Modbus TCP

I'm trying to make a Siemens 1200 PLC talk to an Allen Bradley Micrologix 1400 PLC through Modbus TCP. The Siemens is the "Server."

The Siemens is able to successfully send data TO the Allen Bradley, but nothing ever comes back. All of the data transactions take 3 seconds, and end with a "port busy" error code.

Does this sound familiar to anybody? TIA.

In Modbus terminology, the "server" is a Modbus slave, who is silent unless spoken to by the master (client). The master is in control of all communication.

If the Siemens sends data to the AB, AND the Siemens is a server (slave) then the Siemens is replying to a request for data from the AB.

"But nothing ever comes back"
For the AB to send data to the Siemens server (slave), the AB master (client) would have to 'write' data using Modbus function code 06 or 16 and write it to an available, writeable register.

Does the above description correspond to the operation as you uderstand it?

Sorry, I get confused by the names server/client. The Siemens is the Master, the Micrologix is the Slave.

Is the Siemens writing (sending) data to the AB that you can confirm is received by the AB?

Is the difficulty reading data from the AB into the Siemens?

Please describe, by examples, what you mean by
>The Siemens is able to successfully send data TO the Allen Bradley, but nothing ever comes back.

Okay, so let's address this part of the post:

The Siemens is able to successfully send data TO the Allen Bradley, but nothing ever comes back.

Click to expand...

What exactly is the Function Code you are using to "send" data to the A-B controller, and what datatype, offset, and length are you using ?

And what exactly is the Function Code you are using the "read" data from the A-B controller, and what datatype, offset, and length are you using ?

danw said:

Is the Siemens writing (sending) data to the AB that you can confirm is received by the AB?

Is the difficulty reading data from the AB into the Siemens?

Please describe, by examples, what you mean by
>The Siemens is able to successfully send data TO the Allen Bradley, but nothing ever comes back.

Click to expand...

Yes, the Siemens can write data to the AB. I confirmed this. But the Siemens cannot read data from the AB. In both cases though, I get an error code 8200 for "port busy" after 3 seconds.

Ken Roach said:

Okay, so let's address this part of the post:



What exactly is the Function Code you are using to "send" data to the A-B controller, and what datatype, offset, and length are you using ?

And what exactly is the Function Code you are using the "read" data from the A-B controller, and what datatype, offset, and length are you using ?

Click to expand...

On the Siemens PLC, I'm using a function (provided by Siemens) called MB_CLIENT. It does not accept a modbus function code. Instead, it uses a "MB_MODE" which then translates to the actual function code.

For sending data, I'm using MB_MODE 2, which is supposed to translate to function 16 (decimal), 'write one or more holding registers'. I've successfully written two consecutive 16-bit words to address 40001.

For reading data, I'm using MB_MODE 0, which is supposed to translate to function 3, 'read holding registers'. In this case, I have my program trying to read from different places at different times, and so far as I can tell none of it works. One example is reading 16 words from address 40515.

StatonRo said:

Yes, the Siemens can write data to the AB. I confirmed this. But the Siemens cannot read data from the AB. In both cases though, I get an error code 8200 for "port busy" after 3 seconds.

Click to expand...

I just tried this again, but stepping one transaction at a time manually. The first transaction returns error code 818A, "Invalid data length value." All subsequent transactions give code 8200 "The port is busy processing an existing Modbus request."

So, it would seem the 818A error may be the real culprit. The data length of my first transaction is 2. Is this invalid for some reason???

Staton, I can't comment about the AB side, but the S7-1200 Modbus TCP works.
Can you post code for both PLC's so it can be reviewed? Without seeing the code, we're all just guessing.

Do you have the Modbus configuration in RSLogix 500 configured for "Expanded" mode ?

MicroLogix data files are only 256 words long, so you need to use Expanded data tables to use six total data files, so your available Modbus addresses are 40001 to 41536.

Hello, I figured out what was wrong and got it working. I thought I should post the solution.

The problem was my implementation of MB_CLIENT. Though they have decent documentation, they don't tell you that all of the parameters must remain valid during a transaction even when you're not requesting a new transaction. I had been using temporary variables that were only valid during one scan when the request bit was set. After that, the variables were garbage.

Thanks very much for posting that followup !

I just did a similar project in the reverse direction using the MicroLogix 1400 to "hand-code" a Modbus-like transaction using the Open Sockets feature, which I suspect is similar to how Modbus is implemented in the S7-1200.

I abandoned it in the middle when the vendor told me he'd implemented ordinary Modbus codes 3,4, and 16, but it was an interesting effort.

Hello pro, i got some problem when i try to connect MicroLogix 1400 of AB PLC to S7 1200 of Siemens PLC using Modbus TCP, which the AB as the Modbus client and the Siemens as the Modbus server. The chanel configuration and the parameter is avaible in ppt file include. It show the error discription "local communication channel is shutdown" and i really do not understand, please help me!!! thank in advance
http://www.mediafire.com/?ik2jdeynbx16i8t

Hello all.
I have a question reagrding reading data from a remote PLC (Allen Bradley) via Modbus communication.

I read the following information from the remote PLC. Status of the Inputs (data address 10400, data length 32 bool), Outputs (data address 10440, data length 32 bool), Alarms (data address 10101, data length 48 bool) and analog values (data address 41002, data length 8 real).

I've made my PLC logic like so:
At CPU startup I execute 4 MB_Comm_Load blocks (one for Inputs, one for outputs, one for alarms, and one for Analog values), one at a time.
Then I have 4 MB_Master blocks where each block is linked to one of the Comm_Load blocks ((MB_Comm_Load(Inputs) is linked to MB_Master(inputs) and so on). With each MB_Master block I read a different data address of the remote PLC and store the values to my PLC.

So for my question... Will the communication work If at Startup I execute just one MB_Comm_Load function and link the 4 MB_Master blocks to this one MB_Comm_Load block?

I hope that you understand my question.

Best regards.
Aleix