GEI-100696E

WorkstationST Modbus® Feature

Instruction Guide
These instructions do not purport to cover all details or variations in equipment, nor to provide for every possible
contingency to be met during installation, operation, and maintenance. The information is supplied for informational
purposes only, and GE makes no warranty as to the accuracy of the information included herein. Changes, modifications,
and/or improvements to equipment and specifications are made periodically and these changes may or may not be reflected
herein. It is understood that GE may make changes, modifications, or improvements to the equipment referenced herein or to
the document itself at any time. This document is intended for trained personnel familiar with the GE products referenced
herein.
This document is approved for public disclosure.
GE may have patents or pending patent applications covering subject matter in this document. The furnishing of this
document does not provide any license whatsoever to any of these patents.
GE provides the following document and the information included therein as is and without warranty of any kind, expressed
or implied, including but not limited to any implied statutory warranty of merchantability or fitness for particular purpose.
For further assistance or technical information, contact the nearest GE Sales or Service Office, or an authorized GE Sales
Representative.

Revised: Jul 2014

Issued: Dec 2007

Copyright © 2007 - 2014 General Electric Company, All rights reserved.

___________________________________
* Indicates a trademark of General Electric Company and/or its subsidiaries.
All other trademarks are the property of their respective owners.

We would appreciate your feedback about our documentation.

Please send comments or suggestions to controls.doc@ge.com

For public disclosure

 Document Updates
Document Date Update Description
GEI-100696E July 2013 New format Create a pdf in the new format.

2 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Contents
1 Overview ....................................................................................................................................................4
2 Configuration...............................................................................................................................................5
2.1 Enable the Modbus Feature.......................................................................................................................7
2.2 Configure the Modbus Feature ..................................................................................................................9
2.3 Modbus Properties ................................................................................................................................ 15
2.4 Hardware Interface Properties ................................................................................................................. 18
2.5 Master Message Properties ..................................................................................................................... 19
2.6 Slave Properties.................................................................................................................................... 20
2.7 Data Structure Properties........................................................................................................................ 20
2.8 Scaling ............................................................................................................................................... 21
2.9 Spare Values ........................................................................................................................................ 24
2.10 Importing or Exporting .csv Files ........................................................................................................... 25
2.11 Error/Warning Messages....................................................................................................................... 26
3 Runtime.................................................................................................................................................... 31
3.1 WorkstationST Status of Features............................................................................................................. 31
3.2 WorkstationST Additional Status.............................................................................................................. 33
3.3 Tracing ............................................................................................................................................... 39
3.4 Ethernet Messages ................................................................................................................................ 41
3.5 Serial Messages .................................................................................................................................... 42
3.6 Modbus Protocol Quick Reference ........................................................................................................... 43
3.7 Slave Exception Response Format............................................................................................................ 43
3.8 Monitoring Live Values.......................................................................................................................... 44
4 Troubleshooting ......................................................................................................................................... 45
4.1 Slave Exception Responses..................................................................................................................... 45
5 Terms ....................................................................................................................................................... 47

Instruction Guide GEI-100696E 3

For public disclosure
1 Overview
The ToolboxST* application allows you to configure the Modbus® feature that runs in a
workstation configured with the WorkstationST* application (WorkstationST computer).
Modbus is an application layer messaging protocol for client/server communication
between components connected on different types of busses or networks. The
WorkstationST application supports both serial and Ethernet communication, and can
operate as both a Master and a Slave. It is possible to have serial and Ethernet Masters
and Slaves all running at the same time, within the limits of the computer used.

4 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
2 Configuration
When the Modbus item in the component Tree View is selected, the properties that
display in the Property View apply to all connections. When the Modbus item is
expanded, Master and Slave items display. These are organizational categories with no
configuration properties. When you insert a hardware interface into either a Master or a
Slave, several configuration properties display in the Property Editor. One or more Slaves
may be inserted under each hardware interface. Slave definitions consist of four types of
data structures:

• Holding Registers
• Holding Coils
• Input Registers
• Input Coils
The Slave data structures represent different data depending on whether the Slave
definition being configured is under the Masters or the Slaves item in the Modbus Tree
View. A Slave definition under the Slaves item is the WorkstationST Modbus data
structure sent to the remote Master. A Slave definition under the Masters item reflects a
local copy of the remote Slave data that is mapped to ToolboxST variables. Each Slave
under the Masters item also contains configuration properties for each Modbus message
to be sent by the Master, including the rate at which the messages are sent.

Modbus Data Flow

Instruction Guide GEI-100696E 5

For public disclosure
 Modbus Slaves are configured in two steps:

• Creating the Modbus data structures, which comprise the memory map (address and
datatype) of every message to be sent or received by Modbus.
• Attaching each Modbus data point to a ToolboxST variable, which is then used to
transfer data to or from the corresponding Modbus data point.
Each data structure contains Modbus data points that are created by connecting a
ToolboxST variable to a Modbus address in one of the data structures. Each Modbus data
point is configured with an address and a data type to be sent or received over Modbus.
When the WorkstationST computer is operating as a Master, the data structure to be
configured is determined by the remote Slave component. This means that the user must
know the details of the remote Slave component to configure the WorkstationST
computer's Master data structure.
When the WorkstationST computer is operating as a Slave, the data structure to be
configured is primarily determined by the WorkstationST application. Any address and
datatype can be assigned. However, in this case, you must also communicate with the
remote Master to determine if any special addressing or data types are required. Once the
data structures are determined, the Modbus data points are connected to the ToolboxST
variables.
Once the Slave definitions are configured, the Modbus Master Messages must be
configured for each Slave under the Masters item. These messages determine the values
to be read from, or written to the Slave, and at what frequency.

6 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.1 Enable the Modbus Feature
� To enable the Modbus feature
1. From either the System Editor Tree View or the Summary View, doubleclick
the WorkstationST component. The WorkstationST Component Editor
displays.

Note The EGD Configuration Server must be set to True in one of the configured
WorkstationST computers (it does not have to be the WorkstationST computer with
Modbus enabled).

Instruction Guide GEI-100696E 7

For public disclosure
 2. From the Tree View, select Network Adapter 0.

8 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.2 Configure the Modbus Feature

Note Modifying the Modbus configuration results in a minor difference in the

configuration, however, removal of all Modbus points will result in a major difference
forcing an offline load.

� To configure a Modbus Master

1. From the Modbus tab, right-click the Masters item, then select Insert New HW
Interface.

Instruction Guide GEI-100696E 9

For public disclosure
 2. From the Tree View, right-click the interface you inserted, and select Insert New
Modbus Slave.

3. From the Tree View, select the Slave you inserted. From the Summary View,
Holding Registers and Input Registers tabs, add variables. From the Holding
Coils and Input Coils tabs, enter Boolean variables.

Note Many vendors refer to Coil/Register Numbers without including the Table Name,
because it is implied by the numbers they use.

The following table displays how vendors’ Coil/Register Numbers correspond to

WorkstationST Table Names and Addresses:

Vendor's Coil/Register Table Name in Address in WorkstationST Access

Numbers WorkstationST configuration
configuration
0001 - 9999 Holding Coils 0001 - 9999 Read-Write

10001 - 19999 Input Coils 0001 - 9999 Read-Only

30001 - 39999 Input Registers 0001 - 9999 Read-Only

40001 - 49999 Holding Registers 0001 - 9999 Read-Write

Modbus protocol uses Function Code 3 to read Holding Registers, whose vendor numbers
start with a 4, and Function Code 4 to read Input Registers, whose vendor numbers start
with a 3.

10 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Note When you connect a Modbus variable, the data type defaults to the data type of the
variable that was connected. Some data types use more than one register. (Refer to the
section, Data Types.) If you want the data type to be different than the variable that was
connected, it is recommended that you change the data type before connecting the next
variable. This is because the program reserves as many registers as needed for that data
type and changing the data type later could leave you with either holes or overlapping
registers. For example, variables A and B are LREALs in the system, but you want to send
them over Modbus as REALs. Variable A would be put at address 00001 and variable B at
address 00005 unless you changed A’s data type to a REAL before connecting B.

