Automatización

MODBUS Master and Slave
Protocol for Alspa 8000 PLCs

User’s Manual
ALS 53302 d-en
First issue: 01-97

This edition: 09-98
Meaning of terms that may be used in this
document / Notice to readers
WARNING
Warning notices are used to emphasize that hazardous voltages,
currents, temperatures, or other conditions that could cause personal
injury exist or may be associated with use of a particular equipment.
In situations where inattention could cause either personal injury or
damage to equipment, a Warning notice is used.
Caution
Caution notices are used where there is a risk of damage to equipment
for example.
Note
Notes merely call attention to information that is especially significant to

understanding and operating the equipment.
This document is based on information available at the time of its publication. While efforts have been made to be accurate, the information
contained herein does not purport to cover all details or variations in hardware or software, nor to provide for every possible contingency in
connection with installation, operation, or maintenance. Features may be described herein which are not present in all systems. Cegelec
assumes no obligation of notice to holders of this document with respect to changes subsequently made.
Cegelec makes no representation or warranty, expressed, implied, or statutory with respect to, and assumes no responsibility for the
accuracy, completeness, sufficiency, or usefulness of the information contained herein. Cegelec gives no warranties of merchantability or
fitness for purpose shall apply.
In this publication, no mention is made of rights with respect to trademarks or tradenames that may attach to certain words or signs. The
absence of such mention, however, in no way implies there is no protection.
Partial reproduction of this document is authorized, but limited to internal use, for information only and for no commercial purpose.
However, such authorization is granted only on the express condition that any partial copy of the document bears a mention of its property,
including the copyright statement.
© Copyright 1998, Cegelec, Levallois-Perret (France)

All rights reserved
Page 2 MODBUS Master and Slave Protocol for Alspa 8000 PLCs ALS 53302 d-en
User’s Manual
Revisions
Index letter Date Nature of revision
b 09-97 Minor changes
c 04-98 Minor changes
d 09-98 Minor changes
ALS 53302 d-en MODBUS Master and Slave Protocol for Alspa 8000 PLCs Page 3
User’s Manual
Revisions
User’s Manual
Preface
1 CONTENT OF THIS MANUAL

This manual applies to version 1.5. It is made up as follows:
Chapter 1: General
Chapter 2: Operation of the MODBUS Exchange Unit (EU)
Chapter 3: Master EU Exchange Specifications
Chapter 4: MODBUS Transmission Frame
Chapter 5: Operation
Chapter 6: Details of RTU transmission frames
3. RELATED PUBLICATIONS
For more information, refer to this publication ALS 52402.
4. WE WELCOME YOUR COMMENTS AND SUGGESTION

Cegelec strives to produce quality technical documentation. Please take the time to fill in and return the "Reader's
Comments" page if you have any remarks or suggestions.
User’s Manual
Preface
User’s Manual
Reader's comments
ALS 53302 d-en MODBUS Master and Slave Protocol for

Alspa 8000 PLCs User’s Manual
Your main job is:
System designer Programmer

Distributor Maintenance
System integrator Operator
Installer Other (specify below)
If you would like a personal reply, please fill in your name and address below:
COMPANY:...............................................................NAME:..................................................................................
ADDRESS:................................................................................................................................................................
....................................................................................COUNTRY: ..........................................................................
Send this form directly to your Cegelec sales representative or to this address:
Cegelec
Technical Documentation Department (TDD)
5, avenue Newton - B.P. 215
92142 CLAMART Cedex
France
Fax: +33 (0)1 46 29 12 44
All comments will be considered by qualified personnel.
REMARKS
User’s Manual
Reader's comments
User’s Manual
Contents
CHAPTER 1 - GENERAL
1. PURPOSE AND USE OF THIS LINK ........................................................................................................ 1-1
2. REMINDER ON THE PROTOCOL............................................................................................................ 1-1
3. GENERAL SPECIFICATIONS OF THE NETWORK ............................................................................... 1-2
4. NETWORK CONFIGURATION ................................................................................................................ 1-3
CHAPTER 2 - OPERATION OF THE MODBUS EXCHANGE UNIT (EU)

1. PLC/EU INTERFACE ................................................................................................................................. 2-1
2. TRANSFER OF REQUESTS....................................................................................................................... 2-3
3. REQUEST TABLES .................................................................................................................................... 2-5
3.1 Format of the Deactivation Request ....................................................................................................... 2-5
3.2 Format of the Activation Request ........................................................................................................... 2-6
3.3 Format of the Exchange Request Table ................................................................................................ 2-10
CHAPTER 3 - MASTER EU EXCHANGE SPECIFICATIONS

1. GENERAL STRUCTURE OF AN EXCHANGE........................................................................................ 3-2
1.1 Structure of a ER (Exchange Request) ................................................................................................... 3-2
1.2 Structure of an Answer ........................................................................................................................... 3-3
2. DETAILED STRUCTURE OF AN EXCHANGE....................................................................................... 3-5
2.1 Reading of "n" Bits................................................................................................................................. 3-5
2.2 Reading of "n" Words ............................................................................................................................ 3-6
2.3 Writing a Bit at a Value.......................................................................................................................... 3-7
2.4 Writing a Word at a Value...................................................................................................................... 3-8
2.5 Asynchronous Reading of a Particular Byte ........................................................................................... 3-9
2.6 Diagnostic and maintenance functions ................................................................................................. 3-10
2.7 Writing of "n" Bits................................................................................................................................ 3-13
2.8 Writing of "n" Words ........................................................................................................................... 3-14
2.9 Return Equipment Type........................................................................................................................ 3-16
2.10 Read Working Zone Memory............................................................................................................. 3-17
CHAPTER 4 - MODBUS TRANSMISSION FRAME

1. FIELDS ........................................................................................................................................................ 4-1
2. FRAME FORMAT ACCORDING TO CODING........................................................................................ 4-2
2.1 RTU Coding ........................................................................................................................................... 4-2
2.2 ASCII Coding......................................................................................................................................... 4-2
CHAPTER 5 - OPERATION
1. CONFIGURING THE PROCESSING UNIT .............................................................................................. 5-1
1.1 Case of a PCM (IC693PCM301 : IC693PCM311 : IC697PCM701)................................................... 5-1
1.2 Case of an MBM (CF693MBM100: CF697MBM101).......................................................................... 5-1
1.3 Loading the PCM card (IC693PCM301 : IC693PCM311 : IC697PCM701)...................................... 5-1
2. IN THE PCOP DIRECTORY ...................................................................................................................... 5-3
User’s Manual
Contents
2.1 TERMSET command ............................................................................................................................. 5-3
2.2 TERMF command .................................................................................................................................. 5-3
2.2.1 MBPCM application program ........................................................................................................................5-4
2.2.2 Starting up the PC/PS EUs .............................................................................................................................5-4
2.3 Request for Transmission of Exchanges in the PC ............................................................................... 5-16
2.3.1 Use of Answers and Faults in the PC ...........................................................................................................5-28
2.3.2 Counting of Faults in the PS.........................................................................................................................5-33
CHAPTER 6 - DETAILS OF RTU TRANSMISSION FRAMES

1. READING OF "N" BITS ............................................................................................................................. 6-1
2. READING OF "N" WORDS........................................................................................................................ 6-2
3. WRITING A BIT ......................................................................................................................................... 6-3
4. WRITING A WORD.................................................................................................................................... 6-3
5. ASYNCHRONOUS READING OF A PARTICULAR BYTE.................................................................... 6-4
6. READING PS DIAGNOSTIC COUNTERS................................................................................................ 6-4
7. WRITING OF "N" BITS.............................................................................................................................. 6-5
8. WRITING OF "N" WORDS ....................................................................................................................... 6-6
9. RETURN EQUIPMENT TYPE ................................................................................................................... 6-6
10. READING WORKING ZONE MEMORY................................................................................................ 6-7
11. EXCEPTION FRAME, NEGATIVE ANSWER ....................................................................................... 6-8
User’s Manual
Chapter General
1. PURPOSE AND USE OF THIS LINK

The MODBUS protocol (registered trade mark of GOULD INC) allows communication between a master and
one or more slave PLCs sharing the same physical multi-point link. It supports simple exchanges (question-
answer) with a response time varying from a few hundreds of milliseconds to several seconds, depending on the
speed of the medium and the number of stations.
A device in the range can be either master or slave. This protocol therefore means that links can be made between
a device in the range and any heterogeneous device supporting the MODBUS protocol.
2. REMINDER ON THE PROTOCOL

A multi-point link is statically configured between a master and from 1 to 255 slaves.
Only the master can initiate a transaction. A transaction is either of the question-answer type (a single slave
selected) or the broadcast/no-answer type (all slaves selected). A transaction comprises a question frame and an
answer frame, or simply a broadcast frame.
Some characteristics of the protocol are fixed (frame format, sequences, error processing, functions performed),
while others can be configured by the user (transmission rate, parity, number of stop bits, number of bits of one
character (7 or 8), ASCII or RTU transmission mode). These parameters are defined on each station and cannot
be modified during operation.
Each message sent by the master contains an envelope (depending on the type of transmission) and data:
destination address, action to be executed, data associated with the action, error checking code. The station
concerned removes the envelope, checks the error code and, if there is no transmission error, executes the task
and generates an answer message with a format similar to that of the question. The answer is only transmitted if
the question was not broadcast.
The master can send a new message to any slave as soon as it has received a valid answer, or after a time-delay
indicating that there is no answer and a number of repetitions of the same message. The maximum answer time
allocated to the slave for performing a function and sending back an answer, plus the number of repetitions, are
specified in the configuration table.
ALS 53302 d-en MODBUS Master and Slave Protocol for Alspa 8000 PLCs Page 1-1
User’s Manual
General
The actions performed by a slave are of the following type:
• reading of one or more bits
• reading of one or more words (two bytes per word)
• writing of one or more bits
• writing of one or more words (two bytes per word)
• return of diagnostic data
3. GENERAL SPECIFICATIONS OF THE NETWORK

Rate: 300 to 19200 (or 38400) bauds
Line protocol: Modbus RTU or ASCII

Frame length: 261 bytes maximum in RTU mode 525 bytes in ASCII mode
Line access protocol: Question-answer mechanism between a master (PC) and a slave (PS).
The PC questions the PS whenever it so wishes. The PSs anwser the PC’s questions
after performing the work request.
Topology: Bus network.
Theoretical number 256 maximum, 1 master and 255 slaves.

of subscribers: This number can be limited to a lower number by the physical characteristics of the
line.
Page 1-2 MODBUS Master and Slave Protocol for Alspa 8000 PLCs ALS 53302 d-en
User’s Manual
General
4. NETWORK CONFIGURATION
Point-to-point
-------------
+--------+ +--------+
| | RS-485 or RS-232C | |
| PC +-------------------------+ PS |
| | | |
+--------+ +--------+
Multipoint
----------
+------+ RS-485 or modem

| PC |------+------------+------------------------ ---+----------
+------+ | | |
| | |
+--+---+ +--+---+ +------+
| PS | | PS | | PS |
+------+ +------+ +------+
User’s Manual
General
User’s Manual
Chapter Operation of the MODBUS Exchange
Unit (EU)
2
The MODBUS Master/Slave EU can work on the following modules:
• PCM 301 and PCM 311 of the Alspa C80-35 and PCM 711 of the Alspa C80-75, the MBPCM software can
be downloaded to the PCM with the TERMF terminal emulation program. For more information on the
PCMs, see document ALS 52402.
• Modbus Master/Slave Coprocessor Module, P/N CF693CMM100 combined with a IC693PCM300 OEM
module (generic) equipped with an MBP100 PROM.
• Modbus Master/Slave Coprocessor Module, P/N CF697MBM101, combined with IC697PCM711 OEM
module (generic) equipped with an MBP101 PROM.
• For installation and startup of these modules, refer to chapter 5.
1. PLC/EU INTERFACE
The interface between the PLC and the MODBUS EU is via four tables transferred with instruction COMMREQ.
The tables are specified by an identifier (ID_Tab) taking a value equal to

