Host Engineering Forum
General Category => ECOMs and ECOM100s => Topic started by: hoejinkim on January 22, 2014, 03:09:04 PM
-
Hello,
I am a graduate student at Oregon tech and now working on communication between H2-ECOM100 (DL 205) and slave software ( called RoboRealm) via modbus TCP/IP through the Ethernet cable. I have some questions that have not been solved for six months. ( I could not graduate last term because of my thesis project).
If you help me, I can graduate in this term.
As I mentioned, I am using DL 205 and H2-ECOM100 as a client and using RoboRealm(R/R) as a slave.
I just checked that R/R is able to send a data to ModScan 32. That means that R/R ‘s Modbus Tcp/ip is working well. (First picture in attached file)
So, next problem is a communication between R/R and PLC. I have been struggled to set up things for PLC. Here are results and would you look at them if they are right or not.(Second and third picture in attached file)
Then, for the network communications I built the RX instruction below,
I calculate the PLC address to use to target Modbus address 41100 in a server device.
The PLC address is V2113, but as you can see in data window, the status is still ‘0’. (last picture in attached file)
The First LD is K 0410, second LD is K128, third LDA is O 1400, and RX is V2100.
The communication b/w R/R and PLC hasn’t been solved yet. I would be appreciated if you give me a suggestion.
Sincerely,
God Bless You,
Hoejin Kim
-
V2100 is DL mapping of the Modbus Slave Register Address (41100)
You are using LDA O1400, which means Holding Register 41100 is being read into V1400, not V2100 or V2113. Look at V1400 in your Data View.
You are also telling it to read 128 bytes, or 64 holding registers, so V1400 thru V1477 will have the values for your slaves HR 41100 thru 41163.
-
I think your last 2 arguments are backwards. I find the help in Directsoft's help file clearer than the user manual.
-
I think your last 2 arguments are backwards. I find the help in Directsoft's help file clearer than the user manual.
The last 2 arguments means about LDA and RX????
-
Sorry, I reread franj1's post and I agree. Your instructions are asking for the information to be placed in V1400 and up. Look there. The third argumend (the LDA) is settting the local location, the place in the DL PLC. The last instruction, either an RX or a WX, specifies the location in the remote device.
-
Also, the RX parameter needs to be V2113, not V2100.
-
Hello
Thanks for your reply
I changed RX V2100 to RX V2113 but nothing show up. and also, nothing in V1400 thru V1477.
The problem is modbus TCP/IP didn't show anything in message log(attached file 1)
that means that I need to fix this first connecting PLC to server device (but the server device was communicating with ModScan 32)
do you have an idea??
-
Sorry, I reread franj1's post and I agree. Your instructions are asking for the information to be placed in V1400 and up. Look there. The third argumend (the LDA) is settting the local location, the place in the DL PLC. The last instruction, either an RX or a WX, specifies the location in the remote device.
These pictures are results.
I recalculated IP address for PLC and Slave device (RoboRealm).
And i checked V2057 thru V2077, but nothing showed up.
Also, Modbus TCP/IP of slave device has no connection with PLC now.
-
Hi hoejinkim. I think there is some confusion going on here. I see a couple of discrepancies.
First of all you tested your RoboRealm software using ModScan32 software, but your test shows that you are looking at Input Registers starting at 41100. Yet you have set up your ladder logic to read Holding Registers 1089-1152 (and then modified it to read Holding Registers 1072-1134).
So the first question is, do you want the PLC to read Holding Registers or Input Registers?
The second question is, is the offset 41100? Or 1100? In other words, it is possible to address 65,535 holding (or input) registers. Thus the number 41100 has a little ambiguity to it. Sometimes 41100 means Holding Register (designated by the "4") 1100. But sometimes 41100 means an OFFSET of forty-one thousand one hundred. And since your screenshot says "Input Registers" 41100, it looks to me that you have 2 spots of confusion. Like the first question, is it a Holding Register or an Input Register read, and this second question, is the offset forty-one thousand one hundred, or a Holding Register one thousand one hundred?
-
Hello, Mr. Greg
Thank you for your reply,
The answer on first question is that I am looking at Input Registers. PLC only wants to read data from RoboRealm. The data from RoboRealm is number 1, 2, 3, 4.
Second question, first of all, i chose V41100(RoboRealm address) randomly to calculate and find V2100 which would be PLC address, based on the manual called "Internet communication Module" pages 5-16(first picture). Actually i miscalculated, so I tried again using V41200 and it produced V2057 which is for PLC address. (latest uploaded picture). but did not work.
