GEI-100535

g
GE Industrial Systems

Direct Modbus for Mark VI and

EX2100
These instructions do not purport to cover all details or variations in equipment, nor
to provide for every possible contingency to be met during installation, operation,
and maintenance. The information is supplied for informational purposes only, and
GE makes no warranty as to the accuracy of the information included herein.
Changes, modifications and/or improvements to equipment and specifications are
made periodically and these changes may or may not be reflected herein. It is
understood that GE may make changes, modifications, or improvements to the
equipment referenced herein or to the document itself at any time. This document is
intended for trained personnel familiar with the GE products referenced herein.
GE may have patents or pending patent applications covering subject matter in this
document. The furnishing of this document does not provide any license whatsoever
to any of these patents. All license inquiries should be directed to the address below.
If further information is desired, or if particular problems arise that are not covered
sufficiently for the purchasers purpose, the matter should be referred to:
GE Industrial Systems
Post Sales Service
1501 Roanoke Blvd.
Salem, VA 24153-6492 USA
Phone: + 1 888 GE4 SERV (888 434 7378, United States)
+ 1 540 378 3280 (International)
Fax: + 1 540 387 8606 (All)
(+ indicates the international access code required when calling from outside
the USA)
This document contains proprietary information of General Electric Company, USA
and is furnished to its customer solely to assist that customer in the installation,
testing, operation, and/or maintenance of the equipment described. This document
shall not be reproduced in whole or in part nor shall its contents be disclosed to any
third party without the written approval of GE Industrial Systems.
GE PROVIDES THE FOLLOWING DOCUMENT AND THE INFORMATION
INCLUDED THEREIN AS IS AND WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY IMPLIED
STATUTORY WARRANTY OF MERCHANTABILITY OR FITNESS FOR
PARTICULAR PURPOSE.
Issue date: 2002-03-11
2002 by General Electric Company, USA.
All rights reserved.

PC/104 is a trademark of the PC/104 Consortium

Belden is a registered trademark of Belden Electronic Wire and Cable of Cooper
Industries
Modbus is a registered trademark of Gould, Inc.
Ethernet is a registered trademark of Xerox Corporation
SPEEDTRONIC is a trademark of General Electric Company, USA
Innovation Series is a trademark of General Electric Company, USA
Contents
Section Page
Safety Symbol Legend ................................................................................................ 3
Related Toolbox Documents ....................................................................................... 3
Introduction ................................................................................................................. 4
RS-232C Serial Interface............................................................................................. 5
RS-232C Cable and Connector Signals................................................................ 6
Serial Port Parameters .......................................................................................... 7
RS-232C Asynchronous Multi-point Line Driver (Black Box LD485A-MP)............. 9
LD485A-MP RS-232C Cables ........................................................................... 10
GE Multilin F485-120 Communications Converter .................................................. 11
Connection and Configuration ........................................................................... 12
Baud Rate ........................................................................................................... 14
DTE/DCE Control.............................................................................................. 14
Ethernet Interface ...................................................................................................... 14
Configuring the Controller Modbus Interface ........................................................... 15
Modbus Data Format and Scaling ............................................................................. 20
Data Scaling ....................................................................................................... 20
Short Modbus Points .......................................................................................... 21
Long Modbus Points .......................................................................................... 21
Float Modbus Points........................................................................................... 22
Modbus Data Conversions: Boolean Bit ............................................................ 22
Modbus Data Conversions: Analogs .................................................................. 22
Modbus Command and Response Definition ............................................................ 23
Message Format ................................................................................................. 23
Message Errors................................................................................................... 23
Function Code Descriptions ...................................................................................... 25
Function Code 01: Read Output Coils................................................................ 25
Function Code 02: Read Input Coils .................................................................. 26
Function Code 03: Read Holding Registers ....................................................... 26
Function Code 04: Read Input Registers............................................................ 27
Function Code 05: Force Single Output Coil ..................................................... 28
Function Code 06: Preset Single Holding Register ............................................ 28
Function Code 07: Read Exception Status ......................................................... 29
Function Code 15: Force Multiple Output Coils ................................................ 29
Function Code 16: Preset Multiple Holding Registers ....................................... 30
Modbus Diagnostic Aids ........................................................................................... 31

2 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

Safety Symbol Legend
Indicates a procedure, practice, condition, or statement that,
if not strictly observed, could result in personal injury or
death.

Indicates a procedure or condition that, if not strictly

observed, could result in damage to or destruction of
equipment.

Note Indicates an essential or important procedure or statement.

Related Toolbox Documents

The GE controller Modbus page is configured by using the GE Control System
Toolbox (toolbox). For complete details on using the toolbox, refer to the appropriate
toolbox document below:
Mark VI SPEEDTRONIC GEH-6403
Turbine Control System
EX2100 Excitation System GEH-6414
LS2100 LCI Static Starter GEH-6415
Innovation Series GEH-6402
Controller

