DL3500-DH+/MODBUS
COMMUNICATION CONTROLLER APPLICATION NOTE

The DL3500 can be configured as a Modbus network "Master". In this mode it enables SLC’s and other devices on a DH+ network to initiate various commands to read and write coils, inputs and registers of slave devices on a Modbus network. The Modbus interface can be set for RS232 or RS422/RS485. Typical DH+ stations that can communicate with Modbus via the DL3500 include devices such as PLC3s, PLC5s, SLC5/04s, PCs, HMIs and other intelligent OEM devices. (Now referred to as PLC’s in this document)
Communication between Modbus and the DL3500 must be initiated from a DH+ PLC.

The DL3500 must be the only Master on the Modbus network and does not require a Modbus address. The DL3500 is an active station on DH+ and requires a unique DH+ station address number. The DL3500 can accept PLC3 Word Range Read/Write or PLC5 Typed Read/Write message commands from any station on the DH+ network.

The Destination Data Table Address or TAG is normally used to address a specific File and Word in another PLC on the network. This address is interpreted by the DL3500 in a specific way and permits data to be mapped from a PLC and a Modbus slave device. This allows the PLC programmer to directly address a specific register in a Modbus slave device without any previous configuration being necessary in the DL3500.

In the configuration software the type of PLC used is selected. See below.
Destination (Target) Data Table Address Decoding Options for Allan-Bradley PLC5 Type commands (Used by SLC’s and PLC’s):

PLC’s and SLC’s - (NXYY:Z)

Use this format if the SLC, PLC, or other device allows up to 999:9999 to be entered for the file:word.
•   X – Registers or Coils
•   0 = 0X, 1 = 1X, 3 = 3X, 4 = 4X
•   YY – Slave address
•   1 to 99
•   Z – Register address
•   1 to 9999
Example: N41:3036 will access register 43036 from Modbus Slave address 1.

SLC’s - (NXYZ:Z)
Use this format if the SLC, PLC, or other device allows up to 999:999 to be entered for the file:word.

•   X – Registers or Coils
•   0 = 0X, 1 = 1X, 3 = 3X, 4 = 4X
•   Y – Slave address
•   1 to 9
•   Z:Z – Register address
•   Z before the colon ‘:’ – Thousands digit
•   0 to 9
•   Z after the colon ‘:’ – Ones to Hundreds digits
•  0 to 999

Example: N413:36 will access register 43036 from Modbus Slave address 1.
NOTE: Z:Z cannot equal 0:0. The minimum value for Z:Z is 0:1.

MicroLogix’s and SLC’s - (NYXZ:Z)
Use this format if the SLC, PLC, or other device allows up to 255:255 to be entered for the file:word.

•   Y – Slave address
•   0 = slave address 1, 1 = slave address 2, 2 = slave address 3
•   X – Registers or Coils
•   0 = 0X, 1 = 1X, 3 = 3X, 4 = 4X
•   Z:Z – Register address
•   Z before the colon ‘:’ – Thousands digit
•   0 to 9
•   Z after the colon ‘:’ – Ones to Hundreds digits
•   0 to 255

Example: N43:36 will access register 43036 from Modbus Slave address 1.

NOTES:
1. Z:Z cannot equal 0:0. The minimum value for Z:Z is 0:1.
2. Slave address 3 cannot access registers or coils above 5255.

For more information about using PLC-5 Typed Commands with the decoding formats shown above, refer to section 1.2.4 of this manual.

If a PLC is being used to generate messages for the DL3500 to convert and send to a Modbus network, values are entered into the Destination Data Table Address of the PLC’s DH+ Message Command in the format below. MMI’s and other applications would have a similar destination address structure for reading and writing data to and from a PLC (refer to your OEM application documentation).

When a PLC is communicating with other devices over the DH+ network, the destination data table address (DDTA) has different meanings depending on whether it is communicating with another PLC or if it is communicating with a DL3500 Modbus Master. Below are descriptions of the different meanings for the DDTA.

The usual format of the destination data table address (DDTA) is:     T F : e
T, F, and e are explained below.


