Modbus/TCP Troubles

[Controls Guy]

I have a Modbus/TCP voltage monitor in the network with a BRX and I'm trying to poll it, but I get the error output from the MRX.

o Can poll from PC.   Unit ID 0, FC 3, Address 0x0b88 / d3000 on wire (verified), up to 16 registers / 8 floats
o Can PING target from the BRX, 1ms delay
o @IntModTCP client timeout is set to 1000ms.
o As soon as MRX box is energized, error relay comes on immediately.    Doesn't wait for timeout, and does not appear to cycle like successful or unsuccessful polls usually do.   Might be off for one scan between polls I guess.  Have tried both 3000 and 3001 in address field in the MRX, believe 3000 is correct because I think what you put in the box is what goes on the wire.
o Exception register stays at 0.

[Controls Guy]

Hmmm.   On PC, I have to set the Unit ID to 0.    On BRX, it works if I set it to 255.  [shrug]

OK, that still wasn't quite right.   Apparently I need 3001 in the address field and swap words.

[franji1]

Apparently I need 3001 in the address field and swap words.

Yes, the "on the wire" offset is -1 the Application Layer offset.  So Holding Register at HR address 43001 will have an offset of 3000 decimal in the wire.  So the MRX offset is the Application Layer offset, or 3001 (as you figured out).

[rlp122]

IIRC Unit ID of 0 is broadcast to all units, 255 is target single unit which is what most devices want.

[franji1]

IIRC Unit ID of 0 is broadcast to all units, 255 is target single unit which is what most devices want.

Believe it or not, for Modbus/TCP, 0 is a valid slave ID.  We had to "fix a bug" in that some Modbus/TCP devices REQUIRED an ID of 0 and it was NOT for a WRITE broadcast (i.e. we had to tweak MRX firmware to support Modbus/TCP Slave ID of 0).

Modbus/RTU has that limitation (0 only valid on broadcast writes).  Modbus/TCP Gateways sometimes supports that (optional?).  The Modbus/TCP spec said that 0 must be supported as a valid slave ID (we thought the same as you).

[Controls Guy]

Huh.   I was assuming that's why it faulted immediately with no exception response if I had a zero in the Unit ID to match what worked on the PC, was that MRX didn't accept zero as valid.  Now I have no idea.

[franji1]

Huh.   I was assuming that's why it faulted immediately with no exception response if I had a zero in the Unit ID to match what worked on the PC, was that MRX didn't accept zero as valid.  Now I have no idea.

You need the latest firmware.  This is a recent fix.  But having a Slave ID of 0, while technically "valid" for Modbus/TCP, is really NOT a good idea.

So your slave accepted a Slave ID of 0 or 255.  Do-more firmware 2.9.8 added support for making 0 valid on MRX (see https://hosteng.com/HW-Products/DM1/BX-DM1_RevHistory.htm for version 2.9.8).  That's probably your issue?

I still don't like 0.  Use 255.

[Controls Guy]

That sounds right.   I have about 25 BX-10Es left from a batch I bought about a year ago, at 2.9.5 I think.  Used 2 the other day on a job & flashed to current, but this was just a component eval, so I just grabbed a BRX off the shelf.  Thanks!

Oh, and will do on the 255!