Modbus Register Mapping for the PLC IO Interface for GE Genius IO

Knowledge Base /
Technical Notes

By Geoff Nash

Product: PLC IO Interface

This technical note describes the Modbus register mapping for the PLC IO Interface for GE Genius IO.

Modbus TCP/IP

The legacy module will be accessible via a TCP/IP connection using the Modicon Modbus protocol (Open Modbus TCP/IP specification). The access for each IO table will be by IO register address (words 300001-301500 (AI), 400001-401500 (AO) for analog tables (3-4), bits 1-25600 (DO) and 100001-125600 (DI) for discrete tables (1-2)).

Global status will be accessible in AO registers 401501 to 401900, and the configuration table will be accessible in registers 401901 to 402000.

GE Genus Table Set Definition

There are three types of tables. The first type of table is the “Global” legacy status group, while the second is the “IO Table” group containing only data pertinent to a specific IO type, and the third is the “configuration” table. The purposes and organization of these groups is described in this section.

The following sections give the detail organization for the layouts of the individual tables.

Open Modbus TCP/IP Dataset assignments

The data tables will be assigned modbus register (and coil) address for access using Modbus TCP/IP. These will be sequentially assigned to the IO Table registers. (note offsets are specified for the IO address in modbus messages, therefore DI 100001 is addressed as offset 0 in messages.

Global status registers (Table 0, sets 1-4) will be accessible in the AO table in registers 401501 to 401900. The configuration table (5) will be accessible through the AO table (401901-402000).

For Modbus TCP/IP communications the address is specified as an offset in the table (1 to 1500 for IO, 1501 to 1900 for global status, and 1901 to 2000 for configuration dataset).

Global (status) Set(s)

Ports 3 and 4 (Ethernet configuration port and Modbus TCP/IP port) have all 32 Blocks configured.

Global Table Set 1 Layout

This table set contains the global configurations and status data as well as the first nine (9) Block configuration and status words. See DS2 = Blocks 9-18, DS3 = Blocks 19-28, and DS4 = Blocks 29-32