Instruction Guide GEI-100696E 11

For public disclosure
 The Property Editor Message Settings are as follows:
Function Code is the function code used for this message.
Number of Registers is the number of registers or coils read or written for this message.
Period Multiplier is the number multiplied by the Master Message Base Period to
configure how frequently this message is sent.
Start Address is the start address for this message. Depending on which Function Code
was set, this refers to either a coil or register number.

Note The lowest start number is one.

12 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 � To configure a Modbus Slave
1. From the Modbus tab, right-click Slaves, then select Insert New HW Interface.
2. From the Property Editor, select the Interface Type (Ethernet or Serial)
configured for the master. If you are using Ethernet, select the IP Address of your
computer.

Instruction Guide GEI-100696E 13

For public disclosure
 3. From the Tree View, right-click the new interface you inserted, then select Insert
New Modbus Slave.

4. From the Tree View, select the Slave you inserted. From the Summary View, add
variables to the Holding Registers and Input Registers tabs. Enter Boolean
variables to the Holding Coils and Input Coils tabs.

14 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.3 Modbus Properties

Instruction Guide GEI-100696E 15

For public disclosure
 Modbus Properties
Property Lower/Upper Description
Limits or Allowed
Values
Big Endian for Data True/False If set to True (default), all data in the body of the Modbus message is
On Modbus converted to Big Endian before being placed on Modbus. It is assumed that
all data in the body of a received message is Big Endian, and if required by
the local computer, is converted to Little Endian before being used locally.

Big Endian For MBAP True/False If set to True (default), the fields in the Modbus Application Protocol Header
(Tcp Hdr) MBAP are converted to Big Endian before being placed on Modbus. It is
assumed that in received messages, these fields are in Big Endian, and if
required by the local computer, are converted to Little Endian before being
used locally.

Swap Words For True/False All Dint data types are 32 bits. If set to True, the words are swapped before
Dints being sent over Modbus, and before being used when read from Modbus.
For example,

32 bits Data 0x01234567

Transmits 0x45, 0x67, 0x01 and 0x23

Swap Words For True/False All LReal data types are 64 bits. If set to True, the words are swapped
LReals before being sent over Modbus, and before being used when read from
Modbus. For example,

64 bits Data 0x0123456789ABCDEF

Transmits 0x45, 0x67, 0x01, 0x23, 0xCD, 0xEF, 0x89 and 0xAB
Swap Words For True/False All Real data types are 32 bits. If set to True, the words are swapped before
Reals being sent over Modbus, and before being used when read from Modbus.
For example,

32 bits Data 0x01234567

Transmits 0x45, 0x67, 0x01 and 0x23

Swap Words For True/False All UDint data types are 32 bits. If set to True, the words are swapped
UDints before being sent over Modbus, and before being used when read from
Modbus. For example,

32 bits Data 0x01234567

Transmits 0x45, 0x67, 0x01 and 0x23

Clamp Values True/False If set to True, the value sent on Modbus is clamped between the RawMax
and RawMin values. The EngMax/EngMin and RawMax/RawMin are used
to determine how to scale a value when writing to/reading from Modbus.
However, if the actual Engineering value at runtime is greater than EngMax,
or less than EngMin, then a value could be sent on Modbus that is greater
than RawMax or less than RawMin. Some jobs may not find this desirable,
however, if the values are being sent to a computer that only supports 12
bits of data, these limits must be enforced.
Command Limit 0 / 25 Limits the number of EGD Command Message Protocol (CMP) commands
that any given register map writes to a controller in a second. This limit is
designed to prevent the controller from being overloaded with requests.

16 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Property Lower/Upper Description
Limits or Allowed
Values
However, if both the Holding Registers and the Holding Coils each contain
10 signals that are on a controller EGD page, and if the Master sends
messages to all 20 signals every second, it's possible for 20 CMP
messages to be sent to the controller.

Ethernet Port 502 / 503 The Ethernet port that Modbus uses to communicate, if there are any
Ethernet Modbus connections. (A Slave listens on this port, a Master tries to
connect to this port.) The Modbus Protocol Specification default is 502, but if
502 is already used, it can be changed to 503.

Timeout NAK 4/6 When data cannot be obtained from the OPC® Server before the
SlaveSendTimeout time, the Slave returns a Slave Exception Response to
the Master. Most jobs want a NAK Code 6 (Slave component Busy) in this
situation, but this value gives you the option to return a NAK Code 4 (Slave
Component Failure).

Master Message Base 200 / 2147483647 This number defines how frequently a Modbus Master Message can be
Period sent. This number is muliplied by the Period Multiplier on the Modbus
Master Message to indicate, in ms, how often a given message is sent over
Modbus.
Master Read Timeout 500 / 6000000 The Master Read Timeout is the time duration, in ms, to wait for a response
from a Slave before proceeding to the next message.

OPC Data Rate 100 / 15000 The OPC Data Rate is the rate, in ms, at which the Modbus feature gets
updated values from the OPC Server. It should be twice as fast as you
expect the Master to be asking for values over Modbus.

ReConnect Time 500 / 6000000 The ReConnect Time is the time duration, in ms, before the Master tries to
reconnect to the Slave after a connection error. (Also, if Serial Slave has a
problem communicating over a serial port, it closes the serial port and waits
for this time duration before attempting to re-open the port.)

ReStartCycle Time 500 / 6000000 The ReStartCycle Time is the time duration, in ms, before restarting the
Read/Write or Write/Read cycle after an error. If this time duration is too
short, and the error does not clear itself, too many processing cycles are
used.
Slave Read Timeout 500 / 6000000 The Slave Read Timeout is the length of time, in ms, to wait for a request
from a master before marking this transport as being ready to be shutdown.
(This only applies to Ethernet Slaves.)

The program is still waiting for any new connection from a Master, regardless
of the time set here.
Slave Send Timeout 100 / 6000000 The Slave Send Timeout is the length of time, in ms, to wait for data from
the OPC Server before sending back a Timeout NAK response to the
Master.

Instruction Guide GEI-100696E 17

For public disclosure
 2.4 Hardware Interface Properties
When the hardware interface is selected in the Tree View, the following properties display
in the Property Editor.

Note You can only change Ethernet Settings when the Interface Type is Ethernet, and
Serial Settings when it is Serial.

Property Lower/Upper Limits Or Description

Allowed Values
Ethernet Settings

IP Address Valid IP Address format IP address for Ethernet connection. For a Master, this is the IP
Address of the Slave that you are connecting to. For the Slave,
this is the IP Address at which you'll be listening for a connection
from a Master. If you're a Slave, verify that the WorkstationST
has a Network Adapter defined to support this IP Address.

Interface Settings

Detailed Description Text Allows the user to enter a detailed description of this hardware
interface to help the user keep track of their configuration. It can
be left blank.
Enabled True or False If True, the configuration for this hardware interface will be
downloaded to the WorkstationST computer.

Interface Type Serial or Ethernet Modbus hardware interface type

Tree View Description Text Allows the user to enter a shorter description for this hardware
interface to display in the Tree View. If left blank, the IP address
or ComPort will display in the Tree View.

Serial Settings

Baud Rate 300 / 256000 Communication baud rate for serial network
Data Bits 8 Communication data bits for serial network
Parity None / Even / Odd Communication Parity for serial network

Port COM1 / COM 16 Communication Port for serial network

Response Delay 0 / 999 Additional delay time, in ms, before the Slave responds to a
Master request. Change this from zero only if the Master cannot
handle a quick response.

