Babel Buster 9-1-1

I'm not getting any data. Why not?

(click here for TCP version)

This discussion assumes you want the Babel Buster SP (SPX) to be the Modbus Master (most common use). Let's review the setup procedure for a single Modbus read map. We suggest starting with one register. Once you get that working, proceed to fill up the table. First, go to the Local Device page and make sure you have the baud rate set, and parity (if any) selected. If you do not know what baud rate your Modbus device is set to, consult that manufacturers documentation before proceeding. Make sure the Master button is clicked. Start with a liberally slow timeout, like 0.5 second just to be rather certain you do not have timeout problems. (We have yet to see a piece of working equipment take longer than half a second to respond to a Modbus master.)

Next, go to the RTU Read Map page (below) and click the "1" in the left column. This takes you to the expanded view of map #1.

To get started, you must enable some maps. Enter a number greater than zero in the # RTU Read Maps Enabled window at the bottom of the expanded view page (below) and click Update. Next, select a register type, a register number, a unit # (aka slave ID or slave address), and a local register number to store the data in. If any of the red check marks shown below are "none" or zero, you will get no action even attempted. Make sure the Unit # (slave ID or slave address) matches whatever you have your Modbus device set to. If you are uncertain what address it is set to, you need to consult the manufacturer's documentation for that equipment before proceeding. The following example shows the only non-zero entries required to successfully read holding register #1 from unit #1 and store the data in local register #1. Once these (or comparable) entries have been made, click the Update button.

At this point, you can go to the data page (below) and see if you have data showing up. If you get no data, there is a problem. The confirmation that you are probably getting no data is the "time since last update". In this example, we see 126 seconds have elapsed. We are attempting to update every 2 seconds, so obviously data retrieval is not happening.

If you are getting no data, check the Error Codes page (below). Here we see that the "No Responses" is about equal to the "Total Messages". This means we are not getting anything back from the Modbus slave. If you are certain all of the above setup is correct, the only conclusion you (or we) can come to at this point is that there is a wiring problem, or the slave is not responding or not configured correctly. Review wiring information, and check the slave configuration.

Check the DIP switches on your Babel Buster SP. If using RS-485 (EIA-485), switches 1 and 2 should be down, 3 and 4 should be up. You do want termination at the Babel Buster SP (unless you have several on the same Modbus RTU network, which will not work if they are all configured as Master).

Wiring and DIP switch information for Babel Buster SP is shown below. Babel Buster SPX is hard wired for RS-485 only, and therefore has no DIP switches. It has 2 screw terminals for RS-485 which are marked on the device's label. Most other Control Solutions devices are also hard wired for RS-485 with 2 screw terminals for RS-485.

This view is of the male connector looking into the Babel Buster SP. The female connector orientation will be opposite. Note: This is NOT a PC COM port. Connection for Half-Duplex (2-wire RS-485): Connect TXD+ to RXD+ on the SP, and these to the "+" on your Modbus device. Connect TXD- and RXD- on the SP, and these to the "-" on your Modbus device. If your device's RS-485 terminals are marked A and B, with no indication of + or -, just guess. There is about a 50% chance it is marked wrong anyway. Modbus protocol specifications and RS-485 driver chip specifications are opposite each other in their use of A and B. If you are uncertain about the +/- A/B thing, and you are not getting any response, try swapping the wires. You will not do physical damage by reversing RS-485 wires. Many times simply swapping the wires fixes the problem.

How do Modbus registers map to OIDs?

The Babel Buster SP functions as a stand-alone server device. It can be configured as a Modbus RTU master or slave. It is also concurrently a Modbus TCP client and server. When the RTU side is configured as the master, it automatically polls the various Modbus devices periodically. The TCP client, if used, will also automatically poll various Modbus TCP devices periodically. This data is stored in local registers in Babel Buster SP. This data is simply saved, waiting for SNMP to Get the data. When SNMP does a Set, this results in data being written to the Modbus device once per update, or repeatedly if configured to do so. To begin the process of mapping Modbus to SNMP, you need to obtain documentation from the device manufacturer telling you which registers contain what data. You will also need to see that baud rates are matched, and you know or can set the RTU slave address (or unit number, comparable to a shortened IP address). There are technically four types of Modbus "registers"; however, most of the time you will be dealing with "holding registers". If no mention is made of register type, you can reasonably assume holding register. Modbus register numbers are the Modbus equivalent of the SNMP OID, but simply much shorter, having only a single number rather than a string of numbers like the OID. There is no concept of a tree structure to the numbering scheme in Modbus. It can be thought of as a simple array of numbers, and the register number is your index into that array. The screen shot clip below illustrates setting up read map #1 to get register 1 from remote device 1 and storing its data in local register 1. Check out the web page demo above for a more in depth look at this.