0: request for deactivation of the EU.
1: this is a request for activation of the MODBUS Master EU with a configuration table containing the
parameters necessary for operation.
2: this is a request for activation of the Slave MODBUS EU with a configuration table containing the parameters
necessary for operation.
3: this is a request for exchanges with a ER table intended for the MODBUS Master EU.
User’s Manual
Operation of the MODBUS Exchange Unit (EU)
There are three types of exchanges in the ER table:
• Triggered: the EU sends the requests asked for by the PLC as a priority
• Periodic: the EU sends the requests periodically, the value of the period being defined in a field of the
exchange request structure (see exchange request table)
• Cyclic: the EU cyclically sends requests of lower priority than the other two types.
In the PLC program, these tables are prepared in the register memory type data block (%R) of the COMMREQ
command block and transferred separately, first to the configuration table for activation of the MODBUS Master
EU, and then the exchange requests table. Table transfer uses the COMMREQ function of communication
channel (TASK) number 120.
The exchange requests can be modified by a new transfer of the ER table while the MODBUS Master EU is in
service.
User’s Manual
2. TRANSFER OF REQUESTS
The PLC program can send a request to the Master MODBUS EU with instruction COMMREQ, a request is
contained in the data block from 1 to 128 words long (256 bytes) of the PLC memory type (%I, %Q, %R, %AI,
%AQ).
The COMMREQ instruction comprises four input parameters and one or two output parameters (the PCM 80-75
has two) and its format is defined as follows:
+----------+
| COMMREQ |
(Enable) --+ +-- ( OK, PCM 80-75 only)
| |
?????? --+ IN FT +--
| |
?????? --+ SYSID |
| |
?????? --+ TASK |
| |
+----------+
Enable input: enables the instruction.
IN input: designates the beginning of the command block comprising the COMMREQ
command and the data block. This can be any address in the PLC program, oriented
at word level (%R, %AI or %AQ in the COMMREQ request of Alspa 80-75 and
Alspa 80-35; %P or %L of the COMMREQ request of Alspa 80-75 only).
SYSID input: gives the target PCM address - the rack number (high-order byte) and its location - to
which the COMMREQ request is sent. It should be noted that PCM 80-35 should be
installed in rack 0.
TASK input: designates the communication channel between the PLC and the PCM, the channel
value should be between 4 and 120. We choose 120 as the communication channel
number between the PLC and PCM.
the OK and FT (fault) outputs check execution of the COMMREQ instruction and can take the following logic
states:
+----------+-----------------+-----------+-----------+
| Enable | Error ? | output OK | output FT |
+----------+-----------------+-----------+-----------+
| Active | No | True | False |
| Active | Yes | False | True |
| Inactive | No execution | False | False |
+----------+-----------------+-----------+-----------+
User’s Manual
The command block has the following structure:
bit 15 0
+------------------------------------+
| Length of data block |
+------------------------------------+
| WAIT/NOWAIT |
+------------------------------------+
| Type of memory of state pointer |
+------------------------------------+
| Offset of state pointer |
+------------------------------------+
| ACK wait timer |
+------------------------------------+
| MAX communication timer |
+------------------------------------+
| |
| |
/ Data block /
| |
| |
+------------------------------------+
• Length of data block indicates the number of words in the data block. The length is limited to 128 words.
• Wait/Nowait: in Wait mode (1), the CPU waits for a reply from the target PCM before continuing running the
PLC program: in Nowait mode (0), the CPU continues to run the program after the message has been sent.
We recommend using the Nowait mode.
• Type of memory and state point offset specify the memory location of the PLC which contains the state word
that the PCM is to send at the end of the COMMREQ function . It should be noted that the Memory Type and
State pointer offset are not used for the Master and Slave MODBUS EUs.
• ACK wait timer, i.e. the maximum waiting time for an acknowledgement of receipt from the target PCM. This
is ignored in Nowait mode.
• MAX communication timer, the maximum wait time for the COMMREQ command block to be completely
read by the target PCM. It is ignored in Nowait mode.
• Data block containing a request table to be transferred to the MODBUS EU (target PCM).
User’s Manual
3. REQUEST TABLES
3.1 Format of the Deactivation Request
bit 15 8 7 0
+------------------------+------------------------+
| Comm_Chann | ID_Tab = 0 | word 0
+------------------------+------------------------+
* Comm_Chann: communication channel on a PCM serial port.
+-------------+--------------+
| Comm_Chann | Serial port |
+-------------+--------------+
| 1 | Port 1 |
| 2 | Port 2 |
+-------------+--------------+
User’s Manual
3.2 Format of the Activation Request

An activation request table is simply a configuration table containing the parameters necessary for operation of
the EU.
Configuration table
PC configuration table:
bit 15 8 7 0
+------------------+------------------+
+------------------+------------------+
| EU service bits address | word 1
+-------------------------------------+
| Subscriber number | word 2
+-------------------------------------+
| DPE delay | 000 | G |RS|A| TC| word 3
+-------------------------------------+
| Turn-round timer (ms) | word 4
+-------------------------------------+
| Answer wait timer (ms) | word 5
+-------------------------------------+
|Authorized number of retranmsissions | word 6
+-------------------------------------+
| CR zone address | word 7
+-------------------------------------+
| Periodic time base (ms) | word 8
+-------------------------------------+
PS configuration table:
bit 15 8 7 0
+------------------+------------------+
+------------------+------------------+
| EU service bits address | word 1
+-------------------------------------+
| Subscriber number | word 2
+-------------------------------------+
| DPE delay | 000 | G |RS|A| TC| word 3
+-------------------------------------+
+-------------------------------------+
| Fault indicator address | word 5
+-------------------------------------+
| Fault bits address | word 6
+-------------------------------------+
| 1 character transmission | word 7
| timer |
+-------------------------------------+
The G and DPE delay parameters are managed from version 1.5 onwards.
The A and RS parameters are optional and managed from version 1.6 onwards.
User’s Manual
• Comm_Chann: communication channel on a PCM serial port.
+-------------+--------------+
| Comm_chann | Serial port |
+-------------+--------------+
| 1 | Port 1 |
| 2 | Port 2 |
+-------------+--------------+
• COMMREQ answer address is a logical address of the register memory type ( %R ). It is the address to which
the PCM returns an answer to the COMMREQ command in the PLC program. This is a positive (ACK) or
negative (NACK) acknowledgement, with active or inactive EU status.
Meaning of service bits:
bit0 : ACK (acknowledged by the EU)
bit1 : NACK (not acknowledged by the EU)
bit2 : EU in service
bit3 : EU out of service
bit4 : Intentional EU withdrawal (1)
bit5 : not used
bit6 : not used
bit7 : not used
bit8 : Triggered ER list saturated (2)
bit9 : Periodic ER list saturated (2)
bit10 : Cyclic ER list saturated (2)
bit11 : Rejection of current exchange request (2)
bit12 : Triggered ER list empty (2)
bit13 : Periodic ER list empty (2)
bit14 : Cyclic ER list empty (2)
bit15 : not used
(1) : software fault in EU which goes inactive and signals bit4 = 1.
(2) : these bits are used for the Master EU.
• Subscriber number: 0 = MODBUS PC, 1 to 255 = MODBUS PS.
• TC (bit 0): type of frame coding, 0 = RTU, 1 = ASCII.
• A (bit1/word 3): automatic removal of MODBUS EU is stopped or faulty,
• RS (bit2-bit3/ word 3): redefinition of port RS485 link for MBM100 (or MBM101) configured in PROG
PRT mode.
RS = 0: no action,
= 1: RS485 2-wire multipoint link without flow control,
= 2: RS485 4-wire multipoint link without flow control,
= 3: RS485 4-wire point to point link,
• G (bit 4) : management of DPE signal (RTS); 0 = YES, 1 = NO
User’s Manual
• DPE delay (bit 8 to bit 15) : delay on feedback of DPE signal (RTS) at end of transmission in case of use with
a modem. Maximum delay = 255 expressed in milliseconds. It is ignored if no signal management
(G = 1).
• Turn-round timer is a time-out (ms) for matching between PC (master) and PS (slave). It ensures a minimum
interval between two frames on the medium, which enables a “slow” PC or PS subscriber to turn-round from
transmission to reception before the following frame arrives.
• The fault indicator address is a logical address of the register memory type (%R); the indicator is set to FF by
MODBUS Slave EU to signal a fault to be read in the fault address. It should be set to 00 after the fault has
been processed.
• Character transmission timer (Tcar) rejects the frames intended for the other subscribers. It also determines
the time necessary for receiving a question frame asked by the MODBUS Master EU. Tcar is equal to a
minimum of 0.5 milliseconds (Tcar = 0).
example:
+-----------+-----+-----+-----+-----+-----+-----+-----+-----+
|Rate |38400|19200| 9600| 4800| 2400| 1200| 600 | 300 |
+-----------+-----+-----+-----+-----+-----+-----+-----+-----+
|Tchar/RTU | 0 | 1 | 2 | 3 | 5 | 10 | 20 | 40 |
+-----------+-----+-----+-----+-----+-----+-----+-----+-----+
|Tchar/ASCII| 1 | 2 | 3 | 5 | 10 | 20 | 40 | 80 |
+-----------+-----+-----+-----+-----+-----+-----+-----+-----+
• Fault bits address is a logical address of the register memory type (%R); the bits are only significant if the
fault indicator is set to FF.
Meaning of fault bits:
bit0 : function code incorrect in frame received
bit1 : address field incorrect in frame received
bit2 : data field incorrect in frame received
bit3 : reception fault (parity, stop bit, etc. error)
bit4 : CTS fault
bit5 : CRC(RTU) or LRC(ASCII) error
bit6 : non-ASCII character in frame received (ASCII mode only)
bit7 : ASCII frame no termination CR(0DH) and LF(0AH)
bit8 : incorrect frame length
bit9 : not used
bit10 : not used
bit11 : not used
bit12 : not used
bit13 : not used
User’s Manual
bit14 : not used

bit15 : not used
• Timer (ms) waiting for reply from a PS receiving an exchange request. This is started at the end of
transmission of a question frame.
• Number (0 - 3) for message re-transmission, not broadcast, without reply or with physically incorrect reply.
• Address of report zone is a logical address of the register memory type (%R). It is a state and faults zone for
the exchange requests, updated by the MODBUS Master EU before, during and after the exchange.
• This zone is itself divided into 3 contiguous zones:

• 1 zone of 64 words (%R) for triggered exchange request reports (ER00 to ER63),
• 1 zone of 64 words (%R) for periodic exchange request reports (ER64 to ER127),
• 1 zone of 128 words (%R) for cyclic exchange request reports (ER128 to ER255).
Each report word is associated with a ER number ( ERxx ) which is defined in the structure of a ER (see
exchange requests table) and used to determine the type of exchange:
from number 0 (ER00) to 63 (ER63) = triggered ER,
from number 64 (ER64) to 127 (ER127) = periodic ER,
from number 128 (ER128) to 255 (ER255) = cyclic ER.
Format of an exchange request report (ER):
bit 15 4 3 0
+----------------------------------------++--------------+
| faults || state |
+----------------------------------------++--------------+
A report consists of an exchange request state and faults.
Values and meaning of

