Third Party Protocols Support

Programming ToolBox for

MOSCAD™ RTUs
Version 9.50

68P02956C70-C

MOTOROLA and the Stylized M Logo are registered in the U.S.

Patent and Trademark Office. All other product or service names
are the property of their respective owners.

© Motorola, Inc. 2002

 COMMERCIAL WARRANTY (STANDARD)

Motorola radio communications products are warranted to be free from defects in material and workmanship for a
period of ONE (1) YEAR, (except for crystals and channel elements which are warranted for a period of ten (10) years),
from the date of shipment. Parts, including crystals and channel elements, will be replaced free of charge for the full
warranty period but the labor to replace defective parts will only be provided for one Hundred-Twenty (120) days from
the date of shipment. Thereafter purchaser must pay for the labor involved in repairing the product or replacing the
parts at the prevailing rates together with any transportation charges to or from the place where warranty service is
provided. This express warranty is extended by Motorola Communications and Electronics Inc., 1301 E. Algonquin
Road, Schaumburg, Illinois 60196, to the original purchaser only, and only to those purchasing for purpose of leasing or
solely for commercial, industrial, or governmental use.

THIS WARRANTY IS GIVEN IN LIEU OF ALL OTHER WARRANTIES EXPRESS OR IMPLIED WHICH ARE
SPECIFICALLY EXCLUDED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A
PARTICULAR PURPOSE. IN NO EVENT SHALL MOTOROLA BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL
DAMAGES TO THE FULL EXTENT SUCH MAY BE DISCLAIMED BY LAW.

In the event of a defect, malfunction or failure to conform to specifications established by seller, or if appropriate, to
specifications accepted by Seller in writing, during the period shown, Motorola, at its option, will either repair or replace
the product or refund the purchase price thereof, and such action on the part of Motorola shall be the full extent of
Motorola’s liability hereunder.

This warranty is void if:

a. the product is used in other than its normal and customary manner;

b. the product has been subject to misuse, accident neglect or damage;

c. unauthorized alterations or repairs have been made, or unapproved parts used in the equipment.

This warranty extends only to individual products, batteries are excluded, but carry their own separate limited warranty.
Because each radio system is unique, Motorola disclaims liability for range, coverage, or operation of the system as a
whole under this warranty except by a separate written agreement signed by an officer of Motorola.

Non-Motorola manufactured products are excluded from this warranty, but subject to the warranty provided by their
manufacturers, a copy of which will be supplied to you on specific written request.

In order to obtain performance of this warranty, purchaser must contact its Motorola salesperson or Motorola at the
address first above shown, attention Quality Assurance Department.

This warranty applies only within the United States.

COMPUTER SOFTWARE COPYRIGHTS

The Motorola products described in this instruction manual may include copyrighted Motorola computer programs
stored in semi conductor memories or other media. Laws in the United States and other countries preserve for Motorola
certain exclusive rights for copyrighted computer programs including the exclusive right to copy or reproduce in any
form the copyrighted computer program. Accordingly, any copyrighted Motorola computer programs contained in the
Motorola products described in this instruction manual may not be copied or reproduced in any manner without the
express written permission of Motorola. Furthermore, the purchase of Motorola products shall not be deemed to grant
either directly or by implication, estoppel, or otherwise, any license under the copyrights, patents or patent applications
of Motorola, except for the normal non-exclusive, royalty free license to use that arises by operation of law in the sale of
a product.
Table of Contents
MODBUS...........................................................................................................................................................1
RTU as PLC ...................................................................................................................................................1
RTU as FIU....................................................................................................................................................2
Remote Access of PLC via RTU (Network) ....................................................................................................3
Local RTU as PLC Master .............................................................................................................................4
Remote RTU as PLC Master ..........................................................................................................................5
General System ..............................................................................................................................................6
MODBUS Drivers ..........................................................................................................................................6
MODBUS Data Types ....................................................................................................................................7
Floating Point Numbers( ≥ V7.00)...............................................................................................................10
RTU Definitions for MODBUS Support.......................................................................................................11
Data Types ................................................................................................................................................................ 11
PLC Table................................................................................................................................................................. 11
Port Configuration & Protocol Downloading ........................................................................................................... 12
Step-by-Step Definitions...............................................................................................................................14
RTU as PLC (Connected to Master Computer) ........................................................................................................ 14
RTU as FIU (Connected to Master Computer) ......................................................................................................... 15
Remote Access of PLC via RTU (MDLC) ............................................................................................................... 16
Local RTU as PLC Master........................................................................................................................................ 16
Remote RTU as PLC Master .................................................................................................................................... 17
RTU as Master – Ladder Diagram Consideration .......................................................................................18
I/O Link for PLC Data Types Columns .................................................................................................................... 18
Scan from Rungs....................................................................................................................................................... 19
RTU as PLC (Slave) – Register Numbering .................................................................................................20
RTU Supported MODBUS Protocol Exceptions (Negative Acknowledges).................................................21
ALLEN BRADLEY...............................................................................................................................................23
Local RTU as PLC Master ...........................................................................................................................24
Remote RTU as PLC Master ........................................................................................................................24
Allen Bradley PLC–5 Settings......................................................................................................................25
Allen Bradley PLC 5/40 Settings.............................................................................................................................. 26
PLC Address for Allen Bradley Protocol.................................................................................................................. 27
Data Type Compatibility Between RTU and PLC–5 ................................................................................................ 27
RTU Definitions for Allen Bradley PLC–5 Support................................................................................................. 29
Step-by-Step Definitions........................................................................................................................................... 32
RTU as Master – Ladder Diagram ............................................................................................................................ 34
MODBUS

MOSCAD ≥ V3.00 and MOSCAD-L ≥ V1.00 support the MODBUS RTU protocol:

(CRC: x16 + x15 + x2 + 1)

The MODBUS protocol support is applicable to the following situations:

a) Master Configuration: Polling/modifying the database of existing PLC(s). The RTU is

defined as a master and the PLC – as a slave. The RTU provides the ability to access the
database of a PLC from the application ladder.

b) Slave Configuration: Connecting an RTU as a slave to any SCADA master using the
MODBUS protocol. The SCADA central can control all RTUs, as well as all PLCs.

In addition, the RTU communication may be used as a wide area communication network
between a MODBUS-based central and its PLCs.

