Page is loading ...
FloBoss S600+ Modbus Specification Manual
D301904X012
January 2021
Remote Automation Solutions
FloBoss S600+ Modbus Specification Manual
FloBoss S600+ Modbus Specification Manual
D301904X012
January 2021
ii
System Training
A well-trained workforce is critical to the success of your operation. Knowing how to correctly install, configure,
program, calibrate, and trouble-shoot your Emerson equipment provides your engineers and technicians with the
skills and confidence to optimize your investment. Remote Automation Solutions offers a variety of ways for your
personnel to acquire essential system expertise. Our full-time professional instructors can conduct classroom
training at several of our corporate offices, at your site, or even at your regional Emerson office. You can also receive
the same quality training via our live, interactive Emerson Virtual Classroom and save on travel costs. For our
complete schedule and further information, contact the Remote Automation Solutions Training Department at
800-338-8158 or email us at education@emerson.com.
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
Contents iii
Contents
1. Introduction 1
2. Physical Transport of Data 1
2.1 TCP Socket ............................................................................................................................................ 1
2.2 Modbus TCP .......................................................................................................................................... 1
2.3 Serial ..................................................................................................................................................... 1
2.4 Types and Capabilities of Serial Ports ..................................................................................................... 2
3. Network Interface 2
4. Modbus 3
4.1 Configuration........................................................................................................................................ 3
4.2 Master .................................................................................................................................................. 3
4.3 Slave ..................................................................................................................................................... 3
5. RTU/ASCII Protocol 4
6. Implemented Modbus Functions 5
6.1 Function 1: Read Output Status ............................................................................................................. 5
6.2 Function 2: Read Input Status ................................................................................................................ 6
6.3 Function 3: Read Output Registers ........................................................................................................ 6
6.4 Function 4: Read Input Registers ........................................................................................................... 7
6.5 Function 5: Write Single Coil ................................................................................................................. 7
6.6 Function 6: Write Single Register ........................................................................................................... 8
6.7 Function 8: Loopback ............................................................................................................................ 8
6.8 Function 15: Write Multiple Coils ........................................................................................................... 9
6.9 Function 16: Write Multiple Registers .................................................................................................... 9
6.10 Function Codes 65, 66, 67, and 68 ...................................................................................................... 10
7. Message Length Mode 11
8. Register Formats 12
8.1 Register: Float ..................................................................................................................................... 12
8.2 Register: Rosemount ........................................................................................................................... 12
8.3 Register: Double ................................................................................................................................. 13
8.4 Register: Phillips Float ......................................................................................................................... 13
8.5 Register: Phillips Double ...................................................................................................................... 13
8.6 Register: INT ....................................................................................................................................... 13
8.7 Register: LONG_INT ............................................................................................................................ 13
8.8 Register: SCALE 0 nnnn ....................................................................................................................... 13
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
iv Contents
8.9 Register: Modicon ............................................................................................................................... 14
9. Enron Functions 15
9.1 Enron Modbus Map ............................................................................................................................. 15
9.2 Special Enron Functions for Events ...................................................................................................... 15
9.2.1
Clear/Acknowledge Modbus Event Log ................................................................................. 15
9.2.2 Event Count Register ............................................................................................................ 15
9.2.3 Alarm Count Register ........................................................................................................... 16
9.2.4 Read Modbus Alarm/Event Log Functions ............................................................................. 16
9.3 Special Enron Functions for Data Log Collection .................................................................................. 18
9.4 Read Report Log Configuration ........................................................................................................... 19
9.5 Read Report Log Data ......................................................................................................................... 20
10. S600+ Modbus Configuration Files 21
10.1 Config File Title ................................................................................................................................... 21
10.1.1 Config File Header ................................................................................................................ 22
10.2 Config File Master Section ................................................................................................................... 23
10.3 Config File Slave N Section .................................................................................................................. 24
10.4 Config File Data ................................................................................................................................... 24
10.5 Config File Data Coil ............................................................................................................................ 25
10.6 Config File Data Input .......................................................................................................................... 25
10.7 Config File Data Registers .................................................................................................................... 25
10.8 Discrete Data Point Format ................................................................................................................. 26
10.9
Numeric Data Point Format ................................................................................................................. 27
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
Contents v
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
1
1. Introduction
This document describes the Modbus communications protocol on the FloBoss S600+ flow
computer. The flow computer has 20 user definable communication tasks. Each of the links may be
individually configured.
