Menggunakan Harmony Edge Box / IoT Box sebagai Modbus Gateway (TCP to RTU)

Magelis Edge Box (sekarang berubah menjadi Harmony Edge Box) adalah sebuah Computer dengan ukuran mini dengan kebutuhan khusus dan di design dengan spesifikasi industrial. belakangan lebih sering disebut sebagai IoT Box karena kebanyakan digunakan sebagai bridge ke IoT. lebih lengkapnya dapat di cek diwebsite Schneider Electric:

Kali ini saya akan membahas bagaimana menggunakan IoT Box terutama untuk yang versi Linux, untuk digunakan sebagai gateway Modbus TCP ke Modbus Serial. menggunakan NodeRED

flow di NodeRED untuk menjadikan IoT Box sebagai gateway.
READ MORE

Industrial Communication Protocol Segregation

Mengapa ada banyak sekali protokol komunikasi data di dunia ini?

Mungking ini pertanyaan yang sering terpikirkan dibanyak benak orang banyak selama ini. apa saja Industrial protocol yang ada? sangat-sangat banyak… karena setiap brand device mengusung protocolnya masing-masing dan dengan keunggulannya masing-masing. bisa di cek di Driver List protocol Machine SCADA Expert bayangkan disini saja ada 200driver.

tapi, dari kesemua protokol, ada beberapa Industrial protokol (yang digunakan untuk Control System) yang sangat-sangat common atau populer di segment nya masing-masing yang digunakan banyak brand. apa saja?

Modbus, Profibus, Modbus TCP, Profinet, Ethernet/IP, DeviceNET, DNP3, IEC61850, BAC, BACNET, IEC 60870-5-101, IEC 60870-5-104, EtherCAT, LonWorks, CANOpen, HART.

Ayo kita segragasi berdasarkan pemakaiannya:

Industri Proses (Field Bus, Instrumentation / Transmitter) :
  • Modbus
  • HART
  • Profibus PA
  • FF (FieldbusFoundation)
Industri Proses (device network)
  • Modbus TCP
  • Profinet
  • Ethernet/IP (CIP)
Industri Proses (Control Network – To software Communication)
  • Modbus TCP
  • EtherNet/IP
Industri Proses – Telemetry
  • DNP3
  • IEC 60870-5-101/104
  • Modbus
Manufacturing
  • CANOpen
  • AS-i
  • DeviceNET
  • Profibus (PA/DP)
  • CANBus
Substation Automation / Electrical Device Network
  • IEC 61850
  • DNP3
  • IEC 60870-5-101/104
  • Modbus
Building Automation
  • BACNet – create by ASHRAE
  • LonWorks
  • Modbus

Baca INT 64 bit di SCADA?

seperti kita ketahui, kebanyakan SCADA belum support tipe data Integer 64 bit (max value: 9,223,372,036,854,775,807), lalu gimana kalau kita mau baca dari device yang menyediakan data ini? contohnya pada power meter Schneider untuk data KWH

berikut trik nya:

  1. Siapkan 1 variable Real / floating 32bit – sebagai contoh kita kasih nama Energy)
  2. Siapkan 4 variable INT (16bit) dimana nilai tersebut  didapat dari register modbus PM yaitu 43204, 43205, 43206, 43207) – sebagai contoh kita kasih nama RAW_1 dan RAW_2, RAW_3, dan RAW_4

Energy = (raw_4 * 281474976710656) + (raw_3 * 4294967296) + (raw_2 *  65536) + raw_1

Node-Red ~ Modbus Floating Point Convert (Float32 / Real)

this function script is used to convert your 2 words into Float32bit

/* Converts from an number, string, buffer or array representing an IEEE-754 value
 to a javascript float.
 The following may be given in msg.payload:
 A string representing a number, which may be hex or binary
 examples, "1735" "0x02045789" 0b01000000010010010000111111011011
 An integer value
 A two element array or buffer of 16 bit values, less significant byte first.
 A four element array or buffer of 8 bit values, most significant byte first.
 Source: https://flows.nodered.org/flow/359ead34237b7ab6ec0465ee85a34b62
 */
 // first make a number from the given payload if necessary
 let intValue;
 if (typeof msg.payload === "number") 
{
 intValue = msg.payload;
 } else if (typeof msg.payload === "string") {
 intValue = Number(msg.payload);
 } else if (msg.payload.length == 2) {
 // two int array or buffer
 intValue = (msg.payload[1] << 16) + msg.payload[0];
 } else if (msg.payload.length == 4) {
 // four byte array or buffer
 intValue = (((((msg.payload[0] << 8) + msg.payload[1]) << 8) + msg.payload[2]) <<
 8) + msg.payload[3];
 } else {
 node.warn("Unrecognised payload type or length");
 } 
 msg.payload = Int2Float32(intValue);
 msg.payload = msg.payload.toFixed(1);
 return msg;
 function Int2Float32(bytes) {
 var sign = (bytes & 0x80000000) ? -1 : 1;
 var exponent = ((bytes >> 23) & 0xFF) - 127;
 var significand = (bytes & ~(-1 << 23));
 if (exponent == 128)
 return sign * ((significand) ? Number.NaN : Number.POSITIVE_INFINITY);
 if (exponent == -127) {
 if (significand === 0) return sign * 0.0;
 exponent = -126;
 significand /= (1 << 22);
 } else significand = (significand | (1 << 23)) / (1 << 23);
 return sign * significand * Math.pow(2, exponent);
 }