The RTU-to-MODBUS connection is described in this chapter according to the following

configurations:

1) RTU as PLC

2) RTU as FIU

3) Remote Access of PLC via RTU (MDLC)

4) Local RTU as PLC Master

5) Remote RTU as PLC Master

6) General System Configuration

RTU as PLC
The RTU as PLC configuration allows the connection of a MODBUS-based central computer
to an MDLC Network.

The port of this RTU is defined as Connected to Master Computer. The central computer can
access the database of this RTU that reflects the databases of all RTUs in the field.

In the RTU as PLC, definition of the PLC Table is required.

1
 MODBUS

PLC Table

Ind PLC Connected to via Port (Name)

Address RTU (Name)
0 1 LOCAL RTU AS PLC

RTU

PLC#=1

MODBUS RTU
AS PLC MDLC NETWORK RTU
MODBUS PORT
TO MASTER
SCADA CENTRAL
(MASTER)

RTU

For a detailed description of the site configuration and application definitions, refer to RTU as
PLC (Connected to Master Computer)

RTU as FIU
The RTU as FIU configuration allows the connection of a MODBUS-based central computer
to an MDLC Network. The FIU allows the master to communicate with any RTU in the
network (including the FIU) by "encapsulating" the MODBUS protocol in the MDLC
protocol. The FIU's port is defined as Connected to Master Computer.

In the FIU, definition of the PLC Table is required.

Since the FIU and RTUs communicate over an MDLC network, every unit has to hold a table
(Site Table), that includes the Site ID of the units that it communicates with.

The Site Table of the FIU will hold the Site ID of all RTUs, and the Site Table of each RTU
will hold the Site ID of the FIU.

2
 MODBUS

PLC#=26
Sites Table Site ID=86
Site Name=FOX9
S^Ind Site Name Site ID Link ID ComFal (bit)

0 Cntral 65533
PLC2
RTU AS
1 FOX9 86 RADIO1 PLC

PLC#=15
Site Name=FOX1

MODBUS
RTU AS RTU AS
FIU MDLC NETWORK PLC
MODBUS PORT
RADIO1
TO MASTER
SCADA CENTRAL
(MASTER)
PLC Table

Ind PLC Connected to via Port (Name)

Address RTU (Name) RTU AS
0 15 LOCAL RTU AS PLC
PLC
1 26 FOX9 RTU AS PLC

For a detailed description of the Site Configuration and Application definitions, refer to RTU
as FIU (Connected to Master Computer).

Remote Access of PLC via RTU (Network)

This configuration allows the connection of a MODBUS-based central computer to MODBUS
PLCs via a network. It is achieved by using two RTUs: one at the central computer side and
the other at the PLC side (the network may include other RTUs as routers).

At the central computer side, the RTU port is defined as Connected to Master Computer, and
the port of the RTU at the PLC side is defined as Connected to PLC. The two RTUs
communicate using the MDLC protocol.

In the RTU at the central computer, definition of the PLC Table is required.

3
 MODBUS

Site Table

Ind Site Name Site ID Link ID ComFal (bit)

0 Cntral 65533

1 MOD9 10 RADIO1
Site ID=25
Site Name=FOX1

RTU MODBUS PORT

TO SLAVE
Site ID=10
Site Name=MOD9 PLC1

RTU AS MDLC
MODBUS
FIU RADIO1
MODBUS PORT
TO MASTER PLC
SCADA CENTRAL
(MASTER) PLC Table
PLC#=3
Ind PLC Connected to via Port (Name)
Address RTU (Name)

0 3 FOX1 PLC1

Site Table

Ind Site Name Site ID Link ID ComFal (bit)

0 Cntral 65533

1 FOX1 25 RADIO1

For a detailed description of the Site Configuration and Application definitions, refer to
Remote Access of PLC via RTU (MDLC).

Local RTU as PLC Master

This configuration allows polling/modifying the database of the PLC from an MDLC-based
network. The RTU is connected to the PLC via a port defined as Connected to PLC. It
controls the PLC by means of the Ladder Diagram.

RTU

RTU MODBUS
RTU AS PLC PLC1
MDLC NETWORK PLC
MASTER MODBUS PORT
TO SLAVE
PLC#=1

PLC Table
RTU
Ind PLC Connected to via Port (Name)
Address RTU (Name)

0 1 LOCAL PLC1

4
 MODBUS

For a detailed description of the Site Configuration and Application definitions, refer to
Step-by-Step Definitions below.

Remote RTU as PLC Master

This configuration is very similar to the previous one, except that the RTU that controls the
PLC is not the local one, but a remote one, due to application requirements. For example, the
local RTU controls a lighting system, while the remote RTU and PLC control a
reservoir/pump system.

The Site Table should be defined for both RTUs.

Any number of RTUs may have access to the PLC connected to one of the RTUs.

RTU

RTU MODBUS
RTU AS PLC PLC1
MDLC NETWORK PLC
MASTER MODBUS PORT
TO SLAVE
PLC#=1

PLC Table
RTU
Ind PLC Connected to via Port (Name)
Address RTU (Name)

0 1 LOCAL PLC1

For a detailed description of the Site Configuration and Application definitions, refer to
Step-by-Step Definitions below.

5
 MODBUS

General System
MODBUS
RTU 13

MODBUS PORT
TO SLAVE
RTU PLC1
FOX1

MODBUS PORT
TO MASTER RTU
LOCAL
MDLC NETWORK
SCADA CENTRAL RTU
(MASTER)

RTU
MODBUS PORT FOX5
MODBUS PORT
TO SLAVE
PLC2 TO SLAVE
PLC1

MODBUS
MODBUS
RTU 15
RTU 14

MODBUS Drivers
Six drivers are supplied with the Third Party installation diskette. They are:

6
 MODBUS

Driver file name Description

MB2MPLC1 MODBUS to Master driver; Port in RTU slave
defined as PLC 1
MB2MPLC2 MODBUS to Master driver; Port in RTU slave
defined as PLC 2
MB2MPLC3 MODBUS to Master driver; Port in RTU slave
defined as PLC 3
MB2PLC1 MOSCAD Master; Port in RTU defined as PLC
1.
MB2PLC2 MOSCAD Master; Port in RTU defined as PLC
2.
MB2PLC3 MOSCAD Master; Port in RTU defined as PLC
3.

