1. Modbus with the AKD Using Modbus Poll and Wireshark Rev. F Dec
Modbus with the AKD Using Modbus Poll and Wireshark Rev. F Dec. 2, 2011 Jimmy Coleman

2. Reference Sources Modbus Documentation Software
Manual – Modbus section of AKD User Manual and Parameter Table
Software
Modbus Poll
WireShark (for use with Ethernet and Modbus TCP communication)
Convert Dec Hex Bin
The Lucent Hex Calc 64
Windows Calculator

3. Modbus TCP Communication Settings
Port:
Modbus communication on the AKD drive is handled through the Service Port. That is the X11 Ethernet port that is use for communication with the Workbench software. Workbench uses ASCII commands over Telnet communication. It is possible to communicate via Modbus and Telnet at the same time from the same PC.
TCP/IP:
Modbus communication uses the IP address of the drive. The IP address is displayed on the drive after it boots up. It is also displayed on the drive after pressing the B1 button on top of the drive. It can also be read from the Overview screen in Workbench.
The AKD uses port 502 for Modbus TCP.
There is no CRC code to be added to the Modbus telegram.
Data Size:
The AKD has memory registers of 16 bit data size. The 32 bit parameters consist of 2 registers and the 64 bit parameters consist of 4 registers. The drive supports Modbus functions 3 (Read Holding Registers) and 16 (Write Multiple Registers). Currently, the AKD supports only reading and writing 2 or 4 registers for one parameter/command at a time.
Firmware:
Version or later is required for the Modbus features in this document.

4. Modbus Poll Software
Modbus Poll is a master controller simulator. It can be used to send and receive Modbus communication and record communication traces. Modbus Poll can be downloaded from as a trial version. The trial version will automatically disconnect communications every 10 minutes. Communication can be re-established. The purchased license allows for uninterrupted communication.

5. Starting the Modbus Poll Software
The software will open with default setting that are not correct. You will see the error message.
Disconnect and click on Connection / Connect… This will open the connection setup window.
Or close the Mbpoll1 window and open your saved connection configuration file.
Select TCP/IP. Enter the IP address of the AKD drive. Use the default port 502. Save the settings for ease of use next time.
Error messages tell you that:
- the connection settings are incorrect,
- the communication cable is disconnected,
- the drive is not functional,
- the Read/Write Definition is not correct (see next slide).

6. Reading
Click Setup / Read/Write Definition…, or click the button in the toolbar.
Function is “03 Read Holding Registers (4x)”.
Slave ID doesn’t matter.
Address is the lower 16 bit register number corresponding to the AKD parameter or command.
Quantity is 2 for 32 bit parameters and 4 for 64 bit parameters. (Currently the AKD only supports reading/writing one parameter at a time.)
The data type is Long Inverse.
The checkboxes are for display convenience only.

7. Example: Read DIN1.MODE Reading the value of DIN1.MODE over Modbus.
Look up DIN1.MODE in the parameter table. It is number Actually it is registers 122 and 123, since it is a 32 bit parameter.
Set the address to 122 and the Quantity to 2.
The data type is always Long Inverse.
Modbus Poll send the read request and the drive returns the value of 15.
See the Workbench setting of “15 – Quick Stop”.

8. Example: Read AIN.PSCALE
Reading the value of AIN.PSCALE over Modbus.
Look up AIN.PSCALE in the parameter table. It is number 8. Actually it is registers 8 through 11, since it is a 64 bit parameter.
Set the address to 8 and the Quantity to 4.
Set data type to Hex to show all 4 registers.
Modbus Poll sends the read request and the drive returns the value.
2AF7FFFC (hex) converts to (dec) (If you don’t see this value, it is because the Units Scaling is not set up correctly.)
All floating point variables (numbers with three decimal places) are weighted by 1000 in Modbus.
So the value is (with some rounding error due to units scaling).

