GE Industrial Solutions Entellisys 4.0 User Manual
DEH-432
Warnings, Cautions, and Notes as used in this publication
Warnings
WARNING! Warning notices are used in this publication to emphasize that hazardous voltages,
currents, or other conditions that could cause personal injury exist in this equipment or may be
associated with its use.
Warning notices are also used for situations in which inattention or lack of equipment knowledge
could cause either personal injury or damage to equipment.
Cautions
CAUTION: Caution notices are used for situations in which equipment might be damaged if care is
not taken.
Notes
NOTE: Notes call attention to information that is especially significant to understanding and
operating the equipment.
This document is based on information available at the time of its publication. While efforts have been
made to ensure accuracy, the information contained herein does not cover all details or variations in
hardware and software, nor does it provide for every possible contingency in connection with
installation, operation, and maintenance. Features may be described in here that are not present in all
hardware and software systems. GE Consumer & Industrial assumes no obligation of notice to holders
of this document with respect to changes subsequently made.
GE Consumer & Industrial makes no representation or warranty, expressed, implied, or statutory, with
respect to, and assumes no responsibility for the accuracy, completeness, sufficiency, or usefulness of
the information contained herein. No warrantees of merchantability or fitness for purpose shall apply.
Entellisys™, EntelliGuard™, and FlexLogic™ are trademarks of the General Electric Company.
Modbus RTU is a registered trademark of AEG Schneider Automation.
©Copyright 2005,2007 General Electric
All Rights Reserved
How to contact us
Please have your Entellisys System Summary # and Sub # ready when calling. This information can be
found on the Entellisys HMI on the System Health screen by clicking the Job Info button.
Post Sales Service
GE Switchgear
510 Agency Road
West Burlington, IA 52655
Phone (toll free): 1-888-437-3765
Additional information:
www.entellisys.com
Contents
1 Integrator’s Guide
1.1 PLC support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.1.1 PLC Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.1.1.1 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.1.1.2 Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.1.1.3 PLC Input States. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.1.2 FlexLogic Operand States. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.1.2.1 Breaker Control Flex Operand States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.1.2.2 Bus Differential Flex Operand States. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.1.2.3 Ground Fault Flex Operand States. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
1.1.2.4 High Current and High Current Transient Flex Operand States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
1.1.2.5 HRGF Detection Flex Operand States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
1.1.2.6 HRGF Location Flex Operand States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.1.2.7 IOC Flex Operand States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
1.1.2.8 LT Overcurrent Flex Operand States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
1.1.2.9 MSGF Overcurrent Flex Operand States. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
1.1.2.10 Multi Point RELT Flex Operand States. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
1.1.2.11 Over (and Under) Frequency Flex Operand States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
1.1.2.12 Over (and Under) Voltage Flex Operand States. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
1.1.2.13 Phase Loss Flex Operand States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
1.1.2.14 Power Reversal Flex Operand States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
1.1.2.15 ST Overcurrent Flex Operand States. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.1.2.16 Summation MSGF Zone Flex Operand States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.1.2.17 Synch Check Flex Operand States. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2 Modbus® protocol implementation
1.2 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
1.3 Physical layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
1.4 Data link layer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
1.5 CRC-16 Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
1.6 Supported function codes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
1.6.1 Function Code 03H/04H – Read Actual Values or Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
1.6.2 Function Code 05H – Execute Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
1.6.3 Function Code 06H – Store Single Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
1.6.4 Function Code 10H – Store Multiple Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
1.6.5 Exception responses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
1.6.6 File transfers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
1.6.6.1 Obtaining CPU files using Modbus protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
1.6.7 Modbus password operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
1.7 Interfacing to the Alarm Handler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
3 Modbus Memory Map
4 Modbus Memory Map Format Codes
Contents 5
6Contents
1 Integrator’s Guide
1.1 PLC support
PLCs are supported by providing status of all FlexLogic operands and discrete inputs through
the Modbus TCP interface.
PLCs have access to states of FlexLogic operands (protection elements, breaker control, status,
contact inputs/outputs, and virtual inputs/outputs) through the Modbus communication. It shall
be PLC's responsibility to figure out which CPU is running in the primary mode (Modbus register:
“FlexLogic Active”) and FlexLogic health status (Modbus register: “FlexLogic Status Message”).
CPU does not initiate communication with PLC.
1.1.1 PLC Input
PLC inputs provide the ability to manipulate FlexLogic execution. There are 256 PLC inputs, each
of which have a corresponding operand that is accessible in FlexLogic.
