|
|
本帖最后由 fakeCode 于 2016-1-7 11:09 编辑
由于文章是直接转载的，有网友反应看着比较累，我转了一个PDF文档，建议用WEB视图打开。
freemodbus源码分析详解 我这里为了方便代码浏览，用了VS2013，DEMO自然用WIN32的，选用哪个DEMO进行分析也并不影响我们对FREEMODBUS的解剖。
代码组织结构
首先是modbus这个大文件下的文件：
- ascii目录的文件是用于实现MODBUS ASCII模式的，这个在modbus里是可选实现代码比较简单，看完RTU的分析我相信你对比着自己也就看明白ASCII模式了，这将不是本文的重点。
- funcions是与RTU的执行功能码相关的代码，主要就是读、写寄存器开关线圈之类的，根据你自己的需要在去实现里面回调，按照相应参数去执行相应功能。
- include是freemodbus的一些定义，这里先不作分析，在看源代码的时候我们再去看每个数据结构的相关定义。
- rtu这个文件夹就是RTU模式的实现了，本文分析重点之一。
- port这个是移植相关，port.h是移植需要的函数声明。portevent.c这个是事件队列的实现，freemodbus只是用了一个消息作为队列简单赋值处理，portother.c是一相从字节里取位等与MODBUS没多大关系的函数，portserial.c是串口移植相关函数，porttimer.c是定时器相关移植（由于RTU方式依赖时间来判断帧头帧尾），移植相关可以参见我的另一篇博文(译自官方文档)freemodbus RTU/ASCII 官方移植文档。
- mb.c这个就是modbus的应用层实现，本文分析重点之一。
Source Files目录中的demo.cpp是例程，stdafx.cpp是WIN32的预编译文件与modbusfree无关。
流程分析
win32的main（）分析，不感兴趣直接跳到mb.c一节
一切还是从main开始吧。
int
_tmain( int argc, _TCHAR * argv[] )
{
int iExitCode;
TCHAR cCh;
BOOL bDoExit;
const UCHAR ucSlaveID[] = {0xAA, 0xBB, 0xCC };
if( eMBInit( MB_RTU, 0x01, 1, 115200, MB_PAR_EVEN ) != MB_ENOERR )
{
_ftprintf( stderr, _T( "%s: can't initialize modbusstack!\r\n" ), PROG );
iExitCode = EXIT_FAILURE;
}
else if( eMBSetSlaveID( 0x34, TRUE, ucSlaveID, 3 ) != MB_ENOERR )
{
_ftprintf( stderr, _T( "%s: can't set slave id!\r\n" ), PROG);
iExitCode = EXIT_FAILURE;
}
else
{
/* Create synchronization primitives and set the current state
* of the thread to STOPPED.
*/
InitializeCriticalSection( &hPollLock );
eSetPollingThreadState( STOPPED );
/* CLI interface. */
_tprintf( _T( "Type 'q' for quit or 'h' for help!\r\n" ) );
bDoExit = FALSE;
do
{
_tprintf( _T( "> " ));
cCh = _gettchar( );
switch ( cCh )
{
case _TCHAR( 'q' ):
bDoExit = TRUE;
break;
case _TCHAR( 'd' ):
eSetPollingThreadState(SHUTDOWN );
break;
case _TCHAR( 'e' ):
if( bCreatePollingThread( ) != TRUE )
{
_tprintf( _T( "Can'tstart protocol stack! Already running?\r\n" ) );
}
break;
case _TCHAR( 's' ):
switch (eGetPollingThreadState( ) )
{
case RUNNING:
_tprintf( _T("Protocol stack is running.\r\n" ) );
break;
case STOPPED:
_tprintf( _T( "Protocolstack is stopped.\r\n" ) );
break;
case SHUTDOWN:
_tprintf( _T("Protocol stack is shuting down.\r\n" ) );
break;
}
break;
case _TCHAR( 'h' ):
_tprintf( _T( "FreeModbusdemo application help:\r\n" ) );
_tprintf( _T( " 'd' ... disable protocol stack.\r\n" ));
_tprintf( _T( " 'e' ... enabled the protocol stack\r\n") );
_tprintf( _T( " 's' ... show current status\r\n" ) );
_tprintf( _T( " 'q' ... quit applicationr\r\n" ) );
_tprintf( _T( " 'h' ... this information\r\n" ) );
_tprintf( _T( "\r\n") );
_tprintf( _T( "Copyright2006 Christian Walter <wolti@sil.at>\r\n" ) );
break;
default:
if( cCh != _TCHAR('\n') )
{
_tprintf( _T( "illegalcommand '%c'!\r\n" ), cCh );
}
break;
}
/* eat up everything untill returncharacter. */
while( cCh != '\n' )
{
cCh = _gettchar( );
}