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 3

Introduction
See sections, RS-232C
Asynchronous Multi-Point
Line Driver and GE Multilin
F485 Communications
Converter.
4 Direct Modbus Communications for Mark VI and EX2100 Controllers
The Mark VI, EX2100, LS2100, and Innovation Series controller can be a Modbus
slave on either an RS-232C serial connection or over Ethernet.
The serial interface to the controller is a full-duplex RS-232C connection. It is
possible to use this connection on a half-duplex or an RS-485 serial network by
using additional interface devices. Two types of interface devices are used in the RS-
232C serial communications to the controller, the Black Box LD485A-MP and the
GE Multilin F485-120. The LD485A-MP is used when a long distance (>50 ft) full-
duplex interface is required and the F485-120 is used when a half-duplex interface is
required.
Note Modbus support is available for either simplex or triple modular redundant
(TMR) configurations of the Mark VI, but only in simplex mode for the EX2100,
LS2100, and Innovation Series controller. In the TMR configuration, commands are
replicated to multiple controllers so only one physical Modbus link is required.
There are four Modbus register page types:
Input coils
Output coils
Input registers
Holding registers
Since the controller has high priority control code running at a fixed frame rate, it is
necessary to limit the amount of CPU resources that can be used by the Modbus
interface. To control the run time, a limit on the number of commands per second
received by the controller is enforced. The controller returns a busy status when
more than 10 commands are sent in a one-second period. The controllers control
code can also disable all Modbus commands by setting an internal logical signal.
GEI-100535
RS-232C Serial Interface
Terms describing the various
signals used in the sending or
receiving of data are
expressed as from the DTE
device. For example, the
signal transmit data (TD)
represents the transmission of
data coming from the DTE
device going to the DCE
device.
RS-232C is a technical specifications standard of the Electronic Industries
Association (EIA) for serial communications equipment (C denotes the standards
revision). This specification standard specifies the control functions and signal paths
of signal lines interconnecting Data Terminal Equipment (DTE) and Data
Communication Equipment (DCE). DTEs are usually computers, pcs, printers, and
CRTs, while DCEs are usually modems.
The RS-232C specification specifies twenty-five signal lines: twenty lines for
routine operation, two lines for modem testing, and the three remaining lines are
unassigned. Nine of the signal pins are used in a nominal RS-232C communication
system. Cable references refer to the 9-pin cable definitions found in Table 1.
Each RS-232C signal uses a single wire. The RS-232C standard specifies the
conventions used to send sequential data as a sequence of voltage changes to signify
the state of each signal. Depending on which signal group, a negative voltage (less
than 3 V) represents either a binary one data bit, a signal mark, or a control off
condition, while a positive voltage (greater that +3 V) represents either a binary zero
data bit, a signal space, or a control on condition. Because of voltage limitations, an
RS-232C cable may not be longer than fifty feet.
A DTE device is identified as a device that transmits serial data on pin 3 (TD) of a 9-
pin RS-232C cable (see pin definitions in Table 1). A DCE device is identified as a
device that transmits serial data on pin 2 (RD) of a 9-pin RS-232C cable.
Using this definition, the GE slave Modbus system is a DTE device because it
transmits serial data on pin 3 (TD) of the 9-pin RS-232C cable. If the master Modbus
device is also a DTE device, connecting the master and slave devices together will
require an RS-232C null modem cable. Pin definitions for 9-pin RS-232C straight
through and null modem cables are shown below.

S traigh t T hrou gh R S -232C C ab le N u ll M o dem R S -232C C ab le

D TE P in s D C E P ins D TE P ins D TE P in s
1 (D C D ) 1 (D C D ) 1 (D C D ) 1 (D C D )
2 (R D ) 2 (R D ) 2 (R D ) 2 (R D )
3 (TD ) 3 (TD ) 3 (TD ) 3 (TD )
4 (D TR ) 4 (D TR ) 4 (D TR ) 4 (D TR )
5 (G N D ) 5 (G N D ) 5 (G N D ) 5 (G N D )
6 (D S R ) 6 (D S R ) 6 (D S R ) 6 (D S R )
7 (R TS ) 7 (R TS ) 7 (R TS ) 7 (R TS )
8 (C TS ) 8 (C TS ) 8 (C TS ) 8 (C TS )
9 (R I) 9 (R I) 9 (R I) 9 (R I)

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 5

 Table 1. RS-232C Connector Pin Signals

9-Pin 25-Pin Description DTE DTE Signal Function

Output Input Type
1 8 DCD (data carrier X Control Signal comes from the other RS-
detect) 232C device telling the DTE device
that a circuit has been established
2 3 RD (receive data) X Data Receiving serial data
3 2 TD (transmit data) X Data Transmitting serial data
4 20 DTR (data terminal X Control DTE places positive voltage on this
ready) pin when powered up
5 7 GND (signal ground) Ground Must be connected
6 6 DSR (data set ready) X Control Signal from other RS-232C device
identifying to DTE that the other RS-
232C device is powered up
7 4 RTS (request to send) X Control DTE has data to send and places
this pin high to request permission
to transmit
8 5 CTS (clear to send) X Control DTE looks for positive voltage on
this pin for permission to transmit
data
9 22 RI (ring indicator) X Control A modem signal indicating a ringing
signal on the telephone line

RS-232C Cable and Connector Signals

Nine of the twenty-five RS-232C pins are used in a common asynchronous
application. All nine pins are necessary in a system configured for hardware
handshaking. The GE Modbus system does not use hardware handshaking, therefore
it requires just three wires, receive data (RD, pin 2), transmit data (TD, pin 3) and
signal ground (GND, pin 5), to transmit and receive data.
The signals used are broken down into four groups: data, control, timing, and ground
(see Table 1).
Data signal wires send and receive serial data. Pin 2 (RD) and pin 3 (TD) transmit
data signals. A positive voltage (> +3 volts) on either of these two pins signifies a
logic 0 data bit or space data signal. A negative voltage (< 3 volts) on either of
these two pins signifies a logic 1 data bit or mark signal.
Control signals coordinate and control the flow of data over the RS-232C cable.
Pins 1 (DCD), 4 (DTR), 6 (DSR), 7 (RTS), and 8 (CTS) are control signals. A
positive voltage (> +3 volts) indicates a control on signal, while a negative voltage
(< 3 volts) signifies a control off signal. When a device is configured for hardware
handshaking these signals are used to control the communications.
Timing signals are not used in an asynchronous 9-wire cable. These signals,
commonly called clock signals, are used in synchronous communication systems to
synchronize the data rate between transmitting and receiving devices. The logic
signal definitions used for timing are identical to those used for control signals.
Ground signals (signal and frame ground) on both ends of an RS-232C cable must
be connected. Pin 7 (GND) of a 9-pin connector is the signal ground. Frame ground
is sometimes used in 25-pin RS-232C cables as a protective ground.