1. ER state bits:
bit0 : exchange in progress, updating of this bit deleted for cyclic ERs, as of version 1.3
bit1 : exchange ended without fault
bit2 : exchange ended with fault (CR <> 0)
bit3 : ER validity indicating that the request is stored in the list of requests to be issued
User’s Manual
2. ER fault bits:
bit5 : CTS fault
bit7 : non-ASCII Character in received frame (ASCII mode only)
bit8 : no answer to the question after answer wait time-out; this time-out is in the configuration table
bit9 : expected function code incorrect
bit10 : expected data length incorrect
bit11 : question function code or data incorrect
bit12 : no correct reply after planned number of retransmissions
bit13 : rejection of a ER by PS, reception of 1 negative answer frame (exception frame)
bit14 : rejection of a ER by PC, exchange in progress
bit15 : rejection of a ER by PC, ER list saturated
• Periodic time base is the unit value of the periodic type exchange period; at least or by default it is equal to
200 milliseconds.
3.3 Format of the Exchange Request Table

The number of requests in this table is limited to 18.
bit 15 8 7 0
+------------------+------------------+
+------------------+------------------+
| Number of DEs | word 1
+-------------------------------------+
| | word 2
| |
| DE block |
| |
| | word n
+------------------+------------------+
n = (7 x Number of DEs) + 1
User’s Manual
A request is defined as the following structure:
bit 15 8 7 0
+------------------+------------------+
|DV| period | DE number | word 0
+------------------+------------------+
| PS address | Function code | word 1
+------------------+------------------+
| MODBUS address / Sub_function code | word 2
+-------------------------------------+
| Number / Variable value | word 3
+-------------------------------------+
| Memory type | word 4
+-------------------------------------+
| Memory type address | word 5
+-------------------------------------+
| Reply address in PC | word 6
+-------------------------------------+
word 4: memory type sampled from the PC
• * Comm_Chann: communication channel on PCM serial port.

+-------------+--------------+
| Comm_Chann | Serial port |
+-------------+--------------+
| 1 | Port 1 |
| 2 | Port 2 |
+-------------+--------------+
• ER (bit 0 - bit 7) Number (exchange request) is between 0 (ER0) and 255 (ER255).
The triggered exchange requests are numbered from 0 (ER00) to 63 (ER63) and have the highest priority. The
periodic exchange requests are numbered from 64 (ER64) to 127 (ER127).
The cyclic exchange requests are numbered from 128 (ER128) to 255 (ER255) and have lower priority than
the other two.
• A ER can be modified while the MODBUS Master EU is in service.
DV (bit 15) = 1, valid request: insert or change the request,
= 0, invalid request: cancel the request.
• period (bit 8 - bit 14): number of the periodic value unit, this unit is defined in the periodic time base field of
the configuration table.
• PS subscriber address (bit 0 - bit 7), this is the address of a PS on the network. The PSs are numbered from 1
to 255, with address 0 meaning that the message is broadcast.
• Function code asking the slave to perform a job
• MODBUS address or sub-function code. This is the first word of the data field, not used for certain functions.
• Number or value of variable, this is the second word of the data field, not used for certain functions.
User’s Manual
• Sampling address in PC, consisting of:

• type of memory
= 16 , %I logic inputs (1)
= 18 , %Q logic outputs (1)
= 20 , %T temporary internal bits (1)
= 22 , %M memorised internal bits (1)
= 8 , %R registers (2)
= 10 , %AI analogue inputs (2)
= 12 , %AQ analogue outputs (2)
• the memory type address which begins at 1.
• Answer address in PC is a logic address of the register memory type (%R). It is the address at which a PS
answer is stored.
(1) : only valid for function code 15.
(2) : only valid for function code 16.
User’s Manual
Chapter Master EU Exchange Specifications
Each exchange consists of an exchange request ER (question) and an associated answer, but a broadcast ER has
no answer.
Broadcasting is not authorised for all types of Function codes and is impossible if the network consists of
heterogeneous subscribers.
A ER is simply a question sent by the Master subscriber to one or more Slave subscribers. The Slave subscriber
receives an error-free question frame intended for it, executes the job requested and sends an answer frame.
The content of the answer depends on the content of the ER and varies from 2 to 130 words (4 to 260 bytes).
The ERs only concern the Master EU and the ERs are loaded by the COMMREQ instruction. It should be
remembered that the number of ERs is limited to 18 in the exchange request table. Each ER is associated with a
report word whose address is defined in the configuration table and which is used to fill out the exchange state
and faults. When the exchange ends without fault, the answer is stored in the application memory at the address
defined in a field - Answer address in PC - of the ER structure (see page 3-2).
User’s Manual
Master EU Exchange Specifications
1. GENERAL STRUCTURE OF AN EXCHANGE
1.1 Structure of a ER (Exchange Request)

bit 15 8 7 0
+--+---------------+------------------+
word 0 |DV| period | ER number | See ER Table
+--+---------------+------------------+
word 1 | Function code | PS address |
+------------------+------------------+
word 2 | Start address of the variable or |
| sub-function code |
+-------------------------------------+
word 3 | Number or value of variable |
+-------------------------------------+
word 4 | Type of memory | | sampling address
+-------------------------------------+ | in PC, used for
word 5 | Address of type of memory | | function codes
+-------------------------------------+ | 15 and 16
word 6 | Answer address in PC |
+-------------------------------------+
PS address: slave number (0 to 255 (0FFH), 0 = broadcast to all the PSs ).
Start address of the variable is a MODBUS compatible address in the PS PLC questioned, Sub-function code is a
sub-code of diagnostic and maintenance Function 8.
+---------------+----------------------------------------------+
| Function code | Function |
+---------------+----------------------------------------------+
| 1 and 2 | read request for n bits |
+---------------+----------------------------------------------+
| 3 and 4 | read request for n words |
+---------------+----------------------------------------------+
| 5 | writing a bit at a value |
+---------------+----------------------------------------------+
| 6 | writing a word at a value |
+---------------+----------------------------------------------+
| 7 | asynchronous reading of a particular byte |
+---------------+----------------------------------------------+
| 8 | diagnostic and maintenance function |
| | specified by the function sub-code |
+---------------+----------------------------------------------+
| 15 (0FH) | write n bits |
+---------------+----------------------------------------------+
| 16 (10H) | write n words |
+---------------+----------------------------------------------+
| 17 (11H) | send back equipment type |
+---------------+----------------------------------------------+
| 32 (20H) | read or clear table of state changes |
| | for a PS |
+---------------+----------------------------------------------+
| 67 (43H) | read memory of working zone |
+---------------+----------------------------------------------+
User’s Manual
For the Alspa 8000 PLCs using the RTU protocol and MODBUS Slave EU PCM, the meaning of the sub-codes
is as follows (see document ALS 52506).
+---------------+------------------------------------------------+
| Sub-code | Sub-function of function 8 |
+---------------+------------------------------------------------+
| 0 | return query data |
+---------------+------------------------------------------------+
| 1 | trigger restart of communications |
+---------------+------------------------------------------------+
| 4 | force reception mode only |
+---------------+------------------------------------------------+
The values not given in these tables are not authorised.
1.2 Structure of an Answer

• Content of an error-free answer to a non-broadcast request
bit 15 8 7 0
+-+---------------+-------------------+
word 0 |0| Function code | PS address |
+-+---------------+-------------------+
word 1 | | |
+-------------------------------------+ | see details for
word 2 | | | each Function code
+-------------------------------------+ | below
: : |
+-------------------------------------+ |
word n | | |
+-------------------------------------+
PS address: slave number = 1 to 255 (0FFH)
Function code: see the Function code of the ER.
User’s Manual
• Content of a negative answer from the slave which did not execute the order, bit 15 of word 0 is set to 1.
bit 15 8 7 0
+-+---------------+-------------------+
word 0 |1| Function code | PS address |
+-+---------------+-------------------+
word 1 | 00 | error code |
+-----------------+-------------------+
+---------------+---------------------------------------------+
| Error code | Meaning |
+---------------+---------------------------------------------+
| 1 | Function code incorrect |
+---------------+---------------------------------------------+
| 2 | start address of variable incorrect |
+---------------+---------------------------------------------+
| 3 | data incorrect |
+---------------+---------------------------------------------+
| 4 | PLC not ready |
+---------------+---------------------------------------------+
When an exchange is completed, the following three cases are possible:
• either error-free exchange, bit 1 of the associated report word is at 1 and the fault bits are at 0,
• or exchange with fault, bit 2 of the associated report word is at 1 and at least one fault bit is set to 1,
• or a negative answer, bit 1 and bit 13 are at 1 (exception frame).
In any case, bit 3 remains at 1 if the ER is periodic or cyclic, otherwise it is reset to 0.
User’s Manual
2. DETAILED STRUCTURE OF AN EXCHANGE
2.1 Reading of "n" Bits

Composition of the ER
bit 15 8 7 0
+--+---------------+------------------+
+--+---------------+------------------+
word 1 | F.C. = 1 or 2 | PS Address |
+------------------+------------------+
word 2 | Address of first bit to be read | MODBUS encoded address
+-------------------------------------+
word 3 | Number of bits to be read | from 1 to 2048 bits
+-------------------------------------+
word 4 | xxxx (not used) |
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
DV = 1, valid request: insert or change the request
For C80-35 and C80-75 PLCs, Function code (F.C.) 1 means reading of n bits of a table of:
• Logical outputs %Q, MODBUS encoded address of beginning of table is equal to 0 (%Q0001),
• Memorised Internal Bits %M, MODBUS encoded address of beginning of table is equal to 20000 (%M0001),
• Temporary Internal Bits %T, MODBUS encoded address of beginning of table is equal to 40000 (%T0001),
and Function code 2 for reading of n bits of a logical inputs table %I, MODBUS encoded address of beginning of
table is equal to 0 ( %I0001 ).
Content of error-free answer
bit 15 8 7 0
+-+---------------+-------------------+
word 0 |0| F.C. = 1 or 2 | PS Address |
+-+---------------+-------------------+
word 1 | Number of significant bytes | from 1 to 256 bytes
| below |
+-------------------------------------
word 2 | Value of first bits | | depends on the number
| 16th bit 1st bit| | | of bytes defined by
+-------------------------------------+ | word 2
word 3 | 17th bit | | nbr bytes ) nbr bits/8
+-------------------------------------+ | (rounded off to next
: : | higher value)
+-------------------------------------+ |
word n | | |
+-------------------------------------+
User’s Manual
2.2 Reading of "n" Words

bit 15 8 7 0
+--+---------------+------------------+
+--+---------------+------------------+
word 1 | F.C. = 3 or 4 | PS Address |
+------------------+------------------+
word 2 | Address of first word to be read | MODBUS encoded address
+-------------------------------------+
word 3 | Number of words to be read | of 1 to 128 words
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
For C80-35 and C80-75 PLCs, Function code (F.C.) 3 means reading of n words of a table of registers of
reference %R, Function code 4 reading of n words of a table of analogue inputs of reference %AI, and the
address of the first word to be read is equal to the number of the first register (F.C. = 3) or the first analogue
input (F.C. = 4) sent back in the normal answer minus 1.
Content of error-free answer
bit 15 8 7 0
+-+---------------+-------------------+
word 0 |0| F.C. = 3 or 4 | PS Address |
+-+---------------+-------------------+
word 1 | Number of significant bytes | from 1 to 256 bytes
| below |
+-------------------------------------+
word 2 | Value of the first word | | depends on number
+-------------------------------------+ | of bytes defined by
word 3 | Value of the second word | | word 2
+-------------------------------------+ | nbr bytes = nbr words*2
: : |
+-------------------------------------+ |
word n | Value of the last word | |
+-------------------------------------+
User’s Manual
2.3 Writing a Bit at a Value

