4.8.2 Protocol : Modbus-IDA, Network


 

Telegram structure

The telegram circulation is controlled by the master station, i.e. RTU only replies on inquiry. The analysis of the values in the telegram in monitoring direction is only possible concerning the command/ inquiry sent before in control direction.

 

Information about the structure of the telegram and ethernet frames see
<MODBUS Network : Telegram structure of MODBUS NET-mode>

 


MODBUS Network : Configuration

The PC must be connected to the network hub or switch before LIAN 98 will be started, otherwise parametrization of the network in LIAN can not be done.

 

 

With the channel button ( channel 1 ...12 ) on the bottom following settings are possible :

 

Local machine

 

Network adapter

If there are several network adapters in the PC the corresponding adapter to be tested has to be selected here.

Network protocol

Here the suitable protocol ( e.g. TCP/IP ) for the test must be selected.

Host Name

The name of the PC declared during the network installation is displayed here. It can be set via the network settings in the Windows system control. ( No input is possible, it is only a display field ! )

IP address

The IP-address allocated to the network adapter is displayed here. It can be set via the network settings in the Windows system control. ( No input is possible, it is only a display field ! )

If no IP address is displayed when opening the register card, the network is not correctly installed in Windows or the connection to the network hub or switch does not exist.

Port number

When LIAN 98 is used as client ( RTI simulation ) the port number = 0 must be entered. During the establishment of the client connection a free port address will be allocated to LIAN 98 automatically.
When LIAN 98 is used as server ( RTU simulation ) the port number = 502 must be set.

 

Remote machine

 

Port number

When LIAN 98 is used as client ( master simulation ) the port number of the station to be tested must be entered. Normally it is the port number = 502.
When LIAN 98 is used as server ( slave simulation ) the port number is not relevant.

 

Receiving/ Capture

 

Time out

Recommendation : 100 msec
LIAN 98 waits this time until it will continue processing all network packets received in this time. Also the end of the transmission is detected with the timeout.

 


MODBUS Network : Simulation

 

MODBUS Network : RTI ( Client/ Master )-Simulation

 

LIAN 98 is simulating a CLIENT ( master ) and can communicate with up to 32 connected servers simultaneously. Assuming that these servers have different IP addresses.

 

 

Unit Identifier
( address of the target server )

All telegrams to be sent are provided with the station address of the SIM list during master simulation.

Exception :
. If the station address 255 is inserted in a telegram of the TDB buffer, the telegram will be transmitted with the address = 0 ( "BROADCAST message to all server" ).
. If a server address of the server list is inserted in the telegram it will be transmitted unchanged with this inserted address.

IP Adresse
( target = server )

This is the IP address of the default server with which one will test mostly.

t0
Connection establishment

[ sec ] Network connection establishment timeout
Timeout for the establishment of the connection with the server.

t1
Response Timeout

[ sec ] Response timeout
This parameter defines the time in seconds that LIAN 98 waits maximum for an acknowledge from the server.

Number of frame retries

0 - 255

Via this parameter it is defined how many times the transmission is to be repeated when the response is missing.

Maximum number of
"Client transactions"

1 ( fixed )

 

Test with a connected router

yes / no

If the parameter is activated, it is assumed that all stations are connected through a router and therefore all have the same IP address. ( Modbus NET -> Modbus RTU seriell )

Insert server addresses
number of addresses
delete
insert

Multi-Server operation :
All servers ( max. 32 stations ) to be processed by LIAN 98 must be inserted in the server list. LIAN 98 will make a connection to all this servers during the master simulation.

In order to insert the addresses please proceed as follows :

"Activate "Insert server addresses" ( button "insert" will be displayed ).
Insert in the fields "Unit Identifier" / "IP Address" the station to be entered in the server list.
Take over the addresses into the server list by clicking "insert".
When all stations are inserted, please deactivate "insert server addresses" ( button "insert" disappears ).

In order to delete a station out of this list select it and click "delete".

Disable automatic data requests

yes / no

When the RTI simulation is activated, LIAN 98 starts automatically with the request of the user data. If this requests are not wanted it can be deactivated here.

Data reqest ( TDBnum from )

Number of the TDB buffer containing the first request message.

Data reqest ( TDBnum till )

Number of the TDB buffer containing the last request message.

If this buffer number ( e.g. equal 0 ) smaller than the number of the TDB buffer "from", only the request telegram in the field "from " is used.

Request delay

0 - 30 000 msec

This parameter determines the time that the program LIAN 98 delays the next request.

 

MODBUS Network : RTU ( Server/ Slave )-Simulation

 

LIAN 98 is working as server ( sub-station ) and can provide 8 connected CLIENTS ( master ) simultaneously.

 

 

Unit Identifier/ Station Address
( address of the source server )

All telegrams to be sent will be provided with the station address out of the SIM list during slave simulation.

t0
Connection establishment

[ sec ]
Only important for the client !