If we now want to see the OID list where we find this data, look at the MIB View page. The OID for reaching the data obtained from register 1 at device 1 is 1.3.6.1.4.1.3815.1.2.2.1.1.1.1.1.2.1.

Can I read floating point registers?

Yes. Although floating point is not standardized in Modbus protocol, it is a widely accepted standard that Modbus uses IEEE-754 32-bit floating point notation. But you do need to know some details and pitfalls to watch for. Modbus protocol defines "registers" as 16-bit entities. This means devices will use two consecutive registers to provide access to a 32-bit floating point number. This concept is widely recognized; however, the definition of whether the high order register is first or second is not at all standardized. Since the Modbus protocol is by definition "big endian", Control Solutions treats big endian register ordering as "normal". If the low order register comes first, Control Solutions calls this "swapped". Other companies may define swapping opposite this. It doesn't matter, because each read or write map allows you to specify whether the target remote register is swapped or not and it becomes a relative thing. If floating point registers are incorrectly swapped, a floating point value of 1.0 will become 2.27795e-41, which will most often be rounded to zero. In case you are tempted to draw a simple conclusion about the pattern of 1 displayed as zero, here is another example: Incorrectly swapping registers will turn the value 1.1 into -107084896. How do the two registers containing a floating point value map to an OID? The pair of registers are treated as one entity by Babel Buster SP any time you specify a 32-bit register format. Provided you select a floating point local register as the destination for reading Modbus, or as the source for writing Modbus, that local register is accessed as a single floating point OID.

How do I handle 32-bit integer values?

Local registers in Babel Buster SP are either 16-bit integer or 32-bit floating point. If you are interested in a large value provided by the Modbus device as a 32-bit integer, we recommend you map it to a floating point local register. You will end up with approximately the same data. There are times when "approximately" isn't good enough, particularly when the 32-bit register is a bit mask and you are interested in each individual bit. In this case, you can usually read the 32-bit register as two consecutive 16-bit registers (that's what they are in the protocol to begin with), and map them to two separate 16-bit local registers.

Babel Buster isn't talking, now what? (we are assuming Modbus RTU RS-485 here)
(1) (2) (3) (4) Check the wiring web page to see that you have correctly wired the devices. Check the device tab to be sure you have selected the correct baud rate. Check to see that you have at least one read map defined. Holding register is most common type. Make sure response timeout is long enough (1 sec is ok during testing)

The red power light doubles as a status light used by Babel Buster SP software. If you have successfully configured Babel Buster to read at least one Modbus register, this light will be flashing. If off, recheck the web pages for missing configuration information. If you think everything looks good so far, check the Error Codes page. The columns toward the right will show total message count and error counts. The most common problem will be finding a count in the "No Responses" column equal to the "Total Messages" (or within one). This means you are not communicating at all. A zero count, or count that never increases in the Total Messages column means it isn't trying - go back to checking the configuration. However, if Total Messages is counting upward, and No Responses is counting up just as fast, you have no communication between the devices even though Babel Buster is trying. Reasons for no communications: (a) Wiring problem. In addition to making sure plus goes to plus and minus to minus, make sure termination is turned on at the Babel Buster (DIP switch), and that you have termination at the other end of the line. You want termination only at the far end of the line, and not in any devices in the middle. (b) Slave address, slave ID, or unit number (all names for same thing) not correct. (c) Baud rate not correct. (d) Response timeout too short for this device. (e) Modbus device requires additional configuration before it will honor Modbus protocol. (f) If device documentation only mentions "register" without reference to type, it is a holding register 99% of the time. But try "Input register" anyway if having no luck with holding register. As long as you have at least one read map configured to try to read something, it is irrelevant whether the data is correct until Total Messages starts to exceed No Reponses by more than one. If there is a long line between Babel Buster and the Modbus device that is not responding, temporarily move Babel Buster to within a few feet of the Modbus device and disconnect the rest of the RS-485 network. This test will rule out wire breaks, wire quality issues, termination questions, etc. If you get a count in the "Exceptions" column, consider it progress. It means you are communicating, the devices are understanding each other, but the Modbus device is telling you something is invalid about your request. Asking for a register number that doesn't exist in the device is the most common cause of an exception error. If you get CRC errors, wiring or baud rate mismatch are the most common cause.