This request can be broadcast.
bit 15 8 7 0
+--+---------------+------------------+
+--+---------------+------------------+
word 1 | F.C. = 5 | PS Address |
+------------------+------------------+
word 2 | Address of bit to write | MODBUS encoded address
+-------------------------------------+
word 3 | Value of bit to write | 1 = FF00H, 0 = 0000H
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
For C80-35 and C80-75 PLCs, Function code 5 means writing of a single output:
• output reference %Q, MODBUS encoded address of beginning of table (%Q0001) equal to 0,
• memorised internal bit %M, MODBUS encoded address of beginning of table (%M0001) equal to 20000.
• temporary internal bit %T, MODBUS encoded address of beginning of table (%T0001) equal to 40000.
Content of error-free, non-broadcast answer.
bit 15 8 7 0
+-+---------------+-------------------+
word 0 |0| F.C. = 5 | PS Address |
+-+---------------+-------------------+
word 1 | Address of bit written |
+-------------------------------------+
word 2 | Value of bit written | FF00H or 0000H
+-------------------------------------+
User’s Manual
2.4 Writing a Word at a Value

bit 15 8 7 0
+--+---------------+------------------+
word 0 |DV| period | ER number | see ER Table
+--+---------------+------------------+
+------------------+------------------+
word 2 | Address of word to write | MODBUS encoded address
+-------------------------------------+
word 3 | Value of word to write |
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
For C80-35 and C80-75 PLCs, Function code 6 means writing of a single register of reference %R, and the
address of the word to be written is equal to the number of the register to be written minus 1.
Content of the error-free, non-broadcast answer.
bit 15 8 7 0
+-+---------------+-------------------+
+-+---------------+-------------------+
word 1 | Address of written word |
+-------------------------------------+
word 2 | Value of written word |
+-------------------------------------+
User’s Manual
2.5 Asynchronous Reading of a Particular Byte

This function is used for asynchronous reading of a particular byte of the application memory. For C80-35 and
C80-75 PLCs, this byte is the first eight output points of %Q (%Q0001 to %Q0008).
bit 15 8 7 0
+--+---------------+------------------+
+--+---------------+------------------+
+------------------+------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
Content of error-free answer.
bit 15 8 7 0
+-+---------------+-------------------+
+-+---------------+-------------------+
word 1 | Not significant | Value of byte |
+-------------------------------------+
User’s Manual
2.6 Diagnostic and maintenance functions

bit 15 8 7 0
+------------------+------------------+
+--+---------------+------------------+
+------------------+------------------+
word 2 | 00 |Function sub-code |
+------------------+------------------+
word 3 | 0000 |
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
bit 15 8 7 0
+-+---------------+-------------------+
+-+---------------+-------------------+
word 1 | 00 | Function sub-code |
+-----------------+-------------------+
word 2 | Value of counter requested |
+-------------------------------------+
Message (08): Looping/maintenance (basic)
FORMAT:
Address Funct. Diagnostic code Data Error check

08 0, 1 or 4
Data Data
Question
Address Funct. Diagnostic code Data Error check

08 0, 1 or 4
Data Data
Normal answer
User’s Manual
QUESTION:
• The Function code is 08.
• The diagnostic code takes up two bytes. The high-order byte of the diagnostic code is the first byte sent to
the Diagnostic code field. The low-order byte is the second byte sent. The Looping/Maintenance command is
only defined for diagnostic codes 0, 1 or 4. All other diagnostic codes are reserved.
• The data fields take up two bytes. The content of the two data bytes is a function of the value of the
diagnostic code.
ANSWER:
See description of diagnostic codes below:
DIAGNOSTIC CODE (00) Return data from question (Looping/Maintenance) :
• A looping/maintenance question with diagnostic code 0 is a request for question data to be returned.
• Address 0 is not authorized for this request.
• The values of the two bytes in the data field are arbitrary.
• The normal answer is identical to the question.
• The values of the data bytes in the answer are identical to those sent in the question.
DIAGNOSTIC CODE (01) Trigger restart of communications (Looping/Maintenance)
A looping/maintenance request (question or broadcast type request) with diagnostic code 1 is a Trigger restart of
communications request.
• Address 0 indicates a broadcast request. All slave stations process broadcast requests but do not return an
answer.
• This request deactivates Reception only mode (it allows the slave stations to send answers when the questions
are received in order to restart communications).
• The value of the first byte of the data field (DATA1) must be 0 or FF. Any other value will generate an error
answer. The value of the second byte of the data field (DATA2) is always 0.
• The normal answer to a Trigger restart of communications request is identical to the question.
User’s Manual
DIAGNOSTIC CODE (04) Force Reception only mode (Looping/Maintenance)
A looping/maintenance request (question or broadcast type request) with diagnostic code 4 is a Force Reception
only mode request.
• Address 0 indicates a broadcast request. All slave stations process broadcast requests.
• When a Force Reception only mode request is received, the RTU equipment is set to Reception only mode,
does not run the functions requested, and does not send any answer (normal or error) to the questions. The
Reception only mode is deactivated when the RTU equipment receives a Trigger restart of communications
request or when the equipment is restarted.
• The two bytes of the data field of a Force Reception only mode request are set at 0. The RTU equipment
never answers a Force Reception only mode request.
Note
When the RTU equipment is restarted, it deactivates the Reception only mode and can again answer questions.
User’s Manual
2.7 Writing of "n" Bits

bit 15 8 7 0
+--+---------------+------------------+
+--+---------------+------------------+
+------------------+------------------+
word 2 | Address of first bit to write | MODBUS encoded address
+-------------------------------------+
word 3 | Number of bits to write | 1 to 800 bits
+-------------------------------------+
word 4 | Type of memory | | sampling
+-------------------------------------+ | address in
word 5 | Address of type of memory | | the PC
+-------------------------------------+
+-------------------------------------+
The value of word 4, the type of memory:
• either type %I logical inputs, is equal to 16,
• or type %Q the logical outputs, is equal to 18,
• or type %T the temporary internal bits, is equal to 20,
• or type %M the memorised internal bits, is equal to 22.
For C80-35 and C80-75 PLCs, Function code 15 means writing of several:
• outputs of reference %Q, MODBUS encoded address of beginning of table (%Q0001) equal to 0,
• memorised internal bits %M, MODBUS encoded address of beginning of table (%M0001) equal to 20000,
• temporary internal bits %T, MODBUS encoded address of beginning of table (%T0001) equal to 40000.
User’s Manual
Content of error-free, non-broadcast answer.
bit 15 8 7 0
+-+---------------+-------------------+
+-+---------------+-------------------+
word 1 | Address of first bit written |
+-------------------------------------+
word 2 | Number of bits written |
+-------------------------------------+
2.8 Writing of "n" Words

bit 15 8 7 0
+--+---------------+------------------+
+--+---------------+------------------+
+------------------+------------------+
word 2 | Address of first word to write | MODBUS encoded address
+-------------------------------------+
word 3 | Number of words to write | 1 to 100 words
+-------------------------------------+
word 4 | Type of memory | | sampling
+-------------------------------------+ | address
word 5 | Address of type of memory | | in the PC
+-------------------------------------+
+-------------------------------------+
User’s Manual
The value of word 4, the type of memory:
• either type %R registers, is equal to 08,
• or type %AI analogue inputs, is equal to 10,
• or type %AQ analogue outputs, is equal to 12.
For C80-35 and C80-75 PLCs, Function code 16 means writing of several registers of reference %R, and the
address of the first word to be written is equal to the number of the first register to be written minus 1.
Content of error-free and non-broadcast answer.
bit 15 8 7 0
+-+---------------+-------------------+
+-+---------------+-------------------+
word 1 | Address of first word written |
+-------------------------------------+
word 2 | Number of words written |
+-------------------------------------+
User’s Manual
2.9 Return Equipment Type

This function is reserved for C80-35 and C80-75 PLCs.
bit 15 8 7 0
+--+---------------+------------------+
+--+---------------+------------------+
+------------------+------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
bit 15 8 7 0
+-+---------------+-------------------+
+-+---------------+-------------------+
word 1 | Number of bytes = 5 |
+-----------------+-------------------+
word 2 | PS RUN LED | Device Type |
+-----------------+-------------------+
word 3 | Pm data | PF data | PF : high order
+-----------------+-------------------+ Pm : middle order
word 4 | Not significant | Pf data | Pf : low order
+-----------------+-------------------+
The values of the various fields are defined in document ALS 52506.
Note
For the PCM MODBUS Slave EU the PS RUN LED is not significant.
User’s Manual
2.10 Read Working Zone Memory

This function is reserved for C80-35 and C80-75 PLCs.
bit 15 8 7 0
+--+---------------+------------------+
+--+---------------+------------------+
+------------------+------------------+
word 2 | Start byte number ( i ) |
+-------------------------------------+
word 3 | Number of bytes to read |
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
Error-free content of answer
bit 15 8 7 0
+-+----------------+------------------+
+-+----------------+------------------+
word 1 | Nbr of bytes in data field |
+------------------+------------------+
word 2 | byte i+1 | byte i |
+------------------+------------------+
word 3 | byte i+3 | byte i+2 |
+------------------+------------------+
: | :
: Data :
: | :
+------------------+------------------+
word n | | |
+------------------+------------------+
Byte i, the first byte in the data field, corresponds to the byte number of the working zone memory. The values of
the different fields are defined in document ALS 52506.
Note
For the PCM MODBUS Slave EU, the non-significant byte numbers in the
working zone memory are as follows:
00-01, 04-11, 16-17, 19-21, 23 and 48-255.
User’s Manual
RTU working zone
The working zone is entirely updated each time the RTU receives an external READ request. All working zone
addresses are read only. The working zone is a byte-oriented memory.
Allocating RTU working zone memory
Address Field identifier Bits

7 6 5 4 3 2 1 0
00 CPU run state 0 0 0 0 See note (1) below
01 CPU command state Binary configuration identical to SP (00)
02 CPU type Major (note 2a below) (in hexadecimal)
03 Minor (note 2b below) (in hexadecimal)
04-0B SNP CPU ID 7 ASCII characters + end character = (00h)
OC Microprogram review no. Major
OD CPU Minor
OE Microprogram review no. Major
OF CMM Minor
10 - 11 Reserved (00h)
12 Subscriber type ID (80-75 : 0Ch ; 80-35 : Odh)
13-15 Reserved (00h)
16 RTU station address 1-247 (in decimal)
17 Reserved (00h)
18-33 Size of memory types See note (3) below
18-1B Register memory Size %R
1C-1F Analog input table Size %AI
20-23 Analog output table Size % AQ
24-27 Input table Size %I
28-2B Output table Size %Q
2C-2F Internal logic memory Size %M
30-33 User Program Code See note (4) below
34-FF Reserved (00h)
User’s Manual
Notes on allocating working zone memory

1 0000 = Run_Enabled 0100 = Stopped
0001 = Run_Disabled 0101 = Suspended
0010 = Stopped 0110 = Stopped _ES_Enabled
0011 = Stopped _At_default
2a Major types of CPUs :

12 (0Ch) CPU API Alspa C80-75
16 (10h) CPU API Alspa C80-35
2b Minor types of Alspa C80-75 CPUs :