Communicating with another PLC on the DH+ network
•   T = File Type     (O = output, I = input, B = binary, N = integer, etc.)
•   F = File Number     (0 - 63, 0-255, 0 - 999, or 0 - 9999) *
•   e = Word Number     (0 - 255, 0 - 999 or 0 – 9999) *


Communicating with a DL3500 Modbus Master on the DH+ network using PLC-3 commands
Data and Control Functions
•   T = Modbus Command (B, N, S, F)
•   F = Modbus Slave Address (1 - 255)
•   e = Modbus Coil/Register (1 - 9999)Diagnostic Functions (Dxyyy:zzzz)
•   T = Modbus Command (D)
•   F = Sub-function Command / Slave Address (xyyy)
•   e = Sub-function Command / Data (zzzz)

For more details about mapping the data and control functions and the diagnostic functions using PLC-3 commands, see section 1.2.3


Communicating with a DL3500 Modbus Master on the DH+ network using PLC-5 commands Data and Control Functions (includes Diagnostic Function)
•   T = Not used **
•   F = PLC-5 Decoding Format (NXYY:Z, NXYZ:Z, or NYXZ:Z Format)
•   e = PLC-5 Decoding Format (NXYY:Z, NXYZ:Z, or NYXZ:Z Format)

For more details about mapping the data and control functions and the diagnostic functions using PLC-5 commands, see sections 1.1 and 1.2.4
* Depends on PLC type.
** To avoid errors when downloading your program to the PLC, a file type is needed so that a legal format for the DDTA is used.



The DL3500-DH+ set to Modbus Master Mode can generate Modbus protocol functions on receipt of the following DH+ message commands:
•   PLC-3 Word Range Read or Word Range Write Commands
•   PLC-5 Typed Read or Typed Write Commands
•   PLC-5 Word Range Read and Writes

A-B PLCs can generate the following commands:

•   SLC’s PLC-5 Typed Read/Write Commands
•   PLC-3 PLC-3 Word Range Read/Write Commands
•   PLC-5 PLC-3 Word Range Read/Write Commands and PLC-5 Typed Read/Write Commands

The Modbus commands and addresses that can be generated depend on the specific DH+ message command received. The DL3500-DH+ in Master Mode is designed to work with DH+ message commands including PLC-5 Typed Read and Write and PLC-3 Word Range Read and Write. Use the PLC-3 Word Range Read and Write commands whenever possible because the larger address field of these commands provides the additional flexibility necessary to generate the full range of Modbus commands and addresses.


MODBUS DATA AND CONTROL COMMANDS USING PLC-3 WORD RANGE READ / WRITE COMMANDS
On receiving a PLC-3 Word Range Read or Word Range Write Message Command (MC) a DL3500 Modbus Master decodes the command’s Destination Data Table Address (DDTA) File type (character). Then, dependent on whether the DH+ message is a read or a write it can generate the appropriate Modbus command as shown in the table below.

Note:
For Modbus command 05, set the first word of data in the PLC data table to FF00 (hex) to turn the coil ON and 0000 to turn the coil OFF.

MODBUS DIAGNOSTIC COMMANDS USING PLC-3 WORD RANGE R/W COMMANDS





MODBUS DATA AND CONTROL COMMANDS USING PLC-5 TYPED READ / WRITE COMMANDS

On receiving a PLC-5 Typed Read or Word Range Write Message Command (MC) a DL3500-DH+ Modbus Master decodes the command’s Destination Data Table Address (DDTA) File type (character). Then, depending on whether the DH+ message is a read or a write command, it can generate the appropriate Modbus command as shown below.

Use this format if the SLC, PLC, or other device allows up to 999:9999 to be entered for the file:word. This format allows access to all Modbus registers and coils for slaves 1 to 99.
Note:   Leading zeros in the Destination Data Table Address can be left out.