Modbus-IoT (Modbus over MQTT)

Modbus?? old school protocol (more than 40th years).

when Modbus created, it was created for Serial communication via RS485. after year by year, technology was changing and ethernet / TCP widely used in PLC and industrial control system, then Modbus move their medium to Ethernet and wrap their message in TCP (encapsulated) over ethernet.

Now, when everything going to the cloud or  RTU/PLC are not in the same place with SCADA and it only have internet connection, it will be hard and expensive for Modbus to keep exist in Internet area. because we need at least public IP for each device, or creating VPN.

but with MQTT the message can be send over the broker (on the cloud), so it will be exiting if modbus can be sent through MQTT.

if you’ve heard about Node-red this is cool IoT tools/platform built in NodeJS.

I’m using Node-red to make it’s encapsulation, and Modscan as Modbus Master (or SCADA), and Modsim as Modbus Slave (or  PLC)

READ MORE

Vijeo XL ( Machine SCADA )- Indusoft Web Studio – Intouch Machine Edition – Blue Open Studio

Pada tahun 2013, Indusoft sebuah software company yang bermarkas di Texas USA, di akuisisi / dibeli oleh Vendor dan Multinational Company yang membindagi automation software dan DCS ternama yaitu Invensys dimana perusahaan ini memiliki sebuah rentang produk yang cukup lengkap dari Mulai DCS nya Foxboro DCS, Triconex Safety System, dan si Worldwide Market Leader untuk SCADA dan HMI yaitu Wonderware. Walaupun bertahun-tahun sebelumnya Invensys sudah mengakuisisi Wonderware, sepertinya masih belum puas dengan fitur-fitur dan segment yang ditawarkan oleh Wonderware baik Wonderware System Platform dan keturunannya seperti Intouch HMI. Mungkin Invensys mengejar ranah low-end market dimana indusoft pada saat itu bermain di OEM software dan HMI kelas murah.

READ MORE

Water Tank PLC Control Simulation with Matlab Simulink

httpvh://youtu.be/Uz827S7tjRU

To play this simulation you need to have this item:

  1. Unity PRO S (minimum) / Unity Pro L /Unity Pro XL. Version 5 / 6 / 7 / 8 (I’m not provide the installer, you can find on another forum 1.5 Gb)
  2. Matlab 2012 / Matlab 2013 with simulink (I’m not provide the installer, you can find on another forum 6.5Gb)
  3. Modbus Ehternet OPC Server (Iconics) http://adf.ly/lA1Gt this is free OPC server, you don’t need to license the software
  4. Simulink Model, OPC Configuration(should be load from iconics modbus OPC Server) http://adf.ly/lA205

READ MORE

Trik mencari modbus register

Anda pernah mengalami kesulitan ketika mencari register address dari device modbus yang datasheetnya sudah hilang atau susah ditemukan di internet, atau merek yang jarang dipakai banyak orang? maka jika anda memilki software untuk membaca data pengukuran dari device tersebut maka anda masih ada kesempatan untuk mengetahui registernya. READ MORE

Modbus Exception Codes

Modbus Exception Codes adalah  sebuah reply dari slave ketika kita mengQuery ke slave.

susunan Frame nya sebagai berikut:

[Slave Address] [Function Code Exception] [Error Code] [CRC1] [CRC2]

 

Function Code Exception:

merupakan “exception code” dari “function code” yang kita query kan ke Slave
contoh:

ketika kita merequest Funtion code 03 (Read Holding Register) maka exception code-nya adalah 83

ketika kita merequest Funtion code 06 (Write Multiple Register) maka exception code-nya adalah 86

Berikut adalah tabelnya:

Function Code in Request

Function Code in Exception Response

01 (01 hex) 0000 0001

129 (81 hex) 1000 0001

02 (02 hex) 0000 0010

130 (82 hex) 1000 0010

03 (03 hex) 0000 0011 131 (83 hex) 1000 0011

04 (04 hex) 0000 0100

132 (84 hex) 1000 0100
05 (05 hex) 0000 0101 133 (85 hex) 1000 0101
06 (06 hex) 0000 0110 134 (86 hex) 1000 0110
15 (0F hex) 0000 1111 143 (8F hex) 1000 1111
16 (10 hex) 0001 0000 144 (90 hex) 1001 0000