31 (1Fh) CPU 731
32 (20h) CPU 732
71 (47h) CPU 771
72 (48h) CPU 772
81 (51h) CPU 781
82 (52h) CPU 782
88 (58h) CPU 788
89 (59h) CPU 789
92 (5ch) CPU 914
94 (5eh) CPU 924
Alspa C80-35 sub-types:

35 (23h) CPU 331
36 (24h) CPU 341
3 Working zone bytes 18h-33h:
Size returned
Bytes Length of memory in
18-1B %R Register memory Words
1C-1F %AI Analog input table Words
20-23 %AQ Analog output table Words
24-27 %I Input table Points (Bits)
28-2B %Q Output table Points (Bits)
2C-2F %M Internal logic memory Points (Bits)
30-33 User Program Code Bytes
Note
The hexadecimal length of each memory type is encoded in four bytes whose
high-order word is reserved for future use. For example, the default size of
1024 words (0400h) in the memory of the 731 registers would be returned in
the following format:
Word Low order High order
SP byte 18 19 1A 1B
contains 00 04 00 00
4 Program memory area occupied by program. Also displayed in Memory used screen by Alspa P8 API in User Prog field.
User’s Manual
User’s Manual
Chapter MODBUS Transmission Frame
1. FIELDS
The MODBUS frame consists of four fields with the following format:
+---------+----------+------ - - - ----+------------+
| Address | Function | Data | Control |
+---------+----------+------ - - - ----+----------+
• Address field: this is the address of a PS (slave on the network)
The number of PSs is limited to 255.
Address 0 means broadcast, the PSs (slave) will be numbered from 1 to 255.
The PC (master) has no address. Each slave having a unique address, only that concerned answers the question
containing its address. The answer message contains the slave address, which enables checking by the master.
After a broadcast message, all the slaves on the network perform the job requested, but there is no answer.
• Function field:
This indicates what job is to be done and how to interpret the data. It can also be used to determine the message
length. The MSB of this field is set to 1 when a slave sends back an exception answer (negative) and to 0 for all
normal questions or answers.
• Data field: useful information
The data length varies according to the function.
• Control field:
If frame coding is in RTU mode, then CRC-16 (Cyclic Redundancy Check) is used, whose generator polynomial
is equal to 2^16 + 2^15 + 2^12 + 1. If frame coding is in ASCII mode, then LRC8 (Longitudinal Redundancy Check
on 8 bits) is used.
User’s Manual
MODBUS Transmission Frame
2. FRAME FORMAT ACCORDING TO CODING
2.1 RTU Coding

+---------+----------+------ - - - ----+----------+
Message |PS Addr. | Function | Information | CRC16 |
+---------+----------+------ - - - ----+----------+
\ B \ B \ B B \ B B \
Byte \ Y \ Y \ Y Y \ Y Y \
transmitted \ T \ T \ T Variable T \ T T \
\ E \ E \ E E \ E E \
\ 1 \ 1 \ 1 X \ 1 2 \
Hexadecimal +---------+----------+----- - - - -----+----------+
value | 01 | 0F | | Pf PF |
transmitted +---------+----------+----- - - - -----+----------+
For the detailed frames see appendix A.
2.2 ASCII Coding

+---+----------------+------ - - - ----+-------+----+----+
Message | : |PS Addr|Function| Information | LRC | CR | LF |
+---+----------------+----- - - - -----+-------+----+----+
\ B \ B B \ B B \ B B \ B B \ B \ B \
Byte \ Y \ Y Y \ Y Y \ Y Y \ Y Y \ Y \ Y \
transmitted\ T \ T T \ T T \ T Variable T \ T T \ T \ T \
\ E \ E E \ E E \ E E \ E E \ E \ E \
\ 1 \ 1 2 \ 1 2 \ 1 X \ 1 2 \ 1 \ 1 \
Hexadecimal +---+-------+--------+----- - - - -----+-------+----+----+
value | 3A| 30 31 | 30 46 | | PF Pf | 0D | 0A |
transmitted +---+-------+--------+------ - - - ----+-------+----+----+
The beginning of frame is specified by the “:” character. The end of frame is specified by the CR and LF
characters (CR = carriage return, LF = line feed).
User’s Manual
Chapter Operation
1. CONFIGURING THE PROCESSING UNIT
1.1 Case of a PCM (IC693PCM301 : IC693PCM311 : IC697PCM701)

In the configuration part of your development tool, insert a PCM card and configure it in CFG PCM mode. Then
transfer the configuration to the PLC.
1.2 Case of an MBM (CF693MBM100: CF697MBM101)

In the configuration part of your programming tool, insert a PCM card and configure it in PRT PCM mode.
Configure the connection parameters, then transfer the configuration to the PLC.
For a CF693MBM100, serial port No. 2 operates only in RS485 mode.
1.3 Loading the PCM card

(IC693PCM301 : IC693PCM311 : IC697PCM701).
Insert the diskette, reference IC641SWP023, in your computer and type the following command:
A : yinstall
You have just created a directory named PCOP.
In this directory, create a file PCMEXEC.BAT and a file HARDEXEC.BAT/
The file PCMEXEC.BAT allows you to launch the MODBUS software at each power-up or at each «Soft-Reset»
of the card.
User’s Manual
Operation
Example of a PCMEXEC.BAT command file:
To set serial port 2 <COM2:> to <19200> baud, without parity<N> (even parity <E> and odd parity <O>), <8>
data bits, <1> stop bit, no flow control <N> (hardware flow control RTS/CTS <H>) and use the point-to-point 4
wire network RS485 <485> configuration junction <P> (2-wire half-duplex multipoint <2>, 4-wire full-duplex
multipoint <4>, configuration ignored if RS232) :
I<sp>COM2:<sp>19200,N,8,1,N,485,P
<sp> = a space; follow the syntax.
and to run the file MBPCMV**.EXE using task 5 [option /I5]:

R<sp>MBPCMV**.EXE<sp>/I5
<sp> = a space; follow the syntax.
Note
We advise against using [option /B] in background mode, because if the task
and PCM commands interpreter use the common serial port (for example
COM1:), the interpreter remains active and is liable to interfere with the task.
For the file HARDEXEC.BAT, simply write R<sp>BASIC.EXE.
User’s Manual
Operation
2. IN THE PCOP DIRECTORY
2.1 TERMSET command

This executable allows you to set the parameters for communicating between your computer and the PCM card.
Once the parameters are set, save the changes in the card and quit.
2.2 TERMF command

This executable allows you to dialog with the PCM card. You must first connect yourself to port 1 of the PCM
card using an RS232 cord. Check that when you press a key on your keyboard, the US1 light blinks. The prompt
«>» should be displayed on your monitor. If it does not appear, do a Hard-Reset of the PCM card by holding
down the PCM card button for more than 10 seconds.
If "Ready" is displayed, type the command BYE and confirm.
If the prompt is displayed, type two exclamation points.
The exclamation points are not displayed on your monitor. Then enter a question mark: you enter
INTERACTIVE3 mode. Type the command L and confirm. The software asks you for FILE NAME/3. Enter the
path where your MODBUS software reference MBPCMV11 is located.
Example: PC :A :yMBPCMVXX.EXE.XX corresponding to the version number. Type the same command to
load files PCMEXEC.BAT and HARDEXEC.BAT. Now, to quit the executable TERMF, type the command
ALT-Z. To initialize the PCM card, you must now do a Soft-Reset by holding down the button on the front for at
least five seconds.
User’s Manual
Operation
2.2.1 MBPCM application program
A PC application program which has at least the following role:
• start up the EU (see paragraph 2.2.4),
• request transmission of exchanges in the PC (see paragraph 2.3),
• use the answers and faults in the PC (see paragraph 2.3.1).
A PS application program which has at least the following role:
• start up the EU (see paragraph 2.2.4),
• use the faults in the PC (see paragraph 2.3.2).
2.2.2 Starting up the PC/PS EUs
At power-up, the EU waits for the configuration table transferred by communication channel (TASK) number
120 using the COMMREQ function. If the configurable table is accepted, the EU sends an ACK answer with an
EU in service bit to the address of the EU service bits defined in this table, otherwise it does not answer.
User’s Manual
Operation
Master MODBUS:
Reminder of structure of PC startup request tables:
bit 15 8 7 0
+------------------+------------------+
+------------------+------------------+
| Address of EU service bits | word 1
+-------------------------------------+
| Subscriber number = 0000 | word 2
+-------------------------------------+
| DPE delay | 000 | G | 000 | TC | word 3*
+-------------------------------------+
+-------------------------------------+
| Answer wait timer (ms) | word 5
+-------------------------------------+
|Authorized number of retransmissions | word 6
+-------------------------------------+
| CR zone address | word 7
+-------------------------------------+
| Periodic time base (ms) | word 8
+-------------------------------------+
Example:
We wish to start up the MODBUS Master EU 6 seconds after starting up the C80-35 PLC, with the following
configuration table:
• Comm_Chann = 1, communication channel on PCM serial port 1
• Address of EU service bits is installed at %R0191 (00BFH)
• TC (bit 0) : 0 mode (RTU)
• G (bit 4) = 1
• DPE delay (bit 8 to bit 15) = 10 ms
• Value of turn-round timer = 150 ms (0096H)
• Value of answer wait timer = 2000 ms (07D0H)
• Number of message retransmissions = 1
• CR (report) zone address is installed at %R0201 (00C9H)
• Periodic time base = 500 ms (01F4H)
When the EU is in service, check that the content of %R0191 = 0005H.
User’s Manual
Operation
* From version 1.5 onwards, the EU manages DPE delay (see page 2-6).
User’s Manual
Operation
Slave MODBUS:
Reminder of structure of the PS startup request tables:
bit 15 8 7 0
+------------------+------------------+
| Comm_Chann= 02H | ID_Tab = 02H | word 0
+------------------+------------------+
| Address of EU service bits | word 1
+-------------------------------------+
| Subscriber number = 0014H | word 2
+-------------------------------------+
| DPE delay | 000 | G | 000 | TC | word 3*
+-------------------------------------+
+-------------------------------------+
| Fault indicator address | word 5
+-------------------------------------+
| Fault bits address | word 6
+-------------------------------------+
| Timer for transmission of | word 7
| 1 character |
+-------------------------------------+
Example:
We wish to start up the MODBUS Slave EU 6 seconds after starting up the 80-35 PLC, with the following
configuration table:
• Comm_Chann= 2, communication channel on PCM serial port 2.
• Address of EU service bits installed at %R0192 (00C0H).
• TC (bit 0) : 0 mode (RTU)
• G (bit 4) = 1
• DPE delay (bit 8 to bit 15) = 10 ms
CAUTION
If hardware flow control is active via either the I command (equipment
initialization) or the P8 configuration, the DPE signal drops immediately at
end of transmission.
It is impossible to manage the DPE delay.
* From version 1.5 onwards, the EU manages DPE delay (see page 2-6).
User’s Manual
Operation
Value of turn-round timer = 50 ms (0032H).
• Fault address indicator is installed at %R0193 (00C1H).
• Fault bits address is installed at %R0194 (00C2H).
• Timer for transmission of 1 character is equal to 1 millisecond.
When the EU is in service, check that the content of %R0192 = 0005H.
User’s Manual
Operation
MODBUS Master EU activation program:
|
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Initialise register %R0191 ( service bits ) to zero *)
|(**********************************************************************)
|
|
|FST_SCN +-----+ %T0001
+--] [---+MOVE_+-----------------------------------------------------(R)--
| | INT |
| | |
| CONST -+IN Q+-%R0191
| +00000 | LEN |
| |00001|
| +-----+
|
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Prepare the configuration table in the COMMREQ data block *)
|(* whose command block begins at address %R0001 *)
|(* and data block at address %R0007. *)
|(**********************************************************************)
|
|
User’s Manual
Operation
|FST_SCN +-----+ +-----+ +-----+