Writing to PLC inputs: The PLC must be programmed to write to specific bits in the PLC Input
State registers in the Modbus memory map. See Modbus Memory Map
on page 39)
Events:
If the “Events” parameter for the PLC Input is enabled and event will be logged in the Events
screen when the state has changed. 'x' in the text of event is a placeholder for number from
range 1 to 256. Source of the events is reported as (-1).
“PLC Input x On” - logged when PLC Input transitioned from low to high state.
“PLC Input x Off” - logged when PLC Input transitioned from high to low state.
PLC support 7
1.1.1.1 Configuration
User must set the parameters for each PLC Input from the PLC Input screen (Main Menu, User
Settings, Control).
Figure 1-1 PLC Input configuration screen
Function: Controls whether the input is either enabled or disabled. When input is disabled,
FlexLogic always reads its state as low. If input is enabled, FlexLogic reads the state from
corresponding Modbus register.
Events: When enabled, if there is transition of state, an event corresponding to the direction of
the transition will be logged.
Integrator’s Guide8
1.1.1.2 Status
To view a snapshot of the PLC input states from the HMI, open the PLC Input State screen (Main
Menu, User Settings, Control). Click refresh if update the status.
Figure 1-2 PLC Input States register format
1.1.1.3 PLC Input States
Each bit of the “PLC Input States” register represents one PLC input. Bit value 0 indicates the
corresponding PLC input is in off state; and bit value is 1 indicating corresponding PLC input is in
on state. See Table 1-1.
Table 1-1 PLC Input States register format
PLC Input States register PLC Input States bit field PLC Input X
101
2017
…
16 0 241
12
23
……
15 16
118
……
1242
……
15 256
PLC support 9
1.1.2 FlexLogic Operand States
After each protection pass, all the information regarding each operand's state is updated in
corresponding Modbus register. The section PLC Interface (Read/Write) on page 110 is the
complete list of registers holding state information of corresponding operand.
1.1.2.1 Breaker Control Flex Operand States
Each breaker has 13 different states shown in Table 1-2. Each one of them corresponds to a
different bit in the data item.
Table 1-2 Breaker Control status bit field
Bit Value Notes
0 Breaker Opened
1Breaker Closed
2 Breaker Locked Out
3 Closing Spring Charged
4 Primary Disconnect Connected
5 Primary Disconnect Disconnected
6 Secondary Disconnect Connected
7Breaker Ready
8 Breaker Available
9 Breaker Open Failed
10 Breaker Close Failed
11 Breaker Fault
12 Breaker RELT State Not used in this release. It shall be always set to 0.
The breaker states for all 30 breakers span across 25 consecutive modbus registers as shown in
Table 1-3. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-3 Breaker status offsets
Breaker Number Register
Offset
Breaker 1 0 0 N/A
Breaker 2 0 13 This breaker’s information spans
Breaker 3 1 10 This breaker’s information spans
Bit Offset Notes
over two adjacent registers
over two adjacent registers
Breaker 4 2 7 This breaker’s information spans
over two adjacent registers
... ... ... ...
Integrator’s Guide10
1.1.2.2 Bus Differential Flex Operand States
Each zone has 6 different states shown in Table 1-4. Each one of them corresponds to a different bit
in the data item.
Table 1-4 Bus Differential status bit field
Bit Value
0 Trip Dropout
1 Alarm Dropout
2 Trip Pickup
3Alarm Pickup
4 Trip Operated
5 Alarm Operated
6 Backup Trip Operated
The zone states for all 4 relay instances span across 2 consecutive modbus registers as shown in
Table 1-3. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-5 Bus Differential status offsets
Zone Number Register
Offset
Bit Offset Notes
Zone 1 0 0
Zone 2 0 7
Zone 3 0 14 This zone’s information spans
over two adjacent registers
Zone 4 1 5
1 12 Bits from 12 thru 15 are not used
and shall always be set to 0
PLC support 11
1.1.2.3 Ground Fault Flex Operand States
Each breaker has 5 different states shown in Table 1-6. Each one of them corresponds to a different
bit in the data item.
