TCP/IP Modbus problem

[hoejinkim]

Hello,

I am a graduate student at Oregon tech and now working on communication between H2-ECOM100 (DL 205) and slave software ( called RoboRealm) via modbus TCP/IP through the Ethernet cable. I have some questions that have not been solved for six months. ( I could not graduate last term because of my thesis project).
If you help me, I can graduate in this term.

As I mentioned, I am using DL 205 and H2-ECOM100 as a client and using RoboRealm(R/R) as a slave.
I just checked that R/R is able to send a data to ModScan 32. That means that R/R ‘s Modbus Tcp/ip is working well. (First picture in attached file)

So, next problem is a communication between R/R and PLC. I have been struggled to set up things for PLC. Here are results and would you look at them if they are right or not.(Second and third picture in attached file)

Then, for the network communications I built the RX instruction below,
I calculate the PLC address to use to target Modbus address 41100 in a server device.
The PLC address is V2113, but as you can see in data window, the status is still ‘0’. (last picture in attached file)

The First LD is K 0410, second LD is K128, third LDA is O 1400, and RX is V2100.
The communication b/w R/R and PLC hasn’t been solved yet. I would be appreciated if you give me a suggestion.

Sincerely,

God Bless You,
Hoejin Kim

[franji1]

V2100 is DL mapping of the Modbus Slave Register Address (41100)
You are using LDA O1400, which means Holding Register 41100 is being read into V1400, not V2100 or V2113.  Look at V1400 in your Data View.
You are also telling it to read 128 bytes, or 64 holding registers, so V1400 thru V1477 will have the values for your slaves HR 41100 thru 41163.

[b_carlton]

I think your last 2 arguments are backwards. I find the help in Directsoft's help file clearer than the user manual.

[hoejinkim]

I think your last 2 arguments are backwards. I find the help in Directsoft's help file clearer than the user manual.

The last 2 arguments means about LDA and RX?

[b_carlton]

Sorry, I reread franj1's post and I agree. Your instructions are asking for the information to be placed in V1400 and up. Look there. The third argumend (the LDA) is settting the local location, the place in the DL PLC. The last instruction, either an RX or a WX, specifies the location in the remote device.

[franji1]

Also, the RX parameter needs to be V2113, not V2100.

[hoejinkim]

Hello

Thanks for your reply

I changed RX V2100 to RX V2113 but nothing show up. and also, nothing in V1400 thru V1477.
The problem is modbus TCP/IP didn't show anything in message log(attached file 1)
that means that I need to fix this first connecting PLC to server device (but the server device was communicating with ModScan 32)

do you have an idea??

[hoejinkim]

Sorry, I reread franj1's post and I agree. Your instructions are asking for the information to be placed in V1400 and up. Look there. The third argumend (the LDA) is settting the local location, the place in the DL PLC. The last instruction, either an RX or a WX, specifies the location in the remote device.

These pictures are results.
I recalculated IP address for PLC and Slave device (RoboRealm).
And i checked V2057 thru V2077, but nothing showed up.
Also, Modbus TCP/IP of slave device has no connection with PLC now.

[Greg]

Hi hoejinkim. I think there is some confusion going on here. I see a couple of discrepancies.

First of all you tested your RoboRealm software using ModScan32 software, but your test shows that you are looking at Input Registers starting at 41100. Yet you have set up your ladder logic to read Holding Registers 1089-1152 (and then modified it to read Holding Registers 1072-1134).

So the first question is, do you want the PLC to read Holding Registers or Input Registers?

The second question is, is the offset 41100? Or 1100? In other words, it is possible to address 65,535 holding (or input) registers. Thus the number 41100 has a little ambiguity to it. Sometimes 41100 means Holding Register (designated by the "4") 1100. But sometimes 41100 means an OFFSET of forty-one thousand one hundred. And since your screenshot says "Input Registers" 41100, it looks to me that you have 2 spots of confusion. Like the first question, is it a Holding Register or an Input Register read, and this second question, is the offset forty-one thousand one hundred, or a Holding Register one thousand one hundred?

[hoejinkim]

Hello, Mr. Greg

Thank you for your reply,

The answer on first question is that I am looking at Input Registers. PLC only wants to read data from RoboRealm. The data from RoboRealm is number 1, 2, 3, 4.