2. Physical Transport of Data
2.1 TCP Socket
The TCP/IP stream socket supports both master and slave links.
If the unit is the slave on the link it creates a server socket and listens for clients to connect. The
TCP/IP address of the slave link is the TCP/IP address of the flow computer.
If the unit is the master on the link it acts as a client and attempts to connect to a remote server
machine. When you configure the data link, you specify the TCP/IP address of the slave with which
the master must communicate.
The S600+ supports communication between networks using a gateway.
Other communication parameters are independent of the mode of data transfer. ASCII and RTU are
supported over stream sockets and the Modbus map is independent of the transport mechanism.
2.2 Modbus TCP
This protocol is based on the Modbus/TCP Specification. The connection mechanism is TCP/IP
which secures data transfer between any machines connected on a network. The Modbus protocol
is encapsulated into the TCP/IP frame.
The data transfer within the Modbus part of the protocol is standard Modbus. The only significant
difference is that the Modbus CRC is not use; . Instead the CRC used with the TCP/IP protocol is
used.
2.3 Serial
In serial mode the data links communicate over standard serial lines with these specifications:
Baud rates: 2400, 4800, 9600, 19200, 38400, and 57600
Data bits: 7 (ASCII, required for Modbus ASCII) and 8 (RTU, required for Modbus RTU).
Stop bits: 1, 2
Parity: None, Even, Odd
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
2
2.4 Types and Capabilities of Serial Ports
The S600+ supports the following serial ports:
Com. Port 1: Reserved for the front panel display and keypad.
Com. Port 2: Reserved for the Config600 interface (actually a Modbus slave link)
Com. Ports 3 and Port 4: Dedicated RS-232 with RTS-CST handshaking capabilities
Com. Ports 5, 6, and 7: RS-485/RS-232 capability. RTS line is controlled automatically by the
P152 module’s UART and rapid turnaround is possible on the 485 links.
Com. Port 8: Reserved for I/O board communications.
Com. Ports 9, 10, 11, and 12: Dedicated RS-485.
3. Network Interface
The S600+ includes two 10 or 100 MB/s, full-duplex Ethernet interfaces. The system firmware
provides a full TCP/IP stack implementation on this interface.
Standard supported features include:
Telnet
FTP
Socket-based Modbus communications
The S600+ supports two gateways, which are configured on NWTK1. The IP addresses of the two
network ports
must differ in the third octet:
Supported: 193.195.232.1 / 193.195.230.1
Not supported: 193.195.232.1 / 193.195.232.2
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
3
4. Modbus
Modbus is the standard interface to the S600+. The protocol is based on Gould/Modicon Modbus.
The Config600 configuration software interfaces to the S600+ using Modbus. The link uses the
special function code 65, with specially defined S600+ sub-functions to provide file transfer,
system edit commands, and other specialized functionality. The S600+ is the slave on this link.
4.1 Configuration
The system firmware supports up to 20 communications links. Links can have individual
configurations or can share common parameters or configuration.
Configuration has two parts:
Link Configuration
This step defines the data link’s port or socket, its master or slave status, and whether it uses
RTU or ASCII. You enter this information using Config600 when the link is initially assigned,
but the link configuration can be modified later if required.
Map Configuration
This step assigns database points and fields to Modbus coils, inputs, and registers using a
text file created using Config600’s map builder utilities. You can modify this map later if
required.
4.2 Master
In master mode, the device communicates with up to 10 slaves on a single-drop link. You can
configure several masters if necessary.
4.3 Slave
In slave mode, the device waits for polls from an external master and responds to polls are
requested. You can define several slaves if necessary. The slave address is configurable per link, so a
single S600+ can have several slave addresses if required.
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
4
5. RTU/ASCII Protocol
The S600+ fully supports both RTU Modbus and ACSII Modbus. A single configuration switch
enables you to select one or the other. Other communication parameters exist independently of
the ASCII/RTU switch.
RTU Mode
In RTU mode, you must configure the link for 8 data bits. No message header or trailers are
included. The checksum is the 16-bit CRC specified in the -Modbus specification.
