New feature in the ESC Data Controller Modbus Map Spreadsheet. Anthony Dougherty

Size: px

Start display at page:

Download "New feature in the ESC Data Controller Modbus Map Spreadsheet. Anthony Dougherty"

Joel Bailey
6 years ago
Views:

1 New feature in the ESC Data Controller Modbus Map Spreadsheet Anthony Dougherty 1

2 Overview Presenter Modbus Spreadsheet Modbus Address History Modbus Spreadsheet Example 2

Presenter - Legendary Ham Anthony Dougherty Computer Engineer ESC 9 years development and engineering A story about a ham A woman is cooking a holiday ham, lets call her Augusta, and cuts one end of

3 Presenter - Legendary Ham Anthony Dougherty Computer Engineer ESC 9 years development and engineering A story about a ham A woman is cooking a holiday ham, lets call her Augusta, and cuts one end of the ham off and puts the larger part into a pan and the smaller part into another pan and puts both pans into the oven to cook. Her husband sees this and asks her why she cooks it that way. She shrugs and says it is the way her mother always did it. She calls her mother, lets call her June, while waiting on the ham to cook and asks her why and she replies that is the way her mother always did it. After hanging up with her daughter the mother calls her mother, lets call her May, and asks her why she and her daughter cook the ham that way. The woman replies to her daughter that she doesn t know why June and Augusta cook their hams that way but May cooks her ham that way because her pan isn t big enough to hold the whole ham. Some things are done because they have always been done that way and not always correctly. I want to demonstrate in this presentation how MODBUS nomenclature and addressing is the way it is because someone did it that way and it stuck ever sense and therefore MODBUS is not some mystical digital communication protocol, it 3

4 just like everything else in this world. And we have been doing it this way because it has always been done this way. But first lets talk in general about the MODBUS map spreadsheet. 3

5 Spreadsheet - The Main Event But first, demo the spreadsheet as background. 4

History Modbus standard is across the wire 0011000000111001

the actual bytes that go across the wire.

6 History Modbus standard is across the wire Apparently, there are several *different* ways (conventions) to name the *same* Modbus holding register. Forgetting about relative and absolute for a minute and just focus on the actual bytes that go across the wire. The bytes on the wire apparently define the true address of the register. Since the address is two bytes, then not surprisingly the address can range from 0 to 65,535. That is *always* the case. Unfortunately, it seems that three things have conspired to complicate this simple concept: 5

Why are DC streets missing a letter of the alphabet? Real world example of where you need to add one. Anyone here ever been to Washington DC our nations capitol?

7 Why are DC streets missing a letter of the alphabet? Real world example of where you need to add one. Anyone here ever been to Washington DC our nations capitol? There is H street, I Street and then K Street, ever notice there is no J street? There is no J street because when they were laying out the streets of Washington D.C. j and I were still largely interchangeable. (The 1740 New General English Dictionary published in London had a single section for I and J, and the standard identification Thomas Jefferson used on his personal possessions was T.I. ) Having both an I and a J street would have been redundant at best and confusing at worst, so J ended up as the odd man out. MODBUS has a similar thing were two different things are really the same thing. 6

8 History - Three Things => 1. Zero Equals One Address Register 0 Address + = isone Register = zero 1 = Register based index 1 Since some people apparently can t conceive that the first register is 0, it became convention that the register number started at 1 and ranged up to 65,536. So, register #1 is at Modbus address 0. That is why you are sometimes off by one people, companies, documentation, etc. get these two concepts mixed up and sometimes they are referring to register number and sometimes to address but use the wrong name leading to confusion. So address zero is the same as register one they are the same even though they have different names, if only we had left the register out of the map like DC did with J street. 7

9 How does one space define another? Fascinating Stuff... Railroad Tracks [CLICK] The U.S. Standard railroad gauge (distance between the rails) is 4 feet, 8.5 inches. That's an exceedingly odd number. Why was that gauge used? Because that's the way they built them in England, and English expatriates designed the U.S. Railroads. Why did the English build them like that? Because the first rail lines were built by the same people who built the pre-railroad tramways, and that's the gauge they used. Why did 'they' use that gauge then? 8