}
while( !bDoExit );
/* Release hardware resources. */
( void )eMBClose( );
iExitCode = EXIT_SUCCESS;
}
return iExitCode;
}
eMBInit( MB_RTU,0x01, 1, 115200, MB_PAR_EVEN ) != MB_ENOERR 初始化modbus协议栈，如果实始化失败则打印错误信息并退出，否则打印命令提示符，要求输入指令。
do
{
_tprintf( _T( "> " ));
cCh = _gettchar( );
switch ( cCh )
{
case _TCHAR( 'q' ):
bDoExit = TRUE;
break;
case _TCHAR( 'd' ):
eSetPollingThreadState(SHUTDOWN );
break;
case _TCHAR( 'e' ):
if( bCreatePollingThread( ) != TRUE )
{
_tprintf( _T( "Can'tstart protocol stack! Already running?\r\n" ) );
}
break;
case _TCHAR( 's' ):
switch (eGetPollingThreadState( ) )
{
case RUNNING:
_tprintf( _T("Protocol stack is running.\r\n" ) );
break;
case STOPPED:
_tprintf( _T("Protocol stack is stopped.\r\n" ) );
break;
case SHUTDOWN:
_tprintf( _T("Protocol stack is shuting down.\r\n" ) );
break;
}
break;
case _TCHAR( 'h' ):
_tprintf( _T( "FreeModbusdemo application help:\r\n" ) );
_tprintf( _T( " 'd' ... disable protocol stack.\r\n" ));
_tprintf( _T( " 'e' ... enabled the protocol stack\r\n") );
_tprintf( _T( " 's' ... show current status\r\n" ) );
_tprintf( _T( " 'q' ... quit applicationr\r\n" ) );
_tprintf( _T( " 'h' ... this information\r\n" ) );
_tprintf( _T( "\r\n") );
_tprintf( _T( "Copyright2006 Christian Walter <wolti@sil.at>\r\n" ) );
break;
default:
if( cCh != _TCHAR('\n') )
{
_tprintf( _T( "illegalcommand '%c'!\r\n" ), cCh );
}
break;
}
/* eat up everything untill returncharacter. */
while( cCh != '\n' )
{
cCh = _gettchar( );
}
}
while( !bDoExit );
如果用户输入e,则会调用bCreatePollingThread( )启动协议栈线程。那么我们跟进bCreatePollingThread()去看看。
BOOL
bCreatePollingThread( void )
{
BOOL bResult;
if( eGetPollingThreadState( ) ==STOPPED )
{
if( ( hPollThread = CreateThread( NULL, 0, dwPollingThread, NULL, 0,NULL ) ) == NULL )
{
/* Can't create the polling thread.*/
bResult = FALSE;
}
else
{
bResult = TRUE;
}
}
else
{
bResult = FALSE;
}
return bResult;
}
先是确认一下线程状态，然后创建并启动线程函数dwPollingThread（），
DWORD WINAPI
dwPollingThread( LPVOID lpParameter )
{
eSetPollingThreadState( RUNNING );
if( eMBEnable( ) == MB_ENOERR )
{
do
{
if( eMBPoll( ) != MB_ENOERR )
break;
}
while( eGetPollingThreadState( )!= SHUTDOWN );
}
( void )eMBDisable( );
eSetPollingThreadState( STOPPED );
return 0;
}
从这里就跟MCU\ARM上应用freemodbus一样一样的了，无法是先使能协议栈，然后循环调用eMBPoll( )，同时用eGetPollingThreadState（）检测线程状态。eMBPoll( void )就是我们的重点咯，我们现在已经进入mb.c这个文件啦，这个是freemodbus实现的modbus应用层，虽然代码里面对数据链路层以及应用层分的不是很清晰，但这个mb.c是完完全全的应用层了。
mb.c
eMBErrorCode
eMBPoll( void )
{
static UCHAR *ucMBFrame;
static UCHAR ucRcvAddress;
static UCHAR ucFunctionCode;
static USHORT usLength;
static eMBException eException;
int i;
eMBErrorCode eStatus =MB_ENOERR;
eMBEventType eEvent;
/* Check if the protocol stack is ready. */
if( eMBState != STATE_ENABLED )
{
return MB_EILLSTATE;
}
/* Check if there is a event available. If not return control to caller.