Driver Status words		Driver Version	1	401501	00-07	Build (1-255 in bits 0-7) Minor (0-15 in bits 8-11), and Major (1-15 in bits 12-15)		1
		Sync Byte	2	401502	00-07	Sync Byte Incremented by driver each IO scan (0-255)
					08-15	Status Byte
		Mode	3	401503	00-07	Legacy module Mode (1= running, 0= program) display only, set in Table 5 (configuration table)		0
					08-15	Legacy module redundancy status		0
		RIO Status	4	401504	00-07	Module RIO status
					08-15	Redundant partner RIO status
		Blocks	5	401505	00-07	First Block (1-32)
					08-15	Blocks (1-32)
Card Revision			6	401506	00-07	Revision number of the µGENI software (read from shared memory)		0
					08-15	Reserved		0
Watchdog time/Hardware Status			7	401507	00-07	Indicates the status of the µGENI hardware
					08-15	Heartbeat timeout multiplier (Watchdog timer time) in 50 ms units: 0=OFF, or 4-20 (200 to 1000 ms)
Card Bus Errors			8	401508		Integer count of the total bus errors		0
Bus scan time			9	401509		Time between µGENI’s two previous turns on the bus (or 0xFFFF if unable to communicate on bus. Time for one scan of the IO blocks
Board Setup			10	401510	00-07	IO Table Length (0-128)		128
					08-15	Configuration (initially from dip switches, then set by configuration)		FF or FE
Module Identification			11	401511	00-07	Module ID (1-255)		0
					08-15	Redundant partner ID (1-255, or 0 if no partner communicating)		0
Reference Address			12	401512		Reference address broadcast		0xFFFF
Command Block			13	401513	00-07	Status for datagram commands
					08-15	Command byte for datagrams
Controller Communications			14	401514	00-07	Modbus TCP/IP Connections
					08-15	Primary Communications Method (0= Modbus TCP/IP, 1 = RS485)
µGENI Ports			15	401515	00-07	µGENI Board command port byte value
					08-15	µGENI Board status port byte value
Process scan time			16	401516	00-07	Current process scan time (ms)
					08-15	Maximum process scan (10 ms units)
Active block table			17	401517	00-07	Set bits reflect blocks communicating with this module (inputs and status values are valid).	Blocks 1-8
					08-15		Blocks 9-16
			18	401518	00-07		Blocks 17-24
					08-15		Blocks 25-32
Redundant block table			19	401519	00-07	Set bits reflect blocks communicating with this module via the redundant unit (inputs and status values are valid).	Blocks 1-8
					08-15		Blocks 9-16
			20	401520	00-07		Blocks 17-24
					08-15		Blocks 25-32
Block 1 Configuration / Status	Block ID		21	401521	00-07	Module ID (number) of block assigned to this block number		0
	Block Address				08-15	Block bus address accessed (0-31)
	Present		22	401522	00-07	Block is present (on-line = 1), or not (0)		0
	Outputs Enabled				08-15	Time to wait for message from Block (in 100 ms units)		3
	Process Bits		23	401523		Dynamic Process control bits
	Broadcast length		24	401524	00-07	Length of broadcast messages from this block
	Directed data length				08-15	Length of directed data messages from this block		3
	Block Fault Status		25	401525	00-07	Returned in fault messages, this block status varies by type:		0
	Block Configuration				08-15	Block configuration words (holds data types)
	Circuit Faults (1-16)		26	401526	01-15	Fault status of first 16 circuits in the specified block
	Circuit Faults (17-32)		27	401527	01-15	Fault status of second 16 circuits (17-32) in the specified block
	Datagram Command		28	401528	00-15	Datagram command/response for block
	Block Cfg bits		29	401529	00-15	Dynamically accessible block configuration bits
	Redundancy		30	401530	00-07	Device update ID
					08-15	Redundant block present
Block 2 Configuration / Status	Block ID		31	401531	00-07	Module ID (number) of block assigned to this block number		0
	Block Address				08-15	Block bus address accessed (0-31)		0
	Present		32	401532	00-07	Block is present (on-line = 1), or not (0)		0
	Outputs Enabled				08-15	Time to wait for message from Block (in 100 ms units)		3
	Process Bits		33	401533		Dynamic Process control bits		3
	Broadcast length		34	401534	00-07	Length of broadcast messages from this block		3