-
If you want the ECOM100 to read Input Registers then what you currently have will not work because, by default, the ECOM100 reads Holding Registers. Also, you have a fundamental misunderstanding. I will see if I can clear this up for you.
Currently your program looks like this:
LD K410
LD K128
LDA O1400
RX V2057
What this code means:
- The LD K410 (or LD K0410) is the base number (0), ECOM slot number (4) and partner ID (10).
- The LD K128 is how many bytes you want to read (128 bytes), or 64 words (registers).
- The LDA O1400 means, when you do the RX (read), store the results starting at V1400. This V1400 has NOTHING to do with Modbus mapping. This can literally be ANY V-memory location in your PLC because this is where the results are going. For example, it could be LDA O2000, which would store the 64 words read starting at V2000. With a value of LDA O1400 then the range of V1400-1477 will be overwritten with whatever was read.
- The RX V2057 normally means read V2057 from the slave device. However, because this is a request sent to the ECOM100 in slot 4 which has a peer-to-peer configuration, this will get translated into a Modbus TCP telegram. Here's how... the ECOM100 in slot 4 hears the RX command on the backplane. This RX command is to slave ID 10 (the first LD instruction determined this; LD K410). The ECOM100 checks and sees if he has a peer-to-peer table entry for 10. In your case, he does. According to your configuration, he will then translate that request as a Modbus TCP telegram that will be sent to IP address 169.254.54.15 over TCP port 502 and Unit ID 255. The V-memory parameter (in this case V2057) will get translated into a particular Modbus Function Code and Range. According to the range in the manual:
V2057 --> Function Code 03 "Read Holding Registers" with offset 1072 decimal (2057 octal is 1071 decimal, but you have to add 1 because Modbus registers begin with 1, not 0).
So, the code you have is going to read Holding Registers, not Input Registers.
If you want it to read Input Registers, you will have to change your code to this:
LD K410
LD K129
LDA V1400
RX V2057
Notice the 2nd LD instruction is now an odd number (129) instead of an even. This will make the RX V2057 now get translated to Function Code 04 "Read Input Registers" with offset 1072 decimal.
If you want different Input Registers, then you'll have to do the math conversion and change your RX V to something else.
-
Hello,
thanks for your helping,
1) I tried as you mentioned first, but it sill didn't work (First picture)
2) and i tried again by changing IR to Holding registers (but i don't understand offset 1072 value?)
but it didn't work.(Second and Third picture)
In the manual, "ECOM100 does not support function code 4. Thus 30001 address ranges cannot be read from a server/slave device" So i think i need to change from IR to HR cause the funcion 03 has 'Read Holding Registers'
In terms of HR, Do i have to write like this:
LD K410
LD K129
LDA O1400
RX V2057
and the address for Modbus TCP/IP slave would be 41200 right??
V2057 --> Function Code 03 "Read Holding Registers" with offset 1072 decimal (2057 octal is 1071 decimal, but you have to add 1 because Modbus registers begin with 1, not 0).
So, the code you have is going to read Holding Registers, not Input Registers.
what does that mean?? what is offset 1072? i just calculated address for slave based on the manual, is the way of calculation on manual right?? the manual don't have enough information to understand.....
-
Hello, sir
I just found excel file which called 'Modbus Conversion' and easily calculated Address for Client and slave.
I got 41072 Holding Registers (HR), and 31072 Input registers, but i am not going to use Input registers.
but i tried again with new value of HR but it didn't work too.(first picture)
And also i have questions
From second picture, i touched this setup communication ports little bit, is there anything wrong?? does it affect communication?
thanks
-
Greg, is there a source at AutomationDirect documenting your 'odd number' tweak to read 'Input' registers?
-
b_carlton, I don't think this has ever made it into the ECOM manual, but I wrote an FAQ on it when we implemented it.
http://www.hosteng.com/FAQFiles/ECOM.htm#FAQ0064 (http://www.hosteng.com/FAQFiles/ECOM.htm#FAQ0064)
-
hoejinkim, you wrote, "I tried as you mentioned first, but it still didn't work (First picture)"
Your first picture would've caused the ECOM100 to do a Modbus Function Code 04 "Read Input Register" 1072. Input Register 1072 is sometimes commonly written as 31072, but not always. The value 1072 comes from your RX's parameter V2057. V2057 is an octal address. When you convert this octal address to decimal you get 1071, but you must add 1 because V0 = Register 1, therefore V2057 = 1072. The reason it did a Function Code 04 "Read Input Registers" instead of a Function Code 03 "Read Holding Registers" is because the 2nd LD instruction's parameter K129 is an odd number (not even).