* Otherwise we will handle the event. */
if( xMBPortEventGet( &eEvent ) == TRUE )
{
switch ( eEvent )
{
case EV_READY:
break;
case EV_FRAME_RECEIVED:
eStatus = peMBFrameReceiveCur(&ucRcvAddress, &ucMBFrame, &usLength );
if( eStatus == MB_ENOERR )
{
/* Check if the frame is forus. If not ignore the frame. */
if( ( ucRcvAddress ==ucMBAddress ) || ( ucRcvAddress == MB_ADDRESS_BROADCAST ) )
{
( void )xMBPortEventPost(EV_EXECUTE );
}
}
break;
case EV_EXECUTE:
ucFunctionCode =ucMBFrame[MB_PDU_FUNC_OFF];
eException =MB_EX_ILLEGAL_FUNCTION;
for( i = 0; i < MB_FUNC_HANDLERS_MAX; i++ )
{
/* No more function handlersregistered. Abort. */
if(xFuncHandlers.ucFunctionCode == 0 )
{
break;
}
else if(xFuncHandlers.ucFunctionCode == ucFunctionCode )
{
eException =xFuncHandlers.pxHandler( ucMBFrame, &usLength );
break;
}
}
/* If the request was not sent tothe broadcast address we
* return a reply. */
if( ucRcvAddress !=MB_ADDRESS_BROADCAST )
{
if( eException != MB_EX_NONE )
{
/* An exception occured.Build an error frame. */
usLength = 0;
ucMBFrame[usLength++] = (UCHAR )( ucFunctionCode | MB_FUNC_ERROR );
ucMBFrame[usLength++] =eException;
}
if( ( eMBCurrentMode ==MB_ASCII ) && MB_ASCII_TIMEOUT_WAIT_BEFORE_SEND_MS )
{
vMBPortTimersDelay(MB_ASCII_TIMEOUT_WAIT_BEFORE_SEND_MS );
}
eStatus = peMBFrameSendCur(ucMBAddress, ucMBFrame, usLength );
}
break;
case EV_FRAME_SENT:
break;
}
}
return MB_ENOERR;
}
eMBPoll（）就是一个状态机。它只有下面四种状态：
typedef enum
{
EV_READY, /*!< Startup finished. */
EV_FRAME_RECEIVED, /*!< Frame received. */
EV_EXECUTE, /*!< Execute function. */
EV_FRAME_SENT /*!< Frame sent. */
} eMBEventType;
从注释中可以看出，分别是启动完成，帧接收完成，执行功能码，执行帧发送。
这个状态机通过xMBPortEventGet( &eEvent ) 获取事件状态，而事件状态的投递方是谁呢？这里我们先不关注（咱们自上向下分析吧）。我们先分析一下这个状态机的流程。
由于我在写这篇文章之前做过功课，所以比较清楚，这里大家过一下就可以了。
在整个协议栈运行的最初肯定是EV_READY态，然后过了一个3.5T（这个就是modbus的帧头帧尾确认时间啦，不清楚？去翻翻协议吧，我当然不建议你去读国人写的那些“modbus协议整理”之类的葵花宝典，而是建议你去modbus官网下载。找不到下载链接？看这里Modbus Specifications and Implementation Guides,点那个I Accept就可以进去啦。）如果这个时候接收到一个完整的帧那么就会进入EV_FRAME_RECEIVED态，至于是谁负责去接收和检验帧我们后面再去理，你要记住我们还在应用层里打转转。
/* Check if theframe is for us. If not ignore the frame. */
if( ( ucRcvAddress ==ucMBAddress ) || ( ucRcvAddress == MB_ADDRESS_BROADCAST ) )
{
( void )xMBPortEventPost(EV_EXECUTE );
}
在EV_READY态如果检测收到的地址跟从机地址（freemodbus的开源版本只支持从机，如果你想要主机的可以参考一下FreeModbus_Slave-Master-RTT-STM32）匹配，或是广播地址就自己给自己投递一个EV_EXECUTE 事件。
case EV_EXECUTE:
ucFunctionCode =ucMBFrame[MB_PDU_FUNC_OFF];
eException =MB_EX_ILLEGAL_FUNCTION;
for( i = 0; i <MB_FUNC_HANDLERS_MAX; i++ )
{