Second question, first of all, i chose V41100(RoboRealm address) randomly to calculate and find V2100 which would be PLC address, based on the manual called "Internet communication Module" pages 5-16(first picture). Actually i miscalculated, so I tried again using V41200 and it produced V2057 which is for PLC address. (latest uploaded picture). but did not work.



 

[Greg]

If you want the ECOM100 to read Input Registers then what you currently have will not work because, by default, the ECOM100 reads Holding Registers. Also, you have a fundamental misunderstanding. I will see if I can clear this up for you.

Currently your program looks like this:
LD K410
LD K128
LDA O1400
RX V2057

What this code means:
- The LD K410 (or LD K0410) is the base number (0), ECOM slot number (4) and partner ID (10).

- The LD K128 is how many bytes you want to read (128 bytes), or 64 words (registers).

- The LDA O1400 means, when you do the RX (read), store the results starting at V1400. This V1400 has NOTHING to do with Modbus mapping. This can literally be ANY V-memory location in your PLC because this is where the results are going. For example, it could be LDA O2000, which would store the 64 words read starting at V2000. With a value of LDA O1400 then the range of V1400-1477 will be overwritten with whatever was read.

- The RX V2057 normally means read V2057 from the slave device. However, because this is a request sent to the ECOM100 in slot 4 which has a peer-to-peer configuration, this will get translated into a Modbus TCP telegram. Here's how... the ECOM100 in slot 4 hears the RX command on the backplane. This RX command is to slave ID 10 (the first LD instruction determined this; LD K410). The ECOM100 checks and sees if he has a peer-to-peer table entry for 10. In your case, he does. According to your configuration, he will then translate that request as a Modbus TCP telegram that will be sent to IP address 169.254.54.15 over TCP port 502 and Unit ID 255. The V-memory parameter (in this case V2057) will get translated into a particular Modbus Function Code and Range. According to the range in the manual:

V2057 --> Function Code 03 "Read Holding Registers" with offset 1072 decimal (2057 octal is 1071 decimal, but you have to add 1 because Modbus registers begin with 1, not 0).

So, the code you have is going to read Holding Registers, not Input Registers.

If you want it to read Input Registers, you will have to change your code to this:

LD K410
LD K129
LDA V1400
RX V2057

Notice the 2nd LD instruction is now an odd number (129) instead of an even. This will make the RX V2057 now get translated to Function Code 04 "Read Input Registers" with offset 1072 decimal.

If you want different Input Registers, then you'll have to do the math conversion and change your RX V to something else.

[hoejinkim]

Hello,
thanks for your helping,
1) I tried as you mentioned first, but it sill didn't work (First picture)

2) and i tried again by changing IR to Holding registers (but i don't understand offset 1072 value?)
but it didn't work.(Second and Third picture)

In the manual, "ECOM100 does not support function code 4. Thus 30001 address ranges cannot be read from a server/slave device" So i think i need to change from IR to HR cause the funcion 03 has 'Read Holding Registers'

In terms of HR, Do i have to write like this:
LD K410
LD K129
LDA O1400
RX V2057
and the address for Modbus TCP/IP slave would be 41200 right??

V2057 --> Function Code 03 "Read Holding Registers" with offset 1072 decimal (2057 octal is 1071 decimal, but you have to add 1 because Modbus registers begin with 1, not 0).

So, the code you have is going to read Holding Registers, not Input Registers.

what does that mean?? what is offset 1072? i just calculated address for slave based on the manual, is the way of calculation on manual right?? the manual don't have enough information to understand.....

[hoejinkim]

Hello, sir

I just found excel file which called 'Modbus Conversion' and easily calculated Address for Client and slave.
I got 41072 Holding Registers (HR), and 31072 Input registers, but i am not going to use Input registers.
but i tried again with new value of HR but it didn't work too.(first picture)

And also i have questions
From second picture, i touched this setup communication ports little bit, is there anything wrong?? does it affect communication?

thanks

[b_carlton]

Greg, is there a source at AutomationDirect documenting your 'odd number' tweak to read 'Input' registers?

[Greg]

b_carlton, I don't think this has ever made it into the ECOM manual, but I wrote an FAQ on it when we implemented it.

http://www.hosteng.com/FAQFiles/ECOM.htm#FAQ0064