	Directed data length				08-15	Length of directed data messages from this block
	Block Fault Status		35	401535	00-07	Returned in fault messages, this block status varies by type:		0
	Block Configuration				08-15	Block configuration words (holds data types)
	Circuit Faults (1-16)		36	401536	01-15	Fault status of first 16 circuits in the specified block
	Circuit Faults (17-32)		37	401537	01-15	Fault status of second 16 circuits (17-32) in the specified block
	Datagram Command		38	401538	00-15	Datagram command/response for block
	Block Cfg bits		39	401539	00-15	Dynamically accessible block configuration bits
	Redundancy		40	401540	00-07	Device update ID
					08-15	Redundant block present
. . .
Block 8 Configuration / Status	Block ID		91	401591	00-07	Module ID (number) of block assigned to this block number		0
	Block Address				08-15	Block bus address accessed (0-31)		0
	Outputs Enabled		92	401592	00-07	Time to wait for message from Block (in 100 ms units)		0
	Present				08-15	Block is present (on-line = 1), or not (0)		3
	Process Bits		93	401593		Dynamic Process control bits		3
	Broadcast length		94	401594	00-07	Length of broadcast messages from this block		3
	Directed data length				08-15	Length of directed data messages from this block
	Block Fault Status		95	401595	00-07	Returned in fault messages, this block status varies by type:		0
	Block Configuration				08-15	Block configuration words (holds data types)
	Circuit Faults (1-16)		96	401596	00-15	Fault status of first 16 circuits in the specified block
	Circuit Faults (17-32)		97	401597	00-15	Fault status of second 16 circuits (17-32) in the specified block
	Datagram Command		98	401598	00-15	Datagram command/response for block
	Block Cfg bits		99	401599	00-15	Dynamically accessible block configuration bits
	Redundancy		100	401600	00-07	Device update ID
					08-15	Redundant block present

Driver Status Words

This group is designed to display the current status of the GE Genus Legacy RIO driver.

Driver Status words	Driver Version	1	401501	00-07	Build (1-255)
				08-11	Minor (0-15)
				12-15	Major (1-15)
	Status/Sync word	2	401502	00-07	Sync Byte Incremented by driver each IO scan (0-255). Resetting this byte to 0, then reading the value back can be used to time IO scans between accesses.
				08-15	Status byte displays the legacy module status. The bits are set sequentially as the driver loads. When the driver is running normally the value should be 0x7F
					08	Module DLL initializing
					09	RIO card memory assigned and driver loaded
					10	Last module configuration loaded
					11	Process thread started (valid check bytes)
					12	Process thread card communications OK (cleared on WD timeout)
					13	RIO card driver watchdog timer timed out, unit is in off-line (0x82) mode.
					14	RIO card driver not responding (process thread has terminated, must reboot)
					15	Reserved
	Mode	3	401503	00-07	Legacy module Mode (1= running, 0= program) display only, set in Table 5 (configuration table)
				08-15	Redundancy status (0x00=non-redundant, 0x01=active, 0x02=standby, 0x82=off-line), set by Query command only
	RIO Status	4	401504	00-07	Module RIO Status
					Bit		Description
					0		Legacy module not running (check High byte of register 2 for reason)
					1		RIO Board timed out, must reboot legacy module
					2		RIO board not on-line
					3		RIO board not communicating on bus
					4		Legacy module off-line
					5		Legacy module in standby mode
					6		Legacy module in program mode
					7		RIO card not present, must reboot
				08-15	Redundant Partner RIO Status (0xFF = Not configured, or not communicating)
					Bit		Description
					0		Legacy module not running (check High byte of register 2 for reason)
					1		RIO Board timed out, must reboot legacy module
					2		RIO board not on-line
					3		RIO board not communicating on bus
					4		Legacy module off-line
					6		Legacy module in standby mode
					7		Legacy module in program mode
					7		RIO card not present, must reboot
	Blocks	5	401505	00-07	First Block (1-32)
				08-15	Number Blocks (1-32, (maximum (32 – First Block) + 1