MODBUS Data Types

The RTU defined as a Master can access the following MODBUS RTU data types/commands:

MODBUS Data Type Command MODBUS RTU Equivalent

Function
Code

Logic Coils Read 1 Discrete Output

Discrete Inputs Read 2 Discrete Input
Holding Registers Read 3 Calculated Internal
Value
Input Registers Read 4 Value Input
Logic Coils Write (single 5 Discrete Output
coil)
Holding Registers Write (single 6 Calculated Internal
register) Value
Logic Coils Write 15 Discrete Output
Holding Registers Write 16 Calculated Internal
Value

The RTU defined as a MODBUS slave supports the following data types/commands from the
MODBUS protocol:

Data Type Command MODBUS Function Code

Logic Coils Read 1

7
 MODBUS

Discrete Inputs Read 2

Holding Registers Read 3
Input Registers Read 4
Logic Coil Write (single coil) 5
Holding Register Write (single 6
register)
None Loopback test 8
Logic Coils Write 15
Holding Registers Write 16
– Report Slave ID 17 dec.

In order to enable the Single Coil Force or Single Register Preset commands ( ≥ 7.00), run the
MOSCAD Site Configuration. Select the Advanced menu , PLC System parameters, PLC
Driver Slave, Driver specific parameter (‘TO SLAVE’ port) #3. This parameter is actually a
mask, or set of bits, each of which can be set or unset, each with a different meaning. To
enable the Single Coil Force command (function code 5), set the mask to 0x0002 (or decimal
value 2). (This will automatically disable function code 15 for Multiple Coil or mask 0x0f.)
To enable the Single Register Preset command (function code 6), set the mask to 0x0004 (or
decimal value 4). (This will automatically disable function code 16 for Multiple Register or
mask 0x10.) If you want to enable BOTH commands, set the mask to 0x0006 (or decimal
value 6).

A Report Slave ID command has been added to support the VXL SCADA central. This may be
useful if the SCADA Central has to identify a communication failure (cause and location).

For example, the two RTUs may be defined as MODBUS slaves in the PLC Table. If the
communication to the PLC fails, the SCADA Central may issue the Report Slave ID command
to each of the RTUs.

The RTU’s response to this command for the MODBUS RTU protocol is:

ADDR FUNC BYTE RESERVED FLAGS CRC

COUNT

XX 11 3 BYTE1 BYTE2 BYTE3 XX XX

where:

ADDR: PLC address

FUNC: 11 hexa
BYTE COUNT: 3 bytes of RTU status data follow this field
RESERVED FLAGS: 24 bits for the Reserved Flags Table (one of RTU system tables).
This field consists of the 3 bytes described in the following tables:

8
 MODBUS

BYTE1
Bit Position in Index in Reserved Flag Name
Byte1 Flags Table

0 0 I/O_Fl
1 1 Init
2 2 PwrUp
3 3 AC_Fal
4 4 BatFal
5 5 PushB1
6 6 PushB2
7 7

BYTE2
Bit Position in Index in Reserved Flag Name
Byte2 Flags Table

0 8 TskPrA
1 9 TskPrB
2 10 TskPrC
3 11 TskPrD
4 12
5 13
6 14
7 15

BYTE3
Bit Position in Index in Reserved Flag Name
Byte3 Flags Table

0 16 ErrLog
1 17 TimTag
2 18 DefC_Y
3 19 CntCom
4 20
5 21 IsEvnt
6 22
7 23

9
 MODBUS

Note: Position 7 of a byte is the most significant bit, and position 0 – the least significant bit.

CRC: 2 bytes of CRC.

In the case of MODBUS ASCII protocol, the response starts with a ":" (colon) character. The
ADDR, FUNC, BYTE COUNT and RESERVED FLAGS fields follow. Each binary byte of
these fields is sent as two characters (0–9, A–F). The response ends with the LRC error check
field, as defined in the MODBUS ASCII protocol, followed by CR and LF.

Floating Point Numbers( ≥ V7.00)

SCADA Central (Master) can access floating point registers using the MODBUS protocol
from MOSCAD as Slave. To access floating MODBUS registers, columns of data type
PLC_RI and PLC_RO ( see Data Types below) should be defined in the Data base Builder of
the Application Programmer. The I/O link is the same as for general MODBUS registers or
coils, except for the data type, which is PLCRel. Floating registers are represented by 4
integer registers. The maximum number of floating point numbers is 35.

To allow floating point number transfer between the MOSCAD master and the MODBUS
slave:

1. Run the MOSCAD Site Configuration.

2. Select the Advanced menu.
3. Select PLC System parameters.
4. Select PLC Driver Slave.
5. Select Driver specific parameter (‘TO SLAVE’ port) #3.
This parameter is actually a mask, or set of bits, each of which can be set or unset, each
with a different meaning.

6. To designate that the low order integer register is sent first, followed by the high order
register, set the mask to 0x0001 (or decimal value 1). To designate that the high order
integer register is sent first, followed by the low order register, unset the mask bit 0x0001
(or decimal value 0). In most cases, the mask 0x0001 should be set on, though the format
depends on the vendor.

Recall that other bits in the parameter #3 mask enable/disable other functions. Therefore,
care should be taken when changing the value of the bits.

10
 MODBUS

RTU Definitions for MODBUS Support

Data Types
The following data types may be used when the RTU serves as a master:

• PLC_VI – PLC Value Input. This data type is used to read integer elements from a
third-party RTU. Each element in a PLC_VI column is a 2-byte signed integer (value). The
column length must be defined as the number of the registers that are to be read.

• PLC_VO – PLC Value Output. This data type is used to write into the Holding Registers
in a third-party RTU.

• PLC_DI – PLC Discrete Input. This data type is used to read 1-bit elements from a
third-party RTU, such as discrete inputs.

• PLC_DO – PLC Discrete Output. This data type is used to write 1-bit elements into a
third-party RTU, such as logic coils.

• PLC_RI –PLC Real Input. .This data type is used to read real (floating point) elements
from a third-party RTU. Each element in PLC_RI is a 4-byte real (floating point) number.

• PLC_RO –PLC Real Output. This data type is used to write real (floating point) elements
to a third-party RTU. Each element in PLC_RO is a 4-byte real (floating point) number.

