 8 bytes to get the
message body.
2007-10-18 14:57:32.007 VERBOSE ModbusSlaveSerialTransport10/16/2007 11:53:19
AM.ReadCompleted: Slave on Serial Port COM1 Received Message Body 255, 4, 0, 0, 0,
13, 36, 17
The Message Body contents are as follows:

• The first byte is the Slave ID: 255

• The second byte is the Function Code 4
The following is specific to Function Code 4

• The next two bytes are the starting Address: 0, 0,

Since the address sent over Modbus is zero-based, and the registers are one-based, this
message starts reading at Input Register 1.

• The next two bytes are the number of registers to read: 0, 13

• The last two bytes are the CRC checksum: 36, 17

42 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 3.6 Modbus Protocol Quick Reference

Function Codes 1, 2, 3, and 4 Function Codes 5 and 6 Function Codes 15 and 16

Request:
Byte1; Slave Id
Byte 2; Function Code
Bytes 3 and 4; Starting Address
Bytes 5 and 6; Number of Registers
Request and Response follow Request:
same format:
Byte1; Slave Id
Byte1; Slave Id
Byte 2; function code
Byte 2; Function Code
Bytes 3 and 4; starting address
Bytes 3 and 4; Address
Bytes 5 and 6; number of registers to be
Bytes 5 and 6; Value to be written written

Response:

Byte1; Slave ID

Byte 2; Function Code

Bytes 3 and 4; Starting Address

Bytes 5 and 6; Number of Registers

Response: Byte 7; number of bytes of data

Byte1; Slave ID Bytes 8+; Data

Byte 2; Function Code Response:

Byte 3; Number of bytes of Data Byte1; Slave ID

Bytes 4 +; Data Byte 2; Function Code

Byte 3 and 4; Starting Address

Bytes 5 and 6; number of registers to be

written

3.7 Slave Exception Response Format

Byte 1 Slave ID

Byte 2 Originating Function Code with the most significant bit set to 1

Byte 3 Exception Code

Instruction Guide GEI-100696E 43

For public disclosure
 3.8 Monitoring Live Values
� To monitor live values: From the Modbus tab select a Slave (such as Slave 1)
and click the Go On/Offline button to monitor live values on a Modbus page.

Note The value displayed is the value before it is scaled and/or clamped to send over
Modbus.

44 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
4 Troubleshooting
Problem Solution
Symptom
The Master tries to talk Could be an issue with Big Endian for MBAP (tcp Change the state (False to True or True to
to a Slave over Hdr) being in the wrong state. To check, change False) of the Big Endian for MBAP (tcp Hdr)
Ethernet and gets no Tracing to include Verbose, (Refer to the section, property, then select the Build and Download
answer even though Tracing) and check messages to see how long the commands.
the slave is running program thinks the message body length should
and healthy be. If the value is extremely high, it is probably an
Endian issue.
Data values for 2 and May need to swap words for 4 or 8- byte data Try changing the state (False to True or True
4 word variables are types. to False) of the Swap Words for xxx property
not as expected (where xxx is the data type of the variable
with the problem), then select the Build and
Download commands.

4.1 Slave Exception Responses

Slave When it occurs Solution
Exception
Codes
01 Illegal Master asks Slave to 1. If the Master is asking for a non-supported function code, the Master
Function perform a function it does not configuration must be modified.
support
2. Verify that all communication properties match between the Master and
Slave, since a scrambled message could be interpreted as an
unsupported function code.

02 Illegal Data Master asks to Read/Write to
Address a register where there is not
a variable connected, or the
variable is unbound
Use the trace log file to identify which variable has the error and what the
error is.
If there was no variable at that address, the user who configured the
Master must determine why a response is expected at this location. Are
there data type mismatches that caused signals to get shifted in the
register map? Should a spare variable be added at this address? (Refer to
the section, Spare Values.)

If the variable was unbound, was it just a momentary occurrence when

another component was being downloaded, so Modbus stopped/started
the lists to the OPC Server? In this case, no action is needed. However, if
Modbus was using a variable from another component, and the other
component deleted the variable and then was downloaded, this error
continually occurs. In that case, ask the component owner if another
variable should be used. If not, the person responsible for the Master must
delete this variable. (In either case, modify your configuration, then select
the Build and Download commands.)