6 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

 Serial Port Parameters
An RS-232C serial port is driven by a computer chip called a universal asynchronous
receiver/transmitter (UART). The UART sends an 8-bit byte of data out of a serial
port preceded with a start bit, the eight data bits, an optional parity bit, and one or
two stop bits. The device on the other end of the serial cable must be configured the
same as the sender to understand the received data. The software configurable setup
parameters for a serial port are baud rate, parity, stop, and data bit counts.
Transmission baud rate signifies the bit transmission speed measured in bits per
second. Parity adds an extra bit that provides a mechanism to detect corrupted serial
data characters. Stop bits are used to pad a serial data character to a specific number
of bits. If the receiver expects eleven bits for each character, the sum of the start bit,
data bits, parity bit, and the specified stop bits should equal eleven. The stop bits are
used to adjust the total to the desired bit count.
UARTs support three serial data transmission modes:
Simplex (one way only)
Full-duplex (bi-directional simultaneous)
Half-duplex (non-simultaneous bi-directional)
The Modbus slave device supports only full duplex data transmission. Its RS-232C
serial port configuration parameters are specified on the run command line. The
following software configurable RS-232C definitions are user-specified arguments
on the Modbus programs run command line. The SYS process issues these
commands when starting up Modbus when CCM3 is configured into the system.
The slave devices QNX command line is:
modbus stn_addr [Device=0|1|2|3] [Baud=9600|19200] [Stop_bits=1|2]
[Parity=even|odd|none] [Code=7|8 (data bits)] p<priority> &
Defaults: d=1 b=19200 s=1 p=none c=8
Station address must be between 1:255
Device is the physical RS-232C port used for communications. The Modbus slave
device uses device two on a normal system. An optional PC/104 WinSystems
PCM-COM4A Serial Communications board can be installed onto a UCPB board to
add up to four additional serial connections. With the optional WinSystems serial
board, devices two, three, four, five, and six are supported. The default device is
number two.
Baud is the serial data transmission rate of the Modbus device measured in bits per
second. The Modbus slave device supports 9600 and 19200 baud. The default baud
rate is 19200.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 7

 Stop bits are used to pad the number of bits that are transmitted for each byte of
serial data. The Modbus slave device supports one or two stop bits. The default is
one stop bit. If the serial communication system expects 11 bits for each data byte,
then the bit count will be as follows: (see examples below)
1 start bit
8 data bits (least significant bit is sent first)
1 bit for even or odd parity (no bit for no parity)
1 stop bit if parity is used (2 stop bits for no parity)

Serial Data Bit Sequencing, with Parity Checking

Start Bit Bit 1 Bit 2 Bit 3 Bit 4 Bit 5 Bit 6 Bit 7 Bit 8 Parity Bit Stop Bit

Serial Data Bit Sequencing, without Parity Checking

Start Bit Bit 1 Bit 2 Bit 3 Bit 4 Bit 5 Bit 6 Bit 7 Bit 8 Stop Bit Stop Bit

Parity provides a mechanism to error check individual serial 8-bit data bytes. The
Modbus slave device supports none, even, and odd parity. The default parity is none.
Code (byte size) is the number of data bits in each serial character. The Modbus
slave device supports seven and eight bit data bytes. The default byte size is eight
bits.

8 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

RS-232C Asynchronous Multi-point Line Driver (Black
Box LD485A-MP)
The Black Box LD485A-MP is an RS-232C to RS-485 interface converter. It permits
an RS-232C device to transport data over a much longer distance than the normal 50
feet. Using the LD485A-MP, 19200 baud serial data can be transmitted up to 1.2
miles.
A multi-point Modbus installation links one or more slave controllers to the single
master controller (see multi-point Modbus system illustration below). Using
LD485A-MP line drivers, the master and individual slave controllers each use their
own line driver to communicate over a single RS-485 based network. As many as 64
devices can be linked together using a twisted-pair 4-wire cable.

Master Controller Slave Controller Slave Controller Slave Controller

RS-232C RS-232C RS-232C RS-232C

LD485A-MP LD485A-MP LD485A-MP LD485A-MP

RS-485 RS-485 RS-485 RS-485

RS-485 Network

The master and slave devices are both set up as DTE devices. Both the master and
slave devices are connected to the LD485A-MP with a straight through 9-wire cable.
The two LD485A-MPs are connected together with a 4-wire twisted-pair cable as
follows:
The masters TXA is connected to the slaves RXA.
The masters TXB is connected to the slaves RXB.
The masters RXA is connected to the slaves TXA.
The masters RXB is connected to the slaves TXB.

Note A suggested cable to use for connecting the two LD485A-MPs is Belden
low capacitance 2-twisted-pair 24 gauge cable catalog number 9842.

The recommended jumper settings for the LD485A-MP are shown in Table 2.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 9

 Table 2. Black Box LD485A-MP Jumper Settings

Jumper/Switch Slave LD485A-MP Master LD485A-MP Description

XW1A Installed Installed DCE device
XW1B Not installed Not installed Not a DTE device
S1 Normal Normal Normal mode
S2 On On Terminated
W7 Out Out Signal ground not
connected to frame ground
W8 Full Full Full duplex
W9 5 ms On CTS delay
W15 A-B A-B DTR/RTS/CD enabled
W16 N/A N/A Not used
W17 N/A N/A Not used
W18 B-C B-C RTS enables driver

Note Jumper W9 is the only jumper different between the master and slave LD485A-MPs.

LD485A-MP RS-232C Cables

Connect a slave device to LD485A-MP with a straight through 9-pin to 25-pin cable.
Use a 9-pin receptacle connector wired to a 25-pin plug connector per Table 3.

Table 3. 9-Pin to 25-Pin Connector Pin Signals

9-Pin 25-Pin Description

Receptacle Plug Pin
Pin No. No.
1 8 DCD (data carrier detect)
2 2 RD (receive data)
3 3 TD (transmit data)
4 20 DTR (data terminal ready)
5 7 GND (signal ground)
6 6 DSR (data set ready)
7 4 RTS (request to send)
8 5 CTS (clear to send)
9 22 RI (ring indicator)

10 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

GE Multilin F485-120 Communications Converter
The GE Multilin F485-120 Communications Converter (F485) is a self-contained
device for converting full-duplex RS-232C signals to half-duplex RS-485 signals. It
can be used with direct or modem communications. The F485-120 uses internal
switches to select the conversion type (RS-232C to RS-485) and the RS-485
communications baud rates (from 1200 to 57600 baud). It uses the data on the serial
port to determine direction and therefore requires no hardware handshaking signals
from the computer. The F485-120 is powered through the supplied power adapter or
by connecting an external 9 V ac or dc source to the power supply terminals on the
back of the unit.
The front panel has LED indicators to show the following:
Power
RS-232C RX
RS-232C TX
RS-485 RX
RS-485 TX

The ground terminal must be connected to ground to ensure

adequate protection from transients.