PLC Table
The PLC Table, one of the System Tables, is used to define the connectivity to the third-party
PLC units in the system. This table must be defined for:

• The RTU, which is connected to the Master Computer.

• Any RTU, which serves as a PLC master for a PLC connected to one of its ports or
connected to one of the other RTUs in the network.

11
 MODBUS

This table has three columns as detailed below:

• PLC Address – the address of the PLC RTUs (1–255).

• Connected to RTU (name) – the name of the RTU to which the PLC is connected. Click
the arrow to open the list. If the RTU is locally connected to one of the ports of the unit
where the PLC Table is to be defined, choose LOCAL from the choice list.

• via Port (name) – the name of the port for connection. Click the arrow to open the list.
Choose the same name that was used when the port was defined.

If the PLC is connected directly via a UART port to the RTU master, then define the
Connected to RTU field as LOCAL and the via Port field as PLC 1, 2 or 3.

If the PLC is connected to a remote unit which acts as a router, then define the Connected to
RTU field as the RTU router Site Name. Assign the name that was used in the Site Table.

If the remote is an RTU which acts as PLC, then define the Connected to RTU field as the
RTU’s remote Site Name and the via Port field as MOSCAD AS PLC.

Port Configuration & Protocol Downloading

The configuration of an RTU port as a third party protocol port requires two levels of
configuration:

• Site configuration (physical port configuration)

• Third-party protocol downloading

12
 MODBUS

Site Configuration
Any one of the three CPU/Ports may be defined as a PLC port. For CPU/Port 1 or CPU/Port 2,
define the Connection Type as Third Party Protocols. For CPU/Port 3 select RS232, then
Third Party Protocols, and finally the connection mode.

• Connection Mode – this field defines the port mode of operation: MOSCAD as DTE or
MOSCAD as DCE with/without RTS/CTS/DTR/CD support.

The selection of MOSCAD as DTE or MOSCAD as DCE depends on the type of unit
to be connected to the RTU.

If the unit acts as a computer/terminal, define the Connection Mode as MOSCAD as

DCE. In this case, you should use the FLN6457 adapter, which ends with the female
25-pin, D-type connector.

If the unit acts as a modem (DCE), define the Connection Mode as MOSCAD as
DTE. In this case, you should use the FLN6458 adapter, which ends with the male
25-pin D-type connector.

The selection of RTS/CTS/DTR/CD support depends on the signals used for

communication between the RTU and unit. If only the Tx-Data, Rx-Data, and GND
signals are used, then select either MOSCAD as DTE or MOSCAD as DCE. If all
signals are used (including RTS, CTS, DTR, and CD), then select MOSCAD as DTE
with RTS/CTS/DTR/CD support or MOSCAD as DCE with RTS/CTS/DTR/CD
support.

After you click OK, you return to the fields listed below. The default values may be changed
according to the following:

13
 MODBUS

• Connected to – Master Computer or PLC.

• Port Name – the name of the port: PLC 1, PLC 2, or PLC 3.

• Data Speed – This field defines the communication data speed of the selected Connection
Type. The default is 9600 bps.

• Format – This field defines the UART's character format for the communication port. The
default is 8 bit, no parity, 1 stop bit. Click the arrow to open a list that includes all
combinations of 7/8 bits, even/odd/no parity, and 1/2 stop bits.

• Description – In this field you may enter a free-format description of the communication
link (up to 36 characters).

Third-Party Protocol Downloading

After the configuration of the RTU physical port, according to the type of connection (to
Master Computer or PLC), Toolbox provides you with the Downloader utility.

Note:The protocol should be loaded only to the RTUs whose ports have been defined as
Connected to Master Computer or Connected to PLC.

The Downloader supports downloading to RTUs either locally or remotely via the network.
For instructions on how to operate Downloader, see the System Setup and Diagnostics Tools
manual. In the More Modules window of Downloader, you can select to download to PLC
Port 1, 2, and 3. Click the Browse button to see the list of drivers available, as described
above in MODBUS Drivers.

Step-by-Step Definitions

RTU as PLC (Connected to Master Computer)

Site Configuration

1. Define one of the ports as Third Party Protocols.

2. Select the MOSCAD as DCE or the MOSCAD as DCE with RTS/CTS/DTR/CD support
Connection Mode.

3. Define the port as Connected to Master Computer.

4. Define the Port Name: PLC 1, PLC 2, or PLC 3.

5. Select the appropriate Data Speed and Format.

Download the site configuration to the RTU.

Download the appropriate protocol file as described in Third-Party Protocol Downloading

above.

14
 MODBUS

Application

1. Define the PLC Table as follows:

• PLC address as required.

• Connected to MOSCAD (Name) LOCAL.
• via Port (Name) RTU AS PLC.

2. Define database tables and process.

RTU as FIU (Connected to Master Computer)

Site Configuration

1. Define one of the ports as Third Party Protocols.

2. Select the RTU as DCE or the RTU as DCE with RTS/CTS/DTR/CD support Connection
Mode.

3. Define the port as Connected to Master Computer.

4. Define the Port Name: PLC 1, PLC 2, or PLC 3.

5. Select the appropriate Data Speed and Format.

6. Download the site configuration to the RTU.

7. Download the appropriate protocol file as described in Third-Party Protocol Downloading

above.

Application

1. Define the Site Table as follows:

• Site Name FOX9

• Site ID 86
• Link ID as required

2. Define the following PLC Table in the FIU:

a. First (FIU) element:

• PLC address 15
• Connected to RTU (Name) LOCAL
• via Port (Name) RTU AS PLC

b. The second (remote) element:

• PLC address 86
• Connected to RTU (Name) FOX9
• via Port (Name) RTU AS PLC

15
 MODBUS

3. For the RTU as PLC, define the Site Table as follows:

• Site name FOX1

• Site ID 85
• Link ID as required.

Remote Access of PLC via RTU (MDLC)

Site Configuration (for RTU connected to the PLC)

1. Define one of the ports as Third Party Protocols.

2. Select the appropriate Connection Mode of operation.

3. Define the port as Connected to PLC.

4. Define the Port Name: PLC 1, PLC 2, or PLC 3.

5. Select the appropriate Data Speed and Format.

6. Download the site configuration to the RTU.

7. Download the appropriate protocol file as described in Third-Party Protocol Downloading

above.