9. Writing
Click Functions / 16: Write Registers…, or click the button in the toolbar.
Function is “16: Write Multiple Registers”.
Slave ID doesn’t matter.
Address is the lower 16 bit register number corresponding to the AKD parameter or command.
Quantity is 2 for 32 bit parameters and 4 for 64 bit parameters. (Currently the AKD only supports reading/writing one parameter at a time.)
Use data type Long Inverse for 32 bit parameters and Hex for 64 bit parameters. The data type is set in the Read/Write Definition screen.
Double click or click on Edit to change the value. Then click Send to write that value to the drive.

10. Drive Command Parameters
To issue a command, such as DRV.EN, DRV.DIS, HOME.MOVE etc., write a value of 1 to the parameter. Actually, any non-zero value can be written. The action of writing to the parameter is what executes the command. These commands do not have values associated with them, so you can’t read them. If these parameters are read through Modbus, the drive will return a value of zero. When using an HMI, set these command parameters as Write-Only. MT.MOVE is different in that the value written specifies the number of the motion task to be executed. So in this case, the value is important.

11. Trace – Read 32 bit parameter
Click Display / Communication…
The Communication Traffic window shows all of the Modbus communication taking place in Modbus Poll.
It is in hex.
In this example, Modbus Poll was reading DIN.MODE, Modbus address 122 (7Ah). The Tx data “… A 00 02” defines the read request.
01 is the slave ID, which really doesn’t matter.
03 is the function code for Read.
00 7A is the register number for DIN.MODE (address 122).
00 02 is the number of registers (32 bits) for this parameter.
The Rx data “… F” is the response from the drive.
01 is the slave ID, which really doesn’t matter.
03 is the function code for Read.
04 is the number of bytes of data.
F is the value of this parameter (0Fh = 15).

12. Trace – Read 64 bit parameter
Click Display / Communication…
The Communication Traffic window shows all of the Modbus communication taking place in Modbus Poll.
In this example, Modbus Poll was reading AIN.PSCALE, Modbus address 8. The Tx data “… ” defines the read request.
01 is the slave ID, which really doesn’t matter.
03 is the function code for Read.
00 08 is the register number for AIN.PSCALE (address 8).
00 04 is the number of registers (64 bits) for this parameter.
The Rx data “… A F ” is the response from the drive.
01 is the slave ID, which really doesn’t matter.
03 is the function code for Read.
08 is the number of bytes of data.
A F is the value of this parameter = (dec).

13. Trace – Writing 32 bit parameter
Click Display / Communication…
In this example, Modbus Poll was reading and writing VL.CMDU, Modbus address 852.
Read:
The Tx data “… ” defines the read request.
01 is the slave ID, which really doesn’t matter.
03 is the function code for Read.
03 54 is the register number for VL.CMDU (address 852).
00 02 is the number of registers (32 bits) for this parameter.
The Rx data “… ” is the response.
04 is the number of bytes of data.
is the value of this parameter = 0 (dec).
Note: There are 6 bytes of data before the Slave ID number.
The first 5 bytes can be all zeros when sending a hex string.
The 6th byte is the number of bytes to follow, starting with the Slave ID number.
Write:
The Tx data “… C3 50” is the write.
10 is the function code for Write.
03 54 is the register number for VL.CMDU (address 852).
00 02 is the number of registers
04 is the number of bytes of data.
00 00 C3 50 is the value written to this parameter = (dec).
The Rx data “… ” is the response.
00 02 is the number of registers written to successfully.