Table 1-6 Ground Fault status bit field
Bit Value
0 Trip Pickup
1 Trip Operated
2 Trip Dropout
3Alarm Pickup
4 Alarm Operated
5 Alarm Dropout
The breaker states for all 30 breakers span across 12 consecutive modbus registers as shown in
Table 1-7. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-7 Ground Fault status offsets
Breaker Number Register
Offset
Bit Offset Notes
Breaker 1 0 0
Breaker 2 0 6
Breaker 3 0 12 This breaker’s information spans
over two adjacent registers
Breaker 4 1 2
... ... ... ...
Integrator’s Guide12
1.1.2.4 High Current and High Current Transient Flex Operand States
Each breaker has 3 different states shown in Table 1-8. Each one of them corresponds to a different
bit in the data item.
Table 1-8 High Current status bit field
Bit Value
0Alarm Pickup
1 Alarm Operated
2 Alarm Dropout
The breaker states for all 30 breakers span across 6 consecutive modbus registers as shown in
Table 1-9. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-9 High Current status offsets
Breaker Number Register
Offset
Breaker 1 0 0
Breaker 2 0 3
Breaker 3 0 6
Bit Offset Notes
Breaker 4 0 9
... ... ... ...
PLC support 13
1.1.2.5 HRGF Detection Flex Operand States
Each breaker has 3 different states shown in Table 1-10. Each one of them corresponds to a
different bit in the data item.
Table 1-10 HRGF Detection status bit field
Bit Value
0 Alarm Dropout
1Alarm Pickup
2 Alarm Operated
The breaker states for all 30 breakers span across 6 consecutive modbus registers as shown in
Table 1-11. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-11 HRGF Detection status offsets
Breaker Number Register
Offset
Breaker 1 0 0
Breaker 2 0 3
Breaker 3 0 6
Bit Offset Notes
Breaker 4 0 9
... ... ... ...
Integrator’s Guide14
1.1.2.6 HRGF Location Flex Operand States
Each zone has 2 different states shown in Table 1-12. Each one of them corresponds to a different
bit in the data item.
Table 1-12 HRGF Location status bit field
Bit Value
0 Locator in On State
1 Locator in Off State
The zone states for all 4 location function instances are contained in a single modbus register as
shown in
Table 1-13 HRGF Location status offsets
Zone Number Register
Zone 1 0 0
Zone 2 0 2
Zone 3 0 4
Zone 4 0 6
Table 1-13. See PLC Interface (Read/Write) on page 110 for memory locations.
Offset
Bit Offset Notes
0 8 Bits from 8 thru 15 are not used
and shall always be set to 0
PLC support 15
1.1.2.7 IOC Flex Operand States
Each breaker has 2 different states shown in Table 1-14. Each one of them corresponds to a
different bit in the data item.
Table 1-14 IOC status bit field
Bit Value
0 Trip Operated
1 Trip Dropout
The breaker states for all 30 breakers span across 4 consecutive modbus registers as shown in
Table 1-15. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-15 IOC status offsets
Breaker Number Register
Breaker 1 0 0
Breaker 2 0 2
Breaker 3 0 4
Breaker 4 0 6
Bit Offset Notes
Offset
Breaker 5 0 8
Breaker 6 0 10
Breaker 7 0 12
Breaker 8 0 14
Breaker 9 1 0
... ... ...
Integrator’s Guide16
1.1.2.8 LT Overcurrent Flex Operand States
Each breaker has 3 different states shown in Table 1-16. Each one of them corresponds to a
different bit in the data item.
Table 1-16 LT Overcurrent status bit field
Bit Value
0Alarm Pickup
1 Alarm Operated
2 Alarm Dropout
The breaker states for all 30 breakers span across 6 consecutive modbus registers as shown in
Table 1-17. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-17 LT Overcurrent status offsets
Breaker Number Register
Offset
Breaker 1 0 0
Breaker 2 0 3
Breaker 3 0 6
Breaker 4 0 9
Breaker 5 0 12
Breaker 6 0 15 This breaker’s information spans
... ... ...
Bit Offset Notes
over two adjacent registers
PLC support 17
1.1.2.9 MSGF Overcurrent Flex Operand States
Each zone has 7 different states shown in Table 1-18. Each one of them corresponds to a different
bit in the data item.
Table 1-18 MSGF Overcurrent status bit field
Bit Value
0 Trip Dropout
1 Alarm Dropout
2 Trip Pickup
3Alarm Pickup
4 Trip Operated
5 Alarm Operated
6 Backup Trip Operated
The zone states for all 4 instances span across 2 consecutive modbus registers as shown in
Table 1-19. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-19 MSGF Overcurrent status offsets
Zone Number Register
Offset
Zone 1 0 0
Zone 2 0 7
Zone 3 0 14 This zone’s information spans
Zone 4 1 5
1 12 Bits from 12 thru 15 are not used
Bit Offset Notes
over two adjacent registers
and shall always be set to 0
Integrator’s Guide18
1.1.2.10 Multi Point RELT Flex Operand States
This relay has 1 state shown in Table 1-20.