Card Status Words

This group of register displays the current status of the S&S RIO card. Except for the Incremented CRC error value, these values are read only (cannot be changed).

Revision Number	6	401506	00-07	Revision number of the µGENI software running on the RIO board
			08-15	Reserved
Hardware Status	7	401507	00-07	µGENI runs self-tests periodically as part of normal operation. If an error occurs during one of these self-tests, the µGENI immediately stops all processing. Individual bits in this byte indicate the type of error that has occurred. If any of these bits is set, the µGENI OK bit (see 'µGENI OK Status', above) is cleared and the processor halts, which allows the watchdog timer to reset the board.						Bit		Status	0
										0		RAM Fault
										1		EPROM Fault
										2		Processor Fault
										3		Communication Hardware Fault
										4		Host Heartbeat Fault
										5		Excessive Bus Errors
										6		HMI Present
										7		WD Heartbeat enabled*
Card Watchdog Time			08-15	Watchdog timer in 50 ms units: 0=OFF, or 4-20 (200 to 1000 ms)									0
Buss Errors	8	401508		Integer count of the total bus errors. At power-up, this count is 0. If any bus errors occur, µGENI increments this count. As errors occur over multiple bus scans, the total count increases to a maximum of 65535. If this total is reached, the count wraps back to 0. If a hand-held is attached but ‘OFF’, then this error count will continually increment.
Card Bus Communications Time	9	401509		Integer representation of the bus scan-time. This milliseconds value is updated each bus scan. It represents the amount of time between µGENI’s two previous turns on the bus. If µGENI cannot access the bus, the value is set to 65535 (FFFFH). The host can monitor this location to verify that µGENI is communicating on the bus.
Board Setup	10	401510	00-07	Board setup byte (read only, values are set with dipswitch in module)
				Bits		Block address (normal should be 31, or 30). Other addresses are not recommended, the blocks expect one of these addresses for the bus controller (31), or backup bus controller (30). Other addresses may be used to monitor the block status.							11111
				00-04
						Bit Pattern			Value(s)
						11111			31
						11110			30
						11101			29
						11100			28
						11011			27
						11010			26
						11001			25
						11000			24
						10111			23
						10110			22
						10101			21
						10100			20
						10011			19
						10010			18
						10001			17
						10000			16
						01111			15
						01110			14
						01101			13
						01100			12
						01011			11
						01010			10
						01001			9
						11000			8
						00111			7
						00110			6
						00101			5
						00100			4
						00011			3
						00010			2
						00001			1
						00000			0
				05-06		Bus Baud rate, the communications speed on the bus. If modules do not communicate at the speed here, this bus controller will not see them.
						00			153.6 Extended (8 bit skip)				11
						01			38.4 (8 bit skip)
						10			76.8 (8 bit skip)
						11			153.6 Standard (4 bit skip)
				07		Module Outputs Enabled on startup
						0			Disabled at startup				0
						1			Enabled at startup
			08-15	The length of each buffer in the block I/O Tables. The default buffer length is 128 bytes. Shortening the buffer length (all buffers are the same length), shortens the entire I/O Table. The buffer length may be 1 to 128 bytes. The length selected must be long enough to accommodate any block’s inputs and outputs (including Global Data and Directed Control Inputs data). µGENI will not log in any block that sends or receives more data than will fit into its I/O Table buffer.									128
Module Identification	11	401511	00-07	Module identifier number, this is configured with the module configuration utility (PLC Explorer), should be a unique number (1-255)
			08-15	Redundant partner ID (Set in the partner using the PLC Explorer utility (1-255) or 0 if no partner is communicating.
Module Configuration Word	12	401512		This is a copy of the current module configuration word from the configuration dataset									65535
				Bit(s)	Description
				0	GE Genius Bus, the bus on which this module is communicating (0=A, 1=B). This may only be set in program mode (in active module)
				1	Redundant Bus, this is the Bus to switch to if this module fails (0=A, 1=B). This read-only bit will not match bit 0 (current bus), it is automatically set to the opposite state.
				2	Disable (1) Alternate BSM, standby BSM will be opposite from primary (i.e, if not set, and Primary is A, partner will be B, if set (1), primary and partner are the same)
				3	Automatically send reset for any fault (1) or require manual (0) resets.
				4	Block IO polling datagrams enabled (1) for any block that is capable (and enabled) to respond to this message, input data length will is increased to allow this data.
				5	Reserved
				6	Outputs enabled after first write in standby (0). This is used to allow the output table to be written to prior to establishing communications with block (used to prevent writing default zeros (0) outputs to block when module cycles from program to run (or on a cold reboot), this is disabled if this bit is set to 1 (outputs will always be enabled).
				7	All outputs are enabled (this allows module to be recognized by all blocks). This may be used prior to starting an auto-configuration sequence to allow BSM enabled blocks to be switched to the unit for detection.
				8	Standby poll of output values from active enabled (0) or Disabled (1)
				9	Standby poll of parameters values from active enabled (0) or Disabled (1)
				10	Controller communications (RS485/ModbusTCP) watchdog timer disabled (1) to allow communication by configuration utility even when no controller is communicating with the module. When this bit transitions from 1 to 0, the current configuration (if modified) is written to flash (if modified).
				11	Reserved
				12	Configuration status being captured (1) (read only)
				13	Configuration capture initialized (1) or not (0)
				14	Configuration utility bit (set by configuration utility, this prevents timeouts on Controller communications link (1), and when transitions from 1 to 0 triggers configuration write (if not already written). Also sets fail bits in RIO status word (Global word 4) so controller will not trigger status changes during configuration process.
				15	LED’s being flashed to identify unit

