Using the Modbus Gateway

Solution

The Modbus Gateway can:

1. Allow the SCADA System to access any HMI internal memory.
2. Allow the SCADA System to access any device connected to the HMI.
3. Allow the HMI to act as a ModbusTCP-to-ModbusRTU bridge.

These 3 modes can be used simultaneously.

See 4.0 Configure the Modbus Gateway section for details on enabling the Modbus Gateway in EBPro.

NOTE: Serial connections are limited by the number of communication ports on the HMI.  A large number of Modbus Gateway items may reduce the performance of the HMI.

---

Allow the SCADA System to Access HMI Internal Memory

This is the default setting, where Modbus addresses are mapped to HMI internal storage.

Modbus Request	Mapped To HMI Register
0x1 – 0x12400	LB0 – LB12399
1×1 – 1×12400	LB0 – LB12399
3×1 – 3×9999	LW0 – LW9998
4×1 – 4×9999	LW0 – LW9999
3×10000 – 3×65536	RW0 – RW55535
4×10000 – 4×65536	RW0 – RW55535

Be careful when using Local Bit and Word addresses 9000 and higher.  Many addresses in this range are used by the HMI for specific functions.

---

Allow the SCADA System to Access Devices Connected to the HMI

This is a custom setting, where Modbus addresses are mapped to a device with which the HMI is communicating.  The following examples demonstrate a few of the many possible configurations.

---

Example 1 – Animatics Smart Motor

This example shows an Animatics SmartMotor mapped to a series of Modbus registers.

Modbus Request	Mapped To Animatics Register
4×1 – 4×9	al[0] – al[9]
0x1 – 0x32	a.0-a.15, b.0 – b.15

The SmartMotor is connected to the HMI via an RS232 serial connection.  This example shows how an RS232 device can be connected to an Ethernet SCADA system.

---

Example 2 – Allen Bradley DF1

This example shows an Allen Bradley Micrologix using DF1 mapped to a series of Modbus registers.

Modbus Request	Mapped To AB Register
0x1 – 0x64	B100:0.0 – B100:3.15
1×1 – 1×64	B101:0.0 – B101:3.15
3×1 – 3×32	N110:0 – N110:31
4×1 – 4×10	T20:0.PRE – T30:0.PRE
4×11 – 4×42	N120:0 – N120:31

The AB PLC is connected to the HMI via an RS232 serial connection.  This example shows how an RS232 device can be connected to an Ethernet SCADA system.

---

Example 3 – Omron Hostlink

This example shows an Omron CS/CJ using Hostlink mapped to a series of Modbus registers.

Modbus Request	Mapped To Omron Register
0x1 – 0x64	CIO0.00 – CIO3.15
1×1 – 1×64	CIO4.00 – CIO7.15
3×1 – 3×32	CIO220 – CIO251
4×1 – 4×32	H0 – H31

The Omron PLC is connected to the HMI via an RS485 4-wire serial connection.    This example shows how an RS485 4-wire device can be connected to an Ethernet SCADA system.

---

Example 4 – Yaskawa MP Series over Ethernet

This demonstrates that the Modbus Gateway can be used to connect a SCADA system to an Ethernet device that the SCADA system does not support, but that the HMI does.

Modbus Request	Mapped To Yaskawa Register
0x1 – 0x64	OB0 – OB40
4×1 – 4×64	MW0 – MW63

---

Use the HMI as a ModbusTCP to ModbusRTU Bridge

This example shows a number of Modbus RTU devices mapped to a series of Modbus registers.  In the Mapped PLC Address column, the pound-sign notation is used to specify the station number followed by the starting register in the specified station.  For more information on specifying station numbers, please refer to the EBPro Programming Manual.