Use this format if the SLC, PLC, or other device allows up to 999:999 to be entered for the file:word. This format allows access to all Modbus registers and coils for slaves 1 to 9.
Note:  
1.  Leading zeros in the Destination Data Table Address can be left out.
2.  Register/Coil Address
•   Z before the colon ‘:’ – Thousands digit
•   Z after the colon ‘:’ – Ones to Hundreds digits

Use this format if the SLC, PLC, or other device allows up to 255:255 to be entered for the file:word. This format allows access to certain Modbus registers and coils for slaves 1 to 3.
Note:  
1. Leading zeros in the Destination Data Table Address can be left out.
2. Register/Coil Address

•   Z before the colon ‘:’ – Thousands digit
•   Z after the colon ‘:’ – Ones to Hundreds digits
•   Register and coil addresses range from 1-255, 1000-1255, 2000-2255, etc.
3. Slave Address
•   0 = slave address 1, 1 = slave address 2, 2 = slave address 3 4. Slave address 3 cannot access registers or coils above 5255.

When using PLC-5 Typed Read / Write commands, the Diagnostic commands have the following PLC-3 address format :




A-B’s DH+ network does not typically support Broadcast. However, using a PLC message command with the Destination Data Table Address containing a File Address of 0 in the write commands specified in sections 1.3.1 and 1.3.2 above will generate a Modbus Broadcast command to all Modbus Slave stations. The DL3500-DH+ will not get an “ACK” response to a Broadcast command from any Modbus slave device.
Note:   This is not supported for section 1.2.4.3 PLC-5 Typed commands using the NYXZ:Z decode option.



Below are some examples for writing the destination data table address using the formats discussed in this manual. These examples are to aid the programmer in setting up an Allan-Bradley PLC, SLC, or other device on the DH+ network as a Modbus master. These examples only show the destination data table address and do not show the source data table address.




Examples
1. Integer - Writing to Modicon registers 40001 to 40010 in slave 5
2. Integer - Reading from Modicon registers 32201 to 32205 in slave 21
3. Binary - Writing to Modicon coil 00010 in slave 3
4. Binary - Writing to Modicon coils 00021 to 00036 in slave 6
5. Binary - Reading from Modicon coils 10101 to 10132 in slave 15

Note :
When mapping binary files using Modbus commands 01, 02, and 15, the DL3500 Modbus Master maps 16 consecutive coils for every 1 element. Therefore 2 elements will map 32 consecutive coils.



Examples
1. Integer - Writing to Modicon registers 40001 to 40010 in slave 5
2. Integer - Reading from Modicon registers 32201 to 32205 in slave 21
3. Binary - Writing to Modicon coil 00010 in slave 3
4. Binary - Writing to Modicon coils 00021 to 00036 in slave 6
5. Binary - Reading from Modicon coils 10101 to 10132 in slave 15

Note :
When mapping binary files using Modbus commands 01, 02, and 15, the DL3500 Modbus Master maps 16 consecutive coils for every 1 element. Therefore 2 elements will map 32 consecutive coils.


Examples
1. Integer - Writing to Modicon registers 40001 to 40010 in slave 5
2. Integer - Reading from Modicon registers 32201 to 32205 in slave 21
3. Binary - Writing to Modicon coil 00010 in slave 3
4. Binary - Writing to Modicon coils 00021 to 00036 in slave 6
5. Binary - Reading from Modicon coils 10101 to 10132 in slave 15


Note :
When mapping binary files using Modbus commands 01, 02, and 15, the DL3500 Modbus Master maps 16 consecutive coils for every 1 element. Therefore 2 elements will map 32 consecutive coils.


Examples
1. Integer - Writing to Modicon registers 40001 to 40010 in slave 5
2. Integer - Reading from Modicon registers 32201 to 32205 in slave 21
3. Binary - Writing to Modicon coil 00010 in slave 3
4. Binary - Writing to Modicon coils 00021 to 00036 in slave 6
5. Binary - Reading from Modicon coils 10101 to 10132 in slave 15


Note :
When mapping binary files using Modbus commands 01, 02, and 15, the DL3500 Modbus Master maps 16 consecutive coils for every 1 element. Therefore 2 elements will map 32 consecutive coils.