Issues connecting with an Energy meter through MODBUS

[Steve Bailey]

I looked at some of the other datasheets for different models from the same manufacturer. I didn't see any menu selection to enable/disable Modbus. There is a password entry, but generally on devices like this, the password is only used to restrict access to parameter changes.
Other models from the same manufacturer allow you to select the number of stop bits and data bits, so I like Bernie's suggestion to try different settings in the software on your PC.
If your USB/serial converter has LEDs that indicate traffic, check to see if the LED for the Rx line ever blinks. Based on your settings in the screenshot you should see the LED for the Tx line blink every three seconds. If that [00] character is coming from the Modbus slave, you should also see the Rx LED blink shortly after the Tx LED.
Also, have you checked Windows Device Manager to verify that the USB/serial converter is COM3?

 

[keristos]

I think you need to look at cabling and comms setup in the slave and double check, I don't think you are connected to the slave at all, one your screenshots of Modbus Poll states that ?

Is it a 2 wire or 4 wire device, which USB > RS485 converter are you using, has it got Rx and Tx lights, when you send a request you should get an Rx at the laptop end even ifs its an illegal response as the slave will be Tx'ing that back to the master

I did check that the cabling was correct, I double checked the information printed on the side of the device and the information from this datasheet.

Unfortunately i don't know the exact state of LEDs but yes the device does have TX and RX leds, and they were showing something when the cables were connected well, and stopped showing when the cable was switched.

 

[keristos]

I looked at some of the other datasheets for different models from the same manufacturer. I didn't see any menu selection to enable/disable Modbus. There is a password entry, but generally on devices like this, the password is only used to restrict access to parameter changes.
Other models from the same manufacturer allow you to select the number of stop bits and data bits, so I like Bernie's suggestion to try different settings in the software on your PC.
If your USB/serial converter has LEDs that indicate traffic, check to see if the LED for the Rx line ever blinks. Based on your settings in the screenshot you should see the LED for the Tx line blink every three seconds. If that [00] character is coming from the Modbus slave, you should also see the Rx LED blink shortly after the Tx LED.
Also, have you checked Windows Device Manager to verify that the USB/serial converter is COM3?

Yes the password to access settings is normal, but I also know of another brand that has a special password (different to the default) that allows you do some other changes.

I will have to go on site again (planned for monday) and take the device with me, I will do all the things you guys suggested (which I did do myself already) but this time I'll keep an eye on the LEDs to see whats going on.

Yes I had to check the COM port from device manager otherwise I would get a timeout immediately.

 

[danw]

1) swapped (+) and (-)
The situation has all the appearances of not having any connection because the (+) and (-) wires are backwards.

But the generic Modbus master app, Modscan32, uses "Modbus Message Time-out" as an indication of a disconnected cable or RS-485 (+) and (-) wired backwards, too.

It doesn't seem to be the case here.

2) DLMUK has the correctly identified the appropriate function code (03) for holding registers addressing the 4xxxx memory and need to request 2 registers for the full word.

Some slaves will reply with an error code if only one register of a two register value is requested, but there's no valid error response coming from the slave, yet.

3) There is no valid Modbus response that consists of a single byte 00.

All Modbus Error messages are 5 byte messages where
- the first byte is the slave ID number
- the second byte is the requested function code with its MSB is set to logic one
Function code 03h becomes function code 13h in an error response
- the third byte is an Exception code, any of which starts at 01 (there is no 00 Exception Code)
- the 4th and 5th bytes are CRC

A legal error response to the master message
07 03 10 00 00 02 35 6C
would be
07 13 xx CRCLo CRCHi
where xx is the exception code

Conclusion - the slave is not responding at all.

Any chance this is not "on the benchtop" connection, but a long distance connection where a junction box wiring connection is broken?

 

[keristos]

1) swapped (+) and (-)
The situation has all the appearances of not having any connection because the (+) and (-) wires are backwards.

But the generic Modbus master app, Modscan32, uses "Modbus Message Time-out" as an indication of a disconnected cable or RS-485 (+) and (-) wired backwards, too.

It doesn't seem to be the case here.

2) DLMUK has the correctly identified the appropriate function code (03) for holding registers addressing the 4xxxx memory and need to request 2 registers for the full word.

Some slaves will reply with an error code if only one register of a two register value is requested, but there's no valid error response coming from the slave, yet.

3) There is no valid Modbus response that consists of a single byte 00.

All Modbus Error messages are 5 byte messages where
- the first byte is the slave ID number
- the second byte is the requested function code with its MSB is set to logic one
Function code 03h becomes function code 13h in an error response
- the third byte is an Exception code, any of which starts at 01 (there is no 00 Exception Code)
- the 4th and 5th bytes are CRC

A legal error response to the master message
07 03 10 00 00 02 35 6C
would be
07 13 xx CRCLo CRCHi
where xx is the exception code

Conclusion - the slave is not responding at all.

Any chance this is not "on the benchtop" connection, but a long distance connection where a junction box wiring connection is broken?

Thank you for your reply. At first I thought the issue was the Modbus cable installed (not by me) that was the issue, so I physically connected a short (about 1m) cable directly to one energy meter, took note of it's address and settings and tried communicating directly with it.

With regards to 1) I tried swapping the + and -, but that resulted in a timeout;
2) I believe I tried all the options; function codes, register lengths, register addresses, parity, stop bits, device addresses and baud rates.
3) Thank you for the explanation, I didn't know this.

Thank you

 

[keristos]

Hey guys I've got an update.

