micrologix1400 & modbus 485 power meter

Sydneyguy

Member
Join Date
Jun 2019
Location
Sydney
Posts
39
Hi Guys,

Hope someone can shed some light for this newby

I'm currently configuring an AB ML1400 to talk to a IME Power Meter over Modbus RTU RS485. This is my first time using the ML1400 with Modbus and it seems reasonably straight forward.

I'm looking to read input registers so have setup the commands as follows to test the data retrieval before going further. I'm looking to read the Phase 1 Voltage in address 0x301 all the way through to apparent power 0x321

Command: 04 Read input registers
Data Table Address N7:81
Size In Elements: 26
MSg Timeout:100
MB Data Address: 1
Slave Node: 1
modbus address: 30001

My issue is the reply I'm getting is Error Code (hex) 37 - Message timed out in local processor

See below screenshot of my setup.
modbus1.png

modbus2.png
http://www.plctalk.net/qanda/attachment.php?attachmentid=39824&d=1455523218

Has anyone got any ideas why the meter is not reading my request properly?

Regards
David
 
Assuming this is the Modbus manual for that drive:
https://www.imeitaly.com/wp-content/uploads/technical-sheets/PR106.pdf

1. page 7 shows Modbus Function Code 0x03 which is read holding registers, not read input registers.

Your PLC master command has to change from 04 Read Input Registers (3xxxxx) to 03 Read Holding Registers (4xxxxx)

2. Be aware that labeling of the driver lines for RS-485 is not consistent vendor to vendor. Should be A to A, B to B, or (+) to (+), (-) to (-), but sometimes one of the vendors does the other way. If comm hangs up, try swapping the driver lines on one end.

3. I'd suggest trying a single, one-shot poll first to establish communications and to avoid issues with time-outs, then move to successive polls once you've got a one-shot query-response.

Note that the time-outs on page 6 pdf are stated as much longer than the Modbus spec'd 3.4 characters (1.5 mS).
 
Hi Dan
Thanks for the quick reply
I had tried that function, I had tried both actually.
I also tried swapping polarity on the other end but no luck.
What else could I be doing wrong?
I have set the Baud and address in the power meter as well.
 
Are you using the 1763-NC01 adapter plugged into Channel 0? Is it firmly connected to Channel 0? (I had one Friday that wasn't pushed all the way into the round connector)

Did you power cycle the PLC after setting up channel 0? (I suspect yes, otherwise you'd get a different error)

I don't know much about your power meter, but does it require power cycling after setting up the port?
 
Going through the Manual that danw provided. The Modbus addresses are in Hex. Most Modbus add a 1 to the value. The address is 301 Hex which is 769 Dec. Setup the message as follows:
Command: 03 Read
Data Table Address N7:81
Size In Elements: 2
MSg Timeout:5
MB Data Address: 770
Slave Node: 1
modbus address: 40770
 
Going through the Manual that danw provided. The Modbus addresses are in Hex. Most Modbus add a 1 to the value. The address is 301 Hex which is 769 Dec. Setup the message as follows:
Command: 03 Read
Data Table Address N7:81
Size In Elements: 2
MSg Timeout:5
MB Data Address: 770
Slave Node: 1
modbus address: 40770
Thanks for that, so I guess in my case if I am wanting to read multiple registers than I should just do a seperate read msg block for each register, so in my case I could have 12 or 13(which isn't a big deal)?
Cheers
 
In the image you posted you’re reading MB address 30001 thru 30026 not 30301 thru 30321. The first thing is (as “danw” mentioned) you need to be reading Holding Registers I.E. “40xxx”. The next thing is if you need to read address 301 thru 321 which means you should be reading 40301 to 40321. This also means you need to change the size in elements to 21. Having said all of that, “swimmy67” also has a good point. Some MB devices use standard addressing which starts with “0” (I.E. 40000) and some us “PLC” addressing which starts with “1” (I.E. 40001). I’d start with a single element and try 40300, 40301 and 40302) and see what responds appropriately. I sometime find that different manufactures define the “base” address differently so sometimes you need to subtract “1” from the target address, sometimes you need to add “1” (and sometimes you don’t need to do anything). You may also want to download and use “Modbus Poll” as the Modbus Master from your PC to the power meter just to sort out the addressing before using the PLC. It’s a program that you have to pay for, but it has a 30-day trial period. If you’re going to do a lot of Modbus communications, it can be very valuable to have.
 
SO a bit of luck, I figured out I was trying to write a message to two different devices at the same time, so when I restrcutured th rporgram to let comms take place to a device (node) at a time i started seeing a change in error. Now I am seeing 'error 82- Modbus exception code 02 returned: Illegal Data Address"

I have tried just reading two elements, and modofying the address to 40770, 40771, 40772, 40301, 40302, 40300, but to no luck each time. I feel as if I am 98% there and somethings just not quite right?
 