Application

1. Define the Site Table as follows:

a) for the FIU:

• Site Name: FOX1

• Site ID: 25
• Link ID: as required

b) for the RTU:

• Site Name: MOD9

• Site ID: 10
• Link ID: as required

2. In the RTU as FIU, define the PLC Table as follows:

• PLC address: 3
• Connected to RTU (Name): FOX1
• via Port (Name): PLC1

Local RTU as PLC Master

Site Configuration

1. Define one of the ports as Third Party Protocols.

16
 MODBUS

2. Select the appropriate Connection Mode of operation.

3. Define the port as Connected to PLC.

4. Define the Port Name: PLC 1, PLC 2, or PLC 3.

5. Select the appropriate Data Speed and Format.

6. Download the site configuration to the RTU.

7. Download the appropriate protocol file as described in Third-Party Protocol Downloading

above.

System Tables

1. Define the PLC Table as follows:

• PLC address: 1
• Connected to RTU (Name): LOCAL
• via Port (Name): PLC1

Remote RTU as PLC Master

Site Configuration (for RTU connected to the PLC)

1. Define one of the ports as Third Party Protocols.

3. Select the appropriate Connection Mode of operation.

3. Define the port as Connected to PLC.

4. Define the Port Name: PLC2.

5. Select the appropriate Data Speed and Format.

6. Download the site configuration to the RTU.

7. Download the appropriate protocol file as described in Third-Party Protocol Downloading

above.

System Tables

1. Define the Site table as follows:

a. for the RTU defined as PLC master:

• Site Name FOX3

• Site ID 55
• Link ID as required

b. for the remote RTU:

• Site Name: MOD8

• Site ID: 20

17
 MODBUS

• Link ID: as required

2. For the RTU defined as PLC master, define the PLC Table as follows:

• PLC address: 1
• Connected to RTU (Name): FOX3
• via Port (Name): PLC2

RTU as Master – Ladder Diagram Consideration

The read/write of data from/to MODBUS PLC is done by SCAN operation in rungs. The
SCAN itself is performed on one of the new data type columns: PLC_VI, PLC_VO, PLC_DI,
or PLC_DO.

For each of the above columns, I/O Link should be performed.

When the SCAN operation is performed on one of the above columns, the system accesses the
destination MODBUS PLC by selecting one of the supported commands, according to the data
type of the column and the I/O link.

Note that if the column is of input type, read operation is performed from the PLC, and if the
column is of output type, write operation is performed to the PLC.

I/O Link for PLC Data Types Columns

Before performing the I/O Link, complete the definition of the PLC Table, otherwise you will
not be able to proceed to the I/O Link for PLC data type columns.

In I/O Link, for each PLC data type column you must define the following:

1) PLC Address – the address of destination MODBUS PLC.

2) PLC Data Type – the data type of destination PLC. For MODBUS PLC, only four data
types are relevant:

a) Logic Coils

b) Discrete Inputs

c) Holding Register

d) Input Registers

3) PLC Coord1 – the offset of the element corresponding to the first element of the column,
from the first element of the MODBUS PLC data type.

The elements at MODBUS PLC are referred (numbered) from zero;

(input 10001=zero=10001-10001,

input 10002=one=10002-10001,

18
 MODBUS

input 10003=two=10003-10001,

etc., for 584 PLC).

If the first element of the column corresponds to input 10003, the PLC Coord1 must be set
to 2.

4) PLC Coord Len – should be set to 2. The length of Coord1 is 2 bytes.

Note: Do not change the last three lines for coordinates. They are reserved for protocols with
more than one coordinate.

Scan from Rungs

Before performing SCAN on a PLC column, check the PLCStt status for communication busy.

PLCStt column
= ( SCAN )
PLCBsy

PLCStt is an integer status system variable. The purpose of this variable is to give an
indication of the communication with PLCs. The values for this variable are defined in the
PLC Status Defines table (one of the Constants Tables).

Note that if PLCStt=PLCBsy, the new SCAN will not be performed.

19
 MODBUS

If the communication is successfully terminated, the PLCStt variable changes to PLCRdy.

(Ready for a new SCAN after having successfully finished the previous SCAN).

If the communication is not successfully terminated, the PLCStt variable is changed to one of
following values:

NO_Buf – No buffers to perform the communication

PLCFal – Failed to perform the communication
PLCIol – I/O Link Error
PLCAdr – The address does not appear in PLC Table
PLCTim – No response from the PLC slave
PLCRpl – Reply error from PLC slave

During the communication, the PLCStt variable is equal to PLCBsy.

RTU as PLC (Slave) – Register Numbering

The MODBUS RTU protocol usually assumes that Registers have specific numbers for Output
Registers/Coils (DO), Input Registers (DI), Analog Registers (AI), Analog Output/Holding
Registers (AOs, Internal values, timers, etc).

Since the SCADA Central that polls MODBUS RTUs is based on registers, and the RTU
database is based on Z,Y,X coordinates (where, Z is the table number, Y is the row number,
and X is the column number), the RTU (MODBUS slave) performs an automatic and
user-transparent coordinate translation, as follows:

MODBUS Register = Z×2048 + X×256 + Y

where, Z=0-31, X=0-7, Y=0-255

When using the Toolbox software, the number of rows that may be defined in a table is
between 0 and 249, so Y=0-249.

Thus, only the first 32 user tables are accessible by the master computer.

The resulting register numbers are in the 0-65000 range and not the MODICON 0-4xxx range.

Note: This is the Register number that should be transmitted over the physical line. It might
not be the same number entered in the SCADA system due to hidden offsets.

If a column of bits is to be polled, then the MODBUS fields HIGH ORDER START ADDRESS
and LOW ORDER START ADDRESS should have the first bit reference (could be any number
in the range 0–65,528 DEC) followed by the number of consecutive bits to be polled.

The maximum length of consecutive registers (EndAddr–StartAddr), supported by the

MODBUS driver, is currently 70 registers for the MODBUS RTU protocol.

20
 MODBUS

RTU Supported MODBUS Protocol Exceptions (Negative

Acknowledges)
In case of a failure, the RTU supported MODBUS protocol sends to the master the following
exceptions (negative acknowledges):

Exception Number Sent when

4 (Device FAIL) An internal buffer overflow occurs in RTU.