ASCII Mode
In ASCII mode, you would normally configure the link for 7 data bits, although the S600+ also
supports 8 data bits. The message starts with the ASCII Modbus start character (the colon, or
“:”). The checksum is the 8-bit LRC defined in the Modbus specification. The message
terminates with the ASCII Modbus trailer characters CR followed by LF.
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
5
6. Implemented Modbus Functions
Implemented Modbus functions include:
Function 1: Read Output Status
Function 2: Read Input Status
Function 3: Read Output Registers
Function 4: Read Input Registers
Function 5: Write Single Coil
Function 6: Write Single Register
Function 8: Loopback
Function 15: Write Multiple Coils
Function 16: Write Multiple Registers
Function Codes 65, 66, 67, and 68
Each of these functions is described in this section.
Note
These message formats exclude the message header (ASCII only), the CRC/LRC, and message trailer
(ASCII only), since these are specific to the data transfer mode.
6.1 Function 1: Read Output Status
Function Code 01 reads the output coils (00001–09999), reading up to 2040 coils per poll in non-
extended mode.
Poll Format
Address 1 byte
Function 1 byte
Start Coil 2 bytes
Num Coils 2 bytes
Response Format
Address 1 byte
Function 1 byte
Byte Count 1 or 2 bytes
Note
: Byte count may be 8-bit or 16-bit
Data byte 1 1 byte (coils 0–7)
Data byte 2 1 byte (coils8–15)
…
Data byte N 1 byte (coils…)
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
6
6.2 Function 2: Read Input Status
Function Code 02 reads the input coils (10001–19999), reading up to 2040 coils per poll in non-
extended mode.
Poll Format
Address 1 byte
Function 1 byte
Start Input 2 bytes
Num Inputs 2 bytes
Response Format
Address 1 byte
Function 1 byte
Byte Count 1 or 2 bytes
Note
: Byte count may be 8-bit or 16-bit
Data byte 1 1 byte (inputs 0–7)
Data byte 2 1 byte (inputs 8–15)
…
Data byte N 1 byte (inputs…)
6.3 Function 3: Read Output Registers
Function Code 03 reads the output registers (40001–49999); data can be configured at every
address.
Poll Format
Address 1 byte
Function 1 byte
Start Item 2 bytes
Num Items 2 bytes
Response Format
Address 1 byte
Function 1 byte
Length 1 or 2 bytes
Note
: Length can be 8-bit byte count, 8-bit
item count; 16-bit byte count, or 16-bit item
count.
Data item 1 2, 4, or 8 bytes
Data item 2 2, 4, or 8 bytes
…
Data item N 2, 4, or 8 bytes
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
7
6.4 Function 4: Read Input Registers
Function Code 04 reads the input registers (30001–39999); data can be configured at every
address.
Poll Format
Address 1 byte
Function 1 byte
Start Item 2 bytes
Num Items 2 bytes
Response Format
Address 1 byte
Function 1 byte
Length 1 or 2 bytes
Note
: Length can be 8-bit byte count, 8-bit
item count; 16-bit byte count, or 16-bit item
count. t
Data item 1 2, 4, or 8 bytes
Data item 2 2, 4, or 8 bytes
…
Data item N 2, 4, or 8 bytes
6.5 Function 5: Write Single Coil
Function Code 05 writes a single coil, either on (1) or off (0), to any valid coil address (00001–
09999).
Poll Format
Address 1 byte
Function 1 byte
Coil Number 2 bytes
Coil Value 2 bytes
Response Format
Address 1 byte
Function 1 byte
Coil Number 2 bytes
Coil Value 2 bytes
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
8
6.6 Function 6: Write Single Register
Function Code 06 (Modicon) writes a value to a single holding register in standard Modbus format
to any valid holding register address (40001–49999).
Poll Format
Address 1 byte
Function 1 byte
Item Number 2 bytes
Value 2 bytes
Response Format
Address 1 byte
Function 1 byte
Item Number 2 bytes
Value 2 bytes
Note
The write single register function applies only to simple 16-bit registers. The float and double
formats are
not supported.
6.7 Function 8: Loopback
Function Code 08 performs a loopback test. If successful a loopback test returns the poll received.
There are no variable parameters available on this function code.