Table 1-20 Multi Point RELT status bit field
Bit Value
0 Multipoint Reduced Let-Thru Mode On
The relay state uses one modbus register as shown in Table 1-21. See PLC Interface (Read/Write)
on page 110 for memory locations.
Table 1-21 Multi Point RELT status offsets
Zone Number Register
Offset
RELT State 0 0
0 1 Bits from 1 thru 15 are not used
Bit Offset Notes
and shall always be set to 0
PLC support 19
1.1.2.11 Over (and Under) Frequency Flex Operand States
Each breaker has 6 different states shown in Table 1-22. Each one of them corresponds to a
different bit in the data item.
Table 1-22 Over Frequency status bit field
Bit Value
0Alarm Pickup
1 Alarm Operated
2 Alarm Dropout
3 Trip Pickup
4 Trip Operated
5 Trip Dropout
The breaker states for all 30 breakers span across 12 consecutive modbus registers as shown in
Table 1-23. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-23 Over Frequency status offsets
Breaker Number Register
Offset
Breaker 1 0 0
Breaker 2 0 6
Breaker 3 0 12 This breaker’s information spans
Breaker 4 1 2
... ... ...
Bit Offset Notes
over two adjacent registers
Integrator’s Guide20
1.1.2.12 Over (and Under) Voltage Flex Operand States
Each breaker has 6 different states shown in Table 1-24. Each one of them corresponds to a
different bit in the data item.
Table 1-24 Over Voltage status bit field
Bit Value
0Alarm Pickup
1 Alarm Operated
2 Alarm Dropout
3 Trip Pickup
4 Trip Operated
5 Trip Dropout
The breaker states for all 30 breakers span across 12 consecutive modbus registers as shown in
Table 1-25. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-25 Over Voltage status offsets
Breaker Number Register
Offset
Breaker 1 0 0
Breaker 2 0 6
Breaker 3 0 12 This breaker’s information spans
Breaker 4 1 2
... ... ...
Bit Offset Notes
over two adjacent registers
PLC support 21
1.1.2.13 Phase Loss Flex Operand States
Each breaker has 6 different states shown in Table 1-26. Each one of them corresponds to a
different bit in the data item.
Table 1-26 Phase Loss status bit field
Bit Value
0Alarm Pickup
1 Alarm Operated
2 Alarm Dropout
3 Trip Pickup
4 Trip Operated
5 Trip Dropout
The breaker states for all 30 breakers span across 12 consecutive modbus registers as shown in
Table 1-27. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-27 Phase Loss status offsets
Breaker Number Register
Offset
Breaker 1 0 0
Breaker 2 0 6
Breaker 3 0 12 This breaker’s information spans
Breaker 4 1 2
... ... ...
Bit Offset Notes
over two adjacent registers
Integrator’s Guide22
1.1.2.14 Power Reversal Flex Operand States
Each breaker has 6 different states shown in Table 1-28. Each one of them corresponds to a
different bit in the data item.
Table 1-28 Power Reversal status bit field
Bit Value
0Alarm Pickup
1 Alarm Operated
2 Alarm Dropout
3 Trip Pickup
4 Trip Operated
5 Trip Dropout
The breaker states for all 30 breakers span across 12 consecutive modbus registers as shown in
Table 1-29. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-29 Power Reversal status offsets
Breaker Number Register
Offset
Breaker 1 0 0
Breaker 2 0 6
Breaker 3 0 12 This breaker’s information spans
Breaker 4 1 2
... ... ...
Bit Offset Notes
over two adjacent registers
PLC support 23
1.1.2.15 ST Overcurrent Flex Operand States
Each breaker has 3 different states shown in Table 1-30. Each one of them corresponds to a
different bit in the data item.
Table 1-30 ST Overcurrent status bit field
Bit Value
0 Trip Pickup
1 Trip Operated
2 Trip Dropout
The breaker states for all 30 breakers span across 6 consecutive modbus registers as shown in
Table 1-31. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-31 ST Overcurrent status offsets
Breaker Number Register
Offset
Breaker 1 0 0
Breaker 2 0 3
Breaker 3 0 6
Breaker 4 0 9
Breaker 5 0 12
Breaker 6 0 15 This breaker’s information spans
Breaker 7 1 2
... ... ...
