---

PLC memory layout

Memory ranges used for the BC9050 device.

PLC Data area:

The PLC data area are primary used for terminal data from the PLC. The Teminal data area is from address 0 (IW0 and QW0), and the fieldbus (ModBusTCP) area is from address 1000 (dec.), i.e. QW1000 and IW1000. A small PLC program that copies data to/from the terminal input-output area to the fieldbus input-output area must be running on the PLC. A program that can be used for standard PLC's can be found in the ConSys PLC program section as 'GenericBC9050' . The terminal I/O data will fill up from the start of these address ranges. When reading data from the PLC with ModBusTCP use function code 4, with starting address 0x0. When writing data to the PLC use function code 6, with starting address 0x800. The data written to the PLC can be read back using function code 3 (with an starting address of 0x800).
Address space that are not used for fieldbus data can be assigned for other usage in the PLC program. The ConSys device supports 256 input and 256 output words in this address range.

PLC Flags area:

The controllers flags ares, called process memory in ConSys code, can be used for input as well as output. The BC9050 device has support for up to 400 words in this memory area.

PLC Address  (dec)	PLC IO direction	Usage	ModBusTCP Address (hex)	ModBusTCP  IO direction	ConSys Address    (a0)	ConSys  Address Types (a1)
IW0 - IW255	Input	Terminal input area. Data read from the PLC terminals are found in this area.
QW1000-QW1255	Output	ModBusTCP read area. PLC data is this area are read with ModBusTCP commands (after they have been copied from the Terminal input area).	0x00-0xFF	Read	0-255	0,2
QW0 - QW255	Output	Terminal output area. Data in this area are written to the terminal outputs.
IW1000-IW1255	Input	ModBusTCP write area. Data written with ModBusTCP can be read from the PLC in this range (and copied to the Terminal output area).	0x800-0x8FF	Write	0-255	1,3
MW0-MW1023	Input/ Output	General purpose data area (flags, process memory)	0x4000-0x443F	Read/Write	0-1023	4

The data layout in the terminal input-output area are given by the PLC system: The addresses are defined by the order of the terminal modules. Inputs and outputs has independent address spaces. All complex terminals (analogue inputs/outputs) are assigned first. Bit I/Os follows. With the standard PLC program 'GenericBC9050' the data layout of the fieldbus input/output layout will be the same as the layout of the terminal I/O address spaces as shown in the 'KS2000 mapping', apart from the actual ModBusTCP  write address is offset by 0x800 as explained in the table above. The data layout of the fieldbus input/output can, however, be changed dependent on the implementation of the PLC program. The DatabaseEditor includes a tool to calculate addresses for systems mapped with the standard configuration.
 

Standard layout of fieldbus input/output area:

Complex data

Bit data

'User'  data

 

---

Device parameters, Addressing: device status and control parameters can be accessed.

 

parameter number (a0)	Suggested SurName	Description	Data Type	Interpretation	Mode	Comment
0	ResetComm	Reset Communication	Bit	Pulse bit dataserver	Write	Reinitialize the hardware communication
1	ResetCnt	Reset counters	Bit	Pulse bit dataserver	Write	Reset status counters
2	ResetModBus	Reset MODBUS	Bit	Pulse bit dataserver	Write	Reinitialize the hardware communication and resets MODBUS Bus coupler. All control parameters goes to zero - set again from the device. Should only be defined if needed.
10	Active	Coupler active	Bit		Read	TRUE if the bus coupler is active
100	NCommErr		Word		Read	Counts number of communication failures.
101	noRespncCnt		Word		Read	Counts number of communication connect retries in case of lost connection.
104	lastErrorMsg		String		Read	Last error message as text

 

PLC parameters in ConSys:

Standard MODBUS parameters are accessed by one of the 5 ConSys MODBUSTcp address types:

MODBUS Conversion (22): Address type used for all floating point parameters defined for the PLC crate.

MODBUS Bit (23): Address type used to access a bit.

MODBUS Word (24): Address type used to access a word.

MODBUS Filtered (25): Address type used to access part of a word (selected by a bit mask filter and a rotation number).

MODBUS Three state word (26): Special address type used to combine two bits into a three state value.