The back of the F485-120 provides the following connectors:

RS-232C 9-pin receptacle that accepts a standard 9-pin computer cable (9-pin to
9-pin and 9-pin to 25-pin interface cables are provided)
RS-485 terminals that accept a standard shielded twisted pair and provide
connections for positive, negative, and shield. (The terminating network is
internal and no external terminating network is required.)
Power jack for connecting the supplied 120 V ac to 9 V ac adapter (if used)
Power terminals that accept either 9 V ac or 9 V dc power instead of using the
supplied adapter.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 11

 Connection and Configuration
Typical F485 connection method for RS-232C to RS-485 is shown below.

RS-485

4000 feet maximum

32 devices maximum 2-wire shielded
twisted pair
120 ohm terminating
resistor
100 pF termination
capacitor

RS-232C
Controller

GE Multilin
F485 Converter
Note:
Shield should be grounded at one place only.
A terminating network should be attached to the last
device in the link. The F485 has a built-in terminator
at the beginning of the link.

The F485 is configured through two internal DIP-switch banks that are accessible by
removing the box cover (see illustration below). Switches A1 A8 are used to set
the baud rate for RS-485 communication and determine whether the F485 is DTE
(RS-232C direct) or DCE (RS-232C modem). Switches B1 B6 select the interface
type. The designation for each switch is marked on the printed circuit board.

ON
Switches
B1 B8
ON
Switches
A1 A8

12 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

 Refer to Tables 4 and 5 for switch A position settings and Table 6 for switch B
position settings.

Selecting switch positions other than those shown in the

tables will cause unpredictable results.

Table 4. DIP-switch A Baud Rate Position Settings

Baud DIP-switch Position

Rate A1 A2 A3 A4 A5 A6 A7
1200 On Off Off Off Off Off Off
2400 Off On Off Off Off Off Off
4800 Off Off On Off Off Off Off
9600 Off Off Off On Off Off Off
19200 Off Off Off Off On Off Off
(default)
38400 Off Off Off Off Off On Off
57600 Off Off Off Off Off Off On

Table 5. DIP-switch A DTE/DCE Select Position Settings

Mode DIP-switch
A8 Position
DTE Off
DCE On

Table 6. DIP-switch B Configuration Position Settings

Configuration B1 B2 B3 B4 B5 B6
RS-232C to Off On Off On Off Off
RS-485
RS-232C to Off Off Off Off On On
fiber-optic*
RS-485 to On Off On Off Off Off
fiber-optic*
*These switch settings are not used for Modbus to
controller configurations.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 13

 Baud Rate
Two-wire RS-485 is half-duplex and requires a method for switching between a
receive or transmit state. The F485 converter uses the incoming data to control the
direction and requires no control signals from the master device (RS-232C) to switch
from transmit to receive mode after the last character has been transmitted. The baud
rate switches control the length of time that the RS-485 transmitter remaining in the
transmit direction after the last character has been transmitted. The length of time is
fixed at 3.5 character times at the selected baud rate making it useable with Modbus
RTU protocol.

DTE/DCE Control
The DTE/DCE setting reverses the transmit/receive data lines on the RS-232C side.
For communications between a computer and a slave device, DTE (direct) should be
selected. When connecting the F485 to a modem or other data communication
equipment, DCE should be selected. Another application that requires DCE is when
two F485s are connected back-to-back, such as converting RS-232C to RS-485, and
then converting the RS-485 back to RS-232C. In this case, the second F485 must be
set to DCE control.

Ethernet Interface
The controller supports Ethernet Modbus as a standard slave interface. Ethernet
establishes high-speed communication between the various portions of the control
system. Ethernet Modbus protocol is layered on top of the TCP/IP stream sockets.
The controller follows the Open Modbus /TCP Specification as defined by Modicon
(Schneider Electric), for class 0 and class 1 commands. This document is available
on the www.modicon.com web site. The master sends commands to TCP port 502 on
the controller. Modbus commands can be sent to any of the Ethernet physical
connections on the controller as long as they use the dedicated TCP port.
Refer to the Ethernet installation guidelines in GEH-6421, Volume I, Chapter 5 for
details on how to connect Ethernet to the controller.

14 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

Configuring the Controller Modbus Interface
UCVD and UCVE boards The controller Modbus page is configured by using the GE Control System Toolbox
support the Modbus (toolbox). For complete details on using the toolbox, refer to the appropriate toolbox
interfaces. document listed in section, Related Toolbox Documents.

Note The toolbox user privilege level must be set to at least two to create an I/O
device. (From the Options menu, select Privelege, then select 2).

Once a controller has been created in the toolbox, Modbus interfaces can be inserted
in the Outline View in order to access the Modbus functionality available on certain
hardware forms.

To insert a Modbus interface

1. From the toolbox Outline View (left side of screen), click on the item
Hardware and I/O Definitions.

2. From the Edit menu, select Insert First. Or, click the right-mouse button and
select Insert First. The New I/O or Network Interface dialog box displays.

Select Serial/Ethernet
Modbus, then click OK.

The Modbus Interface network configuration screen displays. The interface

pertains to all the Modbus pages.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 15

Define the necessary Ethernet or Serial
connection fields. Ethernet connections
only need the Name and Station Addr
fields defined. Serial connections also
need the Port, Mode, Baud Rate, Data
Bits, Parity, and Stop Bits fields
defined. (Most serial connections use the
configuration shown in this screen.)

Specify if the interface is Serial,

Ethernet, or Shared
Serial/Ethernet. When Shared
Serial/Ethernet is selected, Serial
and Ethernet Modbus will share the
same register pages.

The Input Enable Signal is defined

if the control codes needs to inhibit
Modbus commands from the master.
This signal is provided so that a
control hierarchy scheme can be
implemented in the GE controller
control code.

3. Click OK. The Modbus item displays under the Hardware and I/O
Definition in the Outline View.

Note It is possible to define two different register sets, one Serial and one Ethernet
by creating two Hardware and I/O Definition entries in the Outline View screen
and selecting one to be Serial and the other to be Ethernet.