Stop Bits 1/2 Communication Stop Bits for serial network

18 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.5 Master Message Properties
Property Lower/Upper Description
Limits or Allowed
Values
Function Code FuncCode1 / 1 - Read Holding Coils

FuncCode2 / 2 - Read Input Coils

FuncCode3 / 3 - Read Holding Registers

FuncCode4 / 4 - Read Input Registers

FuncCode5 / 5 - Write Single Holding Coil

FuncCode6 / 6 - Write Single Holding Register

FuncCode8 / 8 - Diagnostic, sub Function Code 0, Return Query Data

This sends a piece of canned data to the Slave, which the Slave then returns.
This code can be used to test the health of a Slave without needing to know the
register map.

FuncCode15 / 15 - Write Multiple Holding Coils

FuncCode16 / 16 - Write Multiple Holding Registers

Number of 1/65535 The number of Registers (or Coils) to be read or written for this message.
Registers
This is not the number of variables. A 4-byte data type uses two registers, and an
8-byte data type uses four registers.

Period Multiplier 1/2147483647 This number is multiplied by the Master Message Base Period to determine
how frequently, in ms, this message should be sent. (The Master Message
Base Period is an item in the Property Editor when Modbus is selected in the
Tree View)

Start Address 1/65535 The starting address for this message. This refers to either a coil number or
register number, depending on which function code is configured. A variable
must be connected to this address, or you cannot validate the Modbus
configuration and select the Build command.

Instruction Guide GEI-100696E 19

For public disclosure
 2.6 Slave Properties
Property Lower/Upper Limits Description
Or Allowed Values
Slave Settings

Detailed Description Text Allows the user to enter a detailed description for this Slave to help
the user keep track of their configuration. It can be left blank.

Enabled True or False If True, the configuration for this Slave will be downloaded to the
WorkstationST computer.

Measurement System Native The measurement system that is used when WorkstationST Modbus
gets data from, or writes data to the OPC DA Server for this Slave.

Slave ID Number The Slave ID on the Modbus network.

Tree View Description Text Allows the user to enter a shorter description for this hardware
interface to display in the Tree View. If left blank, the Slave address
will display in the Tree View.

2.7 Data Structure Properties

Property Lower/Upper Limits or Allowed Values
Raw Min The value used to scale the data before it is sent or read from Modbus.
Raw Max
Eng Min

Eng Max

where Ymod is the value to be sent over Modbus and XEng is the value of
the connected variable.

2.7.1 Data Types

When variables are sent over Modbus, the following data types are allowed. Note the
number of registers that each data type uses on a Modbus page.

Data Type Number of Registers Needed

BOOL 1 (Can pack up to 16 Booleans into one register).

INT 1
UINT 1
DINT 2
UDINT 2
REAL 2
LREAL 4

20 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.8 Scaling
The relationship between Y (the value sent over Modbus) and X (the engineering value)
is linear. This equation:

can be converted into the slope intercept form:

y = mx + b
Where m = slope
b = offset
For the engineering value in the system:

For the value that is sent over Modbus:

Instruction Guide GEI-100696E 21

For public disclosure
 If all min/max values are zeros, a gain of one (1) and an offset of zero are realized. If the
Clamp Values property is set to True, the value sent on Modbus is clamped between the
RawMax and RawMin. The EngMax/EngMin and RawMax/RawMin are used to
determine how to scale a value when writing to or reading from Modbus. However, if the
actual Engineering value at runtime is greater than EngMax, or less than EngMin, a value
could be sent that is greater than RawMax or less than RawMin. Therefore, RawMax and
RawMin are not true minimums and maximums unless the Clamp Values Boolean is set.
They are only used to determine the scale factors. However, before values are sent over
Modbus, they are always clamped, regardless of the state of the Clamp Values Boolean,
based on the range of the Modbus data type. If values are sent to a computer that only
supports 12 bits of data, verify that your RawMax and RawMin values respect the 12 bits
of data limitation, and set the Clamp Values Boolean to True.
When a Master writes to a WorkstationST Slave, the Slave converts the Modbus value to
an Engineering value. If the calculated Engineering value is outside the range of the
Engineering variable’s data type, that value will not be set, and a Slave Exception
Response (Code 3, Illegal Data Value) is returned to the Master. Any other valid values in
the write request are written. In this case, the OPC Server Write Errors counters increase.
When a Master reads from a WorkstationST Slave, the Slave converts the Engineering
value to a Modbus value. If the calculated Modbus value is outside the range of the
Modbus data type, the value is clamped by the Modbus data type range. This clamping
based on data type occurs even if the Clamp Values property is not set. The clamped value
is returned to the Master. In this case, no Slave Exception response is returned.
Before a WorkstationST Master writes to a Slave, the Master converts the Engineering
value to the Modbus value. If the calculated Modbus value is outside the range of the
Modbus data type, the value is clamped by the Modbus data type range and the clamped
value is written to the Slave. This clamping based on data type occurs even if the Clamp
Values property is not set.
After a WorkstationST Master reads from a Slave, the Master converts the Modbus value
to an Engineering value. If the calculated Engineering value is outside the range of the
Engineering variable’s data type, that value will not be set, and the OPC Server Write
Errors counters increase. Any other valid values in the write request are still written.
At runtime, you can determine the number of times a value was clamped by monitoring
the corresponding counters in the Additional status detail window (for example, Slave 1
on 3.29.17.149 HR has 0 Current, 0 Total Modbus Values being Clamped occurrences).

22 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.8.1 Scaling Examples
EngMax = 8.0 inches
EngMin = 0 inches
Engineering variable is an IEEE float (in ToolboxST, referred to as REAL).
First example:
RawMax = 65000
RawMin = 0
Engineering variable current value is 8.5.
Modbus data type is an unsigned 16-bit integer (in ToolboxST, referred to as UINT).

Modbus Value = 65535 if Clamp Values = False. (just clamped based on Modbus data
type range, for unsigned 16-bit integer is 0 to 65535.)
Modbus Value = 65000 if Clamp Value = True. (the tighter of the two clamps
(RawMax/RawMin versus the data type range) is applied.)
Second example:
RawMax = 32000
RawMin = -32000
Engineering variable current value is 8.07
Modbus data type is a signed 16-bit integer (in ToolboxST, referred to as INT).

Modbus Value = 32560 if Clamp Values = False. (No clamp was reached.)
Modbus Value = 32000 if Clamp Values = True. (RawMax clamp was reached.)

Instruction Guide GEI-100696E 23

For public disclosure
 2.9 Spare Values
A Master cannot read data that contains an empty register. If registers 1 through 100 are
being read by a single read, and there are no values connected to one or more registers, an
Illegal Data Address error occurs.

� To repair empty registers

1. From the WorkstationST component, OPC DA Server tab, select Client Driven
Variables.

Note The recommended variable name is Spare (for example, SpareInt1).

Note If more registers need to be filled, the data type can be INT (uses one register),
REAL (uses two registers) or LREAL (uses up to four registers).

2. Set the External Access to Read/Write.

3. Set the Initial Health to TRUE. If the Initial Health is not set to TRUE, the Master
gets Exception Response: Slave Component Failure 04 when a Read/Write
is attempted that includes this variable.
4. If required, set the Initial Value.
5. Select the Modbus tab to connect this new variable to the empty register.
6. Select the Build and Download commands.
7. Restart the OPC Server.

Note If Booleans are packed into a register, all 16 bits within a register do not have to be
mapped.

24 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 2.10 Importing or Exporting .csv Files
� To export or import a .csv file: From the Modbus item, right-click a Slave
(such as Slave 1) and select Export to .csv file or Import from .csv file.

The Export to .csv file option includes:

• Register Type (Example: HoldingReg, Coil, InputReg, Input)

• Register Address (Example: 00001)
• Signal Name (Example: TVNA)
• Writeable or Read Only (Example: W)
• Modbus Data Type (Example: UDINT)
• Signal Data Type (Example: UDINT)
• Scale Modbus Minimum
• Scale Modbus Maximum
• Scale Engineering Minimum
• Scale Engineering Maximum
• Signal Units
• Signal Description
The Import from .cvs file option includes:

• a .csv file that you exported

• a .csv file exported from a Mark VI or Mark VIe Modbus Master configuration

Instruction Guide GEI-100696E 25

For public disclosure
 2.11 Error/Warning Messages
Any errors/warnings in the Modbus configuration display in the WorkstationST
Component InfoView when the Build command is selected. Double-click an
error/warning to display the location that the error/warning occurs.