/* No more function handlersregistered. Abort. */
if(xFuncHandlers.ucFunctionCode == 0 )
{
break;
}
else if(xFuncHandlers.ucFunctionCode == ucFunctionCode )
{
eException =xFuncHandlers.pxHandler( ucMBFrame, &usLength );
break;
}
}
/* If the request was not sent tothe broadcast address we
* return a reply. */
if( ucRcvAddress !=MB_ADDRESS_BROADCAST )
{
if( eException != MB_EX_NONE )
{
/* An exception occured.Build an error frame. */
usLength = 0;
ucMBFrame[usLength++] = (UCHAR )( ucFunctionCode | MB_FUNC_ERROR );
ucMBFrame[usLength++] =eException;
}
if( ( eMBCurrentMode ==MB_ASCII ) && MB_ASCII_TIMEOUT_WAIT_BEFORE_SEND_MS )
{
vMBPortTimersDelay(MB_ASCII_TIMEOUT_WAIT_BEFORE_SEND_MS );
}
eStatus = peMBFrameSendCur( ucMBAddress,ucMBFrame, usLength );
}
break;
在EV_EXECUTE的第一段就是执行相应的功能码回调，也就是读写寄存器或者是打开线圈什么的，实现上就是执行mbfunctions里面的代码，因为在协议栈初始化的时候这些文件里面的函数都被值给了xFuncHandlers[]，去看看xFuncHandlers[]的定义吧。
/* An array of Modbus functions handlers which associates Modbus function
*codes with implementing functions.
*/
static xMBFunctionHandlerxFuncHandlers[MB_FUNC_HANDLERS_MAX] = {
#if MB_FUNC_OTHER_REP_SLAVEID_ENABLED> 0
{MB_FUNC_OTHER_REPORT_SLAVEID, eMBFuncReportSlaveID},
#endif
#if MB_FUNC_READ_INPUT_ENABLED > 0
{MB_FUNC_READ_INPUT_REGISTER, eMBFuncReadInputRegister},
#endif
#if MB_FUNC_READ_HOLDING_ENABLED > 0
{MB_FUNC_READ_HOLDING_REGISTER, eMBFuncReadHoldingRegister},
#endif
#ifMB_FUNC_WRITE_MULTIPLE_HOLDING_ENABLED > 0
{MB_FUNC_WRITE_MULTIPLE_REGISTERS, eMBFuncWriteMultipleHoldingRegister},
#endif
#if MB_FUNC_WRITE_HOLDING_ENABLED > 0
{MB_FUNC_WRITE_REGISTER, eMBFuncWriteHoldingRegister},
#endif
#if MB_FUNC_READWRITE_HOLDING_ENABLED> 0
{MB_FUNC_READWRITE_MULTIPLE_REGISTERS,eMBFuncReadWriteMultipleHoldingRegister},
#endif
#if MB_FUNC_READ_COILS_ENABLED > 0
{MB_FUNC_READ_COILS, eMBFuncReadCoils},
#endif
#if MB_FUNC_WRITE_COIL_ENABLED > 0
{MB_FUNC_WRITE_SINGLE_COIL, eMBFuncWriteCoil},
#endif
#if MB_FUNC_WRITE_MULTIPLE_COILS_ENABLED> 0
{MB_FUNC_WRITE_MULTIPLE_COILS, eMBFuncWriteMultipleCoils},
#endif
#if MB_FUNC_READ_DISCRETE_INPUTS_ENABLED> 0
{MB_FUNC_READ_DISCRETE_INPUTS, eMBFuncReadDiscreteInputs},
#endif
};
看到这里你就明白了xFuncHandlers不过是一个功能码和功能回调函数的对应表，eMBFuncWriteHoldingRegister（）就是写保持寄存器回调。我们还是接着看EV_EXECUTE，第一段里面需要注意if( xFuncHandlers.ucFunctionCode == 0 )这一句是用来在结束遍历表, freemodbus提供了一个eMBRegisterCB（）eMBRegisterCB函数专门用来注册功能码和与之相应的回调，但是对于不响应的功能码freemodbus通过xFuncHandlers.ucFunctionCode = 0;将其直接置0。
EV_EXECUTE第二段就是对主机作出回应。讲到这里接收处理就讲完了。在mb.c中我们可以看到这一层并不对EV_FRAME_SENT作处理。
mbrtu.c分析
在mb.c里面我们留了一个疑惑，是谁在投递事件？或者说是谁在改变mb.c里面状态机的状态？
