Horner QX451 and ModbusTCP

I've got a Horner Electric QX451 that I am setting up on a job. I will be using an HMI program connected to the QX to allow operator control remotely. I was planning to use ModbusTCP for communications, with the KEPServerEX. The problem I am running into, is that some of the Modbus addresses do not seem to be working properly. Based on the Cscape manual, I should be able to use address 3001 to access bit %M1 in the QX. This works fine from the touchscreen, but I cannot write to this bit through the HMI/KEPServer. I am able to turn %Q bits on and off, but that seems to be it. Has anyone run into this before, and know what undoubtedly stupid thing I'm missing here? Thanks.

This may sound dumb but check your bit settings in KepServer. Make sure that the address is reported as a boolean and that the setting is set as read/write. Not read only. If these are set correctly double check your addresses because I think if I remember the Horner products they use a zero offset which I think means 3000 is m1, 3001 is m2 and so forth. That is if i remember correctly.

jgreenewv said:

I've got a Horner Electric QX451 that I am setting up on a job. I will be using an HMI program connected to the QX to allow operator control remotely. I was planning to use ModbusTCP for communications, with the KEPServerEX. The problem I am running into, is that some of the Modbus addresses do not seem to be working properly. Based on the Cscape manual, I should be able to use address 3001 to access bit %M1 in the QX. This works fine from the touchscreen, but I cannot write to this bit through the HMI/KEPServer. I am able to turn %Q bits on and off, but that seems to be it. Has anyone run into this before, and know what undoubtedly stupid thing I'm missing here? Thanks.

Click to expand...

From memory (so I could be wrong and if so pleas elet me know) but isn't the modbus address's starting with either a 3 or 4 actuall word address's. An address of 4001 would be "output register" effectively read/write while an address of 3001 would be "input register" effectively read only. To address a coil I think you need either 0001 for "output status" (read/write a coil/bit) and 1001 for "input status" (read ONLY coil/bit).

mrtweaver:

That was the first thing I checked, actually. I also tried with a zero offset and a one offset. No dice. I'm just not sure about the addressing, because the only cross reference from Horner to Modbus I can find is in the 2002 version of the Cscape manual.

Dua Anjing:

The addresses I'm looking at are actually 03001. They use the five-digit addresses. I wasn't paying attention and shortened it in my original post. They have the outputs starting at 00001, and the %M bits are SUPPOSED to start at 03001.

don't know if it helps or not..in the past I have used a small shareare app that I downloaded. it's called "simply modbus tcpip" shouldn't be too hard to find on the net, I've found it very useful

Here is the recent document for modbus addressing on Horner products. You are correct in that 3001 is M1. The next questions have to do with how are communicating between the remote HMI and the horner unit. I know you said you were using KepServer. So here are some questions.

1. what version of KepServer are using?
2. How do you have it configured?
3. How do you have it wired?
4. If you are going thru the serial port I know on the units I have worked with you either have to use the open and transmit/receive function blocks or you have to go into the Program/Protocol config and set up your protocol there.
5. If you are using tcp/ip then there is a different location to set up modbus. that would be controller/io/configure then navigate to the ethernet port.
6. In kepserver if you are using it to link two pieces of equipment together I dont recall the name of it but it is similar to their linkmaster software they have.
7. One thing I have done is I used the Horner NX221 and have it connected serially to a Mitsubishi Q series and with the help of the driver that Horner wrote the two shake hands nicely. Was just wondering if you had thought of trying the approach of connecting then together with no software in the middle. Kind of the KISS principle. The more simple the better.

Just some thoughts. Hope this helps.

First of all, where in the world did you find that? I spent 45 minutes searching every combination of Horner, OCS, and Modbus trying to find a recent document.

mrtweaver said:

Here is the recent document for modbus addressing on Horner products. You are correct in that 3001 is M1. The next questions have to do with how are communicating between the remote HMI and the horner unit. I know you said you were using KepServer. So here are some questions.

1. what version of KepServer are using?

Click to expand...

I am running KEPServerEX 4.200.363-U ModbusTCP

mrtweaver said:

2. How do you have it configured?

Click to expand...

KEPServer or the OCS unit?

mrtweaver said:

3. How do you have it wired?

Click to expand...

I am connected over Ethernet, through an unmanaged switch.

mrtweaver said:

5. If you are using tcp/ip then there is a different location to set up modbus. that would be controller/io/configure then navigate to the ethernet port.