+--] [---+BLKMV+-----------------+BLKMV+-----------------+MOVE_+-
| | WORD| | WORD| | WORD|
| | | | | | |
| CONST -+IN1 Q+-%R0001 CONST -+IN1 Q+-%R0008 CONST -+IN Q+-%R0015
| 0009 | | 00BF | | 01F4 | LEN |
| | | | | |00001|
| CONST -+IN2 | CONST -+IN2 | +-----+
| 0000 | | 0000 | |
| | | | |
| CONST -+IN3 | CONST -+IN3 |
| 0000 | | 0000 | |
| | | | |
| 0000 | | 0096 | |
| | | | |
| 0000 | | 07D0 | |
| | | | |
| 0000 | | 0001 | |
| | | | |
| 0101 +-----+ 00C9 +-----+
User’s Manual
Operation
|
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Set the timer to at least 6 seconds for activation of the *)
|(* MODBUS Master EU. *)
|(**********************************************************************)
|
|
|%T0001 +-----+ %T0001
+--]/[---+ TMR +-----------------------------------------------------(S)--
| |0.01s|
| | |
| CONST -+PV |
| +00060 | |
| +-----+
| %R0171
|
|
|%T0001 %M0001
+--] [---------------------------------------------------------------(^)--
|
|
|%M0001 %M0002
+--] [---------------------------------------------------------------(SM)-
|
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Transfer the COMMREQ command block on channel number 120 to the *)
|(* MODBUS Master PCM/EU configured in rack 0, slot 2 *)
|(**********************************************************************)
|
|
User’s Manual
Operation
|%M0002 %T0001 +-----+

+--] [-----] [---+ EQ_ |
| | INT |
| | | +-----+
| %R0191 -+I1 Q+----------+COMM_|
| | | | REQ |
| | | | |
| CONST -+I2 | %R0001 -+IN FT+-
| +00000 +-----+ | |
| | |
| CONST -+SYSID|
| 0002 | |
| | |
| CONST -+TASK |
| 00000078 +-----+
|
|
|
|ALW_ON %M0002
+--] [---------------------------------------------------------------(RM)-
|
|
User’s Manual
Operation
MODBUS Slave EU activation program:
|
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Initialise the registers at zero *)
|(* - %R0192: the service bits *)
|(* - %R0193: the fault indicator *)
|(* - %R0194: the fault bits *)
|(* - %R0195: the fault counter *)
|(**********************************************************************)
|
|
|FST_SCN +-----+ %T0002
+--] [---+MOVE_+-----------------------------------------------------(R)--
| | INT |
| | |
| +00000 | LEN |
| |00004|
| +-----+
|
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Prepare the configuration table in the COMMREQ data block *)
|(* and the data block at address %R0027. *)
|(**********************************************************************)
|
|
User’s Manual
Operation
|FST_SCN +-----+ +-----+

+--] [---+BLKMV+-----------------+BLKMV+-
| | WORD| | WORD|
| | | | |
| CONST -+IN1 Q+-%R0021 CONST -+IN1 Q+-%R0028
| 0008 | | 00C0 | |
| | | | |
| 0000 | | 0014 | |
| | | | |
| 0000 | | 0001 | |
| | | | |
| 0000 | | 0032 | |
| | | | |
| 0000 | | 00C1 | |
| | | | |
| 0000 | | 00C2 | |
| | | | |
| 0202 +-----+ 0001 +-----+
User’s Manual
Operation
|
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Set the timer to at least 6 seconds for activation of the *)
|(* MODBUS Master EU. *)
|(**********************************************************************)
|
|
|%T0002 +-----+ %T0002
+--]/[---+ TMR +-----------------------------------------------------(S)--
| |0.01s|
| | |
| CONST -+PV |
| +00060 | |
| +-----+
| %R0174
|
|
|
|%T0002 %M0003
+--] [---------------------------------------------------------------(^)--
|
|
|%M0003 %M0004
+--] [---------------------------------------------------------------(SM)-
|
User’s Manual
Operation
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* MODBUS Slave PCM/EU configured in rack 0, slot 2 *)
|(**********************************************************************)
|
|
|%M0004 %T0002 +-----+
+--] [-----] [---+ EQ_ |
| | INT |
| | | +-----+
| %R0192 -+I1 Q+----------+COMM_|
| | | | REQ |
| | | | |
| CONST -+I2 | %R0021 -+IN FT+-

| +00000 +-----+ | |
| | |
| CONST -+SYSID|
| 0002 | |
| | |
| CONST -+TASK |
| 00000078 +-----+
|
|
|
|ALW_ON %M0004
+--] [---------------------------------------------------------------(RM)-
|
|
User’s Manual
Operation
2.3 Request for Transmission of Exchanges in the PC

Exchange requests are prepared in the ER table. Like the configuration table, this table is transferred by
communication channel (TASK) number 120 of the COMMREQ function.
The EU sends an answer back to the EU service bits address (e.g.: %R0191). If the ER table is acknowledged,
the answer is positive, (ACK), otherwise it is negative (NACK); in both cases, the answer is accompanied by an
EU in service bit.
If the answer is positive, the bits of all the valid exchange request report words (DV = 1) are set
• either to 0000000000001000, (binary number)
• or to 0000100000000000,
• or to 0100000000000000,
• or to 1000000000000000,
and those of invalid exchange requests (DV = 0) are set to 0000000000000000.
Reminder of the meaning of a report word bits:
bit3 : ER validity
bit11 : the function code or question data are incorrect
bit14 : rejection of an ER by PC, exchange in progress
bit15 : rejection of an ER by PC, ER list saturated
User’s Manual
Operation
Example: 10 seconds after activation of the PLC and 6 seconds after activation of the MODBUS Master EU,
we want the following exchanges:
Reading of 50 (0032H) bits of an input table %I0011 of subscriber 20, of PLC ALSPA 8000, the request type is
cyclic and the answer is stored at address %R0501 (01F5H).
bit 15 14 8 7 0
+--+---------------+------------------+
word 0 | 1| 00H | ER_No = 82H |
+--+---------------+------------------+
word 1 | F.C. = 02H | PS Addr = 14H |
+------------------+------------------+
word 2 | Addr. 1st bit to read = 000AH |
+-------------------------------------+
word 3 | Nbr of bits to read = 0032H |
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
word 6 | Answer addr. in PC = 01F5H |
+-------------------------------------+
The report word corresponding to this ER number 130 (82H) is register %R0331.
User’s Manual
Operation
Writing of 50 (0032H) output bits at %Q0011 of subscriber 20, of PLC Alspa 8000, the sampling address = 0011
for variable type %I (%I0011), the request type is cyclic and the answer is stored at address %R0631 (0277H).
bit 15 14 8 7 0
+--+---------------+------------------+
word 0 | 1| 00H | ER_No = 83H |
+--+---------------+------------------+
word 1 | F.C. = 0FH | PS Addr.= 14H |
+------------------+------------------+
word 2 | Addr. 1st bit to write = 000AH |
+-------------------------------------+
word 3 | Nbr of bits to write = 0032H |
+-------------------------------------+
word 4 | Type of variable = 0010H |
+-------------------------------------+
word 5 | Addr. 1st bit to sample = 000BH |
+-------------------------------------+
word 6 | Answer addr. in PC = 0277H |
+-------------------------------------+
Reading of 50 (0032H) words of a table of analogue inputs %AI0001 of subscriber 20, of PLC ALSPA 8000, the
request type is cyclic and the answer is stored at address %R0701 (02BDH).
bit 15 14 8 7 0
+--+---------------+------------------+
word 0 | 1| 00H | ER_No = 84H |
+--+---------------+------------------+
word 1 | F.C. = 04H | PS Addr.= 14H |
+------------------+------------------+
word 2 | Addr. 1st word to read = 0000H |
+-------------------------------------+
word 3 | Nbr words to read = 0032H |
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
word 6 | Answer addr. in PC = 02BDH |
+-------------------------------------+
User’s Manual
Operation
Writing of 100 (0064H) words of register %R1001 of subscriber 20, of PLC Alspa 8000, the sampling address =
0703 of variable type %R (%R0703), the request type is cyclic and the answer is stored at address %R0691
(02B3H).
bit 15 14 8 7 0
+--+---------------+------------------+
word 0 | 1| 00H | ER_No = 85H |
+--+---------------+------------------+
word 1 | F.C. = 10H | PS Addr. = 14H |
+------------------+------------------+
word 2 | Addr. 1st word to write = 03E8H |
+-------------------------------------+
word 3 | Nbr. of words to write = 0064H |
+-------------------------------------+
word 4 | Type of variable = 0008H |
+-------------------------------------+
word 5 | Addr. 1st word to sample = 02BFH |
+-------------------------------------+
word 6 | Answer addr. in PC = 02B3H |
+-------------------------------------+
Forcing to 1 of output %Q0010 of subscriber 20, of PLC ALSPA 8000, the request type is periodic every 2
seconds (period = 04H, 4 times 500 ms), and the answer is stored at address %R0651 (028BH).
bit 15 14 8 7 0
+--+---------------+------------------+
word 0 | 1| 04H | ER_No = 40H |
+--+---------------+------------------+
word 1 | F.C. = 05H | PS Addr. = 14H |
+------------------+------------------+
word 2 | Addr. of bit to write = 0009H |
+-------------------------------------+
word 3 | Value of bit to write = FF00H |
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
word 6 | Answer addr. in PC = 028BH |
+-------------------------------------+
User’s Manual
Operation
Writing of register %R1001 of subscriber 20, of PLC ALSPA 8000, the request type is periodic every 2 seconds
(period = 04H, 4 times 500 ms), and the answer is stored at address %R0661 (0295H).
bit 15 14 8 7 0
+--+---------------+------------------+
word 0 | 1| 04H | ER_No = 41H |
+--+---------------+------------------+
word 1 | F.C. = 06H | PS Addr. = 14H |
+------------------+------------------+
word 2 | Addr. of word to write = 03E8H |
+-------------------------------------+
word 3 | Value of word to write = A596H |
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
Asynchronous reading of a particular byte of subscriber 20 of PLC ALSPA 8000, the request type is triggered
and the answer is stored at address %R0641 (0281H).
bit 15 14 8 7 0
+--+---------------+------------------+
word 0 | 1| 00H | ER_No = 00H |
+--+---------------+------------------+
word 1 | F.C. = 07H | PS Addr. = 14H |
+------------------+------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
+-------------------------------------+
The report word corresponding to this ER number 00 (00H) is register %R0201 which is the beginning of the ER
reports zone defined in the configuration table.
User’s Manual
Operation
MODBUS Master EU exchange request program:
|
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Initialise the report words to zero: *)
|(* - %R0201 report word for the ER00, triggered type *)
|(* - %R0265 report word for the ER64, periodic type *)
|(* - %R0266 report word for the ER65, periodic type *)
|(* - %R0331 report word for the ER130, cyclic type *)
|(**********************************************************************)
|
|
|FST_SCN +-----+ +-----+ +-----+
|--] [---+MOVE_+-----------------+MOVE_+-----------------+MOVE_+-
| | INT | | INT | | INT |
| | | | | | |
| CONST -+IN Q+-%R0201 CONST -+IN Q+-%R0265 CONST -+IN Q+-%R0331
| +00000 | LEN | +00000 | LEN | +00000 | LEN |
| |00001| |00002| |00004|
| +-----+ +-----+ +-----+
|
User’s Manual
Operation
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Initialise the 1st word of the answer tables to zero: *)
|(* - %R0641 of ER00, triggered type *)
|(* - %R0651 of ER64, periodic type *)
|(* - %R0661 of ER65, periodic type *)
|(* - %R0501 of ER130, cyclic type *)
|(**********************************************************************)
|
|
|FST_SCN +-----+ +-----+ +-----+
|--] [---+MOVE_+-----------------+MOVE_+-----------------+MOVE_+-
| | INT | | INT | | INT |