16 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

 To modify Modbus page settings
1. Click the Hardware and I/O Definitions item to highlight it. From the Edit
menu, select Insert First. Or, click the right-mouse button and select Insert
First. A new item for Pg1 displays.
2. Double-click on Pg1 to modify the page settings.

Change the Page Name

from PG1 to an
appropriate name.

Set the Page Length to

be the number of
registers in the page.

Select the Address

Type (register page
type) of Modbus
page you want to
create.

Use the default settings

for other options.

Repeat these steps for each register page you want to create. Once a page is inserted,
Modbus points can be added.

Note Create pages with the same Address Type but with different register ranges
by assigning a higher First Address. For example, define a page of holding
registers in the range on 1 to 200 and another page in the range of 1001 to 1200. The
advantage of doing this is that a master would get an error if it tried to reference
holding registers between 201 and 1000.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 17

 To insert Modbus page point settings
1. From the Outline View, select a Modbus page. From the Edit menu, select
Insert First. Or, click the right-mouse button and select Insert First. The
Point Settings dialog box displays. This item associates a controller signal
with a Modbus point.
Enter the Name of the
GE controller signal that
will be associated with
this point.

Specify the Address of

the register S1\TNH

Select Data Type as Bit,

Short, Long, or Float.

The Direction field

specifies if the data is a
Write or Read with
respect to the
Controller. (On Input
Coil and Input Register
pages this field is
always set to Write.)

Check this option to

indicate whether or not
scaling is applied when
converting the point
between the Modbus point
and GE controller signal.
Refer to the section,
Modbus Data Format and
Scaling, for more details
on supported Modbus data
types and scaling records.
To insert Modbus page point settings
1. From the Outline View, expand the Function item.
2. Select the item Signal Definition.

18 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

 3. From the Edit menu, select Insert First. Or, click the right-mouse button and
select Insert First. The Edit Signal Definition dialog box displays.
Enter the name of the signal
with at least one and up to
three regions followed by a
signal name. Separate the Enter a scale definition for this device. From the dropdown list,
region(s) and name with a select Custom to create a locally defined scale. Click Edit... to
backslash, such as reg1/ view predefined scales.
signal_name. The Region
can be six characters,
maximum; the signal name
can be 12 characters,
maximum.
S1\TNH
Enter a descriptive Note
with up to 50 characters.

Type lists all the type

definitions and simple types
for this device. From the
dropdown list, select
Custom to create a locally
defined data type. Click
Edit... to add the specific
information for that locally
defined data type.

FALSE is the default, if this

is not a Control Constant.
Select TRUE for signal
definitions and module pins
that can be viewed as a
group and exported to a .csv
file. Select READ to restrict
online changes to this
module pin (althought it is
still viewed as a normal
control constant).
Enter the length of the signal, if
it is an Array and the initial
Value for the elements. If the
Array size is greater than one,
a list box of the initial values
for the array elements displays
above Value.
Connection allows you to
connect signal definitions to
other signals. Enter the name
of the signal in the text box or
click Browse... .
When one signal is connected
to another, they share the
same place in memory.
Select these options to make
the module pin a Hold,
Event, I/O or Network. If the
pin is connected to a
Status_S signal and used in
a task, that task is scheduled
when the value of the signal
changes, as well as at the
normally scheduled
execution times.

Repeat these steps for all the Modbus points to populate the Modbus registers.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 19

Modbus Data Format and Scaling
All points that are handled by the controller Modbus I/O are transferred to controller
signal space at the start of each task if they are referenced in the control code. This
transfer method allows data type conversions and scaling.
The data type conversion is controlled by the type of Modbus point and controller
signal data type being used. Table 7 indicates the allowable data type conversions.

Table 7. Controller Allowable Data Type Conversions

Modbus Controller Signal Data Type

Point Data Type Boolean Integer Lint Float
Bit Yes ------ ------ ------
Short ------ Yes Yes Yes
Long ------ ------ Yes Yes
Float ------ ------ Yes Yes

Float values are rounded prior to being stored in short or long points. Short and long
points are clamped to their minimum and maximum limit if the conversion exceeds
their range.

Data Scaling
Data scaling is used to convert the Modbus point into a signal that represents
engineering units. Multiple signals can share one scaling record. The following is a
signal scaling record example.

In this example, the

Modbus point assumes a
range of 0 to 4000 and
the controller signal is
between 40 degrees
and 160 degrees.

20 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

 The formula for converting the Modbus point to a controller signal is:
Controller signal = Modbus point * engineering unit range/raw count
range + engineering unit min
Controller signal = Modbus point * (160 - -40)/(4000-0) + (40)
Controller signal = Modbus Point * .05 40
If the Modbus points raw value is 1000, then the controller value is 1000*.05 40, or
10 degrees.
The formula for converting the controller signal to a Modbus point is:
Modbus point = (controller signal engineering unit min) * raw count
range/engineering unit range
Modbus point = (controller signal -40) * (4000-0) / (160 -40)
Modbus point = (controller signal + 40) * 20
Modbus point = controller signal * 20 + 800
If the controller signal is 10 then the Modbus point is 10*20 + 800 or 1000.
Modbus points and controller signals do not have to be associated with a scale
definition even if a data type conversion is required. A gain of 1 and an offset of 0
are used in these cases. For more details on the Scale Definition dialog box, refer
to the appropriate toolbox document listed in the section, Related Toolbox
Documents.

Note The range of the Modbus point is determined by the points data type and not
by the scaling record. Each integer data type has an implied range. The raw data
range in the scale dialog box is only used to compute the gain and offset of the point
when converting it to a signal.

Short Modbus Points

If a point is data type SHORT, it is a signed 16-bit number. In this mode, the most
significant bit of the 16-bit analog signal is treated as a sign bit where a one is used
for negative values. controller signals are converted into SHORT Modbus points by
applying the scaling information, rounding the values to the nearest integer value,
and then clamping the result in the range of 32768 to +32767.