Click to expand...

I have the TCP/IP settings configured properly. I can access the %Q bits and the %R registers with no problems. I just can't access the %M bits.

mrtweaver said:

6. In kepserver if you are using it to link two pieces of equipment together I dont recall the name of it but it is similar to their linkmaster software they have.
7. One thing I have done is I used the Horner NX221 and have it connected serially to a Mitsubishi Q series and with the help of the driver that Horner wrote the two shake hands nicely. Was just wondering if you had thought of trying the approach of connecting then together with no software in the middle. Kind of the KISS principle. The more simple the better.

Just some thoughts. Hope this helps.

Click to expand...

I'm not linking equipment currently. I'm just trying to access the %M bits from my HMI software through KEPServer. That is what's confusing me. If nothing at all was being transferred, I would assume I had something configured wrong. But, most items are transferring properly. I may have to throw this back to Horner and see if they have any ideas. I did see they have their own version of KEPServer using native Horner addressing. It may just be easier to use that instead. Thanks for the suggestions.

Thank you for the congrats, as for the location where I found the document, it is in the CSCAPE user manual under modbus.

Now if I understand what you have so far is you have the HMI connected to Kepserver, then you have your Horner unit connected to Kepserver. Each of these is configured to talk to that device. Is this correct so far?

And again if I understand when you toggle the information from the HMI you can see it toggle in KepServer. Is this correct?

Now what you want to do is be able to join the data so that toggling on the HMI will toggle the Horner unit. am I following your process so far? Or am I missing something?

If this is correct so far then there is one more step. That is the linking step. Just because Kepserver sees both devices does not mean that it will natively share the information between the two. This has to be configured. I dont recall the name of the plug in for KepServer but it is used to link 2 devices so that they will share information. They use to have the product linkmaster but I know from talking to them they are in recent releases integrating a similar product into their KepServer. For this configuration I would recommend contacting KepServer.

As for the Horner Driver, one thing you should know about the Horner Driver, that is at the time I last checked into it they still only supported one channel. Now if you are only going to have this one HMI and one Horner unit then you will be fine. But if you are going to have more than one set, then it is best to stick with modbus. The reason is it is recommended that each device has its own channel that way all communication will be more parallel or I think the term is async. This is clearly noted on KepServers website.

Hope this helps and is clear. have a great day.

Here is my exact setup. I have the QX451 running my process (in this case a water treatment plant) The QX451 is connected via Ethernet to a PC. The PC is running KEPServer to handle the ModbusTCP communications, and HMI software (in this case, Inductive Automation) to handle operator interface, reporting, etc. The HMI software (via KEPServer) is able to view the %R registers (starting at Modbus address 403001) and %Q bits (starting at Modbus address 000001) with no issues. If I try to hit an %M bit (starting at Modbus address 003001) it does not work. I don't get any errors in KEPServer, and communications does appear to be taking place. Since everything will go through this QX451, I'm probably going to switch to the Horner driver, and work on the Modbus issues later. Thanks for your suggestions, everyone.

This would be a good question for Nathan (surferb) or a call and maybe a gotomeeting with Inductive. I am using Inductive Automation with Kepserver and am running 87 Horner units all speaking modbus and I am using the following items: %q, %r, %t and %m with no problems. THere might be something in your configuration with the way in which you are operating the %m. If you are using a button to control the %m and you do not have bidirectional turned on this would cause it not to function. If in Factory SQL you dont have bidirectional turned on for that item it wont work. These are the two areas I would check or as mentioned have Inductive do a gotomeeting and help you check if you are unfamilar with these areas. Let me know how this works out for you and I hope it helps.

jgreenewv said:

Here is my exact setup. I have the QX451 running my process (in this case a water treatment plant) The QX451 is connected via Ethernet to a PC. The PC is running KEPServer to handle the ModbusTCP communications, and HMI software (in this case, Inductive Automation) to handle operator interface, reporting, etc. The HMI software (via KEPServer) is able to view the %R registers (starting at Modbus address 403001) and %Q bits (starting at Modbus address 000001) with no issues. If I try to hit an %M bit (starting at Modbus address 003001) it does not work. I don't get any errors in KEPServer, and communications does appear to be taking place. Since everything will go through this QX451, I'm probably going to switch to the Horner driver, and work on the Modbus issues later. Thanks for your suggestions, everyone.

Click to expand...

I also forgot to mention read/write has to be set in Kepserver as well.