14. Trace with Wireshark
Function Code 03, data size 04 bytes, data = F = 1839: AIN.VALUE= volts

15. Wireshark Capturing a Write
Function code = 16
Modbus Address = 6 (AIN.OFFSET)
Number of 16 bit registers = 2
Data size = 4 bytes
Data = = 20 dec: AIN.OFFSET = Volts

16. Binary and Hexadecimal Numbers

17. Working with 64 Bit Numbers
Some devices are limited to working with 32 bit variables. Some of the parameters in the AKD are 64 bits. So the data must be sent and received in 32 bit segments.
Sign bit:
Note that the sign bit is the most significant bit of the upper 32 bits. So the lower 32 bit does not contain a sign bit. Negative numbers require the use of the upper register.
Reading a 64 bit variable in two 32 bit segments:
Read the upper two registers and the lower two registers separately. Then calculate the 64 bit value by multiplying the upper value by 2^32 and adding to it the lower value.
Value = (Upper * 4,294,967,296) + Lower
64 bit to 32 bit re-map:
The 64 bit parameters have been remapped to Modbus registers starting at register These registers use only the lower 31 bits of the parameter plus the sign bit. So it is much easier to work with negative numbers, and allows read/writes of these parameters without any calculations involved.

18. Dynamic Mapping
Dynamic Mapping is a feature that allow the user to map a particular parameter to a specific Modbus register.
There are two advantages of dynamic mapping:
Communication bandwidth of an HMI can be increased by all of the parameters on a given screen having Modbus register numbers in sequential order.
Dynamic mapping allows mapping only 16 bits of a parameter to one 16 bit register. If less than 16 bits of data are used for a small value, this decreases the amount of data that must be transmitted.
To use dynamic mapping:
Set Modbus register 4096 (0x1000) to 1.
Write the register number you want to map into the register you want to map it to. For AOUT.VSCALE, write a value of 36 to register 8192 and a value of 37 to register This puts addresses 36 and 37 into registers 8192 and 8193 (32 bits total).
Set register 4096 back to zero.
Now you can read/write registers 8192 and 8193 for AOUT.VSCALE. Do this for any parameters you want to put in sequential registers.

19. Dynamic Mapping in Workbench
Set up dynamic mapping in the Workbench Terminal:
MODBUS.DYNMAP enables and disables the dynamic mapping setup mode. 1 = setup mode, 0 = run mode.
MODBUS.CLRDYNMAP clears any existing dynamic mapping.
MODBUS.ADDR8192 is the parameter containing the value of the fixed 16 bit register that is mapped to the 16 bit register 8192.
For each of the dynamic map registers, write the number of the fixed register that you want to map.
Example:
MODBUS.DYNMAP 1
MODBUS.CLRDYNMAP
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.ADDR
MODBUS.DYNMAP 0
The dynamic mapping settings can be saved to the drive memory and to a parameter file.

20. Units Scaling
Since many devices are limited to 32 bit data size, the AKD firmware supports scaling the 64 bit position parameters to a lower resolution for use through Modbus. Basically, the 32 bit values available in the HMI are broken into a specified number of units per rev and the remaining bits for multi-turn. By default, it is 20 bits per rev and 32-20=12 bits of revs before a roll-over occurs. So the normally 32 bit size position value in the HMI is bit shifted to the right 12 bits. This results in a 20 bit per rev resolution.
Three parameters handle this scaling:
MODBUS.PSCALE (default = 20, 20 bits per motor rev and 12 bits for counting revs)
MODBUS.PIN
MODBUS.POUT
Set the units to Custom (Custom, Custom/s, and Custom/s^2).
Set MODBUS.PIN = 2^MODBUS.PSCALE = (for MODBUS.PSCALE=20)
Set MODBUS.POUT = UNIT.PIN * 1000 / UNIT.POUT
Example: 360 “degrees” per motor rev.
All units set to Custom
UNIT.PIN = 360
UNIT.POUT = 1
MODBUS.PSCALE = 20
MODBUS.PIN =
MODBUS.POUT = (the factor of 1000 is for the floating point decimal (0.000))
Example: 150 “inches” per 29 motor revs.
UNIT.PIN = 150
UNIT.POUT = 29
MODBUS.PIN =
MODBUS.POUT = (The ratio or 150/29 is not an integer, so there will be rounding error.)

21. Converter Software

22. 22