10 Because the people who built the tramways used the same jigs and tools that they had used for building [CLICK] wagons, which used that wheel spacing. Why did the wagons have that particular Odd wheel spacing? Well, if they tried to use any other spacing, the wagon wheels would break on some of the old, long distance roads in England, because that's the spacing of the wheel [CLICK] ruts. So, who built those old rutted roads? Imperial Rome built the first long distance roads in Europe (including England) for their legions. Those roads have been used ever since. And the ruts in the roads? [CLICK] Roman war chariots formed the initial ruts, which everyone else had to match for fear of destroying their wagon wheels. Since the chariots were made for Imperial Rome, they were all alike in the matter of wheel spacing. Therefore, the United States standard railroad gauge of 4 feet, 8.5 inches is derived from the original specifications for an Imperial Roman war chariot. In other words, bureaucracies live forever. So the next time you are handed a specification, procedure, or process, and wonder, 'What horse s rear end came up with this?', you may be exactly right. Imperial Roman army chariots were made just wide enough to accommodate the [CLICK] rear ends of two war horses. Now, the twist to the story: When you see a Space Shuttle sitting on its launch pad, you will notice that there are [CLICK] two big booster rockets attached to the sides of the main fuel tank. 8

11 These are solid rocket boosters, or SRBs. The SRBs are made by Thiokol at their factory in Utah. The engineers who designed the SRBs would have preferred to make them a bit larger, but the SRBs had to be shipped by train from the factory to the launch site. The railroad line from the factory happens to run through a [CLICK] tunnel in the mountains and the SRBs had to fit through that tunnel. The tunnel is slightly wider than the railroad track, and the railroad track, as you now know, is about as wide as two horses' rear ends. So, a major Space Shuttle design feature of what is arguably the world's most advanced transportation system was determined over two thousand years ago by the width of a horse's rear end. And you thought being a horse's rear end wasn't important! Now you know, Horses' rear ends control almost everything. Explains a whole lot of stuff, doesn't it? Now this story gets forwarded a lot but how true is it? Is it apocryphal? Very interesting, educational, historical, completely true, and hysterical? One out of five, maybe. Modbus however also has some interesting if also not entirely true notions of space. 8

12 History - Three Things => 2. Lost in Space (Input Coils + Output Coils + Code Function Input 1 Read registers Coil +Holding 2 Read Discrete Input Registers ) 3 Read Holding Registers 4 Read Input Registers X 5 Write Single Coil 6 Write (65,536 Single Holding Register addresses) 15 Write Multiple Coils = 16 Write Multiple Holding Registers (262,144 storage locations!) The discrete inputs (1-bit each), the output coils (1-bit each), the input registers (16- bits each), and the holding register (16-bits each) each have their *own* independent address spaces (0.. 65,535). So, actually Modbus supports [CLICK] up to 4 * = 262,144 different storage locations. Each type of entity (and the address space to find them) can only be distinguished by the [CLICK] function codes (1, 3, 5, 6, 16, etc.) used to access them. There is a 1-bit discrete input at address 0, but also a 1-bit coil at address 0, and a 16-bit input register at address 0, *and* a 16-bit holding register at address 0. The address range applies to each type of entity you need to look at the function code in the Modbus message packet to determine what type of entity is being referenced. There is no *requirement* that coils, or discrete inputs, or input registers are made available in the holding register addresses, even though we double map them in the 8832/8864 so that you can read/write coils and discrete inputs in the holding register address space. So in the 8864 coils and registers can share the same space even though it is a different space by MODBUS definition. 9

Why is the steering wheel on the left? It started early in the history of our country with [CLICK] wagons and driving on the right side of the road.

These wagons had no driver s seat; instead the driver sat on the left rear horse, so he could keep his right arm free to lash the team.

Therefore he kept to the right side of the road.