Unfortunately still no luck communicating with these energy meters. I tried a different USB to RS485 converter, the HXSP-2108G.

This time, instead of getting an illegal response of just [00] I actually got a Modbus frame in the response. Here are my results:

____________________________________________________

Sending: (Function 3, Addr 4097, length 1)
[08][04][10][00][00][01][35][93]

Recieving:
[EF][DF][FF][FF][FD][95][00]

Error:
Wrong Slave address in response

____________________________________________________

Sending: (Function 3, Addr 4097, length 2)
[08][04][10][00][00][02][75][92]

Recieving:
[EF][DF][FF][FF][FB][15][00]

Error:
Illegal Response

____________________________________________________

Sending: (Function 4, Addr 4097, length 1)
[08][03][10][00][00][01][80][53]

Recieving:
[2F][DF][FF][FF][FD][FF][00]

Error:
Wrong Slave address in response

____________________________________________________

Sending: (Function 4, Addr 4097, length 2)
[08][03][10][00][00][02][C0][52]

Recieving:
[2F][DF][FF][FF][FB][7F][00]

Error:
Wrong Slave address in response

____________________________________________________

The 'Error' part is what the software I'm using (Modbus Tester) is stating.

Any fresh ideas?

Thank you

 

[m_turk]

Addr 4096?

 

[keristos]

Addr 4096?

Address 304096, I just skipped the first 2 numbers sorry

 

[m_turk]

Address 304096, I just skipped the first 2 numbers sorry

No, I mean, in your last tests you tried with 4097 and what do you get when you run those 4 tests with 4096?

 

[keristos]

No, I mean, in your last tests you tried with 4097 and what do you get when you run those 4 tests with 4096?

Sorry, I misunderstood you.

The same result basically. I tried every combination I could think of for addresses, functions, stop bits, parity, baud rates, etc... I just didn't stay documenting everything.

Does the returned MODBUS frame for the errors I did document make sense?

 

[DLMUK]

Does the returned MODBUS frame for the errors I did document make sense?

No... absolutely no sense at all I don't think.

In your code 3 and code 4 examples below, you have them around the wrong way, but I expect this is a typo...

Function code 3 example

[08][03][10][00][00][02][C0][52]

Response should start [08][03] regardless of successful communication or not. By successful I mean the correct or incorrect command being seen by the slave.

You should then get an exception code between 01 and 11, and then a crc. So an illegal response should look something similar to...

[08][03][02][****]

checkout http://www.simplymodbus.ca/exceptions.htm

if you have the A and B round the wrong way, sometimes running it through a convertor you will get a strange response but still one similar to the one you are looking for. I have seen this before.

I would try using ModScan32 and testing again (the 32bit version will work on 64bit OS). Then post your results.

 

[keristos]

No... absolutely no sense at all I don't think.

In your code 3 and code 4 examples below, you have them around the wrong way, but I expect this is a typo...

Function code 3 example

[08][03][10][00][00][02][C0][52]

Response should start [08][03] regardless of successful communication or not. By successful I mean the correct or incorrect command being seen by the slave.

You should then get an exception code between 01 and 11, and then a crc. So an illegal response should look something similar to...

[08][03][02][****]

checkout http://www.simplymodbus.ca/exceptions.htm

if you have the A and B round the wrong way, sometimes running it through a convertor you will get a strange response but still one similar to the one you are looking for. I have seen this before.

I would try using ModScan32 and testing again (the 32bit version will work on 64bit OS). Then post your results.

Thank you for the reply.

Yes I thought that the first two values should be Echoed back, that's why I think it's strange.

Switching A and B resulted in a timeout so I don't think that is the issue...

These devices are driving me insane

 

[DLMUK]

Sorry I have just noticed something which I should have picked up before.

You are addressing 4096 in your read request.

The function code should address the 4 section. This is because all holding registers start 4...., so using function code 03 will apply that 4.

Therefore what you effectively need to do is address the offset, in your case 97.

So what I think you should be doing is sending

[08][03][00][60][00][02][35][93]

This would address node 8, holding register, offset 96, for a length of 2, then the CRC.


So just to reiterate, if you wanted to address holding register 40017 for example, you would specify you want to read a holding register with your function code, then attempt to read address 17.

 

[DLMUK]

Also, this may be nothing but...

looking at the modbus tester you are using it says:

Data Type: 03 Input Register

03 is not an input register. 04 is an input register. 03 is an analog holding register.

So your "function 4" in you tests is the correct one to use, the one which sends [08][03]

This is probably poor wording in the software, but I would suggest that if there is an elementary error like this in the GUI then certainly start using ModScan instead!!

 

[keristos]

Sorry I have just noticed something which I should have picked up before.

You are addressing 4096 in your read request.

The function code should address the 4 section. This is because all holding registers start 4...., so using function code 03 will apply that 4.

Therefore what you effectively need to do is address the offset, in your case 97.

So what I think you should be doing is sending

[08][03][00][60][00][02][35][93]

This would address node 8, holding register, offset 96, for a length of 2, then the CRC.


So just to reiterate, if you wanted to address holding register 40017 for example, you would specify you want to read a holding register with your function code, then attempt to read address 17.

Thank you for your reply.

Am I mistaken in thinking that modbus is in the range of 400000?

That would mean that in this case, with address 4097, with the function code added it would actually come to 404097.

On the modbus table I linked to earlier, the address is listed in both decimal (4096) and hex (1000)... So I'm not sure what you said is the case.

I will try this nonetheless, as far as I know I already did try this with the new rs485 converter though.