如果是RTU模式，那么就是这mbrtu.c里面的这个函数了
BOOL
xMBRTUTimerT35Expired( void )
{
BOOL xNeedPoll = FALSE;
switch ( eRcvState )
{
/* Timer t35 expired. Startup phase is finished. */
case STATE_RX_INIT:
xNeedPoll = xMBPortEventPost( EV_READY );
break;
/* A frame was received and t35 expired. Notify the listener that
* a new frame was received. */
case STATE_RX_RCV:
xNeedPoll = xMBPortEventPost( EV_FRAME_RECEIVED );
break;
/* An error occured while receiving the frame. */
case STATE_RX_ERROR:
break;
/* Function called in an illegal state. */
default:
assert( ( eRcvState == STATE_RX_INIT ) ||
( eRcvState == STATE_RX_RCV )|| ( eRcvState == STATE_RX_ERROR ) );
}
vMBPortTimersDisable( );
eRcvState = STATE_RX_IDLE;
return xNeedPoll;
}
这个函数是被vMBPortTimerPoll（）被调用的，vMBPortTimerPoll（）又是被xMBPortEventGet（）调用的，这里我们看一下vMBPortTimerPoll（）是在什么情况下调用xMBRTUTimerT35Expired：
void
vMBPortTimerPoll( )
{
/* Timers are called from the serial layer because we have no high
* res timer in Win32. */
if( bTimeoutEnable )
{
DWORD dwTimeCurrent =GetTickCount( );
if( ( dwTimeCurrent - dwTimeLast ) > dwTimeOut )
{
bTimeoutEnable = FALSE;
( void)pxMBPortCBTimerExpired( );
}
}
}
可以看到就当系统的tickCount间隔达到一定时间时就调用xMBRTUTimerT35Expired（）（pxMBPortCBTimerExpired在eMBInit()中被赋值为xMBRTUTimerT35Expired），简单点说吧，就相当于单片机定时器中断函数，定时执行xMBRTUTimerT35Expired()函数。
回到mbrtu.c中来吧，跟踪的第一要点是不能迷路，方向感要好！
xMBRTUTimerT35Expired就是根据eRcvState的不同状态来投递不同的事件给mb.c中的eMBPoll（）这个状态机。而eRcvState又是怎么来的呢？在xMBRTUReceiveFSM（）中我们看到了它。
BOOL
xMBRTUReceiveFSM( void )
{
BOOL xTaskNeedSwitch =FALSE;
UCHAR ucByte;
assert( eSndState == STATE_TX_IDLE );
/* Always read the character. */
( void )xMBPortSerialGetByte( ( CHAR * ) & ucByte );
switch ( eRcvState )
{
/* If we have received a character in the init state we have to
* wait until the frame is finished.
*/
case STATE_RX_INIT:
vMBPortTimersEnable( );
break;
/* In the error state we wait until all characters in the
* damaged frame are transmitted.
*/
case STATE_RX_ERROR:
vMBPortTimersEnable( );
break;
/* In the idle state we wait for a new character. If a character
* is received the t1.5 and t3.5 timers are started and the
* receiver is in the state STATE_RX_RECEIVCE.
*/
case STATE_RX_IDLE:
usRcvBufferPos = 0;
ucRTUBuf[usRcvBufferPos++] = ucByte;
eRcvState = STATE_RX_RCV;
/* Enable t3.5 timers. */
vMBPortTimersEnable( );
break;
/* We are currently receiving a frame. Reset the timer after
* every character received.If more than the maximum possible
* number of bytes in a modbus frame is received the frame is
* ignored.