Datagram Command Block	13	401513	00-07	The low 7 bits of the command byte of the command block, specifies the command to be performed, and determines how µGENI will acknowledge the command when it is received. (If high bit (7) is set, the command returns (status byte is 0 (waiting) as soon as the µGENI captures command, no error processing is available. Most commands should be sent with this bit = 0).					1		Read datagram (		0
									2		Transmit datagram
									3		Transmit datagram (with reply expected)
									4		Change Configuration
			08-15	The status byte of the command block indicates the status of the requested command.(This should be set to 1 before any command is placed in command byte)					0		Waiting (The command block is free)		0
									1		Initializing command (set prior to setting command byte)
									2		Command in progress (set by µGENI)
									4		Command complete (set by µGENI)
									8		Syntax Error (command failed)
									16		Processing Error (command failed)
Controller Communications	14	401514	00-07	Number of Modbus TCP/IP connections currently active with legacy module									0
			08-15	Primary path of communications, 0 = Modbus TCP/IP, 1 = RS-485. This is the path that determines the pattern of the communications lights on the legacy module. If RS-485, each light specifies the status of one of the 485 communications ports (Steady if OK, flashing if no communications on the port). If 0 (Modbus TCP/IP), then the top communications light is lit if there is an open connection (00-07 > 0), the lower LED flashes on each message..									0
µGENI Ports	15	401515	00-07	µGENI command port byte value (These values were obtained from the PCIM users manual (chapter 2)			0	Watchdog Timer Pulse: The watchdog timer is a hardware timer that can be enabled by the configuration software. If the watchdog timer is enabled, it must be reset periodically or it will put the µGENI into RESET. You can toggle the watchdog timer and use it as a failsafe timer to ensure that if the Host system ‘hangs up’, the µGENI will not send any erroneous messages to the serial bus. If the watchdog timer is disabled by by the configuration software, you do not have to toggle it; it will stay turned off and will not put the µGENI into RESET. If the watchdog timer is enabled by the configuration software, this bit must be pulsed at least every 727mS to keep the watchdog timer from expiring. This bit must be pulsed at least once to allow the µGENI to come out of RESET.
							1	Clear RESET Request: When the system is Reset, or when the voltage detector on the motherboard detects a low voltage condition, status bit 0 (see previous page) goes to 0. Command bit 1 (Clear Reset) clears the reset request when set to 0. To prepare for the next detection of RESET or low voltage condition, it must be reset to 1.
							2	Clear Interrupt Request: This bit is used to clear an interrupt to from a µGENI. Setting the bit to 0 clears the interrupt. It must then be set back to 1 to prepare it for the next interrupt.
							3	HHM Test: An HHM present can be indicated even when one is not plugged in by raising this bit to 1. After power up and under normal conditions, this bit should be 0.
							4-5	Not Used
							6	µGENI RESET: When this bit is 0 it resets the µGENI. Under normal conditions, it should be left high.
							7	Not Used
			08-15	µGENI status port byte value (These values were obtained from the PCIM users manual (chapter 2)			0	Low Voltage/Host RESET Detect: This input goes to 0 and stays 0 (until reset) whenever the voltage on the motherboard drops below 3.12 volts or the Host system has gone into RESET. Reset this bit by the setting ‘1’ bit of the command port output byte (bits 0-7). During normal operation this bit should be 1. Note Do not enable interrupts, or read/write to the µGENI for 2 seconds (the period of time required for hardware/software initialization) after reset. One false interrupt occurs within this time period. Reading or writing to the µGENI during this time may cause the watchdog timer to time out. The µGENI OK flag will be invalid during this period of time.
							1	Watchdog Timer Status: This bit is 1 if the watchdog timer as been enabled by the configuration software and is being pulsed every 727mS by µGENI Control bit 0. If the timer expires, this bit goes to 0. It will also go to 0 if the voltage detector detects low voltage. If not enabled by configuration, the timer does not need to be pulsed.
							2	Interrupt Request :When the µGENI generates an interrupt, this goes to 1 and stays 1 until reset by Control bit 2 (see next page).
							3	µGENI OK: The state of this bit follows the condition of the µGENI OK LED on the µGENI. If the LED is lit, the µGENI OK bit is 0.
							4	COMM (Communications) OK: Like the BOARD OK bit, this bit follows the output of one of the LED’s on the µGENI. This bit is 0 if the COMM OK LED on the µGENI is lit.
							5-7	Not Used
Active block table	17	401517	00-07	Set bits reflect blocks communicating with this module (inputs and status values are valid)..				Blocks 1-8 (low bit represents block 1 (bus address 0)
			08-15					Blocks 9-16
	18	401518	00-07					Blocks 17-24
			08-15					Blocks 25-32
Redundant block table	19	401519	00-07	Set bits reflect blocks communicating with this module via the redundant unit (inputs and status values are valid).				Blocks 1-8
			08-15					Blocks 9-16
	20	401520	00-07					Blocks 17-24
			08-15					Blocks 25-32