Poll Format
Address 1 byte
Function 1 byte
Value 1 2 bytes
Value 2 2 bytes
Response Format
Address 1 byte
Function 1 byte
Value 1 2 bytes
Value 2 2 bytes
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
9
6.8 Function 15: Write Multiple Coils
Function Code 15 writes multiple coils on (1) or off (2). Enter data as a string of up to 8 digits (0s
and 1s). The RHS entry represents the LSB. Data is written to any valid coil address (00001–09999).
Poll Format
Address 1 byte
Function 1 byte
Start Coil 2 bytes
Num Coils 2 bytes
Byte Count 1 or 2 bytes
Note
: Byte count may be 8-bit byte count or
16-bit byte count.
Data byte 1 1 byte (coils 0–7)
Data byte 2 1 byte (coils 8–15)
…
Data byte N 1 byte (coils….)
Response Format
Address 1 byte
Function 1 byte
Coil Number 2 bytes
Coil Value 2 bytes
6.9 Function 16: Write Multiple Registers
Function Code 16 writes to multiple registers.
Poll Format
Address 1 byte
Function 1 byte
Start Item 2 bytes
Num Items 2 bytes
Byte Count 1 or 2 bytes
Note
: Byte count may be 8-bit byte count or
16-bit byte count.
Data item 1 2, 4, or 8 bytes
Data item 2 2, 4, or 8 bytes
…
Data item N 2, 4, or 8 bytes
Response Format
Address 1 byte
Function 1 byte
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
10
Item Number 2 bytes
Num Items 2 bytes
6.10 Function Codes 65, 66, 67, and 68
These are Daniel user-defined function codes, used to read or write multiple holding registers in
IEEE single-precision format. The valid address range is 0–65535; data can be configured at every
address.
Note
The Config600 interface to the S600+ is through Modbus. In this case the link uses the special
function codes 65, 66, 67, and 68, with specially defined (S600+-specific) sub-functions to provide
file transfer, system edit commands and other specialized functionality. The S600+ is the slave on
this link.
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
11
7. Message Length Mode
Using standard Modbus, all variable length messages include an 8-bit byte count field which allows
the receiver to determine the amount of data in the message. In some applications, the use of this
field is not the actual byte count but the number of data items in the message. This variation only
applies to register messages.
Emerson has added a further extension to this (primarily for communication with the Daniel DMS
supervisory) which extends this field to a 16-bit value. This simply allows more data to be
transferred on the link.
Note
This functionality does not adhere to strict Modbus functionality.
Available message length modes are:
8-bit byte count
The message contains a single byte, which determines the number of data bytes in the
message.
8-bit item count
The message contains a single byte, which determines the number of data items in the
message.
16-bit byte count
The message contains a pair of bytes, which determines the number of data bytes in the
message.
16-bit item count
The message contains a pair of bytes, which determines the number of data items in the
message.
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
12
8. Register Formats
The Modicon Modbus Protocol Reference Guide (publication PI-MBUS-300, from Modicon, Inc.) does
not specify how numbers greater than 16 bits (that is, 32-bit integers and single- and double-
precision real numbers) should be transferred.
The Modbus protocol has 16-bit elements (“registers”) that are only suitable for transferring 16-bit
integer data. Since no standard exists, Emerson has developed that following formats to transfers
numerical data to third parties and offers these as a standard solution.
Register – Float
Register – Rosemount
Register – Double
Register – Phillips Float
Register – Phillips Double
Register – Int
Register – Long_Int
Register – Scale 0 NNNN
Register – Modicon
Addresses per item (1, 2, or 4)
Each of these registers is described in this section.
8.1 Register: Float
[FORMAT FLOAT]
[FORMAT ENRON FLOAT]
Holds registers as IEEE format single-precision floating point numbers, MSB first. For each point
required, one address is requested in the Modbus message, 4 bytes are returned, and data is
configurable at every address (40001–49999)
8.2 Register: Rosemount
[FORMAT ROSEMOUNT]
Holds registers as IEEE format single-precision floating point numbers, LSB first (used on
Rosemount DCS system). For each point required, two addresses are requested in the Modbus
message, 4 bytes are returned, and data is configurable at every other address (4000
1, 40003,
4000
5,…, 49999).