*/
case STATE_RX_RCV:
if( usRcvBufferPos < MB_SER_PDU_SIZE_MAX )
{
ucRTUBuf[usRcvBufferPos++] = ucByte;
}
else
{
eRcvState = STATE_RX_ERROR;
}
vMBPortTimersEnable( );
break;
}
return xTaskNeedSwitch;
}
这里不兜圈子，直接告诉你xMBRTUReceiveFSM会在串口接收函数中被调用（虽然在这个WIN32例程中并没有中断例程）。我们这里主要分析一下xMBRTUReceiveFSM的流程。
首先xMBRTUReceiveFSM会进入STATE_RX_INIT态，这个时候它调用vMBPortTimersEnable开启定时器，当达到3.5T时间后xMBRTUTimerT35Expired会让 eRcvState =STATE_RX_IDLE，这样xMBRTUReceiveFSM会进入STATE_RX_IDLE态，在STATE_RX_IDLE态一旦通过xMBPortSerialGetByte收到了一个字符，那么就会 进入STATE_RX_RCV态，在这里就是持续的接收字符同时进行两种检测，一种是如果接收的字符超过了MB_SER_PDU_SIZE_MAX（RTU帧的最大值）就会进入STATE_RX_ERROR态，另一种就是检测是否超时，vMBPortTimersEnable()就是用来清零定时器的。如果超时则会由xMBRTUTimerT35Expired向mb.c状态机投递一个EV_FRAME_RECEIVED帧结束事件，这个时候帧数据就会被交给mb.c中的状态机去处理。在xMBRTUTimerT35Expired退出前会再次将xMBRTUReceiveFSM的状态置为STATE_RX_IDLE空闲态。
至此从上到下整个接收流程都理清楚了。那么我再看一看发送流程吧，这个比较轻松。
BOOL
xMBRTUTransmitFSM( void )
{
BOOL xNeedPoll = FALSE;
assert( eRcvState == STATE_RX_IDLE );
switch ( eSndState )
{
/* We should not get a transmitter event if the transmitter is in
* idle state. */
case STATE_TX_IDLE:
/* enable receiver/disable transmitter. */
vMBPortSerialEnable( TRUE, FALSE );
break;
case STATE_TX_XMIT:
/* check if we are finished.*/
if( usSndBufferCount != 0 )
{
xMBPortSerialPutByte( ( CHAR)*pucSndBufferCur );
pucSndBufferCur++; /* next byte in sendbuffer. */
usSndBufferCount--;
}
else
{
xNeedPoll = xMBPortEventPost(EV_FRAME_SENT );
/* Disable transmitter. Thisprevents another transmit buffer
* empty interrupt. */
vMBPortSerialEnable( TRUE, FALSE );
eSndState = STATE_TX_IDLE;
}
break;
}
return xNeedPoll;
}
xMBRTUTransmitFSM在eMBInit（）中被赋值给了pxMBFrameCBTransmitterEmpty，而pxMBFrameCBTransmitterEmpty又被xMBPortSerialPoll调用，最后xMBPortSerialPoll被xMBPortEventGet中被调用。
xMBRTUTransmitFSM只有两个状态。
typedef enum
{
STATE_TX_IDLE, /*!< Transmitter is in idle state. */
STATE_TX_XMIT /*!< Transmitter is in transfer state. */
} eMBSndState;
在没有发送任务的时候，它是处理STATE_TX_IDLE态，在modbus协议栈初始化的时候它就是这个态，而这个STATE_TX_XMIT发送态则是用来将要发送的数据推送到发送缓冲的（这里你可以用你的串口中断来做，但我觉得用DMA会更好一些），发送完数据后又返回到STATE_TX_IDLE态，但是STATE_TX_XMIT是谁让它进入的呢？
eMBErrorCode
eMBRTUSend( UCHAR ucSlaveAddress, constUCHAR * pucFrame, USHORT usLength )
{
eMBErrorCode eStatus =MB_ENOERR;
USHORT usCRC16;
ENTER_CRITICAL_SECTION( );
/* Check if the receiver is still in idle state. If not we where to
* slow with processing the received frame and the master sent another
* frame on the network. We have to abort sending the frame.