Watchdog is enabled (bit 7 set (1)) if shared memory locations 0x0ABB is 0x47and 0x0ABC is ox45, otherwise watchdog is disabled (bit = 0)

Block Status Words

Each configured Block (see Block word in the command word section) contains 10 status words. These words display the current status of the Block.

Block ID	1	00-07	Module ID (number) of block assigned to this block number
Block Number		08-15	Block bus address (communications address 0-31)
Present	2	00-07	Block is present (on-line = 0x01), or not (0x00)
Outputs Enabled		08-15	Control communications with block (0x00 = module will communicate with block if present, 0x01 will not). Should always be 0x00 for configured blocks.
Process bits	3		Dynamic Process control bits
Broadcast length	4	00-07	Length of broadcast messages from this block (0-128 bytes)
Directed data length		08-15	Length of directed data messages from this block (0-128 bytes)
Block Configuration	5	00-07	Block configuration words (holds data types)
			Bit(s)	Description
			00-01	Describes whether the block is an input only, output only, or combination I/O block. Values are: 01 = Input only, 10 = 0uput only, 11 = combination IO. 00 is not used. This is read from block.
			02	Configuration “changed” bit 1= changed. After handling response, writing 0 to this bit allows it to be tripped on the next change.
			03	Configuration matches (reset prior to calling compare block configuration below)
			04	Pulse Test Complete (reset when a pulse command is issued below)
			05	BSM Controller enabled (0=No, 1=Yes)
			06	Current BSM Status (valid if block is BSM enabled) 0=Bus A,. 1=Bus B
			07	BSM Forced by HHM (0-No, 1=Yes)
Block Fault Status		08-15	Returned in fault messages, this block status varies by type: Writing a zero (0) to this byte will trigger a “Reset-ALL” message to the block.
			Type			Bit	Status
			Discrete			11	Terminal Assembly EPROM Fault
			Analog, RTD, Thermocouple			11	Terminal Assembly EPROM Fault
						13	Electronic Assembly EPROM fault (calibration error)
						15	Internal circuit fault
			High Speed Counter			11	Terminal Assembly EPROM Fault
						15	Internal circuit fault
Circuit Faults (1-16)	6	01-15	Status bits for circuits 1 to 16 on block, 0 = OK, 1 = Faulted (examine individual circuit status byte in IO data table section for block for details on status). Writing the bit(s) for the faulted drop will trigger a reset circuit message to the specified block(s).
Circuit Faults (17-32)	7	01-15	Status bits for circuits 17 to 32 on block, 0 = OK, 1 = Faulted (examine individual circuit status byte in IO data table section for block for details on status). Writing the bit(s) for the faulted drop will trigger a reset circuit message to the specified block(s).
Block Cmd Register	8	0-7	This is the response byte for the datagram command byte for the specified block. This byte is read-only, when the command byte is zeroed, this byte is reset. Write a command byte containing one command bit (and bus bit for bus switch), and then wait for the response in this byte.
			Bit	Description
			00	Read configuration complete (1=yes, 0=no)
			01	Writing configuration complete (1=yes, 0=no)
			02	Diagnostic Read complete (1=yes, 0=no)
			03	Block IO complete
			04	Pulse Test running (reset prior to calling pulse test datagram command below)
			05
			06	Bus switching (set to bus selected before sending message), When message is competed, bus bit in configuration byte will match that selected in the command byte.
			07	Datagram command error (this is set when a datagram fails to complete, or returns an error status). This bit before writing to the datagram command register (this is also reset when the datagram command register is set to 0).
		8-15	This command byte should be zero (0x00) when not sending datagram to block. This allows a command to be triggered by simply setting the appropriate bit. Bits may be cleared when response byte matches an expected pattern (or bit 15 is set [error]). Response is cleared when the zero command is set.
			Bit	Description
			08	Read configuration from block (complete configuration is read, CRC is updated). 1=read
			09	Write current configuration to block (complete configuration is written). 1=write
			10	Read Diagnostics
			11
			12	Pulse test (transition to 1 initializes a pulse test, reset to 0 when test complete (or prior to initializing) to enable setting for another test.
			13	Block IO Poll datagram successful (1) or faulted/not enabled or running (0)
			14	Set Bus (1=Set, 0=leave as is), reset (set to 0 when bus in response byte = expected value).
			15	Bus value (0=bus A, 1=bus B)
Block configuration bits	9	0-7	Dynamically accessible block configuration bits
			Bit		Description
			0		Initialize block IO polling, if the block is capable and enabled (see block configuration in configuration section).
			1-7		Reserved
		8-15	Status Bits
			Bit		Description
			8		IO block IO. Successful (1) or fault (0) read of Polled IO on blocks with block IO data. This is different from normal IO reads through the IO table in shared memory, although the normal data is included in this. This is currently limited to blocks that support the “Read Block IO” datagram; this will be expanded later to support blocks with the “Read IO Map” datagram.
			9-15		Reserved
Redundancy status	10	00-07	Device ID (sequence number of current Input data transfer)
		08-15	Redundant block present, sent when block receives input data from its redundant partner, reset when a timeout occurs, or block communications becomes active

Global Tables Sets 2 to 4 Layouts

The global status table sets 2 to 4 are required only if the status/configuration words for Blocks contained in them are required. The number of Blocks per port is specified in the configuration table (5), the current number is displayed in the global table set 1 word 5. Set 2 is required if more than 9 Blocks are configured for global table set group accessed, Set 3 for more than 19, and Set 4 if more than 29.