The database doesn’t exist.
An internal buffer communication error occurs in RTU.
The number of elements is zero.
The master tries to access an integer data-type by
interrogating a bit data-type or vice versa.
An internal failure occurs in RTU.
1 (Illegal function) The function code is not supported.
6 (BUSY) The access to the RTU database is temporarily shut off
by the system. Try polling again!
2 (Illegal Address) The master tries to access an element which is not
defined in the RTU database, or is out of range. This
error usually occurs when the accessed column is not
defined in the RTU database, or the column is defined,
but the first or the last accessed element is out of range.
(First or last Y of the accessed element is greater than
the number of rows.)

21
22
 Allen Bradley

Allen Bradley

The PLC–5 protocol support allows the connection of an Allen Bradley PLC–5 controller
to an existing RTU system. This feature is available for MOSCAD ≥ V3.00, and
MOSCAD-L ≥ V1.00.

Some of PLC-5 controllers may be directly connected to a RTU, for example, the PLC-
5/40 controller.

The RTU can also access PLC-5 controllers that are connected via the Allen Bradley Data
Highway/Data Highway Plus network.

PLC/5

RTU
Allen Bradley
PLC/5 Data Highway/
PLC/5
Data Highway Plus

RTU
RTU MDLC NETWORK AS PLC
MASTER
PLC/5

1770-KF2
RTU
Interface
Module

In this case, the connection of the RTU to one of the PLC-5 controllers (e.g. the PLC-
5/15), must be via the 1770-KF2 RS-232 Interface module.

Note: To simplify the explanations in this chapter, the PLC-5 controller is illustrated, as if
it is directly connected to the RTU. Keep in mind that any PLC-5 controller on Data
Highway/Data Highway Plus is connected to RTU via the 1770-KF2 Interface module.

The PLC–5 protocol support is the solution for polling/modifying the database of existing
PLC(s). In this case, the RTU is defined as a master and the accessed PLC – as a slave.
The RTU provides the ability to access the database of a PLC from the application ladder.

Three drivers are supplied with the Third Party installation diskette. They are:

AB2PLC1 Driver for RTU that is PLC master to Allen

Bradley, whose Port is defined as PLC 1.

AB2PLC2 Driver for RTU that is PLC master to Allen

Bradley, whose Port is defined as PLC 2.

AB2PLC3 Driver for RTU that is PLC master to Allen

Bradley, whose Port is defined as PLC 3.

23
 Allen Bradley

The RTU-to-PLC-5 connection is described in this section according to the following

configurations:

a) Local RTU as PLC master

b) Remote RTU as PLC master

Local RTU as PLC Master

This configuration allows polling/modifying the database of the PLC from an
MDLC-based network. The RTU is connected to the PLC via a port defined as Connected
to PLC. It controls the PLC by means of the Ladder Diagram.

RTU

RTU Allen Bradley

RTU MDLC NETWORK PLC1
AS PLC PLC
AllenBradley PORT
MASTER
TO SLAVE

PLC#=1

PLC Table
RTU
Ind PLC Connected to via Port (Name)
Address RTU (Name)

0 1 LOCAL PLC1

Remote RTU as PLC Master

This configuration is very similar to the previous one, except that the RTU that controls
the PLC is not the local one, but a remote one, due to application requirements. For
example, the local RTU controls a lighting system, while the remote RTU and PLC control
a reservoir/pump system.

The Site table should be defined for both RTUs.

Any number of RTUs may have access to the PLC connected to one of the RTUs.

24
 Allen Bradley

Site ID=20
Site Name=ABD8

RTU
AS PLC Site ID=55
Site Name=FOX3
MASTER MDLC

PLC2 Allen Bradley

RTU PLC
Allen Bradley PORT
TO SLAVE

PLC#=1
Site Table Sites Table

Ind Site Name Site ID Link ID ComFal (bit) Ind Site Name Site ID Link ID ComFal (bit)

0 Cntral 65533 0 Cntral 65533

1 FOX3 55 RADIO2 1 ABD8 20 RADIO2

PLC Table

Ind PLC Connected to via Port (Name)

Address RTU (Name)

0 1 FOX3 PLC2

The RTU defined as a master can access any data type of Allen Bradley PLC-5 controller.

Allen Bradley PLC–5 Settings

To establish the connection between an RTU and an Allen Bradley PLC–5 controller that
is directly connected to the RTU, you must configure the channel 0 port as follows:

a) In the Channel Overview screen, set channel 0 to SYSTEM (SLAVE).

b) In the Channel Config screen, set the Error Detect parameter to CRC.

c) Set the data speed, stop bits, and parity parameters similar to the RTU master
parameters.

d) Set the station address of PLC–5 (it must be in the range of 1 to 254).

Note: These parameters may be set either on-line or off-line.

After setting the channel port, you may connect it to the RTU master PLC port.

If you are using the 1770-KF2 Interface module or another interface module, set the
following:

a) Communication=Half-duplex.

b) Set the Error Detect parameter to CRC.

c) Set the data speed, stop bits, and parity parameters similar to the RTU master
parameters.

25
 Allen Bradley

Allen Bradley PLC 5/40 Settings

If you are using the 1770-KF2 Interface module, set the following switches:

SW-8 SW-1 SW-2 SW-3 SW-4 SW-5 SW-6 SW-7

OFF ON ON ON OFF ON ON OFF OFF ON ON OFF OFF OFF OFF ON ON OFF ON ON ON ON OFF

1 2 1 2 3 4 5 1 2 1 2 3 1 2 3 1 2 1 2 3 4 1 2

The switch functions are listed below:

Switch Number Function

SW-8 RS-232
SW-1 Half-duplex, CRC, No Parity, Non-Embedded Responses,
Accept All Messages, Use Handshaking
SW-2, SW-3, SW-4 Address 60 Octal, 48 Decimal
SW-5 DH+ at 57600 bps
SW-6 9600 bps
SW-7 DH+

RTU to PLC-5/40 Communication Using Port 2

The pin assignment of the cable to be used for RTU to PLC5/40 communication (using
Port 2) is given below.

RTU PLC-5/40
PORT 2
TXD
2 2
RXD
1 3
GND
4 7
RTS
4
CTS
5
DSR
6
DCD
8
20 DTR

26
 Allen Bradley

RTU to 1770-KF2 Communication

The pin assignment of the cable to be used for RTU to 1770-KF2 communication is given
below.