Maximum number of
"Server transactions"

1 ( fixed )

 

Initialize Process Image

yes / no

 


MODBUS Network : Monitoring ( Capture network communication )

LIAN 98 records all MODBUS network data packets of an ethernet, provided the data are available on the LAN interface of the PC running LIAN 98. This means that the PC has to be connected directly to the same network hub as the MODBUS network client ( master ) without using a switch or router.

If a SCADA software is running under a Windows® Operating System, it is also possible to use LIAN 98 on the same computer simultaneously to monitor the network packets which are coming in and going out from this PC without an additional connection to the network hub or switch.

 

 

Ethernet type

0800H ( fixed )
This field indicates the type of the MAC clients protocols. The internet protocol ( IP ) is used for protocol Modbus NET.
( No input is possible, it is only a display field ! )

IP version

4 ( fixed )
This field indicates the format of the IP Headers. Version = 4 ( IPv4 ) is used for protocol Modbus NET.
( No input is possible, it is only a display field ! )

Protocol

6 ( fixed )
This field indicates the protocol of the next level that is used in the data section of the internet datagram.
The transmission control protocol ( TCP ) is used for protocol Modbus NET
( No input is possible, it is only a display field ! )

IPADDR Client

IP address of a Modbus NET-Client ( Master station ). The network traffic between this client and the server(s) will be recorded. The required stations must be indicated in the server list and the PC must be connected with the client over the same network hub.

IP address server
( input field )

Use this field to enter the IP addresses of the servers in the server list.
When the server list is empty all server connections will be captured.

Port number server
( input field )

Use this field to enter the port numbers of servers in the server list.
( Port = 502 is normally used for Modbus NET )

Insert server addresses
number of addresses
delete
insert

Each particular server to be captured must be inserted in the server list. LIAN 98 will use this list to prefilter the network traffic.If no server address is inserted all IP addresses will be captured.

In order to insert the addresses please proceed as follows :

Activate "Insert server addresses" ( button "insert" will be displayed ).
Enter the IP address and port number to be inserted in the fields "IP address server" / "Port number server". Take over the addresses in the server list with "insert". When all stations are inserted deactivate "Insert server addresses". ( The button "insert" disappears ).

In order to delete a server out of this list select it and click "delete".

 

The screen shot above shows the user data of the transmission blocks. Also, if it is required the particulare network headers ( MAC-, IP-, TCP header ) can be displayed. The output format is set via the FMT file - Display format. The headecimal values can be suppressed separately, of course.

The direction of the transmission can be recognized by LIAN 98. A green status line shows the direction client to server and a yellow status line the direction server to client. A status line without any additional data is only a header transmission which is necessary in order to manage the network transfer.

 

Information to the structure of the telegram- and ethernet frame.
MODBUS Network : Ethernet frame

 

MODBUS Network : Routing table

 

 

 

Enable router

yes / no

When this parameter is activated, the LIAN 98 starts the "Modbus NET Server" with router function for the associated channel and waits for the establishment of the connection with the client. The assignment to the channel is set in the configuration ( KNF ) over the parameter "simulation list".
( see : MODBUS Network : RTU ( Server/ Slave )-Simulation )

Message format

With this parameter the telegram format of the connected substation is selected ( Modbus RTU-Mode serial ).

Insert routing addresses
Number of adresses
delete
insert

All connected substations which should be taken into account from the LIAN 98 router have to be entered into the station list.

In order to insert the addresses please proceed as follows :

activate "insert routing addresses" ( button "insert" is displayed ).
Insert in the fields "Station Address" / "Channel number" the station to be entered. Take over the address by clicking "insert". When all stations are inserted please deactivate "Insert routing addresses" ( button "insert" disappears ).

In order to delete one or more stations out of this list select it and click "delete".

 


MODBUS Network : Pre-filter/ Pre-trigger

 

MODBUS Network : Monitoring filters

 

Monitoring filters reduce capture on particular pre-defined data records. By setting the corresponding filters a carefully directed data preselection can be achieved, which results in a reduction of the data to be analyzed later.

 

 

Filter released

yes / no

With this option monitoring filters already set for one channel can be deactivated temporarily without deleting them.

protocol specific filter mask

Here monitoring can be filtered for telegram specific values in which several OR-linked filter masks can be defined for the channel.

= Only values equal to 'from' are let through.
# Only values not equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
b 'from' and 'till' define a valid range
add Add the next OR-element.
remove Remove the current OR-element.

 

MODBUS Network : Action filters

 

For the simulation and execution of data tests actions can be caused with the receipt of defined records. Therefore the possibility exists to define action filters, that effect the transmission of a send-sequence or transmit one or more message buffers ( TDB ).

 

 

Action filter released

yes / no

With this option action filters already set for one channel can be deactivated temporarily without deleting them.

protocol specific
filter mask

The action filter is described over telegram specific features corresponding to a filter setting. Additionally each action filter requires an allocation to a send buffer or alternatively to a send sequence.