Error Message Possible Cause Solution

Connection Bool8 is undefined (where The variable that was entered into the If not, determine where the variable
the connected variable name is the Connected variable field is not defined should have been defined. If the
name you entered) anywhere in the system. variable comes from another
component, make sure that:

-Variable was defined in that

component

-Variable was mapped to EGD page in

that component

-The component was built on a

computer that is working online with the
EGD ConfigServer so that their EGD
page maps are available.

-This component is set up to consume

pages from that component

-This computer is working online with

EGD ConfigServer to get the latest
EGD Map

Point Address 00001 must have a For a specific Slave and register space Determine which variable you want at
unique address (where the address is (such as Holding Registers), more than that address. Is the other variable no
the value you entered) one variable has been mapped to the longer needed, or should it be at a
exact same address. different address?
Raw Min must be set to zero for point A non-zero scale factor (Raw Min, Raw Put zero values in the Raw Min, Raw
HoldingReg8-00 when Data Type is a Max, Eng Min or Eng Max) was entered Max, Eng Min, and Eng Max fields for
BOOL (where the point is your Name, for a Boolean point. this Boolean variable (on either the
and the parameter could also be Raw Holding Register or Input Register tab).
Max, Eng Min or Eng Max)

Point Address 00001 is of type UDINT A variable that takes up more than one Do you want the first variable to be that
and requires 2 addresses. The next register was connected to an address, data type when it is sent over Modbus?
address is located at 00002 (where the but not enough space was left in the When you connect a variable to a
addresses and data types are yours) register map for it. Instead, another Modbus page, the data type defaults to
variable was mapped to a following that of the variable that was connected,
address that would cause an overlap of but this may not be desired. If not, you
data. need to move the second variable.
Remember that two registers are
needed for DINT, UDINT, and REAL
variables, but four registers are needed
for LREAL variables.
A Slave under a Modbus Serial HW The Slave ID is set to 0, and the Change the Slave ID to a non-zero
Interface has to have a non-zero Slave Interface Type is a serial link. value.
ID, since 0 is reserved for broadcast
messages in the Modbus Protocol
Specification.

26 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Error Message Possible Cause Solution

HW I/F COM1, Slave 1, point Coil2 and The same variable is connected to two If this was a spare variable being used
HW I/F COM2, Slave 5, point Coil8 are places in a Slave map under the to fill a hole in a register map, define as
both connected to T1.L27BN. Both pts Masters item. (It can be, but does not many spare variables as needed so
are being written to by values read over have to be on the same Slave, or even they can be unique. Otherwise, split
Modbus, so they will overwrite each under the same Hardware Interface.) your Modbus message into two
other. Either change one connection or That condition alone is okay if in one messages, one that reads the values
one of the Modbus messages that location the variable is being read to be before the hole, and a second that
writes to this variable (where the sent over Modbus, and in the other it’s reads the values after the hole. (Refer
Hardware Interfaces, Slave numbers, being read from Modbus and written to. to the section Spare Values.)
point names and connected variables However, your configuration actually
are yours) has one or more Modbus messages If this is not a spare variable, determine
configured to read from Modbus and which variable you want in each
write to both places where the same instance.
variable is connected. Function Codes
that read values from Modbus and write
them to a variable are FuncCode 1, 2,
3, or 4.
More than one Workstation Modbus More than one Hardware Interface is If you have more than one serial
HW Interface is configured to use the configured to use the same Com Port. interface in the same WorkstationST,
COM1 Com Port (where Com Port is the target computer must have enough
the duplicate in your configuration) hardware to support it. Select the
appropriate Com Port in the
configuration or change one of the
interfaces to Ethernet.
Under Modbus, Masters, there is more There are two or more hardware Determine if one of the hardware
than one HW interface configured to interfaces under the Masters category interfaces should really be a different
use the 172.20.100.151 IP Address. that are using the same IP Address. address, and if so, change it.
Otherwise, all of the slaves need to be
under one entry for this IP Address. Use
cut-and-paste to move the slave
definitions under one hardware
interface and delete the second
hardware interface.
Under Modbus, Slaves, there is more There are two or more Hardware Determine if one of the Hardware
than one HW Interface configured to Interfaces under the Slaves category Interfaces should really be a different
use the 172.20.100.151 IP Address. that are using the same IP Address. address, and if so, change it.
Otherwise, all of the slaves need to be
under one entry for this IP Address. Use
cut-and-paste to move the slave
definitions under one Hardware
Interface and delete the second
Hardware Interface.
Under Modbus, Masters, No messages were defined for a given Determine if you want to read or write
172.20.100.151: Slave 17 does not Masters slave map. values to this slave map, and if so,
have any Messages defined for it. insert a ModbusMasterMessage.

Duplicate Slave IDs are not allowed in The same Slave ID was used for more Change duplicate Slave IDs. To
any Modbus HW Interface than one Slave, underneath any given configure a redundant set of Slaves, the
Configuration. Hardware Interface. backup Slaves should be under their
own Hardware Interface.

Instruction Guide GEI-100696E 27

For public disclosure
 Error Message Possible Cause Solution

An IP Address 3.29.17.201 is Under the Slaves item, an Ethernet From the General tab, verify that all the
configured for a Modbus HW Interface Hardware Interface is defined. Network Adapters in your
that has Slaves on this Workstation, but However, the IP address for it does not WorkstationST computer have been
the Workstation configuration itself does match one of the IP addresses on the configured with the proper IP address.
not have a Network Adapter defined to WorkstationST Network Adapters. This Double-click the error message in the
support this IP Address (where the IP could have happened if the Log View at the bottom of the screen to
Address is yours) WorkstationST Network Adapters go to the Hardware Interface with the
configuration was changed after the IP bad IP address. Select the IP Address
address was selected for your Slaves. field, then select the correct IP address.

An IP Address ASDFG is configured for Under the Masters item, there is an Change the string to the correct IP
a Modbus HW Interface that has Ethernet Hardware Interface whose IP format
Masters, but the format is not a valid IP address doesn’t follow the format nnn.
Address format (where instead of nnn.nnn.nnn, where n is a numerical
ASDFG, it is the string you entered) digit.

ModbusMasterMessage0 is configured Double-click the error message in the

to send Function Code 5, which by the Log View at the bottom of the screen to
Modbus Protocol Specification only go to the bad Modbus Master Message.
sends 1 coil of data. However, the In the Summary View, select the Coil
Number Of Registers configured is 12. tab. Determine if you want to write a
Consider changing this to a Function single point, and if so, change the
code 15 (where the Message Name and number of registers to 1. If you want to
Number Of Registers are your values) write more than one point, change the
Function Code to 15.
ModbusMasterMessage0 is configured Double-click the error message in the
to send Function Code 6, which by the Log View at the bottom of the screen to
Modbus Protocol Specification only go to the bad Modbus Master Message.
sends 1 register of data. However, the In the Summary View, select the
Number Of Registers configured is 12. Holding Register tab. Determine if you
Consider changing this to a Function want to write a single variable, and if so,
Code 16 (where the Message Name change the number of registers to 1. If
and Number Of Registers are your you want to write more than one
values) variable, change the Function Code to
16.
ModbusMasterMessage0 is configured Under the Masters category, a Slave is Did you want to read from Modbus? If
to send a message to read a value from defined that contains a Read-Only not, change your function code. If so,
Modbus and write it to Bool1, but that variable. This Modbus Master message determine if you should be writing to a
variable is defined as Read-Only is either a Function Code 1, 2, 3, or 4 different variable, or if this variable
(where the Message Name and which causes the Modbus Master to should be changed to Read/Write.
connected variable name are yours) read a value from a Slave, and try to
store the value in this Read-Only
Connected Variable.