1. I would think that swimmy67's configuration would work for reading two registers of 32 bit D_Word at 0x301 (zero based address), which normally equates to (4)0770 at a one based address.

I haven't used the uL1400.The screen shot of the Modbus master setup:
screen-shot-of-master-setup.jpg



I deduce that last item - Modbus Address is calculated (not user-entered) from
- the specified Modbus Command (Should be 03 Read Holding Registers), in part because of the grey background which probably reflects that the value is not a user entry, but a calculation.

- MB Data address in the range 1-65536

The resulting Modbus Address (3)0001 is the Modbus Address for MB Data Address 1 for Function Code 04 in the screen shot above.

The range, 1-65536, shows that the addressing one based, not zero based (1 starts at 1, not 0).

I assume "Size in Elements" means that one element = one 16 bit Modbus register. Can anyone confirm that?

The revised setup should be (like swimmy67 posted)

Modbus Command = 03 Read Holding Registers
MB Data address = 770 (one based conversion of 0x301)
Size in Elements = 2 (32 bit D_word is two Modbus registers)
Modbus Address = (4)0770

And that setup produces an "Illegal Data Address" reply?

2.
FYI, the 4xxxx format is almost always decimal. I can't recall a 4xxxx Modbus register address that was hexadecimal.

So attempting to read from 40301 or 40302 is really attempting to register addresss 0x12D or 0x12E which do not exist on this device and which deserve an error response.

Their hex addressing is weird because it appears to be 8 bit byte addressing, not 16 bit Modbus addressing:

Phase 1 voltage
0x301 = 769 decimal (4)0770
0x302
0x303
0x304

Phase 2 voltage
0x305 = 773 decimal (4)0774
0x306
0x307
0x308

Phase 3 voltage
0x309 = 777 decimal (4)0778
0x30A
0x30B
0x30C

Typically, other devices with multiple, successive 32 bit values that require two 16 bit Modbus registers have Modbus addresses alternating by twos, like

phase 1 = (4)0770
phase 2 = (4)0772
phase 3 = (4)0774

But this device uses every 4th Modbus register address between 32 bit D_Word values (by converting hex to decimal and adding 1)

phase 1 = (4)0770
phase 2 = (4)0774
phase 3 = (4)0778

So, I'm not sure where (4)0771 is in relation to (4)0770, but the vendor must have it worked out.
 
Thanks Dan for your very thorough response.
Firstly you are correct in regards to your first assumption. " I deduce that last item - Modbus Address is calculated (not user-entered) from
- the specified Modbus Command (Should be 03 Read Holding Registers), in part because of the grey background which probably reflects that the value is not a user entry, but a calculation."




Like you have suggested and like swimmy67 posted the following:

Modbus Command = 03 Read Holding Registers
MB Data address = 770 (one based conversion of 0x301)
Size in Elements = 2 (32 bit D_word is two Modbus registers)
Modbus Address = (4)0770


However there is a "error 82- Modbus exception code 02 returned: Illegal Data Address" error.
And the same goes for other varius combinations of destination address.



Maybe am I over looking something else?
 
If you get an error message reply it means that the 485 comm is working and messages are recognized, so the error is an addressing issue.

Reading a single register avoids issues with reading values from multiple registers.

Although you don't seem to need the value, would you try the Frequency value, a 16 bit U_Word, an unsigned 16 bit integer.

It's listed at 0x0339 = 825 decimal

I'd suggest trying reading 1 element from

824 (4)0824
825 (4)0825
826 (4)0826

individually, as separate setups, in order to see what you get?
 
The assumption is being made that the MB device is a "1 based" address. The ML1400 is (I.E. 1-65536) but the device you are reading may not be. I'd start with reading a single register at address 40769 and see how it responds. Then try (again a single register) 40770 and 40771.
 
I came to same conclusion and figured it might be worth trying to read a single register at the same time, hence the

decimal conversion minus 1 (4)0824

decimal conversion (4)0825
decimal conversion +1. (4)0826
 

Similar Topics

Hello A quick one for AB experts, can the built in port of a Ml1400 can simultaneously talk with a panel view under the usual AB protocol and be...
Replies
6
Views
4,128
Hi All I have a Panelview 800 HMI hooked up to a Micrologix 1400 controller. I have communication and have the screen set up with some...
Replies
1
Views
917
I have tried to find this everywhere and I am really not sure what I am doing wrong. I am trying to use a CompactLogix and the message functions...
Replies
10
Views
2,725
Hi Friends, I am trying to connect MLX1400 over RS232 serial communication with PV800. I am not sure where I am going wrong, the PV800 doesn't...
Replies
6
Views
918
Hi Friends, I have been away from PLC systems for a while and was more in to BMS. However, recently I started working on a new project where we...
Replies
2
Views
756
Back
Top Bottom