*/
if( eRcvState == STATE_RX_IDLE )
{
/* First byte before the Modbus-PDU is the slave address. */
pucSndBufferCur = ( UCHAR * ) pucFrame - 1;
usSndBufferCount = 1;
/* Now copy the Modbus-PDU into the Modbus-Serial-Line-PDU. */
pucSndBufferCur[MB_SER_PDU_ADDR_OFF] = ucSlaveAddress;
usSndBufferCount += usLength;
/* Calculate CRC16 checksum for Modbus-Serial-Line-PDU. */
usCRC16 = usMBCRC16( ( UCHAR * ) pucSndBufferCur, usSndBufferCount );
ucRTUBuf[usSndBufferCount++]= ( UCHAR )( usCRC16 & 0xFF );
ucRTUBuf[usSndBufferCount++] = ( UCHAR )( usCRC16 >> 8 );
/* Activate the transmitter. */
eSndState = STATE_TX_XMIT;
vMBPortSerialEnable( FALSE, TRUE );
}
else
{
eStatus = MB_EIO;
}
EXIT_CRITICAL_SECTION( );
return eStatus;
}
这个eMBRTUSend就是用来将xMBRTUTransmitFSM置为STATE_TX_XMIT的函数，同时它还使能串口发送功能。eMBRTUSend本身却是在eMBPoll（）的EV_EXECUTE状态的第二段被调用的，就是当收到功能码时我们回应给主机的这一部分。
/* If the request wasnot sent to the broadcast address we
* return a reply. */
if( ucRcvAddress !=MB_ADDRESS_BROADCAST )
{
if( eException != MB_EX_NONE )
{
/* An exception occured.Build an error frame. */
usLength = 0;
ucMBFrame[usLength++] = (UCHAR )( ucFunctionCode | MB_FUNC_ERROR );
ucMBFrame[usLength++] =eException;
}
if( ( eMBCurrentMode ==MB_ASCII ) && MB_ASCII_TIMEOUT_WAIT_BEFORE_SEND_MS )
{
vMBPortTimersDelay(MB_ASCII_TIMEOUT_WAIT_BEFORE_SEND_MS );
}
eStatus = peMBFrameSendCur(ucMBAddress, ucMBFrame, usLength );
}
break;
其中的peMBFrameSendCur（）就是eMBRTUSend（），在eMBInit我们将eMBRTUSend赋值给了peMBFrameSendCur（）。 现在咱们终于绕出来了，发送流程也介绍清楚了。
写到这里，我估计你可能会有一些疑惑，在这个例程中真正完成发送和接收串口的代码在哪里？
BOOL
xMBPortEventGet( eMBEventType * eEvent )
{
BOOL xEventHappened =FALSE;
if( xEventInQueue )
{
*eEvent = eQueuedEvent;
xEventInQueue = FALSE;
xEventHappened = TRUE;
}
else
{
/* Poll the serial device. The serial device timeouts if no
* characters have been received within for t3.5 during an
* active transmission or if nothing happens within a specified
* amount of time. Both timeouts are configured from the timer
* init functions.
*/
( void )xMBPortSerialPoll( );
/* Check if any of the timers have expired. */
vMBPortTimerPoll( );
}
return xEventHappened;
}
其实它们就在xMBPortSerialPoll里，换句话说，每次当mb.c的状态机调用xMBPortEventGet（）都在进行串口操作，要么是发送要么是接收。
BOOL
xMBPortSerialPoll( )
{
BOOL bStatus = TRUE;
DWORD dwBytesRead;
DWORD dwBytesWritten;
DWORD i;
while( bRxEnabled )
{
/* buffer wrap around. */
if( uiRxBufferPos >= BUF_SIZE )
uiRxBufferPos = 0;
if( ReadFile( g_hSerial, &ucBuffer[uiRxBufferPos],
BUF_SIZE - uiRxBufferPos,&dwBytesRead, NULL ) )
{
if( dwBytesRead == 0 )
{
/* timeout with no bytes. */
break;
}
else if( dwBytesRead > 0 )
{
vMBPortLog( MB_LOG_DEBUG, _T("SER-POLL" ),
_T("detected end of frame (t3.5 expired.)\r\n" ) );
for( i = 0; i < dwBytesRead;i++ )
{
/* Call the modbus stackand let him fill the buffers. */
( void )pxMBFrameCBByteReceived( );
}
}
}
else
{
vMBPortLog( MB_LOG_ERROR, _T("SER-POLL" ), _T( "I/O error on serial device: %s" ),
Error2String(GetLastError ( ) ) );
bStatus = FALSE;
}
}
if( bTxEnabled )
{
while( bTxEnabled )
{
( void)pxMBFrameCBTransmitterEmpty( );
/* Call the modbus stack to let himfill the buffer. */
}
dwBytesWritten = 0;
if( !WriteFile
( g_hSerial, &ucBuffer[0],uiTxBufferPos, &dwBytesWritten, NULL )
|| ( dwBytesWritten !=uiTxBufferPos ) )
{
vMBPortLog( MB_LOG_ERROR, _T("SER-POLL" ), _T( "I/O error on serial device: %s" ),
Error2String(GetLastError ( ) ) );
bStatus = FALSE;
}
}
return bStatus;
}
xMBPortSerialPoll依据bRxEnabled 和 bTxEnabled 来区分到底是发送还是接收。
我看到有些人说freemodbus只能通过阻塞方式发送和接收串口数据很显然是错误的，它可以用普通串口中断或者是串口DMA来做。
写第一版的时候忘了分析一下事件队列，虽然说是叫事件队列，其实就是很简单的对一个变量进行了封装,提供了抽象接口，代码也只有这么几行：
/* ----------------------- Variables----------------------------------------*/
static eMBEventType eQueuedEvent;
static BOOL xEventInQueue;
/* ----------------------- Startimplementation -----------------------------*/
BOOL
xMBPortEventInit( void )
{
xEventInQueue = FALSE;
return TRUE;
}
BOOL
xMBPortEventPost( eMBEventType eEvent )
{
xEventInQueue = TRUE;
eQueuedEvent = eEvent;
return TRUE;
}
BOOL
xMBPortEventGet( eMBEventType * eEvent )
{
BOOL xEventHappened =FALSE;
if( xEventInQueue )
{
*eEvent = eQueuedEvent;
xEventInQueue = FALSE;
xEventHappened = TRUE;
}
else
{
/* Poll the serial device. The serial device timeouts if no
* characters have been received within for t3.5 during an
* active transmission or if nothing happens within a specified
* amount of time. Both timeouts are configured from the timer
* init functions.