All of these address types use the first general purpose address fields as follows:
a0: MODBUS address. Remark - calculated by the databaseEditor MODBUS tool from a6,a7
a1: Address type: 0: Floating point/Word input (reading), 1: Floating point/word output, 2: Binary Input, 3: Binary output.
a3: For address type 2,3 when addressing bits: zero based bit number in reading. Remark - calculated by the databaseEditor MODBUS tool from a6,a7

REMARK: a0,a3 are direct address fields used by the device. However, it is recommended to use the special tool for MODBUS devices in the database editor that calculates a0,a3 from module Position and channel number in the module.

a6: Module position: An integer defining the location of the PLC terminal I/O module.
a7: channel: Input/Output channel in PLC module.
s1: Connector: Description of which connector the channel is connected to. See Wiring for syntax:
 

Using the Update MODBUS tool in the databaseEditor:

The Update MODBUS tool found in the database editor is used to calculate the device addresses a0,a3 from the more user friendly address fields a6, module position and a7, input/out channel in the module. One of the major reasons to configure the addressing using this tool is that it is in a way that makes it easy to insert modules at any position - given that module numbers are chosen carefully. Module position numbers must be in increasing magnitude with gaps allowed. It is recommended to have room for insertion of new modules in the module number sequence. The Ethernet bus coupler and the end terminal must be included in the module position sequence. Remark that the tool only works if the plc program uses the standard address map.

From version 1.26.125.28:

When used with PLC programs, some modules may be assigned to the Field bus and others to the process memory for the PLC program. Addresses for modules mapped to the field bus will still be calculated as mentioned above. For modules mapped to process memory a0=a2 + a5.

I/O Type a1	Description	DatabaseEditor Address Calculation Inputs				DatabaseEditor Calculated Addresses
		a2	a5	a6	a7	a0, ModBus Address			a3 Bit Number
						PLC memory	a0, start from	a0, calc.
0	Complex/Word data In		Offset	Module Position	Channel (1..X)	Input	0	f(a6,a7)
1	Complex/Word data out		Offset	Module Position	Channel (1..X)	Output	0	f(a6,a7)
2	Bit data in			Module Position	Channel (1..X)	Input	'Complex end In'+1	f(a6,a7)	0 based bit idx f(a6, a7)
3	Bit data out			Module Position	Channel (1..X)	Output	'Complex end out'+1	f(a6,a7)	0 based bit idx f(a6, a7)
4	Process memory In/out	Parameter Index	SurName Index	99999		Flags/Process	0	a2+a5	Unchanged
0	Word data in, User area	Parameter Index	SurName Index	10000		Input	'Bit end in'+1	a2+a5	Unchanged
1	Word data out, User area	Parameter Index	SurName Index	10001		Output	'Bit end out'+1	a2+a5	Unchanged
0	General data in, Manuel adr.			88888		Input		Unchanged	Unchanged
1	General data out, Manuel adr.			88888		Output		Unchanged	Unchanged

 

 

Example:

Module      Module
position      Type

1                BC9000        Ethernet Bus Coupler.
100            KL2408
110            KL2408
200            KL4132
300            KL3064
400            KL3102
999            KL9010        End terminal

Database helper tables used by the database editor:

ModBusType:

The terminal modules used must be known by the database editor. All known types are defined in the database helper table 'ModBusType'. The IO maps of the terminals are hardcoded into the database editor. New module types can be defined in the ModBusType table as long as its I/O map is similar to one of the maps already defined. The I/O map for each ioType are hardcoded into the databaseEditor.

moduleTypeId: Unique id for the module - typical the terminal module number as integer
moduleTypeStr: Module name as string
moduleDescription: Description of the terminal.
ioType: Identifies the hardcode I/O map, i.e. how many floating point in/out and bit in/out. The type numbers are defined so that input/out type and number of channels can be identified - see the values in the table.
 