Instruction Guide GEI-100696E 45

For public disclosure
 Slave When it occurs
Exception
Codes
03 Illegal Data An exception occurs either
Value when trying to convert an
Engineering value to a
Modbus value, or vice versa.
This conversion incorporates
applying scale factors,
clamps, and converting the
data type, if required.
04 Slave Any one of the following
Component conditions could cause this
Failure exception:
1. Master tries to read or
write a signal that is
unhealthy
2. Master tries to write to a
signal that is read-only
3. Modbus is not connected
to the OPC Server
4. There is an error writing to
the OPC Server
5. There was an Application
Exception
06 Slave 1. Master asks for data from
Component the Slave, but the Slave does
Busy not get the data from the
OPC Server before the Slave
Send Timeout times out.
(Configure with NAK Code to
send 4 or 6 in this case.)
2. The command limit has
been reached.
46 GEI-100696E
For public disclosure
Solution
When a Master writes to a Slave, the Slave converts the Master value to
an engineering value. If the calculated engineering value is outside the
range of the engineering value’s data type, that value is not sent, and a
Slave Exception Response is returned to the Master. (Any other values in
the write request will be written.) You will also see the OPC Server Write
Errors counter increase. In this case, make changes to your data types, as
required. When a Master reads from a Slave, the Slave converts the
engineering value to a Modbus value. If the calculated Modbus value is
outside the range of the Modbus data type, the value is clamped by the
Modbus data type range. This clamping based on data types occurs even
if the Clamp Value property is not set. The clamped value is returned to
the Master. No Slave Exception Response is returned. In this case, a
Slave Exception Response indicates that an unanticipated conversion
problem exists. This could also occur if scrambled data was received over
Modbus. Use the trace log file to identify which variable has the error.
Look at the trace log file to identify the cause of the Slave Exception.
Based on the cause, take the appropriate action:
1. This occurs briefly when another component is downloaded, and
Modbus stopped and restarted the lists to the OPC Server. However, it
would also occur if a component went offline.
2. Determine if the variable can be changed to Read/Write, or if perhaps
another variable should be used. Modify the configuration, then select the
Build and Download commands. This error will not resolve itself.
3. This is a severe error. If Modbus can not connect to the OPC server, it
keeps trying to reconnect. Verify that the OPC Server is running. If it is,
use the OPC Server’s trace log file to identify errors.
4. Modbus tries to catch most causes of OPC Server Write errors (variable
is Read-Only, unbound, or unhealthy, and such), in which case it will not
increase the OPC Server Write Error counter. Use both the Modbus and
OPC Server trace log files to identify errors.
5. Use the Modbus trace log to identify errors.
1. Verify that the OPC Server is running.
2. Determine if this is due to the command limit being reached by viewing
the WorkstationST additional status window. If it is, determine
If the command limit can be raised without jeopardizing the controllers,
and
If the rate at which the Master sends commands can be reduced
WorkstationST Modbus Feature Instruction Guide
5 Terms
Coil A type of data structure (a 1-bit Modbus value)

Data Structure A method of storing data in a computer so that it can be used

efficiently

Feature An element of the WorkstationST runtime system, which can be optionally

enabled through ToolboxST. Examples include OPC DA Server, Recorder, OPC AE
Server and Alarm System.

OPC OLE for Process Control (OLE is Microsoft's Object Linking and Embedding) is
a standard for data exchange in an industrial environment. The OPC foundation provides
specifications for various OPC standards such as OPC DA (Data Access) and OPC AE
(Alarm and Event).

OPC DA Server A core part of the WorkstationST product that conforms to the OPC
Data Access Specification

Register A type of data structure (a 16-bit Modbus value)

Scaling The act of converting one value to another value, or the values (for example,
slope and offset) used to perform this conversion. In this program, an engineering value is
converted before it is sent over Modbus, and a value read from Modbus is converted to an
engineering value before being used in the system.

Slave Exception Responses Modbus protocol used by a slave to communicate to a

Master when there is a problem.

Tracing Messages written by a program to a trace log file to help identify problems. In
the WorkstationST Status Monitor, use the View Detail Log to display the contents of the
trace log file.

1501 Roanoke Blvd.

Salem, VA 24153 USA
For public disclosure