How do I set up an SNMP trap?

Modbus register data is placed in local registers using Read Maps and Write Maps. Each local register is accessible by standard SNMP Get and Set requests. Threshold "rules" determine when traps are sent. The image below is an actual screen shot of a threshold rule that will result in a trap when the Modbus data mapped to local register 7 exceeds a level of 1000. Data values are scaled to any units you decide. You find the threshold rules in the System->Action Rules->Thresholds page.

Additional configuration pages allow setting the IP address or Host Name of one or more SNMP managers that v2c traps are to be sent to. Traps may be repeated periodically for as long as the rule tests true. Trap data includes the register name and number, data value that caused the trap, the event name, test type, and test threshold. Once you have the Threshold Rule set up, you need to go to the IP Network->SNMP Setup->Trap Enable page and check off whether to trap on true, false, or both, and also which group(s) to send the trap to. The following is what you would see for the above rule:

The other tabs under IP Network->SNMP allow you to set up the SNMP manager IP addresses or host names for each of up to 3 groups.

How do I prevent spurious traps when the test value is hovering around the threshold?
Hysteresis will prevent spurious traps near the threshold. In the following example, the trap will occur when register 7 reaches a level of 1000. If register 7 drops below 1000 by a margin less than 50, then returns to above 1000, the trap will not repeat. The value of register 7 must drop below 950 and return to over 1000 before the trap will repeat.

How do I generate a trap only after the condition has existed for a minimum time?
The on/off time qualifications are used to add time to the criteria. The following example shows a minimum on time of 30 seconds. This means the data in register 7, placed there by a Read Map, must exceed a level of 1000 for at least 30 seconds before a trap will be generated. If the minimum off time was also set, the rule must test false for that amount of time before it can repeat the "true" trap.

Do I want register 1 or 40001?

A significant amount of Modbus device documentation uses 40001 to refer to holding register 1. The offset of 40,000 indicates holding register, also sometimes called a "4X" register. This notation is sometimes referred to as "Modicon" convention since Modicon PLCs are where this method was first used and documented. When this form of notation is used, the following offsets are used: 0x 1x 3x 4x Coil 00001-09999 Discrete Input 10001-19999 Input Register 30001-39999 Holding Register 40001-49999

This notation has the limitation of only supporting 9,999 registers of each type. The extended form of the same notation uses an offset of 400,000 to reference a holding register. The entire list of applicable offsets is: 0x 1x 3x 4x Coil 000001-065535 Discrete Input 100001-165535 Input Register 300001-365535 Holding Register 400001-465535

This is only a documentation convention. The offset or register type determines the function code used to access that register. The addresses that go out over the wire start at 0 and run through 65,535 in all cases. Raw address is always one less than register number. If documentation lists register 40001 you should enter register number 1 and select holding register as the type. Some Control Solutions products do use the notation shown above. Babel Buster SP and the AddMe III family all use register numbers starting at 1 in all cases, along with an indication of register type selected from a list of descriptive names such as "holding register".

How to I read individual bits in a register?

The bit mask shown in the expanded form of the RTU read map is a 4 digit hexadecimal (16 bit) value used to mask out one or more bits in a register. The selected bits will be right justified, so a single bit regardless of where positioned in the source register will be stored locally as 0 or 1. The notation of register number followed by a colon and number from 0 to 15 indicates a single bit picked from that register. The hex bit mask values would be as follows, assuming a register number of 40001. 40001:0 mask: 0001 40001:1 mask: 0002 40001:2 mask: 0004 40001:3 mask: 0008 40001:4 mask: 0010 40001:5 mask: 0020 40001:6 mask: 0040 40001:7 mask: 0080 40001:8 mask: 0100 40001:9 mask: 0200 40001:10 mask: 0400 40001:11 mask: 0800 40001:12 mask: 1000 40001:13 mask: 2000 40001:14 mask: 4000 40001:15 mask: 8000 Sometimes a 16-bit register is used to hold two 8-bit values. To strip bytes using the bit mask, you would enter the following: Low byte mask: 00FF High byte mask: FF00 The following example shows reading a single bit documented as 40289:6. After processing this read map, local register 38 will contain either 0 or 1 according to bit 6 in holding register 289 in the device with slave address 1.