Modbus Request	Mapped To Modbus RTU Register
4×1 – 4×32	4×1 – 4×32 in Modbus RTU Station #1
4×33 – 4×64	4×1 – 4×32 in Modbus RTU Station #2
4×65 – 4×96	4×1 – 4×32 in Modbus RTU Station #3
4×97 – 4×128	4×1 – 4×32 in Modbus RTU Station #4
4×129 – 4×160	4×1 – 4×32 in Modbus RTU Station #5
4×161 – 4×192	4×1 – 4×32 in Modbus RTU Station #6
4×193 – 4×224	4×1 – 4×32 in Modbus RTU Station #7
4×225 – 4×256	4×1 – 4×32 in Modbus RTU Station #8
4×257 – 4×288	4×1 – 4×32 in Modbus RTU Station #9
4×289 – 4×320	4×1 – 4×32 in Modbus RTU Station #10

The Modbus RTU devices are connected to the HMI via an RS485 2-wire serial connection.  This example shows how a network of RS485 2-wire serial devices can be connected to an Ethernet SCADA system.  An RS485 4-wire network would be set up the same way.

---

Configure the Modbus Gateway

First, add the protocol to which Modbus registers will be mapped.  Please refer to the EZwarePlus Programming manual or the software help system for more information.  In the example below, the Allen-Bradley SLC500 and Micro (DF1 Serial-CRC) protocol will used.

Next, configure the Modbus RTU/TCP Slave protocol in the Model tab of System Parameter dialog:

• Change the HMI Station Number to the Modbus Unit Number desired for the HMI.
• Change the Port Number to the port used by the ModbusTCP Master.  Typically, Port 502 is used.

Add the Modbus RTU/TCP Slave protocol to the project, and select the PLC I/F as Ethernet.

Check the Enable checkbox in the MODBUS TCP/IP Gateway section, and click the Address Mapping Tables button to set up the Modbus Gateway.

The default settings are shown.  Click the Delete button to delete the selected item.  Click the Add button to add a new item, or the Setting button to modify the selected item.

Click the Add button to set up a new map.

Description: Text that describes this item.

Device Type: Specify whether this item is a Bit or Word device.  This selection determines the options available in the MODBUS Address and Mapped PLC Address fields.

MODBUS Address: Specify the starting MODBUS address that will represent the data in the device being mapped.  This is the address from which the SCADA system will ask for data, in this case 4×11.

Mapped PLC Address: Select the controller to which the Modbus address will be mapped, and specify the starting address in that controller.  The Allen Bradley protocol and address N120:0 have been selected above. 

Table Size: Specify the number of elements to map.  Since a Word transfer is being configured, this represents 32 words.

NOTE: The table size defines the maximum number of elements to be mapped.  The HMI will issue one request to the mapped device for each request received from the ModbusTCP master.  If a request is received requesting an address outside of the mapped range, the Modbus error register LW9288 will set to 2.

Conversion, AB -> BA: When checked, each byte of each word value is swapped.  Available only when the Device Type is set to Word.

Conversion, ABCD -> CDAB: When checked, each word of each double-word value is swapped.  If both conversion options are checked, AB -> BA occurs first.  Available only when the Device Type is set to Word.

OK: Close the dialog and add this item to the Modbus Gateway map.

Modbus address 4×11 is mapped to AB address N120:0, for a block of 32 words.

Modbus Address	Micrologix Address
4×11	N120:0
4×12	N120:1
4×13	N120:2
4×14	N120:3
4×15	N120:4
4x…	N120:…
4×41	N120:30
4×42	N120:31

The ModbusTCP Master in the SCADA system would be configured to read/write address 4×11, at the IP address assigned to the HMI.  The HMI will read/write  from the Micrologix at address N120:0, and send the appropriate Modbus response to the ModbusTCP Master.

The following Modbus function codes are supported:

Code	Definition
1	Read Coil Status
2	Read Input Status
3	Read Holding Registers
4	Read Input Registers
5	Force Single Coil
6	Preset Single Register
15	Force Multiple Coils (LB addresses in the HMI only, not compatible with bits in a PLC)
16	Preset Multiple Registers

Modbus communication errors are reported in HMI Local Word 9288:

Value	Error
0	No error
1	Attempt to read/write an undefined register
2	Attempt to read/write an address outside the defined map
3	Bad command format from the Modbus Master
4	Attempt to write to a Read-only register
5	Attempt to read to a Write-only register
6	Timeout from the mapped device
7	Invalid function code received from the Modbus Master

To debug comms from the HMI to the mapped device, place a numeric display object on the HMI referencing an address in the mapped device.