Block (relative or abs)	Description	Set Word	Set 2 Register	Set 3 Register	Set 4 Register	Bits	Detail explanation
Block 9 /19/29 Configuration / Status	Block ID	1	401601	401701	401801	00-07	Module ID (number) of block assigned to this block number
	Block Number					08-15	Block Number Accessed (1-32)
	Outputs Enabled	2	401602	401702	401802	00-07	Determines whether module will communicate with block (0x00) or not (0x01)
	Present					08-15	Block is present (on-line = 1), or not (0)
	Process bits	3	401603	401703	401803		Dynamic Process control bits
	Directed data length	4	401604	401704	401804	00-07	Length of directed data messages from this block
	Broadcast length					08-15	Length of broadcast messages from this block
	Block Fault Status	5	401605	401705	401805	00-07	Returned in fault messages, this block status varies by type
	Block Configuration					08-15	Block configuration words (holds data types)
	Circuit Faults (1-16)	6	401606	401706	401806		Fault status of first 16 circuits in the specified block
	Circuit Faults (17-32)	7	401607	401707	401807		Fault status of second 16 circuits (17-32) in the specified block
	DataGram Command	28	401608	401708	401808	00-15	Datagram command/response for block
	Block Cfg bits	29	401609	401709	401809	00-15	Dynamically accessible block configuration bits
	Redundancy	8-10	401610	401710	401810	00-07	Device ID
						08-15	Redundant block present
Block 10/20/30 Configuration / Status	Block ID	11	401611	401711	401811	00-07	Module ID (number) of block assigned to this block number
	Block Number					08-15	Block Number Accessed (1-32)
	Outputs Enabled	12	401612	401712	401812	00-07	Determines whether module will communicate with block (0x00) or not (0x01)
	Present					08-15	Block is present (on-line = 1), or not (0)
	Process bits	13	401613	401713	401813		Dynamic Process control bits
	Directed data length	14	401614	401714	401814	00-07	Length of directed data messages from this block
	Broadcast length					08-15	Length of broadcast messages from this block
	Block Fault Status	15	401615	401715	401815	00-07	Returned in fault messages, this block status varies by type
	Block Configuration					08-15	Block configuration words (holds data types)
	Circuit Faults (1-16)	16	401616	401716	401816		Fault status of first 16 circuits in the specified block
	Circuit Faults (17-32)	17	401617	401717	401817		Fault status of second 16 circuits (17-32) in the specified block
	DataGram Command	28	401618	401718	401818	00-15	Datagram command/response for block
	Block Cfg bits	29	401619	401719	401819	00-15	Dynamically accessible block configuration bits
	Redundancy	18-20	401620	401720	401820	00-07	Device ID
						08-15	Redundant block present
. . .
Block 12/22/32 Configuration / Status	Block ID	41	401641	401741	401841	00-07		Module ID (number) of block assigned to this block number
	Block Number					08-15		Block Number Accessed (1-32)
	Outputs Enabled	42	401642	401742	401842	00-07		Determines whether module will communicate with block (0x00) or not (0x01)
	Present					08-15		Block is present (on-line = 1), or not (0)
	Process bits	43	401643	401743	401843			Dynamic Process control bits
	Directed data length	44	401644	401744	401844	00-07		Length of directed data messages from this block
	Broadcast length					08-15		Length of broadcast messages from this block
	Block Fault Status	45	401645	401745	401845	00-07		Returned in fault messages, this block status varies by type
	Block Configuration					08-15		Block configuration words (holds data types)
	Circuit Faults (1-16)	46	401646	401746	401846			Fault status of first 16 circuits in the specified block
	Circuit Faults (17-32)	47	401647	401747	401847			Fault status of second 16 circuits (17-32) in the specified block
	DataGram Command	28	401648	401748	401848	00-15		Datagram command/response for block
	Block Cfg bits	29	401659	401749	401849	00-15		Dynamically accessible block configuration bits
	Redundancy	48-50	401650	401750	401850	00-07		Device ID
						08-15		Redundant block present
Block 13/23 Configuration / Status	Block ID	51	401651	401751	401851	00-07		Module ID (number) of block assigned to this block number
	Block Number					08-15		Block Number Accessed (1-32)
	Outputs Enabled	52	401652	401752	401852	00-07		Determines whether module will communicate with block (0x00) or not (0x01)
	Present					08-15		Block is present (on-line = 1), or not (0)
	Process bits	53	401653	401753	401853			Dynamic Process control bits
	Directed data length	54	401654	401754	401854	00-07		Length of directed data messages from this block
	Broadcast length					08-15		Length of broadcast messages from this block
	Block Fault Status	55	401655	401755	401855	00-07		Returned in fault messages, this block status varies by type
	Block Configuration					08-15		Block configuration words (holds data types)
	Circuit Faults (1-16)	56	401656	401756	401856			Fault status of first 16 circuits in the specified block
	Circuit Faults (17-32)	57	401657	401757	401857			Fault status of second 16 circuits (17-32) in the specified block
	DataGram Command	28	401658	401758	401858	00-15		Datagram command/response for block
	Block Cfg bits	29	401659	401759	401859	00-15		Dynamically accessible block configuration bits
	Redundancy	58-60	401660	401760	401860	00-07		Device ID
						08-15		Redundant block present
. . .
Block 18/28 Configuration / Status	Block ID	91	401691	401791	401891	00-07	Module ID (number) of block assigned to this block number
	Block Number					08-15	Block Number Accessed (1-32)
	Outputs Enabled	92	401692	401792	401892	00-07	Determines whether module will communicate with block (0x00) or not (0x01)
	Present					08-15	Block is present (on-line = 1), or not (0)
	Process bits	93	401693	401793	401893		Dynamic Process control bits
	Directed data length	94	401694	401794	401894	00-07	Length of directed data messages from this block
	Broadcast length					08-15	Length of broadcast messages from this block
	Block Fault Status	95	401695	401795	401895	00-07	Returned in fault messages, this block status varies by type
	Block Configuration					08-15	Block configuration words (holds data types)
	Circuit Faults (1-16)	96	401696	401796	401896		Fault status of first 16 circuits in the specified block
	Circuit Faults (17-32)	97	401697	401797	401897		Fault status of second 16 circuits (17-32) in the specified block
	DataGram Command	28	401698	401798	401898	00-15	Datagram command/response for block
	Block Cfg bits	29	401699	401799	401899	00-15	Dynamically accessible block configuration bits
	Redundancy	98-100	401600	401800	401900	00-07	Device ID
						08-15	Redundant block present

IO Data Table Sets (Tables 2-4)

There are four I/O tables. Each of the tables may contain from 1 to 15 sets, depending on the number that are required for capturing RIO module IO (data and status). This method allows up to 1500 words (or 3000 bytes) of data for each IO type (DI, DO, AI, and AO).