Bit Offset Notes
over two adjacent registers
Integrator’s Guide24
1.1.2.16 Summation MSGF Zone Flex Operand States
Each zone has 7 different states shown in Table 1-32. Each one of them corresponds to a different
bit in the data item.
Table 1-32 Summation MSGF Zone status bit field
Bit Value
0 Trip Dropout
1 Alarm Dropout
2 Trip Pickup
3Alarm Pickup
4 Trip Operated
5 Alarm Operated
6 Trip Restrained
The zone states for both zones reside in a single modbus register as shown in Table 1-33. See PLC
Interface (Read/Write) on page 110 for memory locations.
Table 1-33 Summation MSGF Zone status offsets
Zone Number Register
Offset
Zone 1 0 0
Zone 2 0 8
Bit Offset Notes
PLC support 25
1.1.2.17 Synch Check Flex Operand States
Each relay has 10 different states shown in Table 1-34. Each one of them corresponds to a different
bit in the data item.
Table 1-34 Synch Check status bit field
Bit Value
0 Dead Source Operated
1 Dead Source Dropout
2 Synch Operated
3 Synch Dropout
4 Close Operated
5 Close Dropout
6V1 Above Minimum
7V2 Above Minimum
8 V1 Below Maximum
9 V2 Below Maximum
The relay states for all12 relays span across 8 consecutive modbus registers as shown in Table 1-35.
See
PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-35 Synch Check status offsets
Zone Number Register
Offset
Relay 1 0 0
Relay 2 0 10 This relay’s information spans
Relay 3 1 4
Relay 4 1 14 This relay’s information spans
Relay 5 2 8 This relay’s information spans
Relay 6 3 2
Relay 7 3 12
Relay 8 4 6
Relay 9 5 0
Relay 10 5 10
Bit Offset Notes
over two adjacent registers
over two adjacent registers
over two adjacent registers
Relay 11 6 4
Relay 12 6 14
7 8 Bits from 8 thru 15 are not used
and shall always be set to 0
Integrator’s Guide26
2 Modbus® protocol implementation
2.1 Introduction
The CPU supports a number of communications protocols to allow connection to the HMI
computer, as well as other equipment which includes personal computers, RTUs, SCADA
masters, and programmable logic controllers. The Modicon Modbus® RTU protocol is the most
basic protocol supported. Modbus is available via ethernet as specified by the Modbus/TCP
specification. Note that:
• The CPU always acts as a slave device, meaning that it never initiates communications; it
only listens and responds to requests issued by a master computer.
• For Modbus, a subset of the Remote Terminal Unit (RTU) protocol format is supported that
allows extensive monitoring, programming, and control functions using read and write
register commands.
• The CPU will support a maximum of 8 concurrent Modbus sessions. Four sessions are
reserved for use by HMI computers. A remote device that attempts to connect when all
sessions are in use will receive a response message indicating the number of maximum
connections has been exceeded. If a remote device does not make a request within
30 seconds, the session will be timed out and made available to the next device that
establishes a session.
2
2.2 Physical layer
The Modbus RTU protocol is hardware-independent so that the physical layer can be any of a
variety of standard hardware configurations. The CPU includes a faceplate (front panel)
100BaseT Ethernet port. Data flow is auto-configuring full or half-duplex. Each data byte is
transmitted in an asynchronous format consisting of 1 start bit, 8 data bits, 1 stop bit , and
possibly 1 parity bit. This produces a 10 or 11 bit data frame. The master device in any system
must know the address of the slave device with which it is to communicate. In the case of
ModbusTCP communications, the CPU will not act on a request from a master if the address in
the request does not match the CPU’s slave address. A single setting selects the slave address
used for ModbusTCP. The default slave address for a CPU is 1.
Introduction 27
2.3 Data link layer
22
Communications takes place in packets, which are groups of asynchronously framed byte data.
The master transmits a packet to the slave and the slave responds with a packet. The end of a
packet is marked by ‘dead-time’ on the communications line. The following describes general
format for both transmit and receive packets. For exact details on packet formatting, see the
subsequent sections describing each function code.