28 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Error Message Possible Cause Solution

ModbusMasterMessage1 is configured There is a hole in the signal map. An Select the Modbus Master Message.
to send a message with Starting example of a hole is a message that Based on what the function code is,
Address 2 that takes up 2 coils or tries to write 4 registers starting at select the appropriate tab in the right
registers. However, there is no Variable register 10, where there is a DINT at hand pane. (1, 5, 15 select Coil; 3, 6, 16
connected to address 2 (where the register 10, no variable at register 12, select Holding Register; 2 select Input;
Message Name, Start Address, Number and an INT at register 13. Note that the 4 select Input Register.) Look at the
Of Registers, and first address that hole can be at the beginning or end of hole (address) indicated in the error
does not line up are yours) the message span. message.

Either move variables around to fill the

hole, add a spare variable to fill in the
hole (refer to the section, Spares
Values), or use two Modbus messages.
The first Modbus message includes
variables before the hole and the
second includes variables after the
hole.

If the hole is at the beginning, change

the Start Address in the Message. If the
hole is at the end, change the Number
of Registers in the Modbus Master
Message and verify that it does not
extend beyond the end of the last
connected variable.

If Booleans are packed into a register, all

16 bits within a register do not have to be
mapped.

Instruction Guide GEI-100696E 29

For public disclosure
 ModbusMasterMessage0 is configured The number of registers is not large Select the Modbus Master Message.
to send a message with Starting enough to incorporate the whole length Add the current number of registers and
Address 1 that takes up 12 coils or of the last variable in the message. the exceeded number, then put the
registers. However, the last variable result into the Number of Registers. In
LReal1 is long enough that it causes the the example message, you would add
message to exceed the Number of 12 + 1 = 13 and change the Number of
Registers by 1 register (where the Registers from 12 to 13.
Message Name, Start Address, Number
Of Registers, Connected Variable
Name, and exceeded number are
yours)

ModbusMasterMessage1 is configured The number of registers needed for the Double-click the error message in the
to send Function Code 6, which by the connected variable is greater than one. Component InfoView to go to the poor
Modbus Protocol Specification only Modbus Master Message. In the
sends 1 register of data (two bytes). Summary View, select the Holding
However, the variable LReal1 Register tab. Either change the data
connected to the Starting Address 10 type for the point on the Modbus page
takes up 4 registers. Consider changing so that it only takes up a single register,
it to a Function Code 16 (where the or change the Function Code to 16 to
Message Name, Connected Variable pass the point over Modbus with its
Name, Starting Address and number of current data type. If you change the
registers needed are yours) Function Code to 16, you must also
change the Number of Registers to
reflect the number of actual registers
used for that data type, as indicated in
the error message.

Error Message Possible Cause Solution

ModbusMasterMessage1 is configured The Modbus protocol for the response Add another ModbusMasterMessage
to send a message with 2050 coils, but of a Function Code 1 (Read Holding and read some of the values in the first
the Maximum Number of Coils that can Coils) calls for 1 byte to specify the message, and the remaining values
be sent in any single Message is 2040. number of bytes of data to follow. The with the second message.
Please split this into multiple messages. maximum value for a single byte is 255.
Each byte of data can contain values for
8 coils. Therefore, the maximum
number of coils that can be read is 255
x 8 =2040.
ModbusMasterMessage0 is configured The Modbus protocol for the response Add another ModbusMasterMessage
to send a message with 200 registers, of a Function Code 3 (Read Holding and read some of the values in the first
but the Maximum Number of Registers Registers) calls for 1 byte to specify the message, and the remaining values
that can be sent in any single Message number of bytes of data to follow. The with the second message.
is 127. Please split this into multiple maximum value for a single byte is 255.
messages. There are two bytes of data for each
register. Therefore, the maximum
number of registers that can be read is
255 / 2 =127.5, (127 whole registers).

30 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
3 Runtime
There are three ways to monitor the status of a configured Modbus.

• WorkstationST Status of Features window

• WorkstationST additional status window
• Detail Log

3.1 WorkstationST Status of Features

You can access the WorkstationST Status of Features screen in one of two ways:

• From the Start menu, select All Programs, GE ControlST, WorkstationST, and
WorkstationST Status Monitor.
or

• From ToolboxST, open a WorkstationST component and click the Go On/Offline

button. From the Component InfoView, select the Status tab of the
WorkstationST running the configured Modbus feature.

Instruction Guide GEI-100696E 31

For public disclosure
 The logic that drives the Error/Warning/OK status for the Modbus feature is as follows.
Errors

• Any current connection errors over Modbus

• No connection with the OPC Server
• Any current Checksum Errors
• Any current Read Message Errors
□ Endian mismatch
□ Unsupported function code or scrambled data in the receive buffer because of
serial port parameter mismatches
Warnings

• Any current application errors

• Any current slave exception responses
• Any current invalid Slave ID errors (for example, a Slave receives a message from a
Master for a Slave ID that is not configured.)
• A Master with current:
□ Read timeouts
□ OPC Server write errors
□ Skipped periodic messages
□ Unbound variables
□ Unhealthy variables
□ Exceeded command limit
□ Unsupported Function Code
□ Trying to write to a read-only variable
□ Data conversion error

Note If detail items listed under a Master occur in a Slave, the Slave sends back a Slave
Exception Response, which triggers a WARNING status.

32 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 3.2 WorkstationST Additional Status
� To view additional status information: From the Component InfoView
Features column, right-click the Modbus item and select View Additional
Status Detail.

The Error Level column that displays on the WorkstationST additional status window has
three possible values:

• OK – Value is zero
• Warning – Condition occurred at some point
• Error – Condition is still occurring

Instruction Guide GEI-100696E 33

For public disclosure
 Once a steady state condition has been reached, it is recommended that you set the
counters to zero to make it easier to identify any subsequent conditions that occur.
The following information displays in the WorkstationST additional status window, and
can be monitored at runtime.

34 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Masters and Slaves Status Counters
Message Description
Modbus initially started at The time that the program was last started. If WorkstationST Service is configured to start
10/9/2007 2:06:24 PM. automatically when the computer restarts, and the Modbus feature is enabled, that service
starts the program. Otherwise, the WorkstationST Status Monitor can be used to stop and
start the Modbus feature.
Modbus last restarted at When you download a new WorkstationST configuration from ToolboxST, the Modbus
10/9/2007 3:02:13 PM. (Due to program restarts, and the time of this restart is recorded. If nothing that affects the Modbus
a download.) configuration changes, then Modbus does NOT restart, and an INFO message indicating
this is added to the trace log file.

When Modbus restarts, it goes offline to allow enough time for the COM ports to be
released before the new configuration tries to use them. If another component that Modbus
consumes is downloaded, the lists used to communicate with the OPC Server Modbus are
stopped and restarted. This can cause unhealthy data, which generates a Slave Exception
Response if the Master asks for that data during this timeframe. Stopping and starting the
lists prevents unbound variables (caused by moved variables or changed data types),
which continually return Slave Exception Responses to the Master for this data.

Modbus last zeroed counters Once a steady state condition is reached, it’s recommended that you set the counters to
at 10/9/2007 3:02:13 PM. zero.

Each status line has an Error Level, Current Count, and Total Count for a specific condition.
If the condition is still occurring (non-zero current count), the Error Level displays Error. As
long as the total count is non-zero, the Error Level displays Warning, indicating that at some
point this condition existed. Setting the counters to zero returns the Error Levels to OK.

This makes it easier to identify subsequent problems. A new problem causes the Error
Level to change to either Error (if the condition still is occurring) or Warning (if it occurred),
but has stopped, allowing you to detect transient problems.

The Zero Counters button also zeroes the counters for the number of messages sent and
received.