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
13
8.3 Register: Double
[FORMAT DOUBLE]
Holds registers as IEEE format double precision floating point numbers. For each point required,
one address is requested in the Modbus message, 8 bytes are returned, and data is configurable at
every address (40001 - 49999).
8.4 Register: Phillips Float
[FORMAT PHILLIPS FLOAT]
Holds registers as IEEE format single-precision numbers, MSB first. For each point required, two
addresses are requested in the Modbus message, 4 bytes are returned, and data is configurable at
alternate addresses (40001, 40003 ..... 49999).
8.5 Register: Phillips Double
[FORMAT PHILLIPS DOUBLE]
Holds registers as IEEE format double-precision numbers, MSB first. For each point required, four
addresses are requested in the Modbus message, 8 bytes are returned, and data is configurable at
every fourth addresses (40001, 40005, 40009,…, 49997)
8.6 Register: INT
[FORMAT ENRON 16-BIT]
Holds registers as 16-bit SIGNED integers, ranging from 32767 (Hex 8001) to 32767 (Hex 7FFF),
and data can be configured at every address (40001–49999)
8.7 Register: LONG_INT
[FORMAT ENRON 32-BIT]
Holds registers as SIGNED long integers. For each point required one is requested and two registers
(4 bytes) are returned in the Modbus message, and data can be configured at every address (40001,
40002,…, 49999).
8.8 Register: SCALE 0 nnnn
[FORMAT SCALE 0 999]
[FORMAT SCALE 0 4096]
[FORMAT SCALE 0 9999]
Holds registers as integers, scaled between 0 and nnnn. In master mode the value returned is
displayed in terms of the selected scaling (where
500 would represent 50% on 999 scaling or 5% on
9999 scaling), and data can be configured at every address (40001–49999).
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
14
Scaled 16-bit integer between 0…9999 (or any other integer combination), where each real is
scaled within this range based upon preconfigured zero and full scales, such that:
+
=
Scale Zero- scale Full
0.5 Range x scale) Zero- value(Actual
Trunc ValueInteger Scaled
For example, a flow rate of 300 m
3
/hr has a zero scale of 0 m
3
/hr and a full scale of 1000 m
3
/hr:
[ ]
0003 Integer Scaled
5.07.2999 Trunc
Integer Scaled
1000
0.5 9999 x
0)
-
(300
Trunc Integer Scaled
=
+=
+
=
The supervisory system would then send 3000 to represent the flow rate of 300 m3/hr if the
integer range was 0–999.
8.9 Register: Modicon
[FORMAT ENRON 16-BIT]
Holds registers as integers (16-bit, valid data 0 - 65535) using Modbus formatting and writes to any
valid holding register (40001–49999)
FloBoss S600+ Flow Computer Modbus Specification Manual
D301904X012
January 2021
15
9. Enron Functions
The Enron Modbus protocol has been implemented as part of the Modbus slave application and is
based on the Specifications and Requirements for an Electronic Flow Measurement Remote Terminal
Unit (07-18-1990, Revised 12-05-1994, Enron Corp.)
9.1 Enron Modbus Map
Detailed below are the data areas defined in the Modbus specification. The S600+ Modbus map
builder generates a map which corresponds to this format. Although not recommended, you can
change these settings when you generate the map or by editing the Modbus configuration file.
Coil data (accessed using Modbus function 1, 5 and 15)
Address Descriptions
0032 Event log Clear command
1000 Boolean variables
Input data: accessed using Modbus function 2
1000 Boolean variables
Input data: accessed using Modbus functions 3, 4, and 16
0032 Event/Alarm log register (see following sections)
0701…0720 Report log configuration registers (see following sections)
0721…0740 Report log data registers (see following sections)
3000 Short integer variable
5000 Long integer variables (not used on S600+)
7000 Floating point variables
9.2 Special Enron Functions for Events
The Enron implementation provides a special set of registers and coils that allow transfer of alarm
and event log data to a supervisory computer.
9.2.1 Clear/Acknowledge Modbus Event Log
The normal base address for this data is 32. A coil write with the data value set to this address clears
the event log. A coil write to this address with the data value clear acknowledges the event log.
9.2.2 Event Count Register
The normal base address for this value is 7001. It returns as a floating point value. A register read
from this address returns the number of events available for collection.
/