Long Modbus Points

If a point is data type LONG, it is a signed 32-bit number. The value is transmitted
on Modbus as two consecutive 16-bit integers with the least significant word in
Register N and the most significant word in Register N+1. In this mode, the most
significant bit of the 32-bit analog signal is treated as a sign bit where a one is used
for negative values. controller signals are converted into LONG Modbus points by
applying the scaling information, rounding the values to the nearest integer value,
and then clamping the result in the range of 2147483648 to +2147482647.
To insure data coherency, LONG Modbus points should always start on an odd
register number and the master should send both registers to the controller in the
same Modbus transaction.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 21

 Float Modbus Points
If a point is data type FLOAT, it is a signed 32-bit IEEE 754 standard number. The
value is transmitted on Modbus as two consecutive 16-bit integers with the least
significant word in register N and the most significant word in register N+1. In this
mode, the most significant bit of the 32-bit analog signal is treated as a sign bit and
the next eight bits are a biased exponent followed by a 23-bit Significand. Controller
signals are converted into FLOAT Modbus points by applying the scaling
information.
To insure data coherency, FLOAT Modbus points should always start on an odd
register number and the master should send both registers to the controller in the
same Modbus transaction.

Modbus Data Conversions: Boolean Bit

Logic control signal values can be transmitted to the distributed control system
(DCS) using either coils or registers. Coil data conversion corresponds to a single
Boolean control signal. When registers are used to transmit Boolean bit signal
values, each bit corresponds to the state of one Boolean signal. A register having 16
bits corresponds to a group of (up to) 16 Boolean signals with the least significant bit
(LSB) being the first Boolean signal in the group and the most significant bit (MSB)
as the last Boolean signal in the group. The two bytes are packed in the Modbus
message using the normal rules for MSB and LSB order. The values of undefined
bits in a packed register are transmitted as 0.

Modbus Data Conversions: Analogs

Analog signal values can be transmitted using only registers. Because DCS vendors
handle analog signals in different ways, the controller Modbus may be configured to
transmit analog data in one of several data types. The Modbus signal definition
defines the data type for each signal.

22 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

Modbus Command and Response Definition
This section describes the commands and responses supported by the controller to
implement the needed Modbus communications and control functions. The controller
is a slave station on an RS-232C data link and responds to commands from the
master. Messages are transmitted and received using the RTU transmission mode
where RTU transmits data in 8-bit bytes.

Message Format
The Serial RTU transmission mode uses the following format (where follower
address, function code, CRC-16 MSB, CRC-16 LSB are all bytes):

Station ID Function Function Specific Data CRC-16 CRC-16

Code MSB LSB

The abbreviation CRC stands
for Cycle Redundancy Check.
Station ID (follower address) is a number from 1 to 255 that specifies the unit with
which to communicate.
Function code specifies the purpose and format of the remaining message portion.
CRC-16 are two bytes that complete every serial Modbus message. These bytes
check errors and are calculated to ensure that no transmission error occurred while
the message was in transit. The method for calculating the CRC-16 is a public
protocol. . Refer to the Gould Modicon Modbus Protocol Reference Guide for
information on calculating a correct CRC.
All the same functions are supported over Ethernet that are supported over the serial
ports. All Modbus messages are received on Ethernet port 502. The Ethernet
physical layer provides a CRC-32 checksum on all transmissions so the Modbus
CRC-16 is not included. Modbus over Ethernet adds the header below to the
message formats.

Invocation Invocation Protocol Protocol Length Length Station Function Function

ID MSB ID LSB MSB LSB MSB LSB ID Code Specific Data

Invocation ID is not used by the controller Modbus. Set to 0.

Protocol ID is not used by the controller Modbus. Set to 0.
Length is the byte count of the remaining part of the message and is used by the
Modbus to receive the rest of the message. The rest of the message is exactly what is
sent and received over the serial connections.
Station ID (follower address) is a number from 1 to 255 that specifies the unit with
which to communicate.
Function code specifies the purpose and format of the remaining message portion.

Message Errors
When a message is received that cannot be acted upon, it is either ignored and the
controller waits for the next message or an exception message responds.
Any messages that are misunderstood, incomplete or altered in some manner
(framing, parity, or CRC-16 error) are always ignored because it is not possible to
reliably determine for whom the message was intended. The master must detect this
timeout condition and resend the message as necessary.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 23

 Any time a message receipt is in progress over a serial connection and an interval of
time corresponding to 3.5 character times (based on the baud rate) occurs without
receipt of a character, the message receipt in progress is aborted and ignored.
Message failures due to other causes are responded to with an exception response if
no reception error has occurred and if the message was not a broadcast (follower
address was zero).
The exception code responses that are supported when a normal response is
impossible is shown in Table 8.

Table 8. Exception Code Responses

Exception Code Name Description

Number
01 Illegal function The message function received is not supported
02 Illegal data address The address referenced in the data field is not in a
permissible range.
03 Illegal data value The value transmitted in the data field is illegal.
06 Device busy Too many writes to the controller commands per second
limit exceeded.

The format of exception message reply from the controller is:

Station Function Exception

ID Code Code

Station ID (controller address) must be in the range of 1 255.

Function code is always equal to the masters function code with the MSB set.
Therefore, an exception response sent back to a master that has sent a message with
function code 02 hex would have a function code of 82 hex (or 130 decimal) in the
exception reply.
Exception codes are as described in Table 8. Only codes 01 through 03 and 06 are
supported.

24 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

Function Code Descriptions
The nine function codes implemented in the controller are used to read from and/or
write to the four Modbus table types. Table 9 lists the function codes supported by
the controller included in the messages sent from the DCS. Each function code and
the controller reply are described in this section.