Instruction Guide GEI-100696E 35

For public disclosure
 Message Description
A Slave Manager is listening This lets you know that the program is actively listening for any Masters that might connect
on 3.29.17.149, Port 502 with over Ethernet. The message also shows which IP Address and Port the Master should use
No Errors. There have been 3 when trying to connect, and how many successful connections have occurred since the
successful TCP connections counters were last set to zero. You can also see how many Ethernet Slave connections are
since last Zeroed Counters. currently running.
Currently there are 2 Active
Slave Connections. If a Master has disconnected and reconnected several times, it is possible that the total
number of connections is more than the current number of Slaves. (This number could also
be zero if the counters were just set to zero.)

If a Slave connection does not receive any messages from the Master for a configured
amount of time (refer to the Slave Read Timeout property), it is shut down. The Slave
connection corresponds to the Hardware Interface configured in the ToolboxST application.
More than one Slave ID may be configured to respond over any connection.

More than one Master can talk to the same Slave map at the same time, each Master using
their own Slave connection. This might be done to support a primary/backup redundant
setup. For example, 1.1.1.1 HW Interface has Slaves 1, 2, and 3 defined under it. One
Master connects, which displays as one connection, although the Master can get data from
Slaves 1, 2, and 3. A second Master connects, which displays two connections. This
second Master can also get data from Slaves 1, 2, and 3.

Slave(s) on 3.29.17.149 are Since more than one Master can connect to a given Ethernet Slave Hardware Interface, this
talking to a Master on TCP tells you which Master connection all Status Counters following this line correspond to. If
Remote End Point another Master connects using the same listening port (but still having its own connection)
3.29.17.191:1451 after the Status Counters display for the first connection, this status line is repeated for the
second Master connection, followed by the Status Counters for the second connection.

Slave(s) on 3.29.17.149 have This is the number of messages that have been received and sent since the Counters were
1036 Received, 1036 Sent last set to zero. For Slaves, if the received amount is significantly higher than the sent
Messages Total. amount, the Slave is having problems responding to messages received. Refer to the
additional error counters and the trace log file for information. If the Slave responds with a
Slave Exception Response, it still counts as a message sent.

Slave(s) on 3.29.17.149 have If Masters send too many messages too quickly, this counter allows a field engineer to
0 Messages Received in the report the rate to the person responsible for the Master so that the configuration can be
last Second, 0.4 Average modified.
messages per second over the
last five seconds, 2 messages
per second Highwater Mark.

Slave(s) on 3.29.17.149 have Possibly due to not being physically connected, having mismatched Hardware interface
0 Current, 0 Total Connection configuration parameters, or having the connection closed by another program. When a
Errors. Connection error is received, Modbus closes the connection, waits the ReConnect Time
(configuration parameter), and then attempts to reconnect. Refer to the trace log file for
more information.
Slave(s) on 3.29.17.149 have If an Application Exception occurs, the connection waits the ReStartCycle Time
0 Current, 0 Total Application (configuration parameter) and then restarts the cycle. (The ReStartCycle Time prevents the
Errors. (An Unexpected restart from being caught in an infinite loop.) For a Master, restarting the cycle means
Exception that doesn't appear identifying and sending out the next message. For a Slave, restarting the cycle means
to be related to a connection listening for the next message from a Master.
problem.)

36 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Message Description
Slave(s) on COM1 have 0 When a Checksum error occurs, the Slave ignores the rest of the message, and waits to
Current, 3 Total Checksum read the next message. No Slave Exception Response is returned. This only applies to
Errors. Serial Hardware Interfaces.
Slave(s) on 3.29.17.149 have For Slaves: The Slave has waited a configured amount of time (Slave Read Timeout
0 Current, 0 Total Read property) without receiving a request from a Master before marking this transport as ready
Timeouts, where it waited 5 to be shut down. This only applies to Ethernet Slaves; Serial Slaves do not have a timeout.
minutes for a request.
The program waits for any NEW connection from a Master, regardless of the time set here.

For Masters: The Master has waited a configured amount of time (Master Read Timeout
property) without receiving a response from a Slave before reading the next message.

Slave(s) on 3.29.17.149 have No Slave Exception Response is returned, but the status on the WorkstationST Status
0 Current, 0 Total Invalid Slave Monitor changes to Warning if this occurs. The Master configuration or the Slave ID must
ID Errors, where a Master sent be modified. If the Slave ID is changed, the Build and Download commands must then be
a message for a Slave ID that selected. Use the trace log file to identify the invalid Slave ID.
isn’t configured.

Slave(s) on 3.29.17.149 have Refer to the section, Exception Responses for more information about Slave Exception
0 Current, 0 Total Slave Responses. The count does not differentiate between different error codes.
Exception Responses that
were sent.
Slave 1 on 3.29.17.149 has 0 This is the length of time the Slave waited (configured in the Slave Send Timeout). The
Current, 0 Total Send Slave normally sends back a Slave Component Busy 06 Slave exception response to the
Timeouts, where it didn't get Master. However, if the NAK Code configuration parameter is set to 4, it returns a Slave
data from the OPC Server in Component Failure 04 Slave exception response to the Master.
0.5 seconds so it sent a Slave
Exception Response to the
Master.
Slave 1 on 3.29.17.149 HR has This Master/Slave tried to write values to the rest of the system through the OPC Server
0 Current, 0 Total OPC Server and failed. A Slave then sent a Slave Component Failure 04 Slave Exception Response to
Write Errors. the Master. If the program detects a specific cause of this error (variable is read-only,
unbound, unhealthy, and such), it does not increment this generic counter. Use the trace log
file to identify errors.

Slave 1 on 3.29.17.149 HR has This is a severe error. If the Modbus program cannot connect to the OPC server, it keeps
0 Current, 0 Total OPC Server trying to reconnect. It will not send messages over Modbus until connected. A Slave returns
Connection Errors. a Slave Component Failure 04 Slave Exception Response to the Master if it cannot connect
to the OPC Server. Start the OPC Server, if it is not running. If the OPC Server is running,
use the OPC Server’s trace log file to identify errors.

Slave 1 on 3.29.17.149 HR has The Slave returns an Illegal Data Address 02 Slave Exception Response to the Master. If
0 Current, 0 Total Illegal Data this error occurs, the person responsible for the Master needs to determine why a message
Address Errors. This error is expected at this location. Are there data type mismatches that caused signals to get
occurs when the Master asks shifted in the register map? Should a spare variable be added at this address? (Refer to the
for an address for which no section, Spare Values.) Use the trace log file to identify which variable has the error.
variable was configured.

Slave 1 on 3.29.17.149 HR has The Slave returns an Illegal Data Address 02 Slave Exception Response to the Master.
0 Current, 0 Total UnBound Normally, this occurs briefly when another component is downloaded, causing Modbus to
Variable Errors. stop and restart the lists to the OPC Server. However, if another component deleted a
variable being used by Modbus and was then downloaded, this could continually occur. In
that case, talk with the component owner to see if another variable should be used. If not,
the person responsible for the Master must delete this variable. In either case, modify the

Instruction Guide GEI-100696E 37

For public disclosure
 Message Description
configuration, then select the Build and Download commands. Refer to the trace log file to
identify which variable has the error.

Slave 1 on 3.29.17.149 HR has The Slave returns a Slave Component Failure 04 Slave Exception Response to the Master.
0 Current, 0 Total UnHealthy Normally this is only a momentary occurrence when another component gets downloaded,
Variable Errors. and Modbus stops and restarts the lists to the OPC Server. However, it also occurs if a
component goes offline. Refer to the trace log file to identify which variable has the error.

Slave 1 on 3.29.17.149 HR has The Slave returns a Slave Component Failure 04 Slave Exception Response to the Master.
0 Current, 0 Total Read-Only Refer to the trace log file to identify which variable has the error, then determine if the
Variable Errors. (This error is variable can be changed to Read/Write, or if another variable should be used. Modify your
when it's asked to write to a configuration, then select the Build and Download commands. This error will not resolve
variable that was configured as itself.
read-only.)