| | | | | | |
| +00000 | LEN | +00000 | LEN | +00000 | LEN |
| |00001| |00001| |00001|
| +-----+ +-----+ +-----+
|
|
|FST_SCN +-----+ +-----+ +-----+
|--] [---+MOVE_+-----------------+MOVE_+-----------------+MOVE_+-
| | INT | | INT | | INT |
| | | | | | |
| +00000 | LEN | +00000 | LEN | +00000 | LEN |
| |00001| |00001| |00001|
| +-----+ +-----+ +-----+
User’s Manual
Operation
|
|
|FST_SCN +-----+ %T0003
+--] [---+MOVE_|-----------------------------------------------------(R)--
| | INT |
| | |
| +00000 | LEN |
| |00001|
| +-----+
|
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Set the timer to 10 seconds for requesting exchanges. *)
|(**********************************************************************)
|
|
|%T0003 +-----+ %T0003
+--]/[---+ TMR +-----------------------------------------------------(S)--
| |0.01s|
| | |
| CONST -+PV |
| +00100 | |
| +-----+
| %R0177
|
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* Prepare the exchange request table in the COMMREQ data block *)
|(* and the data block at address %R0047. *)
|(**********************************************************************)
|
|
User’s Manual
Operation
|FST_SCN +-----+ +-----+ +-----+

+--] [---+BLKMV+-----------------+BLKMV+-----------------+MOVE_+-
| | | | | | |
| CONST -+IN1 Q+-%R0041 CONST -+IN1 Q+-%R0048 CONST -+IN Q+-%R0055
| 0033 | | 0007 | | 01F5 | LEN |
| | | | | |00001|
| CONST -+IN2 | CONST -+IN2 | +-----+
| 0000 | | 8082 | |
| | | | |
| 0000 | | 0214 | |
| | | | |
| 0000 | | 000A | |
| | | | |
| 0000 | | 0032 | |
| | | | |
| 0000 | | 0000 | |
| | | | |
| 0103 +-----+ 0000 +-----+
|
User’s Manual
Operation
|
|
|FST_SCN +-----+ +-----+ +-----+
+--] [---+BLKMV+-----------------+BLKMV+-----------------+BLKMV+-
| | | | | | |
| CONST -+IN1 Q+-%R0056 CONST -+IN1 Q+-%R0063 CONST -+IN1 Q+-%R0070
| 8083 | | 8084 | | 8085 | |
| | | | | | |
| CONST -+IN2 | CONST -+IN2 | CONST -+IN2 |
| 0F14 | | 0414 | | 1014 | |
| | | | | | |
| 000A | | 0000 | | 03E8 | |
| | | | | | |
| 0032 | | 0032 | | 0064 | |
| | | | | | |
| 0010 | | 0000 | | 0008 | |
| | | | | | |
| 000B | | 0000 | | 02BF | |
| | | | | | |
| 0277 +-----+ 02BD +-----+ 02B3 +-----+
User’s Manual
Operation
|
|
|FST_SCN +-----+ +-----+ +-----+
+--] [---+BLKMV+-----------------+BLKMV+-----------------+BLKMV+-
| | | | | | |
| CONST -+IN1 Q+-%R0077 CONST -+IN1 Q+-%R0084 CONST -+IN1 Q+-%R0091
| 8440 | | 8441 | | 8000 | |
| | | | | | |
| 0514 | | 0614 | | 0714 | |
| | | | | | |
| 0009 | | 03E8 | | 0000 | |
| | | | | | |
| FF00 | | A569 | | 0000 | |
| | | | | | |
| 0000 | | 0000 | | 0000 | |
| | | | | | |
| 0000 | | 0000 | | 0000 | |
| | | | | | |
| 028B +-----+ 0295 +-----+ 0281 +-----+
|
User’s Manual
Operation
|
|
|%T0003 %M0021
+--] [---------------------------------------------------------------(^)--
|
|
|%M0021 %M0022
+--] [---------------------------------------------------------------(SM)-
|
|(* COMMENT *)
|
|(**********************************************************************)
|(* MODBUS Master PCM/EU configured in rack 0, slot 2 *)
|(**********************************************************************)
|
|
|%M0022 %T0003 +-----+
+--] [-----] [---+ EQ_ |
| | INT |
| | | +-----+
| %R0191 -+I1 Q+----------+COMM_|
| | | | REQ |
| | | | |
| CONST -+I2 | %R0041 -+IN FT+-
| +00005 +-----+ | |
| | |
| CONST -+SYSID|
| 0002 | |
| | |
| CONST -+TASK |
| 00000078 +-----+
|
|
|
|ALW_ON %M0022
+--] [---------------------------------------------------------------(RM)-
|
User’s Manual
Operation
2.3.1 Use of Answers and Faults in the PC
After transferring the configuration and the user program (startup and request for exchanges) to the PLC,
pressing the PCM RESTART button for less than 5 seconds and activating the program with the Alspa P8
console, you can then use the reports (CR) in the PC.
Reminder of meaning of bits of a report word:
bit0 : exchange in progress (relaese 1.3 and above)
bit1 : exchange ended without fault
bit2 : exchange ended with fault ( CR <> 0 )
bit3 : ER validity
bit5 : CTS fault
bit7 : non-ASCII character in the frame received
bit8 : no answer to question after time-out
bit9 : Expected function code incorrect
bit10 : Expected data length incorrect
bit11 : the question function code or data are incorrect
bit12 : no correct answer after the scheduled number of retransmissions
bit13 : rejection of an ER by PS, reception of an exception frame
bit14 : rejection of an ER by PC, exchange in progress
bit15 : rejection of an ER by PC, ER list saturated
Note
We recommend resetting the CR word to zero after using it.
User’s Manual
Operation
The answer to an ER can be used if the exchange ended without fault (bit 1 of report = 1), it is stored at the
address stated in the Answer address in PC field of the ER structure. If the exchange ended with a fault (bit2 of
report = 1), you can also use the report faults.
If the exchange is in progress (bit0 = 1), the ER validity bit (bit3) remains at 1 for all exchange types.
If the exchange has ended (bit1 or bit2 = 1), the ER validity bit (bit3) stays at 1 for all types of periodic and
cyclic exchanges but is set to 0 for the triggered exchange type.
Example: We will again use the previous examples - activation and exchange request. Let us assume that the
exchanges contain no faults and check that.
• For ER00, triggered exchange type: the binary value of %R0201 goes from 0000000000001000 to
0000000000001001 (exchange in progress) and then to 000000000000010 (exchange enERd without fault),
the content of the ER00 answer table:
bit 15 14 8 7 0
+--+---------------+------------------+
%R0641 | 0| F.C. = 07H | PS Addr. = 04H |
+--+---------------+------------------+
%R0642 | 00H | Value of byte |
+------------------+------------------+
User’s Manual
Operation
• For ER64 (ER65), periodic exchange type: the binary value of %R0265 (%R0266) goes from
0000000000001000 to 0000000000001001 (exchange in progress) and then to 0000000000001010
(exchange ended without fault) and every 2 seconds, %R0265 (%R0266) varies between 2 values
0000000000001001 and 0000000000001010.
bit 15 14 8 7 0
+--+---------------+------------------+
%R0651 | 0| F.C. = 05H | PS Addr. = 14H |
+--+---------------+------------------+
%R0652 | Addr. of written bit = 0009H |
+-------------------------------------+
%R0653 | Value of written bit = FF00H |
+-------------------------------------+
bit 15 14 8 7 0
+--+---------------+------------------+
%R0661 | 0| F.C. = 06H | PS Addr. = 14H |
+--+---------------+------------------+
%R0662 | Addr. of written word = 03E8H |
+-------------------------------------+
%R0663 | Value of written word = A569H |
+-------------------------------------+
User’s Manual
Operation
• For ER130 (ER131,ER132,ER133), cyclic exchange type:

The binary value of %R0331 (%R0332, %R0333, %R0334) from 0000000000001000 to
0000000000001010 (exchange completed without fault) and cyclically updated as soon as an exchange is
completed.
The content of the ER131 answer table:
bit 15 14 8 7 0
+--+---------------+------------------+
%R0501 | 0| F.C. = 02H | PS Addr. = 14H |
+--+---------------+------------------+
%R0502 | Nbr significant bytes = 000DH |
+-------------------------------------+
%R0503 |16th bit 1st bit|
+-------------------------------------+
%R0504 | 17th bit|
+-------------------------------------+
: :
: :
: :
+-------------------------------------+
%R0506 |64th bit 49th bit|
+-------------------------------------+
The last 14 bits are not significant (from 51st bit to 64th bit).
Content of the ER132 answer table:
bit 15 14 8 7 0
+--+---------------+------------------+
%R0631 | 0| F.C. = 0FH | PS Addr. = 14H |
+--+---------------+------------------+
%R0632 | Addr. 1st bit written = 000AH |
+-------------------------------------+
%R0633 | Number of bits written = 0032H |
+-------------------------------------+
User’s Manual
Operation
Content of ER133 answer table:
bit 15 14 8 7 0
+--+---------------+------------------+
%R0701 | 0| F.C. = 04H | PS Addr. = 14H |
+--+---------------+------------------+
%R0702 | Nbr significant bytes = 0064H |
+-------------------------------------+
%R0703 | Value of 1st word |
+-------------------------------------+
%R0704 | Value of 2nd word |
+-------------------------------------+
: :
: :
: :
+-------------------------------------+
%R0752 | Value of 50th word |
+-------------------------------------+
Content of ER134 answer table:
bit 15 14 8 7 0
+--+---------------+------------------+
%R0501 | 0| F.C. = 10H | PS Addr. = 14H |
+--+---------------+------------------+
%R0652 | Addr. 1st word written = 03E8H |
+-------------------------------------+
%R0653 | Number of words written = 0064H |
+-------------------------------------+
User’s Manual
Operation
2.3.2 Counting of Faults in the PS
After transferring the configuration and the user program (startup and request for exchanges) to the PLC,
pressing the PCM RESTART button for less than 5 seconds and activating the program with the Alspa P8
console, you can then use the faults in the PS: if fault indicator %R0193 = 00FFH, the %R0195 fault indicator is
incremented by 1 and fault bits %R0194 can be used, and %R0193 is set to 0.
If fault indicator %R0193 = 00FFH, we increment fault counter %R0195 by 1, possibly use fault bit %R0194 and
set %R0193 to 0.
|(* COMMENT *)
|
|(**********************************************************************)
|(* fault counting *)
|(**********************************************************************)
|
|
|ALW_ON +-----+
+--] [_--+ EQ_ |
| | INT |
| | | +-----+ +-----+
|%R0193 -+I1 Q+---------+ ADD_+-----------------+MOVE_+-
| | | | INT | | WORD|
| | | | | | |
| CONST -+I2 | %R0195 -+I1 Q+-%R0195 CONST -+IN Q+-%R0193
| +00255 +-----+ | | 00000 | LEN |
| | | |00001|
| CONST -+I2 | +-----+
| +00001 | |
| +-----+
User’s Manual
Operation
User’s Manual
Chapter Details of RTU transmission frames
1. READING OF "N" BITS