Error Code:

merupakan pesan error yang ingin disampaikan oleh slave terdiri seperti pada tabel dibawah:

Code Name Description
01 ILLEGAL FUNCTION The function code received in the query is not an allowable action for the slave
02 ILLEGAL DATA ADDRESS The data address received in the query is not an allowable address fror the slave
03 ILLEGAL DATA VALUE A value contained in the query data field in not an allowabel value for the slave.
04 SLAVE DEVICE FAILURE An unrecoverable error occurred while the savel was attempting to execute the requested action
05 ACKNOWLEDGE The slave has accpeted the request and is processing it, but a long duration of time is required to do so.
06 SLAVE DEVICE BUSY The slave is engaged in a long duration command.
07 NEGATIVE ACKNOWLEDGEMENT The slave cannot perform the program function received I the query
08 MEMORY PARITY ERROR The slave attempted to read extended memory, but detected a a parity error on the memory

Atau yang lebih lengkap:

Exception Code

Name

Meaning

01
(01 hex)

Illegal
Function

The function code received in the query is not an allowable action for the slave. This may be because the function code is only applicable to newer devices, and was not implemented in the unit selected. It could also indicate that the slave is in the wrong state to process a request of this type, for example because it is unconfigured and is being asked to return register values. If a Poll Program Complete command was issued, this code indicates that no program function preceded it.

02
(02 hex)

Illegal Data Address

The data address received in the query is not an allowable address for the slave. More specifically, the combination of reference number and transfer length is invalid. For a controller with 100 registers, a request with offset 96 and length 4 would succeed, a request with offset 96 and length 5 will generate exception 02.

03
(03 hex)
Illegal Data Value A value contained in the query data field is not an allowable value for the slave. This indicates a fault in the structure of remainder of a complex request, such as that the implied length is incorrect. It specifically does NOT mean that a data item submitted for storage in a register has a value outside the expectation of the application program, since the MODBUS protocol is unaware of the significance of any particular value of any particular register.

04
(04 hex)

Slave Device Failure

An unrecoverable error occurred while the slave was attempting to perform the requested action.
05
(05 hex)
Acknowledge Specialized use in conjunction with programming commands.
The slave has accepted the request and is processing it, but a long duration of time will be required to do so. This response is returned to prevent a timeout error from occurring in the master. The master can next issue a Poll Program Complete message to determine if processing is completed.
06
(06 hex)
Slave Device Busy Specialized use in conjunction with programming commands.
The slave is engaged in processing a long-duration program command. The master should retransmit the message later when the slave is free..
07
(07 hex)
Negative Acknowledge The slave cannot perform the program function received in the query. This code is returned for an unsuccessful programming request using function code 13 or 14 decimal. The master should request diagnostic or error information from the slave.
08
(08 hex)
Memory Parity Error Specialized use in conjunction with function codes 20 and 21 and reference type 6, to indicate that the extended file area failed to pass a consistency check.
The slave attempted to read extended memory or record file, but detected a parity error in memory. The master can retry the request, but service may be required on the slave device.
10
(0A hex)
Gateway Path Unavailable Specialized use in conjunction with gateways, indicates that the gateway was unable to allocate an internal communication path from the input port to the output port for processing the request. Usually means the gateway is misconfigured or overloaded.
11
(0B hex)
Gateway Target Device Failed to Respond Specialized use in conjunction with gateways, indicates that no response was obtained from the target device. Usually means that the device is not present on the network.

 

 

Sumber:
http://ehelp.ingeardrivers.com/mbopc/trouble_shooting/error_codes/modbus_exception_codes.htm

http://www.simplymodbus.ca/exceptions.htm

Menggunakan Modbus Slave Multiple RTU

Modbus Slave Multiple RTU merupakan software yang berfungsi sebagai simulator pengganti PLC/Transmitter berbasis modbus. Jadi software ini menjadi PLC “Dummy” yang berisikan register-register modbus (Holding Register, Input Register, Status Register, dan Coil Register). Register tersebut dapat diakses menggunakan serial port dengan menggunakan PLC ataupun Komputer lain yang berfungsi sebagai HMI. Kegunaannya adalah untuk menggantikan PLC sebenarnya agar ketika membuat HMI akan lebih praktis ketika mencoba mengakses register. Kelebihan utama software ini yaitu dapat menjadi beberapa “dummy” sekaligus. cocok untuk membuat HMI pada SCADA system yang memiliki banyak RTU agar lebih praktis tidak memerlukan menggunakan banyak PLC yang sebenarnya.

READ MORE