Slave 1 on 3.29.17.149 HR has The Slave returns an Illegal Data Value 03 Slave Exception Response to the Master. When
0 Current, 0 Total Data a Master writes to a Slave, the Slave converts the Master value to an engineering value. If
Conversion Errors. the calculated engineering value is outside the range of the engineering value’s data type,
that value is not sent, and a Slave Exception Response is returned to the Master. (Any
other values in the write request will be written.) The OPC Server Write Errors counter also
increases. In this case, make changes to your data types, as required. When a Master
reads from a Slave, the Slave converts the engineering value to a Modbus value. If the
calculated Modbus value is outside the range of the Modbus data type, the value is
clamped by the Modbus data type range. This clamping based on data types occurs even if
the Clamp Value property is not set. The clamped value is returned to the Master. No Slave
Exception Response is returned. In this case, a Slave Exception Response indicates that
an unanticipated conversion problem exists. This could also occur if scrambled data was
received over Modbus. Use the trace log file to identify which variable has the error.

Slave 1 on 3.29.17.149 HR has The Command Limit (configuration property) limits the number of EGD CMP commands
0 Current, 0 Total Times that that any given register map writes to a controller to prevent the controller from being
the Commands Per Second overloaded with requests. (For example, if the Holding Registers and the Holding Coils
Limit was reached. each contain 10 signals that are on a controller EGD page, and the Master sends
messages writing to all 20 signals every second, it's possible for 20 CMP messages to still
get sent to the controller.) The register does not buffer these change requests and send
them at a slower rate, but instead discards any messages that exceed the limit. Even if the
command limit is reached, other non-command values are sent. The Slave returns a Slave
Component Failure 06 Slave Exception Response to the Master.

Slave 1 on 3.29.17.149 HR has If the Clamp Values (configuration property) is set to True, the value sent over Modbus is
0 Current, 0 Total Modbus clamped between the RawMax and RawMin. The EngMax/EngMin and RawMax/RawMin
Values being clamped are used to determine how to scale a value when writing to/reading from Modbus. However,
occurrences. if the actual Engineering value at runtime is greater than EngMax, or less than EngMin, a
value could be sent over Modbus that is greater than RawMax or less than RawMin. Some
jobs may not find this desirable, but if the values are going to a computer that only supports
12 bits of data, these limits must be enforced. Also, if the Modbus value is outside the range
of the Modbus data type when an engineering value is converted to a Modbus value, the
Modbus value is clamped and the counter increases.

Slave 1 on 3.29.17.149 HR has The Modbus program tries to reduce the number of unnecessary EGD commands and
0 Current, 0 Total Times that a minimize the chance of reaching the command limit. This is done by comparing the current
Value has Not Changed so it value of a variable coming from another component, to the value received over Modbus. If
was Not Sent to a Controller the value is the same, it is not sent, but this counter is increased by one. If the value is
different, and the command limit was not reached, a command is sent to that component.

38 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 Masters Messages

Master talking to COM1 has 0 These could occur if either the Master tries to send, or receives a function code that it
Current, 0 Total UnSupported cannot handle.
Function Code Errors.
Master talking to COM1 has 0 This normally occurs when:
Current, 0 Total Skipped
Periodic Modbus Messages. Modbus connection is down
Message would be skipped
OPC Server connection is down
when previously scheduled
messages haven’t completed Too many messages were scheduled to be sent at the same time. In this case, modify your
before new messages are configuration.
scheduled to be sent.

3.3 Tracing
Modbus writes messages to a trace log file to help identify problems.

� To display the Modbus trace log file: From the WorkstationST Status of
Features window, right-click the Modbus feature and select Advanced, then
View Detail Log to display the contents of the trace log file.

There are four message levels in the trace log file:

• Error
• Warning
• Info
• Verbose

Instruction Guide GEI-100696E 39

For public disclosure
 � To change the message level
1. From Windows® Explorer, select C:, Program Files, GE Energy, and
WorkstationST Features.
2. From the WorkstationST Features folder, use Notepad to open the
GeCssModbus.exe.config file.
3. Change the ApplicationDefaultSwitch value. (The program automatically detects
that the file has changed and starts using the new level.) The values are:
1 - Errors
2 - Warnings and Errors
3 - Info, Warnings, and Errors
4 - Verbose, Info, Warnings, and Errors

Note The default value is 3. To view the contents of each message received, change the
value to 4 to include Verbose. However, because this value quickly fills the trace log file,
return the value to 3 as soon as possible.

An example of an Error is when a Modbus Slave Exception Response is generated or

received. An example of a Warning would be a Master not receiving a response from a
Slave before the Master Read Timeout. An example of an Info message is successfully
opening a serial port.

40 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 3.4 Ethernet Messages
Change the message tracing level in the trace log file to Verbose to display raw data about
message content. Byte or word swapping has not yet occurred, if required. However,
when a message displays, for example, beginning to read 6 bytes to get the message body,
byte swapping has already taken place. This determines that 6 bytes were expected for the
message body.
Example:
2007-10-18 15:03:38.081 VERBOSE ModbusSlaveTcpTransport10/18/2007 5:34:32 AM.
BeginRead: Slave at IP Address 172.20.100.151 beginning to read 6 bytes to get the
message header.
2007-10-18 15:03:38.097 VERBOSE ModbusSlaveTcpTransport10/18/2007 5:34:32 AM.
ReadCompleted: Slave at IP Address 172.20.100.151 received Message Header 0, 0, 0, 0,
0, 6
The Message Header contents are as follows:

• The first two bytes are Transaction Identifier: 0, 0,

(The Slave returns what the Master sent it. The Master can use this to match the response
with the correct request.)

• The second two bytes are the Protocol Identifier: 0, 0,

(These should always be value 0 for Modbus protocol.)

• The last two bytes are the message length: 0, 6

(There are 6 bytes for the message body that follow this header.)
Example:
2007-10-18 15:03:38.097 VERBOSE ModbusSlaveTcpTransport10/18/2007 5:34:32 AM.
ReadCompleted: Slave at IP Address 172.20.100.151 beginning to read 6 bytes to get the
message body.
2007-10-18 15:03:38.097 VERBOSE ModbusSlaveTcpTransport10/18/2007 5:34:32 AM.
ReadCompleted: Slave at IP Address 172.20.100.151 Received Message Body 1, 3, 0, 9,
0, 5
The Message Body contents are as follows:

• The first byte is the Slave ID: 1,

• The second byte is the Function Code: 3,
(Everything after this point in the message could be different for specific Function Codes.
Refer to the Modbus Protocol Quick Reference table for details.)

• The next two bytes are the starting Address: 0, 9

(The address sent over Modbus is zero-based, even though the registers are one-based.
This message starts reading at Holding Register 10.)

• The last two bytes are the number of registers to read: 0, 5

Instruction Guide GEI-100696E 41

For public disclosure
 3.5 Serial Messages
Serial messages start by reading a 7-byte header. The program then displays, for example,
beginning to read 8 bytes to get the message body. This means that the entire message is 8
bytes. When reading serial trace messages, focus on the one that reads, Received Message
Body followed by data, not Received Message Header followed by data.
Example:
2007-10-18 14:57:31.977 VERBOSE ModbusSlaveSerialTransport10/16/2007 11:53:19
AM. ReadCompleted: Slave on Serial Port COM1 beginning to read 8 bytes to get the
message body.
2007-10-18 14:57:32.007 VERBOSE ModbusSlaveSerialTransport10/16/2007 11:53:19
AM.ReadCompleted: Slave on Serial Port COM1 Received Message Body 255, 4, 0, 0, 0,
13, 36, 17
The Message Body contents are as follows:

• The first byte is the Slave ID: 255

• The second byte is the Function Code 4
The following is specific to Function Code 4

• The next two bytes are the starting Address: 0, 0,

Since the address sent over Modbus is zero-based, and the registers are one-based, this
message starts reading at Input Register 1.