Table 9. Function Code Descriptions

Function Description
Code
01 Read output coils
02 Read input coils
03 Read holding registers
04 Read input registers
05 Force (write) single output coil
06 Preset (write) single holding register
07 Read exception status
15 Force (write) multiple output coils
16 Preset (write) multiple holding registers

Function Code 01: Read Output Coils

Function code 01 is used to read the output coil table. The format of a message sent
from the master is:

Function Start Coil Start Coil Number Number

Code (01) (MSB) (LSB) of Coils of Coils
(MSB) (LSB)

Starting output coil number is a number two-bytes in length that may be any value
less than the highest output coil number available in the output coil table. The
starting output coil number is equal to one less than the number of the first output
coil returned in the normal response to this request. For example, to get the first
output coil (output coil number 1) enter 0 for the starting output coil number. The
high order byte of the starting output coil number field is sent as the first byte. The
low order byte is sent next.
Number of output coils to return is a number two-bytes in length that must be in
the range from 1 to 2000 inclusive. It specifies the number of output coils returned in
the normal response. The sum of the starting output coil value and the number of
output coils value must be less than or equal to the highest output coil number
available in the output coil table. The high order byte of the number of output coils
field is sent as the first byte. The low order byte is sent next.
Format of normal message reply from the controller is:

Function Byte Data Bytes

Code (01) Count 1-n

Byte count is a binary number from 1 to 250; the specified number of data bytes
follow.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 25

 Data bytes (data field) are the packed output coil status data. Each byte contains
eight output coil values. The LSB of the first byte contains the value of the output
coil whose number is equal to the starting output coil number plus one. The value of
the output coils are ordered by number starting with the LSB of the first byte of the
data field and ending with the MSB of the last byte of the data field. If the number of
the output coils is not a multiple of eight, then the last data byte contains zeros in one
to seven of its highest order bits.

Function Code 02: Read Input Coils

Function code 02 is used to read the input coil table. The format of a message sent
from the master is:

Function Start Coil Start Coil Number of Number of

Code (02) (MSB) (LSB) Coils Coils
(MSB) (LSB)

Starting input coil number is two-bytes in length and may be any value less than
the highest input coil available in the input coil table. The starting input coil number
is equal to one less than the number of the first input coil returned in the normal
response to this request. For example, to get the first input coil (input coil number
one) enter zero for the starting input coil number. The high order byte of the starting
input coil field is sent as the first byte. The low order byte is sent next.
Number of input coils to return is two-bytes in length and must be in the range
from 1 to 2000 inclusive. It specifies the number of input coils returned in the normal
response. The sum of the starting input coil value and the number of input coils value
must be less than or equal to the highest input coil available in the input coil table.
The high order byte of the number of input coils field is sent as the first byte. The
low order byte is sent next.
Format of normal message reply from the controller is:

Function Byte Data Bytes

Code (02) Count 1-n

Byte count is a binary number from 1 to 250; the specified number of data bytes
follow.
Data bytes (data field) are the packed input coil status data. Each byte contains
eight input coil values. The LSB of the first byte contains the value of the input coil
whose number is equal to the starting input coil plus one. The value of the inputs are
ordered by number starting with the LSB of the first byte of the data field and ending
with the MSB of the last byte of the data field. If the number of the input coils is not
a multiple of eight, then the last data byte contains zeros in one to seven of its
highest order bits.

Function Code 03: Read Holding Registers

Function code 03 is used to read holding registers. The format of a message sent
from the master is:

Function Start Start Number of Number of

Code (03) Register Register Registers Registers
(MSB) (LSB) (MSB) (LSB)

26 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

 Starting holding register number is two-bytes in length and may be any value less
than the highest holding register number available in the holding register table. The
starting holding register number is equal to one less than the number of the first
holding register returned in the normal response to this request. For example, to get
the first holding register number (holding register number one) enter zero for the
starting holding register number. The high order byte of the starting holding register
number field is sent as the first byte. The low order byte is sent next.
Number of holding registers value is two-bytes in length and must be in the range
from 1 to 128 inclusive. It specifies the number of holding registers returned in the
normal response. The sum of the starting holding register value and the number of
holding registers value must be less than or equal to the highest holding register
number available in the holding register table. The high order byte of the number of
holding registers field is sent as the first byte. The low order byte is sent next.
Format of normal message reply from the controller is:

Function Byte First First Data Registers Last

Code (03) Count Register Register Requested Register
(MSB) (LSB) (LSB)

Byte count is an even binary number from 2 to 254, or zero. If the byte count is zero
(0), then the master assumes 256 data bytes follow. Otherwise, the specified number
of data bytes follow. The byte count specifies the total number of bytes in the
message following the byte count, not including the two CRC-16 bytes (serial
mode).
Holding registers are returned in the data field in order of number with the lowest
number holding register in the first two bytes and the highest number holding
register in the last two bytes of the data field. The number of the first holding register
in the data field is equal to the starting holding register number plus one. The high
order byte is sent before the low order byte of each holding register.

Function Code 04: Read Input Registers

Function code 04 is used to read input registers. The format of a message sent from
the master is:

Function Start Start Number of Number of

Code (04) Register Register Registers Registers
(MSB) (LSB) (MSB) (LSB)

Number of input registers value is two-bytes in length and must be in the range
from 1 to 128 inclusive. It specifies the number of input registers returned in the
normal response. The sum of the starting input register value and the number of input
registers value must be less than or equal to the highest input register number
available in the input register table. The high order byte of the number of input
registers field is sent as the first byte. The low order byte is sent next.
Format of normal message reply from the controller is:

Function Byte First First Data Registers Last

Code (04) Count Register Register Requested Register
(MSB) (LSB) (LSB)

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 27

 Byte count is an even binary number from 2 to 254, or zero. If the byte count is zero
(0), then the master assumes 256 data bytes follow. Otherwise, the specified number
of data bytes follow. The byte count specifies the total number of bytes in the
message following the byte count, not including the two CRC-16 bytes (serial
mode).
Input registers are returned in the data field in order of number with the lowest
number input register in the first two bytes, and the highest number input register in
the last two bytes of the data field. The number of the first input register in the data
field is equal to the starting input register number plus one. The high order byte is
sent before the low order byte of each input register.

Function Code 05: Force Single Output Coil

Function code 05 is used to force (or write) a single output coil in the output coil
table. The format of a message sent from the master is:

Function Output Output State 0

Code (05) Coil Coil (00 or FF)
(MSB) (LSB)

Output coil number is two-bytes in length and may be any value less than the
highest output coil number available in the output coil table. The output coil number
is equal to one less than the number of the output coil forced. For example, to change
the first output coil (output coil number one) enter zero for the output coil number.
The high order byte of the starting output coil number field is sent as the first byte.
The low order byte is sent next.
State byte is sent by the master with only two possible values. A zero (00h) is sent
to turn the specified output coil off (set false). A value of 255 (FFh) is sent to turn
the specified output coil on (set true). The state byte is always followed by a single
byte with value zero.
Format of normal message reply from the controller is identical to the received
message.