MODBUS PACKET FORMAT
DESCRIPTION SIZE
SLAVE ADDRESS 1 byte
FUNCTION CODE 1 byte
DATA N bytes
CRC 2 bytes
DEAD TIME 3.5 bytes transmission time
SLAVE ADDRESS
This is the address of the slave device that is intended to receive the packet sent by the master
and perform the desired action. Only the addressed slave will respond to a packet that starts
with its address. Note that since Modbus/TCP also relies on a correct IP address to receive the
packet, and each CPU responds as a single device, it is generally not necessary to change the
Modbus address of the device.
FUNCTION CODE
This is one of the supported function codes of the unit which tells the slave what action to
perform. See Supported function codes
from the slave is indicated by setting the high order bit of the function code in the response
packet. See Exception responses on page 35 for further details.
DATA
This will be a variable number of bytes depending on the function code. This may include actual
values, settings, or addresses sent by the master to the slave or by the slave to the master.
CRC
This is a two byte error checking code. The RTU version of Modbus includes a 16-bit cyclic
redundancy check (CRC-16) with every packet which is an industry standard method used for
error detection. If a Modbus slave device receives a packet in which an error is indicated by the
CRC, the slave device will not act upon or respond to the packet thus preventing any erroneous
operations. See CRC-16 Algorithm
on page 30 for complete details. An exception response
on page 29 for a description of how to calculate the CRC.
Modbus® protocol implementation28
2.4 CRC-16 Algorithm
The CRC-16 algorithm essentially treats the entire data stream (data bits only; start, stop and
parity ignored) as one continuous binary number. This number is first shifted left 16 bits and
then divided by a characteristic polynomial (11000000000000101B). The 16-bit remainder of the
division is appended to the end of the packet, most significant byte first. The resulting packet
including CRC, when divided by the same polynomial at the receiver, will give a zero remainder if
no transmission errors have occurred. This algorithm requires the characteristic polynomial to
be reverse bit ordered. The most significant bit of the characteristic polynomial is dropped, since
it does not affect the value of the remainder.
CRC-16 ALGORITHM
SYMBOLS --> data transfer
A 16-bit working register
Alow low order byte of A
Ahigh high order byte of A
CRC 16-bit CRC-16 result
i,j loop counters
(+) logical EXCLUSIVE-OR operator
2
N total number of data bytes
Di i-th data byte (i = 0 to N-1)
G 16-bit characteristic polynomial = 1010000000000001 (binary) with
MSbit dropped and bit order reversed
shr (x) right shift operator (th LSbit of x is shifted into a carry flag, a ‘0’ is
shifted into the MSbit of x, all other bits are shifted right one location)
ALGORITHM:
1. FFFF (hex) --> A
2. 0 --> i
3. 0 --> j
4. Di (+) Alow --> Alow
5. j + 1 --> j
6. shr (A)
7. Is there a carry? No: go to 8 Yes: G (+) A --> A and continue.
8. Is j = 8? No: go to 5 Yes: continue
9. i + 1 --> i
10. Is i = N? No: go to 3 Yes: continue
11. A --> CRC
CRC-16 Algorithm 29
2
2.5 Supported function codes
Modbus officially defines function codes from 1 to 127 though only a small subset is generally
needed. The CPU supports some of these functions, as summarized in the following table.
Subsequent sections describe each function code in detail.
2.5.1 Function Code 03H/04H – Read Actual Values or Settings
This function code allows the master to read one or more consecutive data registers (actual
values or settings) from a relay. Data registers are always 16 bit (two byte) values transmitted
with high order byte first . The maximum number of registers that can be read in a single packet
is 125. See the MODBUS MEMORY MAP table on page 17 for exact details on the data registers.
Since some PLC implementations of Modbus only support one of function codes 03h and 04h,
the CPU interpretation allows either function code to be used for reading one or more
consecutive data registers. The data starting address will determine the type of data being read.
Function codes 03h and 04h are therefore identical. The following table shows the format of the
master and slave packets. The example shows a master device requesting 3 register values
starting at address 4050h from slave device 11h (17 decimal); the slave device responds with
the values 40, 300, and 0 from registers 4050h, 4051h, and 4052h, respectively.
FUNCTION CODE MODBUS DEFINITION CPU DEFINITION
HEX DEC
03 3 Read Holding Registers Read Actual Values or Settings
04 4 Read Holding Registers Read Actual Values or Settings
05 5 Force Single Coil Execute Operation
06 6 Preset Single Register Store Single Setting
10 16 Preset Multiple Registers Store Multiple Settings
Modbus® protocol implementation30
Loading...