RTU 1770-KF2
TXD RXD
1 3
RXD TXD
2 2
CTS RTS
3 4
GND GND
4 7
DCD DTR
5 20
RTS CTS
6 5
12V DSR
7 6
DTR DCD
8 8

PLC Address for Allen Bradley Protocol

Allen Bradley protocol uses destination and source addresses for each transmitted packet.
The address given to the RTU master is 0 by default. To change this default, consult the
factory.

Data Type Compatibility Between RTU and PLC–5

Bit Type
When PLC–5 bits are accessed, the following adjustment is performed:
15 4 3 2 1 0
1st word
PLC_DI, PLC_DO,
. . . . accessed
column
index
0
1
2
3
4
:
:
:

15

27
 Allen Bradley

15 4 3 2 1 0
2nd word
. . . . accessed

16
17
18
:
:

31

Float and Integer Types

RTU
Float, Integer, PLC RI, PLC RO, PLC VI, PLC VO
PLC05 File Data Type Column

element 0 0
1

element 1
.
. .
. .
.
element n
n

Timer File in PLC–5

The timer file in PLC–5 may be mapped to a PLC_VI or PLC_VO data type column in the
RTU. Each element consists of 3 words. The mapping is transparent and is as follows:

PLC-5 File RTU

Timer Element PLC_VI, PLC_VO
Data Type Column
15 14 13 8 7 00

0 EN TT DN not used 0
1 preset value 1
2 accumulated value 2

28
 Allen Bradley

The same applies for counter and control elements.

PLC-5 File RTU

Counter Element PLC_VI, PLC_VO
Data Type Column
15 14 13 12 11 00

0 CU CD DN OV UN 0
1 preset value 1
2 accumulated value 2

PLC-5 File RTU

Counter Element PLC_VI, PLC_VO
Data Type Column
15 8 7 00

0 status 0

1 length 1

2 position 2

If you want to read n elements from a counter/control/timer file, you must define a column
of PLC_VI type with 3×n word elements (last index=3×n–1).

If you want to write to n successive counters/controls/timers in a file, then you must define
a column of PLC_VO type with 3×n word elements (last index=3×n–1).

RTU Definitions for Allen Bradley PLC–5 Support

Data Types
The following data types have been added to be used when the RTU serves as a master:

• PLC_VI – PLC Value Input. This data type is used to read word elements from a
third-party RTU. Each element in a PLC_VI column is a 2-byte signed integer (value).
The column length must be defined as the number of the words that are to be read. The
elements that can be read from PLC–5 are: counters, controls, timers, integers, etc. In
the case of counters, controls, and timers, three successive words are read per one
element (in PLC–5 each counter, control, and timer, consists of three words).

• PLC_VO – PLC Value Output. This data type is used to write into any word element
of Allen Bradley PLC–5 controller. The elements are: counters, controls, timers,
integers, etc. In the case of counters, controls, and timers, three successive words are
written to an element (in PLC–5 each counter, control, and timer, consists of three
words).

• PLC_DI – PLC Discrete Input. This data type is used to read 1-bit elements from a
third-party RTU, such as bits. The number of bits in a column must be defined as a
multiple of 16.

• PLC_DO – PLC Discrete Output. This data type is used to write 1-bit elements into a
third-party RTU, such as bits. The number of bits in a column must be defined as a
multiple of 16.

29
 Allen Bradley

• PLC_RI – PLC Real Input. This data type is used to read real (floating point)
elements from a third-party RTU. Each element in PLC_RI is a 4-byte real (floating
point) number.

• PLC_RO – PLC Real Output. This data type is used to write real (floating point)
elements to a third-party RTU. Each element in PLC_RO is a 4-byte real (floating
point) number.

PLC Table
The PLC Table, one of the System Tables, is used to define the connectivity to the
third-party PLC units in the system. This table must be defined for:

• The RTU which is connected to the Master Computer – not relevant.

• Any RTU which serves as a PLC master for a PLC connected to one of its ports or
connected to one of the other RTUs in the network.

This table has three columns as detailed below:

• PLC Address – the address of the PLC RTUs (1–254). Address 0 is the default address
for the Master. Refer to PLC Address for Allen Bradley Protocol to change the RTU’s
default PLC address.

• Connected to RTU (name) – the name of the RTU to which the PLC is connected.
Click the arrow to open the list. If the RTU is locally connected to one of the ports of
the unit where the PLC Table is to be defined, choose LOCAL from the choice list.

• via Port (name) – the name of the port for connection. Click the arrow to open the list.
Choose the same name that was used when the port was defined.

If the PLC is connected directly via a UART port to the Master, then define the Connected
to RTU field as LOCAL and the via Port field as PLC 1, 2 or 3.

30
 Allen Bradley

If the PLC is connected to an RTU which acts as a router, then define the Connected to
RTU field as the RTU router Site Name. Assign the name that was used in the Site table.

If the remote is an RTU which acts as PLC, then define the Connected to RTU field as the
RTU’s remote Site Name and the via Port field as RTU AS PLC. This case is not relevant
for Allen Bradley PLC–5 protocol, since the RTU is always the master.

Port Configuration and Protocol Downloading

The configuration of an RTU port as a third party protocol port requires two levels of
configuration:

• Site configuration (physical port configuration)

• Third-party protocol downloading

Site Configuration
Any one of the three CPU/Ports may defined as a PLC port. For CPU/Port 1 or CPU/Port 2
define the Connection Type as Third Party Protocols. For CPU/Port 3 select RS232, then
Third Party Protocols, and finally the connection mode.

The Connection Mode parameter defines the mode of operation: MOSCAD as DTE or
MOSCAD as DCE with/without RTS/CTS/DTR/CD support.

The selection of MOSCAD as DTE or MOSCAD as DCE depends on the type of unit to be
connected to the RTU.

If the unit acts as a computer/terminal, define the Connection Mode as MOSCAD as DCE.
In this case, you should use the FLN6457 adapter, which ends with the female 25-pin
D-type connector.

If the unit acts as a modem (DCE), define the Connection Mode as MOSCAD as DTE. In
this case, you should use the FLN6458 adapter, which ends with the male 25-pin D-type
connector.