Function Code 06: Preset Single Holding Register

Function code 06 is used to preset (or write) to a single holding register. The format
of a message sent from the master is:

Function Holding Holding Register Register

Code (06) Register Register Data Data
(MSB) (LSB) (MSB) (LSB)

Holding register number is two-bytes in length and may be any value less than the
highest holding register number available in the holding register table. The holding
register number is equal to one less than the number of the holding register changed
by this request. For example, to change the first holding register (holding register
number one) enter zero for the holding register number. The high order byte of the
starting holding register number field is sent as the first byte. The low order byte is
sent next.

28 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

 Holding register data field is two bytes in length and contains the value to which
the holding register specified by the holding register number field is preset. The first
byte in the data field contains the high order byte of the preset value. The second
byte in the data field contains the low order byte.
Format of normal message reply from the controller is identical to the received
message.

Function Code 07: Read Exception Status

Function code 07 is used to read the exception status data, defined as the first eight
output coils. These can be used to indicate the controller status or condition of any
other state. Function code 07 thus provides a short form of request for the purpose of
reading these first eight output coils, output coils one through eight. The format of a
message sent from the master is:

Function
Code (07)

Format of normal message reply from the controller is:

Function Data Byte

Code (07)

Data bytes (data field) are the packed output coil status data. The data byte contains
eight output coil values. The LSB of the byte contains the value of the output coil
number one. The MSB contains the value of output coil number eight.

Function Code 15: Force Multiple Output Coils

Function code 15 is used to force (or write) multiple output coils in the output coil
table. The format of a message sent from the master is:

Function Starting Starting Coil Coil Data Data

Code (15) Coil Coil Count Count Bytes
(MSB) (LSB) (MSB) (LSB)

Starting coil number is two-bytes in length and may be any value less than the
highest output coil number available in the output coil table. The output coil number
is equal to one less than the number of the output coil forced. For example, to change
the first output coil (output coil number one) enter zero for the output coil number.
The high order byte of the starting output coil number field is sent as the first byte.
The low order byte is sent next.
Coil count is two-bytes in length. It specifies the number of output coils to set. The
sum of the starting output coil value and the number of output coils value must be
less than or equal to the highest output coil number in the output coil table. The high
order byte of the number of output coils field is sent as the first byte. The low order
byte is sent next.
Byte count is the number of data bytes to follow.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 29

 Data bytes (data field) are the packed output coil data. Each byte contains eight
output coil values. The LSB of the first byte contains the value of the output coil
whose number is equal to the starting output coil number plus one. The value of the
output coils are ordered by number starting with the LSB of the first byte of the data
field and ending with the MSB of the last byte of the data field. If the number of the
holding coils is not a multiple of eight, then the last data byte contains unused data in
its highest order bits.
Format of a normal message reply from the controller is:

Function Starting Starting Coil Coil

Code (15) Coil Coil Count Count
(MSB) (LSB) (MSB) (LSB)

The field definitions are the same as the request message.

Function Code 16: Preset Multiple Holding

Registers
Function code 16 is used to preset (or write) to a multiple holding registers. The
format of a message sent from the master is:

Function Starting Starting Register Register Data Data Registers

Code (16) Register Register Count Count Bytes (MSB:LSB format)
(MSB) (LSB) (MSB) (LSB)

Start register number is two-bytes in length and may be any value less than the
highest holding register number available in the holding register table. The holding
register number is equal to one less than the number of the holding register changed
by this request. For example, to change the first holding register (holding register
number one) enter zero for the holding register number. The high order byte of the
starting holding register number field is sent as the first byte. The low order byte is
sent next.
Number of holding registers value is two-bytes in length. It specifies the number of
holding registers to set. The sum of the starting holding register value and the
number of holding registers value must be less than or equal to the highest holding
register number in the holding register table. The high order byte of the number of
holding registers field is sent as the first byte. The low order byte is sent next.
Byte count is the number of data bytes to follow.
Register data field is two-bytes for each holding register to set. The first byte in the
data field contains the high order byte of each preset value. The next byte contains
the low order byte.
Format of a normal message reply from the controller is:

Function Starting Starting Register Register

Code (16) Register Register Count Count
(MSB) (LSB) (MSB) (LSB)

The field definitions are the same as the request message.

30 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

Modbus Diagnostic Aids
Two diagnostic utilities can be used to diagnose problems with the Modbus
communications on a controller. The first utility prints out the accumulated Modbus
errors from a network and the second prints out a log of the most recent Modbus
messages.

Note The Modbus diagnostic utilities require the GE Control System Toolbox. For
complete details on diagnostic utilities using the toolbox, refer to the appropriate
toolbox documents listed in the section, Related Toolbox Documents.

To view diagnostic data from the toolbox

1. From the toolbox, click the View menu, Controller Status Commands, and
then Custom. The following dialog box displays.

2. Highlight the appropriate Modbus Errs entry and click OK. The Controller
Status Command Report displays.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 31

 This example displays error counters and the first 16 bytes of error messages. There
were three bad messages received with a bad station address. Station 1 was
addressed rather than station 17. The last line in the message dump is from the last
message sent and did not cause an error.

32 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535

 The above report is an example of the Controller Status Command Report (a
Modbus log serial report). This report displays the content of the received and
transmitted messages from the controller along with a relative time stamp (UTC
time). The toolbox displays the last 50 messages sent or received.
It is also possible to get a live report of messages by using Telnet to log on to the
controller and then issue one of the following commands:
Serial Modbus >mbus_log o s
Ethernet Modbus >mbus_log o e
The report continues to display messages as they are received until Control + C is
entered. Use the information provided in the previous section to translate the
messages.

GEI-100535 Direct Modbus Communications for Mark VI and EX2100 Controllers 33

g
GE Industrial Systems

+1 540 387 7000 General Electric Company

www.GEindustrial.com 1501 Roanoke Blvd.
Salem, VA 24153-6492 USA
34 Direct Modbus Communications for Mark VI and EX2100 Controllers GEI-100535