Also, I don't know your software that you are using as a Modbus TCP/IP Slave, however, in the Variable Settings box you have selected "Input Registers" with an address of "41200". I don't know what that means. But if that is where you are looking, you are looking in the wrong place. The place that got read from your Modbus TCP Slave was Input Register 1072.
You wrote, "and i tried again by changing IR to Holding registers (but i don't understand offset 1072 value?)
but it didn't work.(Second and Third picture)"
Your second picture would've caused the ECOM100 to do a Modbus Function Code 04 "Read Input Register" 1072 again... the same as your first picture. But this time you have your Modbus TCP/IP Slave looking at Holding Register 1072 instead of Input Register 1072.
Your third picture, again, does a FC04 "Read Input Register" 1072. But this time you now have your Modbus TCP/IP Slave looking at Holding Register 41200.
The only iteration you didn't try was the one that would work. If you left your ladder logic the same and then set your Slave up to provide Input Register 1072, then it should work.
You wrote, "In the manual, 'ECOM100 does not support function code 4. Thus 30001 address ranges cannot be read from a server/slave device' So i think i need to change from IR to HR cause the funcion 03 has 'Read Holding Registers'"
I realize the manual tells you this, but it is incorrect. We at Host Engineering designed the ECOM100 and we made a change to the firmware that allows it to do a FC04 and to read 30001 address if you want it to. This change has never made it into the manual. However, in 2005, when this was implemented, I wrote an FAQ to explain how it works.
http://www.hosteng.com/FAQFiles/ECOM.htm#FAQ0064 (http://www.hosteng.com/FAQFiles/ECOM.htm#FAQ0064)
You wrote, "In terms of HR, Do i have to write like this:
LD K410
LD K129
LDA O1400
RX V2057
and the address for Modbus TCP/IP slave would be 41200 right??"
No. To do Holding Registers your 2nd LD would have to be K128, not K129. Again, if the length parameter is an even number then FC03 "Read Holding Registers" will be done; if the length parameter is an odd number then FC04 "Read Input Registers" will be done.
Also, your RX's parameter (i.e. V2057) is what determines the address of the Register (whether it be Input Register or Holding Register).
2057 octal = 1071 decimal, add 1 = 1072.
You wrote, "I just found excel file which called 'Modbus Conversion' and easily calculated Address for Client and slave.
I got 41072 Holding Registers (HR), and 31072 Input registers, but i am not going to use Input registers.
but i tried again with new value of HR but it didn't work too.(first picture)"
Your ladder in this picture is the same, it is doing a FC04 "Read Input Register" 1072. Your Slave is set to provide Holding Register 41072.
You wrote, "From second picture, i touched this setup communication ports little bit, is there anything wrong?? does it affect communication?"
The setup dialog you have pulled up is for the serial port of your PLC, not the ECOM100.
Please try this:
LD K410
LD K129
LDA O1400
RX V2057
...and set your Modbus TCP/IP Slave software for "Input Registers", with "Address" set to 1072.
-
Hello, Greg
this is results. still no communication...
-
hoejinkim, please download Wireshark (http://www.wireshark.org (http://www.wireshark.org)), install it, and run a trace, save the trace into .PCAP file, and post that file here, or email it to me at support@hosteng.com.
-
Hello, Greg. i sent a file to this email address 'support@hosteng.com'
Thank you.
-
hoejinkim, the Wireshark trace you sent only shows the master as being your Dell PC (169.254.54.15) sending various requests to the ECOM100 (169.254.77.203) using our HAP protocol over UDP.
In other words, there is nothing in the trace showing the ECOM100 sending Modbus TCP telegrams at all.
What you need to do is start Wireshark trace, and then trigger the ECOM100 in your ladders to execute the RX ladders we've been discussing. I am assuming that your Dell PC (with Wireshark) is the one that the ECOM100 is supposed to be sending Modbus TCP telegrams to, correct?
-
Hello Greg
I captured it while the PLC (ladder logic) and Slave device are running. (i am not quite sure if i captured in correct). There were a lot of file types when i save a file.
Yes, ECOM100 needs to send a Modbus TCP telegrams to read a data from slave device.
I will capture again after i study Wireshark (if you let me know certain way to save it, i would be appreciate )
and send you by email.
thanks
-
Just save it into the .PCAP file. In Wireshark that's File --> Save As... (give it a name) and it will save it as a .PCAP file.