ModBusConfig:

Before using the update tool the module positions must be defined in the database helper table 'ModBusConfig'. This is typically done using access. Remark: The fields 'inAdr', 'outAdr','bitInAdr','bitOutAdr',bitInBitNo','bitOutBitNo' are used internally in the database editor and should not be filled manually.

deviceId: Unique device id, as defined in the table DeviceLocation
modulePosition: Integer to define the position of the terminal module. See notes and example above.
moduleTypeId: The moduleTypeId as defined in the table ModBusType.
Comment: Optional user comment. 
ioMap: 0: Should always be 0, mapped to field bus for the BC9050 device

If 'user' data is placed in the input or output field, or process memory is used, the configuration must include the module numbers for these memory areas:

10000: User memory read

10001: User memory write

88888: User memory free addressing

99999: Process memory

 

---

Device configuration: 

 
Modbus, setup:

Unique device id: The unique device id as defined in the database, DeviceLocation table.

IP Address: The ip address of the PLC in the form X.X.X.X

Port number: The TCP port, typical 502

Watchdog Time: The setting of the Watchdog timer. Remark: Only set to device during start if 'Send watchdog settings during start' is checked. Always send to the device, a resetModBus is send to the device (i.e. set from the Console).

Read Delay: The time, in ms, between reading updates. Typical 200 ms, If the PLC is set to fast TCP, can be set down to 30 ms.

Reset MODBUS during start (will reset control value): If checked, a MODBUS reset will be performed during device start. This will set all controls to zero! The settings are restored according to the initialisation mode when the MODBUS has been reset.

Send watchdog settings during start: If checked, the Watchdog timer settings is send to the PLC during start of the device. The recommended setting is to leave this on. Watchdog settings are always send to the device, a resetModBus is send to the device (i.e. set from the Console).

Base persistent file name: If at least one of 'Persistent History' or 'Persistent control data' is checked the base file name must be specified. The filename should be specified without path and extensions. It is used to generate the persistent files used to store current control data and history data. The data files are stored in the ConSys executable directory. The extension on history files is 'hst' and on control files 'permanent'. See also the description of the initialisation method below.

Store interval (hours): The time between update of the persistent data on disc. Under normal conditions, the persistent data is stored when the control system is closed. To ensure loss of data in case of a crash the persistent data is updated regularly at the specified intervals.

Persistent history: Checked, if histories should be stored to disc.

Persistent control data: Checked, if control values should be stored to disc.

Control value initialisation mode:
None: The control values are not transferred to the G64 crate during initialisation
From database: The control values is obtained from the database default values and send to all control values in the G64 crate.
From persistent file: During device initialisation the device first looks for a file with the name '<Base persistent file name>.loadOnce'. If this file exist the command values are loaded from the file and the file is deleted. If the file does not exist, the device looks for a file with the name ' <Base persistent file name>.permanent' and load the command values from this file. If no file could be found the default values from the database is used to set the crate control values.

---

Wiring:

The s1 field in the Parameter table is used for a description of the wiring (i.e. to which connector the parameter is wired).
The syntax of ordinary parameters is a tuple consisting of
        ConnectorType: F(ront)/B(ack)-panelNr[_colunmNr]-ConnectorNr[-pinNr]
Some examples are

Relæ: F-1-1	A relay output on the Front, first panel, first connector (i.e. top connector)
BNC: F-6_3-2	A BNC output on the Front, sixth panel, third column, second connector (from the top)
Thermo-K: F-3-1	A K-type thermo connector on the Front, third panel, first connector (i.e. top connector)

For assisting in the wiring to the PLC-modules (bus terminals) a helper table has been defined which for all the terminal gives the pin numbers for the different channels.

ModBusTypePinNumbering:

moduleTypeId: The moduleTypeId of the ModBusType table.
channelNr: The channel number of the module (corresponding to a7 in the ParameterTable)
pinNr: The pin number on the terminal corresponding to the given channel number.
groundPin: The ground pin on the terminal corresponding to the given channel number. Note that there can be several channels which have to share the same ground (or in some cases there even is no ground in which case the supply ground must be used - these have an entry of 0 for the ground pin).

Specials parameters which require more channels in the PLC, must be defined specially, either directly in s1 or separately.

In the standard Access database a Report (ModBusWiring) has been made for printing the wiring for a PLC device. Likewise there is a table (a view from the SQL database) for typing in the wiring data.

 

---

Last Modified 02 October 2024