13 Why is the steering wheel on the left? It started early in the history of our country with [CLICK] wagons and driving on the right side of the road. In the late 1700s, teamsters in France and the United States began hauling farm products in big wagons pulled by several pairs of horses. These wagons had no driver s seat; instead the driver sat on the left rear horse, so he could keep his right arm free to lash the team. Since he was sitting on the left, he naturally wanted everybody to pass on the left so he could look down and make sure he kept clear of the oncoming wagon s wheels. Therefore he kept to the right side of the road. [CLICK] Travelers with hand guns carried their weapons in the hollows of their left arms and traveled to the right, the better to be ready if an oncoming stranger proved dangerous. [CLICK] Ford changed to left-hand-drive in the 1908 model year. A Ford catalogue from 1908 explains the benefits of placing the controls on the left side of the car: The control is located on the left side, the logical place, for the following reasons: Travelling along the right side of the road the steering wheel on the right side of the 10

14 car made it necessary to get out on the street side and walk around the car. This is awkward and especially inconvenient if there is a lady to be considered. The control on the left allows you to step out of the car on to the curbing without having had to turn the car around. (Getting out where the steering wheel is not sliding over the seat) In the matter of steering with the control on the right, the driver is farthest away from the vehicle he is passing, going in opposite direction; with it on the left side he is able to see even the wheels of the other car and easily avoids danger. So we sit on the left but drive on the right for two different historical reasons. MODBUS has something similar in that there are numbers on the left that mean something other than the numbers on the right and the two are for different historical reasons, let me show you. 10

15 History - Three Things - 3. Where to begin? Type Code Type Number Address Shorthand Name 0x Coil x Discrete Input x Input Register Holding 4x Register To *really* complicate things further, the original Modbus implementations on the Modicon PLCs were restricted to register numbers of 1 to 9999 ( addresses of 0 to 9998). Besides, who would *ever* need more than 9999 holding registers, right? To make things easier for them (and forever confuse everyone else), they started to prepend a code type at the beginning of the register number (not the address ) in order to indicate which address space they were talking about. This resulted in a sort of shorthand name that was never really an address at all, but became confused with register address and everyone called 40,001 the address of the first holding register, even though it wasn t, really. 11

16 History It gets worse > >#### ###### 6 digit addressing Address +1 = number/register Minus One = The problem got worse when people wanted to use more than [CLICK] 9999 holding registers and take advantage of the full address space [CLICK] ( ). [CLICK] Remember the address is converted to the number by adding 1 and when the address [CLICK] was larger than 4 digits, some people started using [CLICK] six-digit naming or (incorrectly termed) [CLICK] six-digit addressing [CLICK] where the first digit was still the type code, [CLICK] but the next 5 digits were the register number [CLICK] subtracting 1 to get the [CLICK] address on the wire. 12

History Still getting worse ##### ###### 0001-9999 >9999 40,001 1 st Reg 49,999 9999 th Reg 410,000 10,000 th Reg 410,001 10,001 st Reg 465,536 65,536 th Reg Others still use the [CLICK] 5-digit

17 History Still getting worse ##### ###### > ,001 1 st Reg 49, th Reg 410,000 10,000 th Reg 410,001 10,001 st Reg 465,536 65,536 th Reg Others still use the [CLICK] 5-digit convention for register numbers from and then switch [CLICK] over to the six-digit scheme once the number gets over That s how Modscan does it. They have shorthand names that count up (for holding registers) by one from [CLICK] 40,001 (the first holding register) until they get to [CLICK] 49,999 (the 9999 th holding register) and then the very next register[click] skips to 410,000 (the 10,000 th holding register) and then goes to [CLICK] 410,001 (the 10,001 st holding register). The last holding register [CLICK] is 465,536 (the 65,536 th holding register [CLICK] the address is 65,535, the number is 65,536, and then you pre-pend with a 4 since it is a holding register to come up with 465,536). 13

18 History It ain t over yet 5#### > ,001 1 st Reg Data Type Start End Coils 0:1 0:65536 Discrete Inputs 1:1 1:65536 Input Registers 3:1 3:65536 Holding Registers 4:1 4: , th Reg 50,000 10,000 th Reg 60,000 20,000 Reg 105,536 65,536 th Reg Still other companies use a convention that allows the registers [CLICK] above 9999 to bleed over into the 5#### numbers. Their registers are named from [CLICK] 40,001 to [CLICK] 49,999, then go to [CLICK] 50,000 and on to 59,999, then [CLICK] 60,000 all the way to [CLICK] 105,536. [CLICK] Apparently, the newer Modicon controllers started using a still-different notation like this (which makes some sense): Coils - 0:1 to 0:65536 Discrete Inputs - 1:1 to 1:65536 Input Registers - 3:1 to 3:65536 Holding Registers - 4:1 to 4:

