Modbus Ascii Siemens Cp341 and Emerson 2700 transmitter

NoMjolnir

Member
Join Date
Dec 2010
Location
Norway
Posts
3
Fellow PLC afficianados,

I'm having some difficulties reading registers from a Emerson Coriolis transmitter.

The following equipment is used:

Emerson Coriolis transmitter modell 2700.
http://www2.emersonprocess.com/fr-f...tters/1700-2700-transmitters/Pages/index.aspx

Siemens 315F PN/DP CPU

Siemens CP 341 with dongle.

***********************************
Configuration:

CP341

see attached image cp341 config.

Emerson micro motion 2700
Interface RS485 two wire.
Protocol Modbus Ascii
baudrate 9600
data bits 7
stop bits 1
parity even.

**********************************
PLC program:

FB7 p_rcv_rk, FB8 p_snd_rk


FC 51 Send:
called in OB1

calls fb8


CALL "P_SND_RK" , "SEND IDB"
SF :='S'
REQ :="SEND WORK DB".P_SND_RK_REQ
R :="SEND WORK DB".P_SND_RK_R
LADDR :="SEND WORK DB".P_SND_RK_WORK_LADDR
DB_NO :="SEND WORK DB".P_SND_RK_WORK_DB_NO
DBB_NO :="SEND WORK DB".P_SND_RK_WORK_DBB_NO
LEN :="SEND WORK DB".P_SND_RK_WORK_LEN
R_CPU_NO:=
R_TYP :=
R_NO :=
R_OFFSET:=
R_CF_BYT:=
R_CF_BIT:=
DONE :="SEND WORK DB".P_SND_RK_DONE
ERROR :="SEND WORK DB".P_SND_RK_ERROR
STATUS :="SEND WORK DB".P_SND_RK_WORK_STATUS

P_SND_RK_REQ is set when send done bit is set and 2 second pulse triggers.
this works Trx is blinking every 2 seconds.

P_SND_RK_WORK_LADDR is 256 according to HW config.
P_SND_RK_WORK_DB_NO is 52
P_SND_RK_WORK_DBB_NO is 12 for offset to char array.
"SEND WORK DB".P_SND_RK_WORK_LEN is 32 for char array.

DB 52
DB52 send src db.jpg

The message frame

aFunction code.jpg

Ascii message frame format.jpg

The Message frame is built like this:

start = : (3A)
address = 1 (30)
function code = 3 (03)
register = 7 (37)
nr of registers = 1 (30)
error check = F4
carriage return = 0D
line feed = 0A

so the array of chars in db52 is 32 bit looking like this:

3A 3031 3033 30303037 30303031 F4 0D 0A

Using this setup im not getting a response from the transmitter. Any input on what I'm doing wrong?

Cp341 config.jpg db51 rcv dst db.jpg
 
Last edited:
I've made a change to the data field of the message frame.
I used 30303037 and 30303031 for register nr and nr of registers, these are two characters each, not four. So the send_text is now:

start: :
address: 01
function code: 03
start reg: 07
# of regs: 01
LRC: F4
carriage return: 0D
new line: 0A


In DB 52 the char array is:
3A 3031 3033 3037 3031 F4 0D 0A
 
You beat me to it.

What I was writing when your message arrived:

Numeral 1 is 31 ASCII in the ASCII table I'm looking at.

You use 30 which is numeral 0 for both the address and number of registers in the Modbus message.

The Modbus standard (serial comm) says that
- the address field has two characters. So I function code 03 (hex) is
30 33 in ASCII.
- the LRC is two characters, not one

"The resulting LRC is ASCII encoded into two bytes and placed at the end of the ASCII mode frame before the CRLF."
 
Last edited:
You're right about that, thanks :)

start: ":" (3A)
address: 01 (30 31)
function code: 03 (30 33)
start reg: 07 (30 37)
# of regs: 01 (30 31)
LRC: F4 (46 34)
carriage return: 0D
new line: 0A

I use chars in my source db, capital letters for A-F.

In FB8 call I specify source db 52, offset 12 (since thats where the chars begin in the data block) nr of bytes: 26.

Still no luck though...
 
I'm clueless on Siemens, I can't help you with Siemens particulars. But there's a couple things to check for any Modbus comms:

1) RS-485 A/B lines might be labeled the same but do not necessarily have the same function manufacturer to manufacturer. If the A/B lines are reversed, comms will not work but the line drivers will not be damaged. Try changing swapping the A/B lines.

2) serial word size, baud rate, parity, stop bit settings have to be identical on both ends.

3) the dreaded one offset - addresses and registers can be offset by one

address 40000 = register 40001

It isn't clear whether the value is an address or a register and misuse of either term is rampant.

So, when you want 40007 try one 40006 and 40008 and see whether you get a hit.

4) I always establish communications with the slave with a generic Windows Modbus master, like Modscan32. Under its connection settings, ASCII mode can be selected.

It's quick to change addresses, quick to change the format of the received value. And it'll show the comm bit stream.
Using a Windows master 'proves' that a certain set of settings communicates with the slave. Then it's an attempt to get that same set conditions into the master.

5) I didn't check your LRC value. If you wrote the algorithm to calculate it, I'd check it against one of the on-line calculators.
 
An LRC error will generate a frame error message, but here's high low order for LRC:

nxwdg2.jpg
 

Similar Topics

Hello friends, Is is possible to make S7-300 with CP341 to be Modbus ASCII master in communication to some other Modbus ASCII slaves? I found...
Replies
0
Views
2,581
I am working on a project, inside an AB CLX, I implemented the Modbus TCP Client AOI published on AB website, to interreact with a Modbus ASCII...
Replies
7
Views
3,458
I have had to write my own Modbus ASCII "driver" for an old DL05 talking to a GS4. I am using the Modbus Slave program for testing. A PID is...
Replies
17
Views
6,926
Found an awesome point of sale for $500. It sends an ascii string when a product is sold. Need to convert this into a number between 0 and 255 or...
Replies
1
Views
2,256
In all my years of control work, I've had limited exposure to Modbus communications. Can anyone explain to me the difference between ModbusASCII...
Replies
6
Views
2,740
Back
Top Bottom