The selection of RTS/CTS/DTR/CD support depends on the signals used for

communication between the RTU and unit. If only the Tx-Data, Rx-Data, and GND signals
are used, then select either MOSCAD as DTE or MOSCAD as DCE. If all signals are used
(including RTS, CTS, DTR, and CD), then select MOSCAD as DTE with
RTS/CTS/DTR/CD support or MOSCAD as DCE with RTS/CTS/DTR/CD support.

After you click OK, you return to the fields shown below.

31
 Allen Bradley

The default values may be changed according to the following:

• Connected to – Master Computer or PLC.

• Port Name – the name of the port: PLC 1, PLC 2, or PLC 3.

• Data Speed – This field defines the communication data speed of the selected Port
Interface. The default is 9600 bps.

• Format – This field defines the UART's character format for the communication port.
The default is 8 bit, no parity, 1 stop bit. Click the arrow to open a list that includes all
combinations of 7/8 bits, even/odd/no parity, and 1/2 stop bits.

• Description – In this field you may enter a free-format description of the

communication link (up to 36 characters).

Third-Party Protocol Downloading

After configuring the RTU physical port according to the type of connection (to Master
Computer or PLC), Toolbox provides you with the Downloader utility.

Note: The protocol should be loaded only to the RTUs whose ports have been defined as
Connected to PLC.

The Downloader supports downloading to RTUs either locally or remotely via the
network. For instructions on how to operate Downloader, see the System Setup and
Diagnostics Tools manual.

Step-by-Step Definitions

Local RTU as PLC Master

Site Configuration

1. Define one of the ports as Third Party Protocols.

32
 Allen Bradley

2. Select the appropriate Connection Mode of operation.

3. Define the port as Connected to PLC.

4. Define the Port Name: PLC 1, PLC 2, or PLC 3.

5. Select the appropriate Data Speed and Format.

6. Download the site configuration to the RTU.

7. Download the appropriate protocol file as described in Third-Party Protocol

Downloading above.

System Tables

1. Define the PLC Table as follows:

• PLC address: 1
• Connected to MOSCAD (Name): LOCAL
• via Port (Name): PLC1

Remote RTU as PLC Master

Site Configuration (for RTU connected to the PLC)

1. Define one of the ports as Third Party Protocols.

2. Select the appropriate Connection Mode of operation.

3. Define the port as Connected to PLC.

4. Define the Port Name: PLC 2.

5. Select the appropriate Data Speed and Format.

6. Download the site configuration to the RTU.

7. Download the appropriate protocol file as described in Third-Party Protocol

Downloading above.

System Tables

1. Define the Site table as follows:

a) for the RTU defined as PLC master:

Site Name: FOX3

Site ID: 55
Link ID: as required
b) for the remote RTU:

Site Name: MOD8

Site ID: 20
Link ID: as required

2. For the RTU defined as PLC master, define the PLC Table as follows:

PLC address: 1

33
 Allen Bradley

Connected to MOSCAD (Name): FOX3

via Port (Name): PLC2

RTU as Master – Ladder Diagram

The read/write of data from/to Allen Bradley PLC–5 is done by the SCAN operation in the
ladder rungs of the application. The SCAN itself is performed on one of the new data type
columns: PLC_VI, PLC_VO, PLC_DI, PLC_DO, PLC_RI or PLC_RO.

For each of the above columns, I/O Link should be performed.

When the SCAN operation is performed on one of the above columns, the system accesses
the destination Allen Bradley PLC–5 by selecting one of the supported commands,
according to the data type of the column and the I/O link.

Note that if the column is of input type, read operation is performed from the PLC, and if
the column is of output type, write operation is performed to the PLC.

I/O Link for PLC Data Types Columns

Before performing the I/O Link, complete the definition of the PLC Table, otherwise you
will not be able to proceed to the I/O Link for PLC data type columns.

In I/O Link, for each PLC data type column you must define the following:

1) PLC Address – the address of destination Allen Bradley PLC–5. The address range is
1–254. Address 0 is the master address. Refer to PLC Address for Allen Bradley
Protocol to change the default PLC address of the master.

2) PLC Data Type – the data type of destination PLC. For Allen Bradley PLC–5, only
three data types are relevant:

a) PLCBit – Use this data type when the destination file to read or write is a file of bits.

b) PLCVal – Use this data type when the destination file is of the following type:

• integer
• control
• counter
• timer
• any word type file

c) PLCRel – Use this data type when the destination file is a floating point file.

3) PLC Coord1 – the file number to access.

PLC Coord1 Len – should be set to 2. The length of Coord1 is 2 bytes.

4) PLC Coord2 – the number of elements in the file corresponding to the first element of
column. If you access a bit file, then the element number is the word number (starting
from zero) in the accessed file.

For any other files, the element number is the index of the first element to be accessed.
The size of the element may be 2, 4, or 6 bytes.

PLC Coord2 Len – should be set to 2. The length of Coord2 is 2 bytes.

34
 Allen Bradley

5) PLC Coord3 – the address (station number) of the Allen Bradley module that is
directly connected to the RTU. If an 1770-KF2 or other Interface module is connected
to the RTU, then PLC Coord3 should be the address of the interface module. If no
interface module is used (the PLC-5 is directly connected to the RTU), then PLC
Coord3 should be the address of the PLC-5 controller.

PLC Coord3 Len – should be set to 1. The length of Coord3 is 1 byte.

6) PLC Coord4 – not relevant for Allen Bradley.

Scan from Rungs

Before performing SCAN on a PLC column, check the PLCStt status for communication
busy.

PLCStt column
= ( SCAN )
PLCBsy

PLCStt is an integer status system variable. The purpose of this variable is to give an
indication on the communication with PLCs. The values for this variable are defined in the
PLC Status Defines table (one of the Constants Tables).

Note that if PLCStt=PLCBsy, the new SCAN will not be performed.

If the communication is successfully terminated, the PLCStt variable is changed to

PLCRdy. (Ready for new SCAN after having successfully finished the previous SCAN).

If the communication is not successfully terminated, the PLCStt variable is changed to one
of following values:

NO_Buf – No buffers to perform the communication

35
 Allen Bradley

PLCFal – Failed to perform the communication

PLCIol – I/O Link Error

PLCAdr – The address does not appear in PLC Table

PLCTim – No respond from the PLC slave

PLCRpl – Reply error from PLC slave

During the communication, the PLCStt variable is equal to PLCBsy.

36