Using MODBUSDIAG on SCADAPack x70 Devices | Schneider Electric Belgium

Hoe kunnen wij u vandaag helpen?

Using MODBUSDIAG on SCADAPack x70 Devices

The MODBUSDIAG command on SCADAPack x70 devices serves as a valuable tool for observing Modbus messages exchanged between the SCADAPack x70, when configured as a Modbus RTU Client or Modbus/TCP Client, and a Modbus Server device. This allows for effective monitoring and troubleshooting of Modbus communication.

You can access the command line interface on a SCADAPack x70 device to use the MODBUSDIAG command through a couple of methods: by connecting to the Command Line Interface port with a terminal program via a configured serial port or by enabling and connecting via the Telnet server.

Accessing Command Line Diagnostics via Serial Port

To access the command line interface via a serial port, you need to connect using a terminal program. A popular and open-source option for this is PuTTY. The command line functionality must be enabled on a serial port of the SCADAPack x70. It's important to note that only one serial port can be designated for command line operation at a time. To configure a serial port for this purpose, navigate to the Serial Communication > Ports section in the configuration software and set the Port Function parameter for your desired serial port to "Command Line". Configure other General Setup parameters like Port Mode (e.g., RS232 or RS485) and Baud Rate accordingly before applying the changes.

Accessing Command Line Diagnostics via Telnet Server

Alternatively, you can enable and connect via the Telnet server functionality on the SCADAPack x70 device. This allows remote access to the device command line. To activate the Telnet server, navigate to IP Communication > Services in the configuration software and select the checkbox for "Telnet Server". Telnet is not a secure protocol since it sends data in cleartext. It is recommended that Telnet be disabled on the device when not in use.

Important Consideration for SCADAPack 47xi Devices: When Role-Based Access Control (RBAC) is enabled on SCADAPack 47xi devices, Telnet server operations are not available.

Understanding MODBUSDIAG Output and Usage

When working with SCADAPack 47xi devices and utilizing MODBUSDIAG, it is crucial to consider user roles and access control, especially if Role-Based Access Control (RBAC) is active. The MODBUSDIAG command is classified as a MEDIUM level command. Therefore, users must have the necessary roles configured within the system to be authorized to execute MEDIUM level commands. The roles that typically have this authorization include "Configuration and Operation", "Firmware Administrator", and "Edge Developer", as outlined in the system's access control settings.

In terms of the output provided by MODBUSDIAG, the command is designed to display both transmitted (TX) and received (RX) Modbus protocol data. Additionally, it can present error messages that indicate communication interruptions between the SCADAPack x70 and the Modbus device.

You can enable specific transmit and receive diagnostics for use with MODBUSDIAG. Within the serial port configuration (Serial Communication > Ports > Serial #), ensure the Port Function is set appropriately for Modbus communication (e.g., set to "Modbus"). The diagnostic output generated will be accessible through the command line interface when the Port Function is set to "Command Line".

Using MODBUSDIAG Filters

The MODBUSDIAG command supports filters to help you focus on specific types of Modbus protocol diagnostics. The basic usage is:

MODBUSDIAG mode filter [filter ....]

mode: This parameter determines whether you are enabling or disabling the specified filters.

- ENABLE or e: Activate the filters that follow.
- DISABLE or d: Deactivate the filters that follow.

filter: You can specify one or more filters to control the diagnostic output.

Here are some of the available filters:

*: Enables or disables every filter except FILTER_ADDR.
TX: Displays Modbus protocol data transmitted by the SCADAPack x70 (Client or Server).
RX: Displays Modbus protocol data received by the SCADAPack x70 (Client or Server).
EXCEPTION: Displays messages related to communication interruptions (e.g., no response, timeout).
FILTER_ADDR: Restricts diagnostic messages to a specific Modbus address (Station Address or Unit Identifier). This filter requires you to provide the address.
OTHER_RTU_MSG: Displays Modbus messages not intended for the local RTU (e.g., on a multi-drop link).
SERIAL: Displays receive and transmit data for Modbus RTU protocol (Client or Server).
TCP_CLIENT: Displays receive and transmit data for Modbus/TCP protocol when the device is a Client.
TCP_SERVER: Displays receive and transmit data for Modbus/TCP protocol when the device is a Server.

Guidance on Using Filters:

Using diagnostics can impact system performance, so disable filters when not in use.
Filters are retained in non-volatile memory after a device restart.
ENABLE * does not enable FILTER_ADDR as it requires a specific address.
Hexadecimal format is used to display protocol data bytes.
Timestamps on Modbus diagnostic messages are displayed in RTU System Time.

Examples of Using MODBUSDIAG with Filters:

MODBUSDIAG enable tx rx tcp_server tcp_client: Displays transmitted and received Modbus protocol data for both Server and Client operations.
MODBUSDIAG disable rx: Removes received data from the diagnostic display (results depend on previously set filters).
MODBUSDIAG enable *: Enables all Modbus message diagnostics except address filtering.
MODBUSDIAG e tx rx serial tcp_server tcp_client filter_addr 12: Displays transmitted and received Modbus protocol data associated only with Modbus Station Address 12 or Modbus Unit Identifier 12.

After the filters have been enabled, at the C:\> prompt, enter in the word DIAG, to begin the diagnostic stream.

modbusdiag

diag

Understanding the structure of Modbus messages is key when interpreting the MODBUSDIAG output. For instance, let's examine a common Modbus function code: Read Holding Registers (FC=03).

Modbus Read Holding Registers (FC=03) Example

This command is requesting the content of analog output holding registers # 40108 to 40110 from the Server device with address 17.

Request:

11 03 006B 0003 7687

11: The Server Address (11 hex = address 17)
03: The Function Code 3 (read Analog Output Holding Registers)
006B: The Data Address of the first register requested (006B hex = 107, + 40001 offset = input #40108)
0003: The total number of registers requested (read 3 registers 40108 to 40110)
7687: The CRC (cyclic redundancy check) for error checking.

Response:

11 03 06 AE41 5652 4340 49AD

11: The Server Address (11 hex = address 17)
03: The Function Code 3 (read Analog Output Holding Registers)
06: The number of data bytes to follow (3 registers x 2 bytes each = 6 bytes)
AE41: The contents of register 40108 (as two bytes)
5652: The contents of register 40109 (as two bytes)
4340: The contents of register 40110 (as two bytes)
49AD: The CRC (cyclic redundancy check).

It is helpful to understand that MODBUSDIAG is a specialized diagnostic command focused solely on Modbus protocol communication. This differentiates it from other available diagnostic commands which are designed for monitoring different protocols or system aspects, such as DNPDIAG for the DNP3 protocol, HARTDIAG for the HART protocol, and TCPDIAG for monitoring TCP communication.