19 History To summarize First holding register 9,999th holding register 10,000th holding register 65,536th holding register Across-the-wire address Register number Traditional Modicon digit addressing New Modicon 4:1 4:9999 4: :65536 Modscan Chippin Modbus Scanner In all cases, the names in each column are referring to the exact same address sent across the wire and the exact same register in the slave device. 15

Example Soak it in I recently had the pleasure of working on a site that had a DCS with MODBUS programming that has been through many years of ESC life cycle and

20 Example Soak it in I recently had the pleasure of working on a site that had a DCS with MODBUS programming that has been through many years of ESC life cycle and projects including HG CEMS and later MATS configurations and we wanted to refresh it so they sent me the mapping they had programmed in the DCS that looked like this 16

21 Example Load from SQL into Map The first thing I did was load the handy MODBUS map spreadsheet and go to the SQL tab. Then type in the logger name and query the StackVision SQL database on the server as shown here. 17

22 Example Load from Config Viewer into Map Alternatively one can get a copy of the configuration viewer spreadsheet and query it using the spreadsheet as shown here. 18

23 Example Lookup Tab Now you can see the channels and digitals are populated. Now we get into the real power of the MODBUS map spreadsheet and head on over to the LOOKUP tab. 19

Example Comparing Here you can see I filled in the address column based on what was in the DCS then tried to match their descriptions to what was in the configuration

24 Example Comparing Here you can see I filled in the address column based on what was in the DCS then tried to match their descriptions to what was in the configuration based on the query we did from the configuration shown in the previous two slides. As you can see things do not lineup too well, yellow are the ones that don t match. 20

Example addressing But wait, I have the power of addressing so maybe they are just using some addressing I am not familiar with so I will try out different addressing schemes and that will surely

25 Example addressing But wait, I have the power of addressing so maybe they are just using some addressing I am not familiar with so I will try out different addressing schemes and that will surely make it all make sense. No matter what address scheme I tried I could not make heads or tails of it. Remember the Lookup tab uses the over-the-wire address to determine the usage so if you get addresses in a different format you will have to convert first before putting into the lookup. [CLICK] Talk and show video 21

Wrapping Up Confusion Map Lookup After several hours of screen sharing and debugging we came to the

We based this off discovering the three actual signals that were correctly set that were used in actual

was in fact an or condition of all the digital logic bits they were pulling via MODBUS which was

Armed with this new MODBUS map spreadsheet the technician was set to reprogram the DCS with the correct

26 Wrapping Up Confusion Map Lookup After several hours of screen sharing and debugging we came to the conclusion that in fact the DCS programming was completely haywire. We based this off discovering the three actual signals that were correctly set that were used in actual process logic for an Opacity run back situation and the fact that a nuisance alarm they had going off a lot was in fact an or condition of all the digital logic bits they were pulling via MODBUS which was essentially a random pull from the controller due to the changes over the years. Armed with this new MODBUS map spreadsheet the technician was set to reprogram the DCS with the correct addresses. The power of the lookup of tab and the new addressing schemes were enough to set us up for success. [CLICK] Confusion divided by the map + the help of the lookup = success Questions? 22

27 Where to get the Modbus Map Spreadsheet ustomer/articles/documentation/ ESC-Data-Controller-Downloads 23

28 References end-the-quirks-of-the-english-alphabet/

RECHARGE, REENERGIZE, REFOCUS

RECHARGE, REENERGIZE, REFOCUS At Our Best In Tough And Changing Times RFMA ANNUAL CONFERENCE & TRADE SHOW ORLANDO, FL MARCH 12, 2013 MURRAY BANKS murray@murraybanks.com WHO YOU ARE MAY BE AS IMPORTANT