Reverse Engineering and tap-in to DL205 via Modbus

[sdrevik]

Good day, all- hoping someone can point us in the right direction.   We've been asked to take data off an already-running DL205 in an application.   The device has an HMI connected to the CPU but an open H2-ECOM100 device on the end.   We are well-versed in Modbus/TCP.

So, our questions are:
- It appears digital ins/outs have a default Modbus mapping, using command 02 to read the X0-X17 inputs, status of the Y outputs, etc.  (Correct?)

Question#2: is there a default mapping for analog input modules like the F2-8AD4DA and F2-D4THM?   Or does it depend whether someone has written logic to move those inputs into V-memory?

If there is default mapping for everyone, is there anything to do on the ECOM100 other than set the IP address?

[plcnut]

Regarding #2:
There is no default mapping for analog IO...
But: The pointer to the address where the data is stored IS in a known location. Please see the manual for the analog card, and you will find a table that will tell you the memory location for the pointer that coincides with the slot the module is in. Be aware that the pointer value will be in octal (if my memory serves me correctly).

[sdrevik]

Thanks.   So, do you think it's safe to program the E100 module  (that appears to be unused) for Modbus slave without affecting any of the existing control logic in the main CPU?

[franji1]

I presume you are doing READs only.  WRITEs would definitely affect the control logic behavior.

[sdrevik]

Correct, we just want to read the status of digital inputs/outputs and the analog inputs.   No-touchy. 

[Greg]

If you go to our website (hosteng.com), and in the left pane click on FAQs, then select the ECOM/ECOM100 as the product, then scroll down to FAQ0038 you can download a PDF file that has the ECOM100 Modbus TCP Client/Server mapping in a chart/table. In your case you would only concern yourself with the SERVER chart. It shows, when using a particular Modbus Function Code, exactly what portion of memory in the PLC you will be reading/writing.

[ATU]

Which CPU do you have?  Hopefully its not a 230.

[sdrevik]

205.   We may need to find a consultant more knowledgeable to jump in between us and the end user.   We just want to get a Modbus port into the system without breaking it. 

[ATU]

205 is a description the general Rack system. Look on the CPU, its either a 230,240, 250, 250-1 or a 260 or a Domore.

[sdrevik]

Ah yes  nice, thanks its a D2-250-1

[sdrevik]

Is anyone available to work on this project with us?