• The next two bytes are the number of registers to read: 0, 13

• The last two bytes are the CRC checksum: 36, 17

42 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
 3.6 Modbus Protocol Quick Reference

Function Codes 1, 2, 3, and 4 Function Codes 5 and 6 Function Codes 15 and 16

Request: Request and Response follow Request:
same format:
Byte1; Slave Id Byte1; Slave Id
Byte1; Slave Id
Byte 2; Function Code Byte 2; function code
Byte 2; Function Code
Bytes 3 and 4; Starting Address Bytes 3 and 4; starting address
Bytes 3 and 4; Address
Bytes 5 and 6; Number of Registers Bytes 5 and 6; number of registers to be
Bytes 5 and 6; Value to be written written

Response:

Byte1; Slave ID

Byte 2; Function Code

Bytes 3 and 4; Starting Address

Bytes 5 and 6; Number of Registers

Response: Byte 7; number of bytes of data

Byte1; Slave ID Bytes 8+; Data

Byte 2; Function Code Response:

Byte 3; Number of bytes of Data Byte1; Slave ID

Bytes 4 +; Data Byte 2; Function Code

Byte 3 and 4; Starting Address

Bytes 5 and 6; number of registers to be

written

3.7 Slave Exception Response Format

Byte 1 Slave ID

Byte 2 Originating Function Code with the most significant bit set to 1

Byte 3 Exception Code

Instruction Guide GEI-100696E 43

For public disclosure
 3.8 Monitoring Live Values
� To monitor live values: From the Modbus tab select a Slave (such as Slave 1)
and click the Go On/Offline button to monitor live values on a Modbus page.

Note The value displayed is the value before it is scaled and/or clamped to send over
Modbus.

44 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
4 Troubleshooting
Problem Solution
Symptom
The Master tries to talk Could be an issue with Big Endian for MBAP (tcp Change the state (False to True or True to
to a Slave over Hdr) being in the wrong state. To check, change False) of the Big Endian for MBAP (tcp Hdr)
Ethernet and gets no Tracing to include Verbose, (Refer to the section, property, then select the Build and Download
answer even though Tracing) and check messages to see how long the commands.
the slave is running program thinks the message body length should
and healthy be. If the value is extremely high, it is probably an
Endian issue.
Data values for 2 and May need to swap words for 4 or 8- byte data Try changing the state (False to True or True
4 word variables are types. to False) of the Swap Words for xxx property
not as expected (where xxx is the data type of the variable
with the problem), then select the Build and
Download commands.

4.1 Slave Exception Responses

Slave When it occurs Solution
Exception
Codes
01 Illegal Master asks Slave to 1. If the Master is asking for a non-supported function code, the Master
Function perform a function it does not configuration must be modified.
support
2. Verify that all communication properties match between the Master and
Slave, since a scrambled message could be interpreted as an
unsupported function code.

02 Illegal Data Master asks to Read/Write to Use the trace log file to identify which variable has the error and what the
Address a register where there is not error is.
a variable connected, or the
variable is unbound If there was no variable at that address, the user who configured the
Master must determine why a response is expected at this location. Are
there data type mismatches that caused signals to get shifted in the
register map? Should a spare variable be added at this address? (Refer to
the section, Spare Values.)

If the variable was unbound, was it just a momentary occurrence when

another component was being downloaded, so Modbus stopped/started
the lists to the OPC Server? In this case, no action is needed. However, if
Modbus was using a variable from another component, and the other
component deleted the variable and then was downloaded, this error
continually occurs. In that case, ask the component owner if another
variable should be used. If not, the person responsible for the Master must
delete this variable. (In either case, modify your configuration, then select
the Build and Download commands.)

Instruction Guide GEI-100696E 45

For public disclosure
 Slave When it occurs Solution
Exception
Codes
03 Illegal Data An exception occurs either When a Master writes to a Slave, the Slave converts the Master value to
Value when trying to convert an an engineering value. If the calculated engineering value is outside the
Engineering value to a range of the engineering value’s data type, that value is not sent, and a
Modbus value, or vice versa. Slave Exception Response is returned to the Master. (Any other values in
This conversion incorporates the write request will be written.) You will also see the OPC Server Write
applying scale factors, Errors counter increase. In this case, make changes to your data types, as
clamps, and converting the required. When a Master reads from a Slave, the Slave converts the
data type, if required. engineering value to a Modbus value. If the calculated Modbus value is
outside the range of the Modbus data type, the value is clamped by the
Modbus data type range. This clamping based on data types occurs even
if the Clamp Value property is not set. The clamped value is returned to
the Master. No Slave Exception Response is returned. In this case, a
Slave Exception Response indicates that an unanticipated conversion
problem exists. This could also occur if scrambled data was received over
Modbus. Use the trace log file to identify which variable has the error.

04 Slave Any one of the following Look at the trace log file to identify the cause of the Slave Exception.
Component conditions could cause this Based on the cause, take the appropriate action:
Failure exception:

1. Master tries to read or 1. This occurs briefly when another component is downloaded, and
write a signal that is Modbus stopped and restarted the lists to the OPC Server. However, it
unhealthy would also occur if a component went offline.

2. Master tries to write to a 2. Determine if the variable can be changed to Read/Write, or if perhaps
signal that is read-only another variable should be used. Modify the configuration, then select the
Build and Download commands. This error will not resolve itself.
3. Modbus is not connected 3. This is a severe error. If Modbus can not connect to the OPC server, it
to the OPC Server keeps trying to reconnect. Verify that the OPC Server is running. If it is,
use the OPC Server’s trace log file to identify errors.

4. There is an error writing to 4. Modbus tries to catch most causes of OPC Server Write errors (variable
the OPC Server is Read-Only, unbound, or unhealthy, and such), in which case it will not
increase the OPC Server Write Error counter. Use both the Modbus and
OPC Server trace log files to identify errors.

5. There was an Application 5. Use the Modbus trace log to identify errors.
Exception

06 Slave 1. Master asks for data from 1. Verify that the OPC Server is running.
Component the Slave, but the Slave does
Busy not get the data from the
OPC Server before the Slave
Send Timeout times out.
(Configure with NAK Code to
send 4 or 6 in this case.)

2. The command limit has 2. Determine if this is due to the command limit being reached by viewing
been reached. the WorkstationST additional status window. If it is, determine

If the command limit can be raised without jeopardizing the controllers,

and

If the rate at which the Master sends commands can be reduced

46 GEI-100696E WorkstationST Modbus Feature Instruction Guide

For public disclosure
5 Terms
Coil A type of data structure (a 1-bit Modbus value)

Data Structure A method of storing data in a computer so that it can be used

efficiently

Feature An element of the WorkstationST runtime system, which can be optionally

enabled through ToolboxST. Examples include OPC DA Server, Recorder, OPC AE
Server and Alarm System.

OPC OLE for Process Control (OLE is Microsoft's Object Linking and Embedding) is
a standard for data exchange in an industrial environment. The OPC foundation provides
specifications for various OPC standards such as OPC DA (Data Access) and OPC AE
(Alarm and Event).

OPC DA Server A core part of the WorkstationST product that conforms to the OPC
Data Access Specification

Register A type of data structure (a 16-bit Modbus value)

Scaling The act of converting one value to another value, or the values (for example,
slope and offset) used to perform this conversion. In this program, an engineering value is
converted before it is sent over Modbus, and a value read from Modbus is converted to an
engineering value before being used in the system.

Slave Exception Responses Modbus protocol used by a slave to communicate to a

Master when there is a problem.

Tracing Messages written by a program to a trace log file to help identify problems. In
the WorkstationST Status Monitor, use the View Detail Log to display the contents of the
trace log file.

1501 Roanoke Blvd.

Salem, VA 24153 USA
For public disclosure