= Only values equal to 'from' are let through.
# Only values not equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
b 'from' and 'till' define a valid range
Sendbuffer number
( from, from/ till )

In correspondence with the action filter the message buffer "from" or the message buffers "from/ till" are to be sent.

Sequence line number
( from, from/ till )

In correspondence with the action filter the send sequence is to be started at line number "from" or to be started at line number "from" and to be ended at line number "till".

add Adds the next OR-element.
remove Removes the current OR-element.

 

MODBUS Network : Start trigger

 

With the receipt of a telegram pre-defined as start trigger, recording is started.

 

 

Start trigger released

yes / no

With this option start triggers already set for one channel can be deactivated temporarily without deleting them.

protocol specific
trigger mask

Here you can define telegram specific start triggers for monitoring in which several OR-linked triggers can be defined for the channel.

= Only values equal to 'from' are let through.
# Only values equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
b 'from' and 'till' define a valid range
add Adds the next OR-element.
remove Removes the current OR-element.

 

MODBUS Network : Stop trigger

 

Monitoring can also be stopped by telegram-specific filters and/ or "stop on error" after a defined number of following records. The number of the following records is defined in the field "records after stop on error/ stop trigger" in the global parameters of the VFL settings.

 

 

Stop trigger released

yes / no

With this option stop triggers already set for one channel can be deactivated temporarily without deleting them.

protocol specific
trigger mask

Here you can define telegram specific stop triggers for monitoring in which several OR-linked triggers can be defined for the channel.

= Only values equal to 'from' are let through.
# Only values not equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
b 'from' and 'till' define a valid range
add Adds the next OR-element.
remove Removes the current OR-element.

 


Each alteration in the settings is displayed by an asterisk * in the caption title and will be only effective after saving.

 


MODBUS Network : Message display format

 

The sent and received messages of all channels are entered binary into the archive file. Before displaying on screen, the binary archived data are coverted to an easily readable procedure specific plaintext. In order to optimize the representation it can be chosen between five different plaintext settings. The plaintext format is set separately for each channel.
( see also "FMT file - Display format" )

 

 

Plain text format 1

Everything is displayed : Telegram header and information elements

Plain text format 2, 3

No header is displayed : Only information elements are displayed.

Plain text format 4, 5

No information element is displayed : Only telegram header is displayed.

 

Additional to the plain text output the transmission data can also be displayed in hexadecimal, decimal, ASCII, binary ( LSB first ) or binary ( MSB first ). Of course the plain text output can also be deactivated in order to display the transmission data only e.g. hexadecimal.

 


MODBUS Network : Error messages

 

Error checks during receive

 

per frame

length and function code

 

*E: NETWORK !

Error during writing on the network, system error e.g. socket failure. 

*E: NET PACKET !

The captured length is not equal to the packet length.

*E: MAC HEADER !

The length of the MAC Header is incorrect or the data packet is not be interpretable.

*E: IPv4 HEADER !

The length of the IPv4 header is incorrect.

*E: TCP HEADER !

The length of the TCP header is incorrect.

 

 

*E: Length !

The length of the user data is not equal to the length of the ADU ( Application Data Unit ). The length of the MAC, IP or TCP header could also be incorrect.

*F: SYNC !

The protocol MODBUS provides no start byte for the identification of the telegram start. Therefore the receive routine checks the MBAP header on plausibility. When this plausibility check fails, a synchronization error is noted and the telegram is entered into the PRO File.

*E: TypeID !

The function code in the telegram is wrong.

 

Error checks during simulation

 

*E: Link address !

The received server address is incorrect or the entry in the SIM list is wrong.

*E: unexpected !

The respond at this time was not expected.

*E: Sequence !

The received "Transaction Identifier" ( send sequence number ) is wrong or a message is missing.

 


MODBUS Network : Parameter list

 

MODBUS Network : Data Model

 

 

 

Total length of the Process Image

maximum 64 kByte ( 0000... FFFF ) = 65536 bytes

 

 

 

Starting address of Coils

0... 65535

 

Length of Image for Coils

maximum 16 kByte

 

Starting address of Discrete Inputs

0... 65535

 

Length of Image for Discrete Inputs

maximum 16 kByte

 

Starting address of Holding Registers

0... 65535

 

Length of Image for Holding Registers

maximum 16 kByte

 

Starting address of Input Registers

0... 65535

 

Length of Image for Input Registers

maximum 16 kByte

 

 

MODBUS Network : Process Image

 

 

Setup Image for Coils and Diskrete Inputs

 

 

Setup Image for Holding- and Input Registers

 

 

 


MAYR Software

Wuerzburger Ring 39,  D 91056 Erlangen

Manual LIAN 98


LIAN 98 Protocol Router, Simulator and Analyzer
© Copyright 2001, 2006, 2011 by Werner Mayr. All Rights reserved.