Request:
info = 4 bytes
<---------------------->
+---------+--------+-----------+------------+-----------+
| PS |function| Ad. of 1st| Number of | CRC16 |
| address | 1 or 2 |bit to read|bits to read| |
| | | MSB | LSB| MSB | LSB| LSB | MSB|
+---------+--------+-----+-----+------+-----+-----+-----+
Number of bits to read is a number between 1 and 2048
Normal answer:
2 <= info <= 257 bytes

<------------------------------->
+---------+--------+---------+----------+ - - -- - - +-----------+
| PS |function| Number | 1st byte | | CRC16 |
| Address | 1 or 2 | bytes | read | | |
| | | read | | | LSB | MSB|
+---------+--------+---------+----------+ - - -- - - +-----+-----+
bit 7 0
|-----> 1st bit read
Number of bytes read is a number between 1 and 256 (0 = 256)
User’s Manual
Details of RTU transmission frames
2. READING OF "N" WORDS

Request:
info = 4 bytes
<---------------------->
+---------+--------+-----------+------------+-----------+
| PS |function| Ad. of 1st| Number of | CRC16 |
| Address| 3 or 4 |wrd to read|wrds to read| |
+---------+--------+-----+-----+------+-----+-----+-----+
Number of words to read is a number between 1 and 128
Normal answer:

<--------------------------------->
+---------+--------+---------+------------+ - - - - - -+-----------+
| PS |function| Number | Value of | | CRC16 |
| Address | 3 or 4 | of bytes|1st wrd read| | |
| | | read | MSB | LSB| | LSB | MSB|
+---------+--------+---------+-----+------+ - - - - - -+-----+-----+
Number of bytes read is a number between 2 and 256 (0 = 256)
User’s Manual
3. WRITING A BIT
Request:
info = 4 bytes
<------------------->
+---------+--------+-----------+----+----+-----------+
| PS |function| Ad. of bit| 00 | | CRC16 |
| Address | 5 | to write | or | 00 | |
| | | MSB | LSB| FF | | LSB | MSB|
+---------+--------+-----+-----+----+----+-----+-----+
<-->
00 if bit = 0
FF if bit = 1
Normal answer:
info = 4 bytes
<------------------->
+---------+--------+-----------+----+----+-----------+
| PS |function| Ad. of bit| 00 | | CRC16 |
| Address | 5 | written | or | 00 | |
| | | MSB | LSB| FF | | LSB | MSB|
+---------+--------+-----+-----+----+----+-----+-----+
<-->
00 if bit = 0
FF if bit = 1
4. WRITING A WORD
Request:
info = 4 bytes
<----------------------->
+---------+--------+-----------+-------------+-----------+
| PS |function| Ad. of wrd| Value of wrd| CRC16 |
| Address | 6 | to write | to write | |
+---------+--------+-----+-----+------+------+-----+-----+
Normal answer:
info = 4 bytes
<----------------------->
+---------+--------+-----------+-------------+-----------+
| PS |function| Ad. of wrd| Value of wrd| CRC16 |
| Address | 6 | written | written | |
+---------+--------+-----+-----+------+------+-----+-----+
User’s Manual
5. ASYNCHRONOUS READING OF A PARTICULAR BYTE

Request:
info = 0 byte
<->
+---------+--------+-----------+
| PS |function| CRC16 |
| Address | 7 | |
| | | LSB | MSB|
+---------+--------+-----+-----+
Normal answer:
info = 1 byte
<------->
+---------+--------+---------+-----------+
| PS |function| Value | CRC16 |
| Address | 7 | of | |
| | | byte | LSB | MSB|
+---------+--------+---------+-----+-----+
6. READING PS DIAGNOSTIC COUNTERS

Request:
info = 4 bytes
<----------------------->
+---------+--------+-----------+-------------+-----------+
| PS |function| sub- | Data | CRC16 |
| Address | 8 | function | | |
+---------+--------+-----+-----+------+------+-----+-----+
Normal answer:
info = 4 bytes
<----------------------->
+---------+--------+-----------+-------------+-----------+
| PS |function| sub- | Data | CRC16 |
| Address | 8 | function | | |
+---------+--------+-----+-----+------+------+-----+-----+
User’s Manual
7. WRITING OF "N" BITS

Request:

<---------------------------------------->
+------+--------+---------+-----------+----------+ - - - - - -+-----------+
| PS |function| Start |Nbr of bits| Number of| Value | CRC16 |
| Addr.| 15 | address | to write | bytes | of | |
| | | MSB| LSB| MSB | LSB| (of bits)| bits | LSB | MSB|
+------+--------+----+----+-----+-----+----------+ - - - - - -+-----+-----+
Number of bits to write is a number between 1 and 800

Number of bytes (of bits) is between 1 and 100
Detail of bit value zone:
1st byte 2nd byte etc....

<---------------------> <--------------------->
+-----------------------+-----------------------+- - - - - - - -
| | |
| | | | | | | | | | | | | | | | |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+- - - - - - - -
bit 7 6 5 4 3 2 1 0 15 14 13 12 11 10 9 8 etc.....
Normal answer:
info = 4 bytes
<----------------------->
+---------+--------+-----------+-------------+-----------+
| PS |function| Start | Nbr of bits | CRC16 |
| Address | 15 | address | written | |
+---------+--------+-----+-----+------+------+-----+-----+
User’s Manual
8. WRITING OF "N" WORDS

Request:

<------------------------------------------->
+------+--------+---------+-----------+----------+ - - - - - -+-----------+
| PS |function| Start |Nbr of wrds| Number | Value | CRC16 |
| Addr.| 16 | address | to write |of bytes | of | |
| | | MSB| LSB| MSB | LSB| | words | LSB | MSB|
+------+--------+----+----+-----+-----+----------+ - - - - - -+-----+-----+
Number of words to write is a number between 1 and 100

Number of bytes = 2 x nb words
Detail of word value zone:
1st word 2nd word 3rd word

<---------> <---------> <---------> etc....
+-----------+-----------+-----------+ - - - - - - -
| | | |
| MSB| LSB| MSB| LSB| MSB| LSB|
+-----+-----+-----+-----+-----+-----+ - - - - - - -
Normal answer:
info = 4 bytes
<----------------------->
+---------+--------+-----------+-------------+-----------+
| PS |function| Start | Nbr words | CRC16 |
| Address | 16 | address | written | |
+---------+--------+-----+-----+------+------+-----+-----+
9. RETURN EQUIPMENT TYPE

Request:
info = 0 byte
<->
+---------+--------------------+
| PS |function| CRC16 |
| Address | 17 | |
| | | LSB | MSB|
+---------+--------+-----+-----+
Normal answer:
info = 5 bytes
<------------------------->
+---------+--------+--------+------+-----------+------------+
| PS |function| Equip. | PS | Data | CRC16 |
| Address | 17 | type | RUN | | | |
| | |30 or 70| lamp | | | | LSB | MSB|
+---------+--------+--------+------+---+---+---+------+-----+
The data field is a CPU type for PLCs C80-35 and C80-75.
User’s Manual
10. READING WORKING ZONE MEMORY

Request:
info = 4 bytes
<--------------------->
+---------+--------+-----------+-----------+------------+
| PS |function| Start byte| Number of | CRC16 |
| Address | 67 | number | bytes | |
+---------+--------+-----+-----+-----+-----+------+-----+
Normal answer:
info = Nbr bytes + 1

<--------------------------->
+---------+--------+-------+--------------------+-------------+
| PS |function| Number| Data | CRC16 |
| Address | 67 | bytes | | | |
| | | | | | | | LSB | MSB|
+---------+--------+-------+---+---+---------+---+------+-----+
User’s Manual
11. EXCEPTION FRAME, NEGATIVE ANSWER

info = 1 byte
<------>
+---------+-+-------+--------+------------+
| PS | | Funct.| Error | CRC16 |
| Address |1| code | code | | |
| | | | | LSB | MSB|
+---------+-+-------+---------------------+
bit 7 6 0
User’s Manual

Automatización

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Automatización

Uploaded by

Copyright:

Available Formats

MODBUS Master and Slave

Protocol for Alspa 8000 PLCs

ALS 53302 d-en

First issue: 01-97

Notes merely call attention to information that is especially significant to

© Copyright 1998, Cegelec, Levallois-Perret (France)

1 CONTENT OF THIS MANUAL

4. WE WELCOME YOUR COMMENTS AND SUGGESTION

ALS 53302 d-en MODBUS Master and Slave Protocol for

Your main job is:

System designer Programmer

All comments will be considered by qualified personnel.

CHAPTER 2 - OPERATION OF THE MODBUS EXCHANGE UNIT (EU)

CHAPTER 3 - MASTER EU EXCHANGE SPECIFICATIONS

CHAPTER 4 - MODBUS TRANSMISSION FRAME

CHAPTER 6 - DETAILS OF RTU TRANSMISSION FRAMES

1. PURPOSE AND USE OF THIS LINK

2. REMINDER ON THE PROTOCOL

The actions performed by a slave are of the following type:

• reading of one or more bits

• reading of one or more words (two bytes per word)

• writing of one or more bits

• writing of one or more words (two bytes per word)

• return of diagnostic data

3. GENERAL SPECIFICATIONS OF THE NETWORK

Line protocol: Modbus RTU or ASCII

Topology: Bus network.

Theoretical number 256 maximum, 1 master and 255 slaves.

+------+ RS-485 or modem

The MODBUS Master/Slave EU can work on the following modules:

• For installation and startup of these modules, refer to chapter 5.

The tables are specified by an identifier (ID_Tab) taking a value equal to

There are three types of exchanges in the ER table:

Enable input: enables the instruction.

The command block has the following structure:

3.1 Format of the Deactivation Request

* Comm_Chann: communication channel on a PCM serial port.

3.2 Format of the Activation Request

• Comm_Chann: communication channel on a PCM serial port.

• Subscriber number: 0 = MODBUS PC, 1 to 255 = MODBUS PS.

• TC (bit 0): type of frame coding, 0 = RTU, 1 = ASCII.

• A (bit1/word 3): automatic removal of MODBUS EU is stopped or faulty,

• G (bit 4) : management of DPE signal (RTS); 0 = YES, 1 = NO

bit14 : not used

• This zone is itself divided into 3 contiguous zones:

from number 0 (ER00) to 63 (ER63) = triggered ER,

from number 64 (ER64) to 127 (ER127) = periodic ER,

from number 128 (ER128) to 255 (ER255) = cyclic ER.

Format of an exchange request report (ER):

A report consists of an exchange request state and faults.

Values and meaning of

3.3 Format of the Exchange Request Table

A request is defined as the following structure:

word 4: memory type sampled from the PC

• * Comm_Chann: communication channel on PCM serial port.

• A ER can be modified while the MODBUS Master EU is in service.

DV (bit 15) = 1, valid request: insert or change the request,

= 0, invalid request: cancel the request.

• Function code asking the slave to perform a job

• Sampling address in PC, consisting of:

1. GENERAL STRUCTURE OF AN EXCHANGE

1.1 Structure of a ER (Exchange Request)

PS address: slave number (0 to 255 (0FFH), 0 = broadcast to all the PSs ).

The values not given in these tables are not authorised.