Each table set is addressed specifying its unique address:

Port Address: 3 for Ethernet port.

Each port accesses the global data words (words 1-10 of the global table set 1). The port also accesses the Block status words (11-100 of set 1 and 1-... of set 2 to 4) as specified in the global word 5. Each port can also access any portion of the IO table sets. Each IO table takes up the number of sets required to hold the number modules entered in the module configuration table (5) set 1.

Table Type: Specify the type of table to access from the port. This is the DeltaV serial card “device”. The most significant 4 bits of the byte specify the Table ID (1-5), the least significant 4 bits specify the offset (1-15 (0x1 to 0xE).

Group	Table ID	Sets	Modbus Address
DI table	1	1-15*	1-25600
DO table	2	1-15*	100001-125600
AI table	3	1-15*	300001-301500
AO table	4	1-15*	400001-401500
Global data / configuration	0	1-4	401501-401900
Module Configuration Table	5	1	401901-402000

* Total (sum of tables 1-5) is 28 to 32 depending on the number assigned to the global (0) group

Modules are assigned addresses in the IO data tables to hold their IO data. Inputs and Outputs are assigned separately. All address start on word boundaries. The controller specifies the address. This may be formatted with spaces between data to allow the global formatting of IO data so all modules will have IO data beginning at predefined addresses, or may be “packed” to optimize communications bandwidth. Modbus TCP/IP communications is rapid (10 to 100 MB).

IO Data bytes

All standard IO data from all GE Genius IO blocks is available at all times the bus controller is “on-line”. This data is captured by the µGENI IO card into shared memory (at C800). A portion of this memory is organized into two IO buffers, each holding blocks of 34 registers. One of these buffers holds all input data that each GE block sends each bus scan. The other buffer holds the output data that will be sent to the IO blocks (again each IO scan). The Legacy module does not simply map the IO buffers into the IO tables, instead it allows the controller to configure the starting location for each IO block data to be stored. The number of bytes actually assigned depends on the module definition associated with the block. This allows the maximum of flexibility in assigning addresses. See the discussion of configuration of the legacy module.

Circuit status bytes

Modules may also be assigned “Status” bytes to hold the status information returned for each circuit. These extra bytes data are assigned to the input data table. These hold the module status (or fault) information, based on the type of block. These bytes are assigned to the AI or DI table (depending on the table selected for IO data).

Each block will be associated with at least one byte of status data. This data contains the status of the legacy driver, the mode of the driver, and the block present bit status, as well as block status bits returned from the block (if communicating). This byte should be zero (0) if communications is occurring and block is functioning correctly. If a failure occurs the byte will be non-zero, with the bit(s) signifying the fault.

Bit	Description
0	Legacy Module RIO driver Failed, ignore remaining bits
1	Legacy module in program mode
2
3	Block not communicating (both active present and redundant present flags are 0 (block is not communicating with either active or redundant module. Inputs are not valid).
4	Terminal assembly EPROM fault, shifted from that returned by block
5	Electronics assembly EEPROM fault (calibration error), for some blocks, shifted from that returned by block
6	Internal circuit fault, shifted from that returned by block
7	Block present bit

Fault status is supplied as a datagram from each block, triggered when a block faults, after a reset (if block is still faulted), or in response to a read diagnostics datagram from bus controller. The report fault message (and read diagnostics response) messages all have a 4 byte header which includes the block type (model number) in byte 0 and the software revision of the block in byte 1. Then next 2 bytes include the block diagnostic data (byte 2 is currently defined for the blocks, byte 3 is not used. Byte 2 (block diagnostics) is displayed in the block status group (word 5) in the global status table. The remaining bytes in the message hold fault data for each of the circuits in the block as described below in block data definition sections.

Modbus TCP/IP

GE Genus Table Set Definition

Open Modbus TCP/IP Dataset assignments

Global (status) Set(s)

Driver Status Words

Card Status Words

Block Status Words

Global Tables Sets 2 to 4 Layouts

IO Data Table Sets (Tables 2-4)

IO Data bytes

Circuit status bytes

Subscribe

Contact

Subscribe

Contact

Contact