*/
( void )xMBPortSerialPoll( );
/* Check if any of the timers have expired. */
vMBPortTimerPoll( );
}
return xEventHappened;
}
xMBPortEventPost这个投递事件的函数只是将事件枚举赋值给这个模块的变量，同时将xEventInQueue置为真表示队列中有数据，xMBPortEventGet的逻辑稍微复杂一点，它会在eMBPoll状态机中被反复调用，它首先将xEventInQueue置为FALSE，然后如果队列中有数据将就队列中的数字赋给eMBPoll传入的指针，没有事件的话就进行一下串口的接收和发送处理。
注意：freemodbus并没有用到T1.5（同一帧内两个字符之间的最大时间间隔）检测，你可以去看源代码里面xMBRTUTimerT15Expired这个函数仅仅只是声明了，我个人猜测是因为T1.5这个时间粒度太小（波特率为19200，按协议t1.5取为750us），一般的MCU根本没精力去做这个检测。
最后提一下asc模式，在eMBInit()函数中我们看到如果你的初时化时候的选择MB_ASCII作为参数，与modbus协议相关的回调和状态都会被替换成maasiic中的内容，顺着这条藤去摸一下ASC模式的瓜应该不难。
#if MB_RTU_ENABLED > 0
case MB_RTU:
pvMBFrameStartCur = eMBRTUStart;
pvMBFrameStopCur = eMBRTUStop;
peMBFrameSendCur = eMBRTUSend;
peMBFrameReceiveCur =eMBRTUReceive;
pvMBFrameCloseCur =MB_PORT_HAS_CLOSE ? vMBPortClose : NULL;
pxMBFrameCBByteReceived =xMBRTUReceiveFSM;
pxMBFrameCBTransmitterEmpty =xMBRTUTransmitFSM;
pxMBPortCBTimerExpired =xMBRTUTimerT35Expired;
eStatus = eMBRTUInit( ucMBAddress,ucPort, ulBaudRate, eParity );
break;
#endif
#if MB_ASCII_ENABLED > 0
case MB_ASCII:
pvMBFrameStartCur = eMBASCIIStart;
pvMBFrameStopCur = eMBASCIIStop;
peMBFrameSendCur = eMBASCIISend;
peMBFrameReceiveCur =eMBASCIIReceive;
pvMBFrameCloseCur =MB_PORT_HAS_CLOSE ? vMBPortClose : NULL;
pxMBFrameCBByteReceived =xMBASCIIReceiveFSM;
pxMBFrameCBTransmitterEmpty =xMBASCIITransmitFSM;
pxMBPortCBTimerExpired =xMBASCIITimerT1SExpired;
eStatus = eMBASCIIInit(ucMBAddress, ucPort, ulBaudRate, eParity );
break;
#endif
|
本帖子中包含更多资源
您需要 登录 才可以下载或查看，没有帐号？注册
x
阿莫论坛20周年了！感谢大家的支持与爱护！！
月入3000的是反美的。收入3万是亲美的。收入30万是移民美国的。收入300万是取得绿卡后回国，教唆那些3000来反美的！
|
[复制链接]
发表于 2016-1-7 10:48:15
楼主
感谢分享!!!
